# Online Forecasting and Anomaly Detection Based on the ARIMA Model
## 2 Materials and Methods
### Anomaly Detection Algorithms
#### 2.4.2 One Point Prediction  
The idea of using the ARIMA model for anomaly detection purposes is not new. However, when using the ARIMA model in an anomaly detection algorithm, the approach is almost always the same [10; 21; 22]. The ARIMA model makes a prediction, then the difference between this prediction and the actual values is calculated and, if this difference is significant, then it is an anomaly. The pseudo-code of this approach is presented in the Algorithm 5. This algorithm has been chosen for comparison with the developed algorithm (Algorithm 4). ``` Input Hyperparameters \(p,d,q\), learning rate \(\eta\), threshold \(\epsilon_{th}\), emply list \(r\); Set \(\alpha,\beta\gets fit(a^{t-1},\beta^{t-1},[X_{1}\ldots X_{t}],\eta)^{*}\), For \(t\) from \(T_{test}^{1}\) to \(T-1\) do:  Predict \(\widehat{X}_{t}(\alpha,\beta)=\sum_{i=0}^{d-1}\
abla^{i}X_{t-1}+\sum_{i=1}^{q} \beta_{i}e_{t-i}+\sum_{i=1}^{p}\alpha_{i}\
abla^{d}X_{t-i}+\epsilon_{t}+c\) If \(|\widehat{X}_{t}-{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{ rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@color@rgb@fill{0}{0}{0}\lvert}\widehat{X}_{t}-{ \color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0} \pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@color@rgb@fill{0}{0}{0}\lvert} \widehat{X}_



the scoring function. The window in which the detected anomaly is perceived as a true positive is called an anomaly window (vertical blue lines in Figure 1). It is recommended by [9] to take a window equal to 10% of the sample length divided by the number of anomalies centered around a ground truth anomaly label. For technical systems, a more reasonable approach is to take the moment of occurrence of a hidden defect as a left boundary and the window width as the value characterizing the time taken to complete physical processes, during which the defect degrades. In order to better understand the properties of each specific anomaly detection algorithm, the concept of an application profile was proposed. The application profile is a set of coefficients for true positives, false positives, and false negatives: \(A_{TP},A_{FP},A_{FN}\), with \(0\leq A_{TP}\) and \(-1\leq A_{FP},A_{FN}\leq 0\). Three application profiles are usually used: standard (standard weights of coefficients), reward low FPs (heavily penalizes FPs), and reward low FNs (heavily penalizes FNs). The application profiles (see Table 1), given by [23], are used in our work. The scoring function is used to weigh all true positives, false positives, and false negatives (true negatives are not used for evaluation, on principle), taking into account the coefficients and window width. Inside the window, only the first detection is used to weigh the true positives, while the rest are not taken into account. The sigmoidal scoring function gives high scores to early detections and gently penalizes detections outside of the window (see Figure 1). The equation of the scoring function is as follows:

\[\sigma^{A}(y)=(A_{TP}-A_{FP})\bigg{(}\frac{1}{1+e^{5y}}\bigg{)}-1 \tag{9}\]

where \(y\) is the relative position of the detection within the anomaly window. Score for each special time series \(d\):

\[S^{A}_{d}=\left(\sum_{y\in Y_{d}}\sigma^{A}(y)\right)+A_{FN}f_{d} \tag{10}\]

where \(Y_{d}\) is the set of data instances detected as anomalies by the detection algorithm and \(f_{d}\) is the number of windows in which there are no detected anomalies. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Metric** & \(\mathbf{A_{TP}}\) & \(\mathbf{A_{FP}}\) & \(\mathbf{A_{TN}}\) & \(\mathbf{A_{FN}}\) \\ \hline Standard & \(1.0\) & \(-0.11\) & \(1.0\) & \(-1.0\) \\ LowFP & \(1.0\) & \(-0.22\) & \(1.0\) & \(-1.0\) \\ LowFN & \(1.0\) & \(-0.11\) & \(1.0\) & \(-2.0\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Application profile for NAB scoring algorithm used in this work. Figure 1: Scaled sigmoid function.