====== Introduction to Time Series Analysis ======
As discussed in the data preparation chapter, time series usually represent the dynamics of some process. Therefore, the order of the data entries has to be preserved. As emphasised, a time series is simply a set of data—usually events—arranged by a time marker. Typically, time series are placed in the order in which events occur/are recorded. 

In the context of IoT systems, there might be several reasons why time series analysis is needed. 
The most widely ones are the following:
  * **Process dynamics forecasting** for higher-performing decision support systems. An IoT system, coupled with appropriate cloud computing or other computing infrastructure, can provide not only a rich insight into the process dynamics but also a reliable forecast using regression algorithms like the ones discussed in the regressions section or more advanced like autoregressive integrated moving average (ARIMA) and seasonal ARIMA (SARIMA) ((Hyndman, Rob J; Athanasopoulos, George. 8.9 Seasonal ARIMA models. oTexts. Retrieved 19 May 2015.)) ((Box, George E. P. (2015). Time Series Analysis: Forecasting and Control. WILEY. ISBN 978-1-118-67502-1.)).
  * **Anomaly detection** is a highly valued feature of IoT systems. In its essence, anomaly detection is a set of methods enabling the recognition of unwanted or abnormal behaviour of the system over a specific time period. Anomalies might be expressed in data differently:
    * **A certain event in time:** for instance, a measurement jumps over a defined threshold value. This is the simplest type of anomaly, and most control systems cope with it by setting appropriate threshold values and alerting mechanisms.
    * **Change of a data fragment shape:** This might happen to technical systems, where a typical response to control inputs has changed to some shape that is not anticipated or planned. A simple example is an engine's response to turning it on and reaching typical rpm values. Due to overloads, worn-out mechanics, or other reasons, the response might take too long, signalling that the device has to be repaired. 
    * **Event density:** Many technical systems' behaviour is seasonal–cyclic. Changes in the periods and their absolute values, or their response shapes within the period, are excellent predictors of current or future malfunctioning. So, recognition of typical period shapes and response shapes in time is of high value for predictive maintenance, process control, and other applications of IoT systems. 
    * **Event value distribution:** In most measuring systems, measurements due to imperfection of sensors or systems are distributed around some actual value, providing an estimate of the true value with some variance. Due to mechanical wear, the variance might increase or change in value distribution over time, which is a good indicator and predictor of malfunctioning or possible system failures.
   ===  ===
Due to its diversity, various algorithms might be used in anomaly detection, including those covered in previous chapters. For instance, clustering for typical response clusters, regression for normal future states estimation and measuring the distance between forecast and actual measurements, and classification to classify normal or abnormal states. An excellent example of using classification-based methods for anomaly detection is Isolation forests ((IsolationForest example — scikit-learn 1.5.2 documentation))
======  ======
  * **Understanding of system dynamics**, where the system owner is interested in having insightful information on the system functioning to make good decisions on its control or further development. Typical applications are system monitoring, the production of dashboards, different industrial research, and the study of system prototypes. 


While most of the methods covered here might be employed in time series analysis, this chapter outlines anomaly detection and classification cases through an industrial cooling system example.

===== A cooling system case =====

A given industrial cooling system has to maintain a specific temperature mode of around -18oC. Due to the technology specifics, it goes through a defrost cycle every few hours to avoid ice deposits, leading to inefficiency and potential malfunction. However, a relatively short power supply interruption has been noticed at some point, which needs to be recognised in the future for reporting appropriately. The logged data series is depicted in the following figure {{ref>Cooling_system}}:



<figure Cooling_system>
{{ :en:iot-reloaded:timeseries_1.png?600 | Cooling System}}
<caption>Cooling System</caption>
</figure>

It is easy to notice that there are two standard behaviour patterns: defrost (small spikes), temperature maintenance (data between spikes) and one anomaly – the high spike. 

One possible alternative for building a classification model is to use K-nearest neighbours (KNN). Whenever a new data fragment is collected, it is compared to the closest ones and applies a majority principle to determine its class. In this example, three behaviour patterns are recognised; therefore, a sample collection must be composed for each pattern. It might be done by hand since, in this case, the time series is relatively short.

Examples of the collected patterns (defrost on the left and temperature maintenance on the right) are present in figure {{ref>Example_patterns}}:

<figure Example_patterns>
{{ :en:iot-reloaded:timeseries_8.png?600 | Example Patterns}}
<caption>Example Patterns</caption>
</figure>

Unfortunately, in this example, only one anomaly is present (figure {{ref>Anomaly_pattern}}):

<figure Anomaly_pattern>
{{ :en:iot-reloaded:timeseries_2.png?400 | Anomaly Pattern}}
<caption>Anomaly Pattern</caption>
</figure>

A data augmentation technique might be applied to overcome data scarcity, where several other samples are produced from the given data sample. This is done by applying Gaussian noise and randomly changing the sample's length (for example, the original anomaly sample is not used for the model). Altogether, the collection of initial data might be represented by the following figure {{ref>Data_collection}}:

<figure Data_collection>
{{ :en:iot-reloaded:timeseries_5.png?600 | Data Collection}}
<caption>Data Collection</caption>
</figure>

One might notice that:
  * Samples of different patterns are different in length.
  * Samples of the same pattern are of different lengths.
  * The interested phenomena (spikes) are located at different locations within the samples and are slightly different. 
The abovementioned issues expose the problem of calculating distances from one example to another since comparing data points will produce misleading distance values. To avoid it, a Dynamic Time Warping  (DTW) metric has to be employed ((Gold, Omer; Sharir, Micha (2018). "Dynamic Time Warping and Geometric Edit Distance: Breaking the Quadratic Barrier". ACM Transactions on Algorithms. 14 (4). doi:10.1145/3230734. S2CID 52070903.)). For the practical implementations in Python, it is highly recommended to visit TS learn library documentation ((Romain Tavenard, Johann Faouzi, Gilles Vandewiele, Felix Divo, Guillaume Androz, Chester Holtz, Marie Payne, Roman Yurchak, Marc Rußwurm, Kushal Kolar, & Eli Woods (2020). TSlearn, A Machine Learning Toolkit for Time Series Data. Journal of Machine Learning Research, 21(118), 1-6.)).

Once the distance metric is selected and the initial dataset is produced, the KNN might be implemented. The closest ones can be determined using DTW by providing the "query" data sequence. As an example, a simple query is depicted in the following figure {{ref>Single_query}}:

<figure Single_query>
{{ :en:iot-reloaded:timeseries_6.png?400 | Single Query}}
<caption>Single Query</caption>
</figure>

For practical implementation, the TSleanr package is used. In the following example, 10 randomly selected data sequences are produced from the initial data set. While the data set is the same, none of the selected data sequences are "seen" by the model due to the randomness. The following figure shows the results {{ref>Multiple_test_queries}}:

<figure Multiple_test_queries>
{{ :en:iot-reloaded:timeseries_7.png?600 | Multiple Test Queries}}
<caption>Multiple Test Queries</caption>
</figure>

As it might be noticed, the query (black) samples are somewhat different from the ones found to be "closest" by the KNN. However, because of the DTW advantages, the classification is done perfectly. 
The same idea demonstrated here might be used for unknown anomalies by setting a similarity threshold for DTW, classifying known anomalies as shown here, or even simple forecasting.