====== Introduction to Time Series Analysis ======
{{:en:iot-open:czapka_p.png?50|General audience classification icon}}{{:en:iot-open:czapka_b.png?50|General audience classification icon}}{{:en:iot-open:czapka_e.png?50|General audience classification icon}}\\

As has been discussed previously in the data preparation chapter, time series usually represent the dynamics of some process. Therefore, the order of the data entries has to be preserved.  As emphasised, a time series is simply a set of data - usually events, arranged by a time marker. Typically, time series are placed in the order in which events occur/are recorded. 

In the context of IoT systems, there might be several reasons why time series analysis is needed. The most widely ones are the following:


  * **Process dynamics forecasting** for higher-performing decision support systems. An IoT system, coupled with appropriate cloud computing or other computing infrastructure, can provide not only a rich insight into the process dynamics but also a reliable forecast using regression algorithms like the ones discussed in the regressions section or more advanced like autoregressive integrated moving average (ARIMA) and seasonal ARIMA (SARIMA) ((Hyndman, Rob J; Athanasopoulos, George. 8.9 Seasonal ARIMA models. oTexts. Retrieved 19 May 2015.)) ((Box, George E. P. (2015). Time Series Analysis: Forecasting and Control. WILEY. ISBN 978-1-118-67502-1.)).
  * **Anomaly detection** is one of the highly valued features of IoT systems. In its essence, anomaly detection is a set of methods enabling the recognition of unwanted or abnormal behaviour of the system over a specific time period. Anomalies might be expressed in data differently:
    * **A certain event in time:** for instance, a measurement jumps over a defined threshold value. This is the simplest type of anomaly, and most of the control systems cope with it by setting appropriate threshold values and alerting mechanisms;
    * **Change of a data fragment shape:** this might happen to technical systems, where a typical response to control inputs has changed to some shape that is not anticipated or planned. A simple example is an engine’s response to turning it on and reaching typical rpm values. Due to overloads, wearing out mechanics or other reasons, the response might take too long, signalling that the device has to be repaired. 
    * **Event density:** In many technical systems, their behaviour is seasonal–cyclic. Changes in the periods and their absolute values, or their response shapes within the period, are excellent predictors of current or future malfunctioning. So, recognition of typical period shapes and response shapes in time are of high value for predictive maintenance, process control, and other applications of IoT systems. 
    * **Event value distribution:** In most measuring systems, measurements due to imperfection of sensors or systems are distributed around some actual value, providing an estimate of the true value with some variance. Due to mechanical wear, the variance might increase or change in value distribution over time, which is a good indicator and predictor of malfunctioning or possible failures of the system.
   ===  ===
Due to its diversity, a wide range of algorithms might be used in anomaly detection, including those that have been covered in previous chapters. For instance, clustering for typical response clusters, regression for normal future states estimation and measuring the distance between forecast and actual measurements, and classification to classify normal or abnormal states. An excellent example of using classification trees based methods for anomaly detection is Isolation forests ((IsolationForest example — scikit-learn 1.5.2 documentation))
======  ======
  * **Understanding of system dynamics**, where the system owner is interested in having insightful information on the system functioning to make good decisions on its control or further development. Typical applications are system monitoring, the production of dashboards, different industrial research, and the study of system prototypes. 


While in the time series analysis, most of the methods covered here might be employed, anomaly detection and classification cases are outlined through an example of an industrial cooling system in this chapter.

===== A cooling system case =====

A given industrial cooling system has to maintain a specific temperature mode of around -18oC. Due to the technology specifics, it goes through a defrost cycle every few hours to avoid ice deposits, leading to inefficiency and potential malfunction. However, at some point, a relatively short power supply interruption has been noticed, which needs to be recognised in the future for reporting appropriately. The logged data series is depicted in the following figure:



<figure Cooling system>
{{ :en:iot-reloaded:timeseries_1.png?600 | Cooling system}}
<caption>Cooling system</caption>
</figure>

It is easy to notice that there are two normal behaviour patterns: defrost (small spikes), temperature maintenance (data between spikes) and one anomaly – the high spike. 

One possible alternative for building a classification model is to use K-nearest neighbours (KNN). Whenever a new data fragment is collected, it is compared to the closest ones and simply applies a majority principle to determine its class. In this example, three behaviour patterns are recognised; therefore, a sample collection must be composed for each pattern. It might be done by hand since, in this case, the time series is relatively short.

Examples of the collected patterns (defrost on the left and temperature maintenance on the right):

<figure Example patterns>
{{ :en:iot-reloaded:timeseries_8.png?600 | Example patterns}}
<caption>Example patterns</caption>
</figure>

Unfortunately, in this example, only one anomaly is present:

<figure Anomaly pattern>
{{ :en:iot-reloaded:timeseries_2.png?400 | Anomaly pattern}}
<caption>Anomaly pattern</caption>
</figure>

To overcome data scarcity, a data augmentation technique might be applied, where a number of other samples are produced from the given data sample. This is done by applying Gaussian noise and randomly changing the length of the sample (for the sake of example, the original anomaly sample is not used for the model). Altogether the collection of initial data might be represented by the following figure:

<figure Data collection>
{{ :en:iot-reloaded:timeseries_5.png?600 | Data collection}}
<caption>Data collection</caption>
</figure>

One might notice that:
  * Samples of different patterns are different in length;
  * Samples of the same pattern are of different lengths;
  * The interested phenomena (spike) are located at different locations within the samples and are slightly different. 
All of the abovementioned issues expose the problem of calculating distances from one example to another since a simple comparison of data points will produce misleading distance values. To avoid it, a Dynamic Time Warping  (DTW) metric has to be employed ((Gold, Omer; Sharir, Micha (2018). "Dynamic Time Warping and Geometric Edit Distance: Breaking the Quadratic Barrier". ACM Transactions on Algorithms. 14 (4). doi:10.1145/3230734. S2CID 52070903.)). For the practical implementations in Python, it is highly recommended to visit TS learn library documentation ((Romain Tavenard, Johann Faouzi, Gilles Vandewiele, Felix Divo, Guillaume Androz, Chester Holtz, Marie Payne, Roman Yurchak, Marc Rußwurm, Kushal Kolar, & Eli Woods (2020). TSlearn, A Machine Learning Toolkit for Time Series Data. Journal of Machine Learning Research, 21(118), 1-6.)).

Now, once the distance metric is selected and the initial dataset is produced, the KNN might be implemented. By providing the “query” data sequence, the closest ones can be determined using DTW. As an example, a simple query is depicted in the following figure:

<figure Single query>
{{ :en:iot-reloaded:timeseries_6.png?400 | Single query}}
<caption>Single query</caption>
</figure>

For practical implementation, the TSleanr package is used. In the following example 10 randomly selected data sequences are produced from the initial data set. While the data set is the same, none of the selected data sequences actually are “seen” by the model due to the randomness. The following figure shows the results:

<figure Multiple test queries>
{{ :en:iot-reloaded:timeseries_7.png?600 | Multiple test queries}}
<caption>Multiple test queries</caption>
</figure>

As it might be noticed, the query (black) samples are rather different from the ones found to be “closest” by the KNN. However, because of the DTW advantages, the classification is done perfectly. 
The same idea as demonstrated here might be used for unknown anomalies by setting a similarity threshold for DTW, known anomalies classification as shown here or even simple forecasting.