Real-World Applications - Immunological Computation: Theory and Applications - page 191

2. Determine the range of
variation of data and
perform a binary
encoding according to
the desired precision

1. Collect sufficient
time series data to
exhibit the normal
behavior of a system

3. Select a suitable window
(concatenation of a fixed
number of data points) size
which captures the
regularities of interest

7. While monitoring the
system, use the same encoding
scheme for the new data
patterns. If a detector is
activated, a change in behavior
has occurred and an alarm
might signal

6. Once a unique set of
detectors is generated
from the normal
database of patterns, it
can probabilistically
detect any change (or
abnormally) in patterns
of unseen data

4. Slide the window along
the time series, in non-
overlapping steps, and store
the encoded string for each
window as self , from which
detectors will be generated

5. Generate a set of
detectors that do
not match any of
the self strings

Figure 7.11 Different steps in implementing anomaly/novelty detection.

Real data

Symbolic representation
(binary or other alphabet)

10101 10010

01010 11010 ...

...

Slide window (of size l , shift k )

10101010

11001010

Symbolic self-patterns
local normal behavior of the system

10110110

Figure 7.12 Preprocessing of time series date in anomaly detection.

improved version called randomized RNS (RRNS; Gonzalez et al., 2003) produced
a good estimate of the optimal number of detectors with maximization of the non-
self coverage done through an optimization algorithm with proved convergence
properties. h is was based on a type of randomized algorithms called “Monte Carlo
methods.” Specifi cally, it uses Monte Carlo integration and simulated annealing.