How Far Should We Look Back to Achieve Effective Real-Time Time-Series Anomaly Detection?

TL;DR

This paper investigates how the amount of historical data influences the performance of RePAD, a real-time anomaly detection algorithm using LSTM, through empirical experiments on real-world datasets.

Contribution

It introduces a comprehensive analysis of historical data length effects on RePAD's accuracy, efficiency, and resource use in real-time anomaly detection.

Findings

Optimal historical data length improves detection accuracy.

Longer historical data increases computational resource consumption.

RePAD effectively balances detection performance and efficiency.

Abstract

Anomaly detection is the process of identifying unexpected events or ab-normalities in data, and it has been applied in many different areas such as system monitoring, fraud detection, healthcare, intrusion detection, etc. Providing real-time, lightweight, and proactive anomaly detection for time series with neither human intervention nor domain knowledge could be highly valuable since it reduces human effort and enables appropriate countermeasures to be undertaken before a disastrous event occurs. To our knowledge, RePAD (Real-time Proactive Anomaly Detection algorithm) is a generic approach with all above-mentioned features. To achieve real-time and lightweight detection, RePAD utilizes Long Short-Term Memory (LSTM) to detect whether or not each upcoming data point is anomalous based on short-term historical data points. However, it is unclear that how different amounts of historical data points affect the performance of RePAD. Therefore, in this paper, we investigate the impact of different amounts of historical data on RePAD by introducing a set of performance metrics that cover novel detection accuracy measures, time efficiency, readiness, and resource consumption, etc. Empirical experiments based on real-world time series datasets are conducted to evaluate RePAD in different scenarios, and the experimental results are presented and discussed.