Reviewing the figure in Section 1.1, as we discussed, the anomaly in (d) is undetectable by merely considering whether the values of the time series are anomalous. Yet, an anomaly indeed exists in (d). How can we identify it then?

Analysis of (d) reveals that the anomaly results from over-rapid change speed. Let’s investigate whether ‘change speed’ can be used for anomaly detection.

In the figure, the left y-axis represents the values of series X, and the right y-axis represents the values of ‘change speed’. In the legend, X is the original series curve, and C is the ‘change speed’ curve. Upon observation, we can see that the anomaly detection methods introduced earlier can be applied to curve C to identify anomalies. (Note: Because the ‘change speed’ cannot be calculated for the initial points of series X, this figure has fewer points than Figure 2.1(d)).

We refer to the time series X as the “original series”. Data derived from the original series (such as ‘change speed’) is called a “derived series” and is denoted X’.

X’= F(X)

Where, the i-th element x’_i of X’ usually depends only on the preceding segment of data of x_i, that is:

x’i= f(X[-(l+1)]_i+1)

Where f(…) represents a mathematical transformation, and X[-(l+1)]_i+1 is the sequence formed by x_i together with the data X[-l]_i from the preceding interval. The first l original values do not have corresponding x’_i values.

In many cases, anomalies that are undetectable using the aforementioned methods for measuring anomaly scores on the original series become detectable after transformation into derived series.

Of course, ‘change speed’ is not the only possible derived series. Many other derived series can describe characteristics of the original series. This chapter introduces some common methods for calculating derived series.