Data Mining: The Textbook

14.7. TIME SERIES CLASSIFICATION

485

14.7 Time Series Classification

Time series classification can be defined in several ways, depending on the association of the underlying class labels to either individual timestamps, or the whole series.

1. 
   Point labels: In this case, the class labels are associated with individual timestamps. In most cases, the class of interest is rare in nature and corresponds to unusual activity at that timestamp. This problem is also referred to as event detection. This version of the event detection problem can be distinguished from the unsupervised outlier detection problem discussed in Sect. 14.6, in that it is supervised with labels.
   

2. 
   Whole-series labels: In this case, the class labels are associated with the full series. Therefore, the series needs to be classified on the basis of the shapes inside it.
   

Both these problems will be discussed in this chapter.

14.7.1 Supervised Event Detection

The problem of supervised event detection is one in which the class labels are associated with the timestamps rather than the full series. In most cases, one or more of the class labels are rare, and the remaining labels correspond to the “normal” periods. While it is possible in principle to define the problem with a balanced distribution of labels, this is rarely the case in application-specific settings. Therefore, the discussion in this subsection will focus only on the imbalanced label distribution scenario.

These rare class labels correspond to the events in the underlying data. For example, consider a scenario, in which the performance of a machine is tracked using sensors. In some cases, a rare event, such as the malfunctioning of the machine, may cause unusual sensor readings. Such unusual events need to be tracked in a timely fashion. Therefore, this problem is similar to point anomaly detection, except that it is done in a supervised way.

In many application-specific scenarios, the time series data collection is inherently designed in such a way that the unusual events are reflected in unexpected deviations of the time series. This is particularly true of many sensor-based collection mechanisms. While this can be captured by unsupervised methods, the addition of supervision helps in the removal of spurious events that may have different underlying causes. For exam-ple, consider the case of an environmental monitoring application. Many deviations may be the result of the failure of the sensor equipment, or another spurious event that causes deviations in sensor values. This may not necessarily reflect an anomaly of interest. While anomalous events often correspond to extreme deviations in sensor stream values, the pre-cise causality of different kinds of deviations may be quite different. These other noisy or spurious abnormalities may not be of any interest to an analyst. For example, consider the case illustrated in Fig. 14.12, in which temperature and pressure values inside pressurized pipes containing heating fluids are illustrated. Figures 14.12 a and b illustrate values on two sensors in a pipe rupture scenario. Figures 14.12 c and d illustrate the values of the two sensors in a situation where the pressure sensor malfunctions, and this results in a value of 0 at each timestamp in the pressure sensor. In the first case, the readings of both pressure and temperature sensors are affected by the malfunction, though the final pressure values are not zero, but they reflect the pressure in the external surroundings. The readings on the temperature sensor are not affected at all in the second scenario, since the malfunction is specific to the pressure sensor.

Thus, the key is to differentiate among the deviations of different behavioral attributes in a multivariate scenario. The use of supervision is very helpful because it can be used

486 CHAPTER 14. MINING TIME SERIES DATA

TEMPERATURE (CENTIGRADE)	80											10000
	75												9000
													8000
	70
												PRESSURE	7000
	65												6000
	60												5000
	55												4000
													3000
	50
													2000
	45
													1000
	400	10	20	30	40	50	60	70	80	90	100		0	0	10	20	30	40	50	60	70	80	90	100

PROGRESSION OF TIME PROGRESSION OF TIME

(a) Temperature (pipe rupture scenario) (b) Pressure (pipe rupture scenario)

TEMPERATURE (CENTIGRADE)

80

75. 
    
    

70. 
    

65. 
    

60. 
    

55. 
    

50. 
    

45. 
    

⁴⁰0 10 20 30 40 50 60 70 80 90 100 PROGRESSION OF TIME

10000
	9000
	8000
PRESSURE	7000
	6000
	5000
	4000
	3000
	2000
	1000
	0
	0	10	20	30	40	50	60	70	80	90	100

PROGRESSION OF TIME

(c) Temperature (sensor failure scenario) (d) Pressure (sensor failure scenario)

Figure 14.12: Behavior of temperature and pressure sensors due to pipe rupture (a, b), and failure of pressure sensor (c, d)

to determine the differential behavior of the deviations across different streams. In the aforementioned pipe rupture scenario, the relative deviations in the two events are quite different. In the labeling input, it is assumed that most of the timestamps are labeled “normal.” A few ground truth timestamps, T₁ . . . T_r, are labeled “rare.” These are used for supervision. These are referred to as primary abnormal events. In addition, spurious events may also cause large deviations. These timestamps are referred to as secondary abnormal events. In some application-specific scenarios, the timestamps for the secondary abnormal events may be provided, though this is not assumed here. The bibliographic notes contain pointers to these enhanced methods.

It is assumed that a total of d different time series data streams are available, and the differential patterns in the d streams are used to detect the abnormal events. The overall process of event prediction is to create a composite alarm level from the error terms in the time series prediction. The first step is to use a univariate time series prediction model to determine the error terms at a given timestamp. Any of the models discussed in Sect. 14.3 may be used. These are then combined together to create a composite alarm level with the use of coefficients α₁ . . . α_d for the d different time series data streams. The values of α₁ . . . α _d are learned from the training data in an offline (or periodic batch) phase, so as to best discriminate the true event from the normal periods. The actual prediction can be performed using an online approach in real time. Therefore, the steps may be summarized as follows: