Strange behaviour of anomaly scores of KMeansAD with a basic time series

[Noskario]

Have a look at the following code:

import numpy as np
import colorcet as cc
from aeon.anomaly_detection import KMeansAD
import plotly.express as px
detectorkmeansad = KMeansAD()
X = .4**np.linspace(0, 7, 10000)
#X[4000] = 1.3
#X = X + np.random.normal(loc=0, scale=.01, size=X.shape)
X = 10 * X
asc = detectorkmeansad.fit_predict(X)
px.scatter(y=X, color=asc, color_continuous_scale=cc.CET_L4).show()
px.scatter(x=X, y=asc).show()
px.scatter(y=asc).show()
px.scatter(x=detectorkmeansad.fit_predict(X), y=detectorkmeansad.fit_predict(10*X))

I find it difficult to understand the behaviour the anomaly scores:

Interestingly the oscillating behaviour of the anomaly scores is not simply a scaled version of the original scores but a bit shifted, when X is scaled.

My question:
Why does this behaviour happen? Is KMeansAD only suited for stationary time series? Is it only suited for multivariate time series?

[baraline]

Hi,

Looking at the KMeansAD code, you can see that point anomaly scores are first computed for each moving window based on the distance to a cluster center and then point anomaly socre on the original time series are obtained by averaging, using a reverse windowing operation, the point anomaly score of all windows.

You would need to inspect the cluster centers to confirm, but what might be happening is that most cluster centers (the method produce 20 clusters by default if you don't change the parameters) will be scattered on the downward slope, creating subsequences with low point anomaly at the start and high at the end (or reversed). Then the averaging performed would also help produce the results you see there.

To illustrate that, you can reduce the number of clusters to 2 :

You can clearly see where the cluster is on the slope (the non anomly part). With one cluster the top of the slope would likely be the most anomalous. In your original example, making the stride parameter the size of the window length (20) would make this more obvious, as moving windows will not overlap.

In general, the better approach is to fit KMeansAD only on data that is considered "normal" (i.e. a continuous line in your example) and then try predicting anomalies. The number of clusters and the window size are the two important parameters here to obtain the desired behaviour.

It might also be interesting to z-normalize the windows prior to computing the clusters and anomaly scores, but I don't think we currently have the option to do that in KMeansAD (the effort would be minimal to implement it tho)