2
$\begingroup$

I have a time series data and I will be adding more data points in a consistent manner. I want to figure out whether the new data point added is an outlier, in regards to the previously observed data points. I was wondering if I should be using a linear regression method with a moving average method, in order to ensure that I use the same number of data points each time a new data point comes in.

I would like some help on how to approach this problem. Thank you.

$\endgroup$
4
  • 1
    $\begingroup$ you need a model to define what an outlier is, compared with the remainder of the series. $\endgroup$
    – Xi'an
    Commented Feb 26, 2015 at 16:55
  • $\begingroup$ @Xi'an I am thinking of taking the standard deviation of a certain number of previous observations and then if the new data point doesn't lie within 3 to 4 standard deviations, then I would say it is an outlier. In this case, I want to know how I can decide on how many previous points to look at for each subsequent observations. $\endgroup$ Commented Feb 26, 2015 at 16:57
  • 1
    $\begingroup$ The standardized distance to the mean does not reliably reveal the outliers. What I wrote there is also true for the classical mean and sd (not just their leave one out versions) $\endgroup$
    – user603
    Commented Feb 26, 2015 at 17:54
  • $\begingroup$ I hope that you'll find the following answers of mine on Cross Validated and Data Science SE sites (and resources linked within) helpful: 1) on using density estimation for data streams; 2) on using entropy to determine time series forecastability - thought that similar approach might also be used to detect anomalies, but not sure about it; 3) some resources and tools on anomaly detection. $\endgroup$ Commented Feb 26, 2015 at 23:28

1 Answer 1

2
$\begingroup$

The suggsted approach is to use all of the data to form a reasonable XARMAX model which might be a simple weighted average of the past (ARMA model) OR perhaps a deterministic model(X) with possible level shifts /local time trends/seasonal pulses/pulses or some rich combination of these two types of predictors (memory and causals). Now with Intervention Detection schemes one can test for and possibly find a pulse/outlier at the most recent point. If one is found then you can conclude that the last point was not predictable from the past and/or deterministic structure. Essentially this enables one to say that the probability of observing the last values BEFORE it was observed is x%. Now it is very important that the error process from the model have the Gaussian Conditions , one of which is constant variance and of course that the model parameters were invariant over time.

To summarize (from Bacon) ; To do science is to search for repeated patterns.
To detect anomalies is to identify values that do not follow repeated patterns. For whoever knows the ways of Nature will more easily notice her deviations
and, on the other hand, whoever knows her deviations will more accurately
describe her ways.One learns the rules by observing when the current rules fail. In modern statistical jargon this means you need to have a useful model ! In my opinion this is the essence of the comment from @Xi'an

Another way to restate your question in my words ...

Can you tell me the probability that a single data point (e.g. the latest
reading) came from the distribution represented by all the previous data points?

I have been involved with writing commercial software that will take a pre-existing model and then conduct the test that you require providing an early-warning / heads-up alert. See What predictive models allow me to make new predictions on a series in constant time, without needing to recompute previous ones? for a similar discussion. This of course could be done by those seeking free software solutions but it could require some special purpose programming.

This is another example of "For any complex problem there is a simple solution. And it's always wrong."

$\endgroup$
4
  • $\begingroup$ thank you for your comment. I think ARIMA is the way to go, because I am dealing with a random walk with drift. Once I get a batch data, I should be able to calculate some stuff, for example taking the first difference. But since it is a random walk, only the last data point will have an effect on the new incoming data. In this case, how can I tell if the new data point is an outlier or not? $\endgroup$ Commented Feb 27, 2015 at 19:23
  • $\begingroup$ If it is a pure random walk with drift , you have to estimate the drift parameter which might change over time . Residuals from a model perhaps with break change points in drift could then be used to compute a standard deviation . This standard deviation could then be used to identify a possible exception from the model's forecast. $\endgroup$
    – IrishStat
    Commented Feb 27, 2015 at 21:11
  • $\begingroup$ thank you so much. that makes sense. I have one more question - if there is no change in drift parameter, do I use the same standard deviation for all the incoming new values, or should I also incorporate the new values and discard old values when calculating the standard deviation? $\endgroup$ Commented Feb 27, 2015 at 21:30
  • $\begingroup$ I would not discard but rather re-estimate periodically .... $\endgroup$
    – IrishStat
    Commented Feb 28, 2015 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.