Time series anomaly detection remains one of the most active areas of research in data mining. In spite of the dozens of creative solutions proposed for this problem, recent empirical evidence suggests that time series discords, a relatively simple twenty-year old distance-based technique, remains among the state-of-art techniques. While there are many algorithms for computing the time series discords, they all have limitations. First, they are limited to the batch case, whereas the online case is more actionable. Second, these algorithms exhibit poor scalability beyond tens of thousands of datapoints. In this work we introduce DAMP, a novel algorithm that addresses both these issues. DAMP computes exact left-discords on fast arriving streams, at up to 300,000 Hz using a commodity desktop. This allows us to find time series discords in datasets with trillions of datapoints for the first time. We will demonstrate the utility of our algorithm with the most ambitious set of time series anomaly detection experiments ever conducted.

The automatic supervision of IT systems is a current challenge at Orange. Given the size and complexity reached by its IT operations, the number of sensors needed to obtain measurements over time, used to infer normal and abnormal behaviors, has increased dramatically making traditional expert-based supervision methods slow or prone to errors. In this paper, we propose a fast and stable method called UnSupervised Anomaly Detection for multivariate time series (USAD) based on adversely trained autoencoders. Its autoencoder architecture makes it capable of learning in an unsupervised way. The use of adversarial training and its architecture allows it to isolate anomalies while providing fast training. We study the properties of our methods through experiments on five public datasets, thus demonstrating its robustness, training speed and high anomaly detection performance. Through a feasibility study using Orange's proprietary data we have been able to validate Orange's requirements on scalability, stability, robustness, training speed and high performance.

Anomaly detection in an industrial context is a complex task. Despite very large amounts of available data, only a small fraction is labelled and anomalies are often of different nature. Moreover, implementing anomaly detection algorithms in a production environment is a costly task, therefore it is needed to unambiguously rank candidate algorithms beforehand. In this paper, we propose a methodological pipeline to evaluate anomaly detection algorithms performance in the presence of very few positive labelled data, belonging to different positive types, within an industrial context. In this pipeline, called BRIGADE (BenchmaRkInG Anomaly DEtection algorithms), we first build multiple benchmarking datasets from the limited available labelled positives and unlabelled production data. Then, we train and test candidate algorithms using a repeated 2-fold cross-validation technique. To evaluate the results, we use a metric usually employed for ranked retrieval tasks. We then aggregate all the results obtained for different benchmarking datasets into a single ranking of the candidate algorithms. We present results obtained with real industrial data, showing exposure to genuine anomalies and demonstrate cost savings.