> For the complete documentation index, see [llms.txt](https://docs.buildings.ability.abb/collection/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buildings.ability.abb/collection/academy/building-intelligence-ai-and-machine-learning-in-buildingpro-suites/machine-learning/introduction-to-anomaly-detection-in-smart-buildings/foundations-of-anomaly-detection.md). # Foundations of Anomaly Detection Anomaly detection aims to identify observations or patterns that deviate from what is considered normal. In time series, this is more subtle than in static data. A point is not judged only by its value, but also by how it relates to time, surrounding observations, recurring patterns, and the current operating regime. This is what makes time series anomaly detection different from ordinary outlier detection. A value may be unusual because it is globally extreme, because it appears in the wrong context, or because it forms part of an unusual pattern over time. In other words, anomaly detection in time series is not only about unusual numbers. It is about unusual behavior. ## Why time series anomaly detection is different In a static dataset, observations can often be treated independently. In time series, observations are ordered in time and usually depend on one another. This creates structure that anomaly detection needs to respect. Time series often contain: * temporal dependence * recurring patterns * changing operating regimes * long-term drift * abrupt changes * repeated anomaly patterns Because of this, normality is rarely just one fixed range. Instead, it is often defined relative to what happened before, what usually happens at this time, and what the surrounding context suggests ## Dimensionality and normality regimes Two ideas are especially important for understanding time series anomaly detection: **dimensionality** and **normality regimes**. ### Dimensionality A time series can be **univariate** or **multivariate**. A univariate time series contains one variable, for example one meter, one temperature signal, or one pressure measurement. A multivariate time series contains several variables that are observed together. These variables may be related, and their relationships can help distinguish normal from abnormal behavior. **What this means for anomaly detection:**\ In univariate settings, anomalies are detected from the behavior of one signal alone. In multivariate settings, anomalies may also arise from unusual relationships between signals, not only from unusual values in one signal. ### Normality regimes Normal behavior can also take different forms. Some time series have one dominant notion of normality. Others have several. A **single-regime** time series has one main normal pattern. A **multi-regime** time series has several valid modes of normal behavior. These modes may be driven by time, context, control state, occupancy, season, or external conditions. **What this means for anomaly detection:**\ The more regimes a system has, the more careful anomaly detection must be. A value may be completely normal in one regime and anomalous in another.
*** ## Multivariate and multi-target time series In anomaly detection, the word **multivariate** is sometimes used in two slightly different ways. In one interpretation, one main target signal is analyzed together with several contextual variables. These additional variables help explain what normal behavior should look like. This is often the most useful interpretation for contextual anomaly detection. In another interpretation, several signals are modeled jointly as equal targets. This is better described as **multi-target** or **multi-sensor** modeling. This distinction matters because the goal is not always the same. Sometimes anomaly detection is about checking whether one primary signal still behaves normally given its context. In other cases, it is about detecting unusual joint behavior across several target signals at once. **What this means for anomaly detection:**\ Before choosing a method, it is important to be clear about the task. Are we evaluating one main signal with context, or are we detecting anomalies across several target signals together? *** ## Structural classes of anomalies Anomalies in time series do not all have the same shape. A useful foundation is to distinguish between different structural classes. ### Point anomalies A point anomaly is a single observation that deviates from expected behavior. Some point anomalies are easy to detect because they are extreme in a global sense. Others are only unusual in a more local or contextual sense.
### Global point anomalies A global point anomaly lies outside the overall historical range or outside what is usually observed in the full dataset. **Example:** * a sudden spike far above anything normally seen ### Contextual point anomalies A contextual point anomaly may not be globally extreme, but it is unusual for the current situation. **Examples:** * a value that is normal during daytime but anomalous at night * a weekday-like pattern appearing on a holiday Contextual anomalies are especially important in time series because normality often depends on time and context. ### Subsequence anomalies A subsequence anomaly is not defined by one point, but by a pattern over time. The issue may lie in the shape, duration, or timing of a sequence rather than in one isolated value. **Examples:** * an unusual ramp-up pattern * a repeated nightly waste pattern * a sustained deviation over several hours **What this means for anomaly detection:**\ A useful time series method should not only catch isolated spikes. It should also recognize anomalies that appear as contextual violations or unusual temporal patterns. ## Multiplicity of occurrence Another useful distinction is how anomalies occur over time. #### Single anomalies These are isolated anomalous events. #### Multiple similar anomalies These are repeated occurrences of the same or a very similar anomaly pattern. #### Multiple different anomalies These are several anomaly types appearing in the same broader period. **What this means for anomaly detection:**\ Repeated anomalies are often more meaningful than isolated ones because they can indicate a systematic issue. At the same time, multiple different anomalies can make interpretation more difficult, because one observed problem may overlap with others. *** ## Learning paradigms Anomaly detection methods also differ in how they learn what normal behavior looks like.
### Supervised learning In supervised anomaly detection, the method is trained with labeled examples of both normal and anomalous behavior. This is attractive in theory, but in practice it is often difficult because anomaly labels are expensive, incomplete, or unavailable. ### Semi-supervised learning In semi-supervised anomaly detection, the method learns mainly from data that is assumed to be mostly normal. This is often the most practical setup in real applications, because historical data is usually available even when explicit anomaly labels are not. ### Unsupervised learning In unsupervised anomaly detection, the method tries to identify unusual behavior without labeled normal or anomalous examples. This is useful when little prior information is available, but it can make interpretation and evaluation harder. **What this means for anomaly detection:**\ The learning setup strongly affects what methods are practical. In many real time series applications, especially operational ones, anomaly detection starts from mostly unlabeled historical data rather than from fully labeled datasets. *** ## Broad families of anomaly detection methods At a high level, anomaly detection methods can be grouped into broad method families according to how they define normality and deviation. ### Distance-based methods Distance-based methods identify anomalies through dissimilarity. A point or subsequence is considered anomalous if it is far from other observed patterns. These methods are often useful for identifying unusual shapes or subsequences. ### Density-based methods Density-based methods identify anomalies as observations or sequences that lie in low-density regions of the data space. These methods are useful when anomaly detection is framed as the problem of identifying unlikely behavior. ### Prediction-based methods Prediction-based methods define anomalies as deviations between expected and observed behavior. This includes forecasting-based approaches and reconstruction-based approaches. These methods are often especially intuitive because they provide an explicit notion of what should have happened and compare it with what actually happened. **What this means for anomaly detection:**\ Different method families are suited to different anomaly types and different operational goals. The right choice depends on whether the task is mainly about unusual values, unusual patterns, unlikely structure, or deviations from an expected baseline.
*** ## Why these foundations matter These foundations show that time series anomaly detection is not one single technique. It is a broader way of thinking about unusual behavior in temporal data. To choose or understand a method, it helps to ask: * Is the problem univariate or multivariate? * Is normality single-regime or multi-regime? * Are the anomalies likely to be isolated points or temporal patterns? * Are labels available? * Is the goal to detect unusual structure, unlikely behavior, or deviation from expected behavior? These questions shape how anomaly detection should be approached. ## Conclusion As you can see, time series anomaly detection is more complex than simply finding unusual values. It depends on how normality is defined, whether context matters, what kind of anomaly needs to be detected, and how much labeled data is available. A useful approach therefore needs to match both the structure of the data and the nature of the anomaly problem. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.buildings.ability.abb/collection/academy/building-intelligence-ai-and-machine-learning-in-buildingpro-suites/machine-learning/introduction-to-anomaly-detection-in-smart-buildings/foundations-of-anomaly-detection.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.