Searching data streams for variable length anomalies

Anomaly detection in data streams is the problem of extracting subsequences, which do not match an expected behavior. Its importance originates from its applicability in many fields such as system health monitoring, event detection in sensor networks, and detecting eco-system disturbances, etc. In detecting anomalous subsequences from data streams, the main challenge for the existing techniques is to determine the lengths of the normal and anomalous subsequences and thus creating a robust model for detecting the anomalous subsequences. In this paper, we propose an incremental algorithm based on the dynamic time warping technique to detect anomalous subsequences in data streams. The proposed algorithm works with relaxed constrains regarding the lengths of normal and/or the anomalous subsequences. That is the proposed algorithm is able to detect variable length anomalous subsequences from among variable length normal sequences. The proposed algorithm can extract variable length anomalies with linear cost of time and memory.