Ocean Observing Time Series Anomaly Detection Based on DTW-TRSAX Method

Ocean observing series anomaly detection is an essential part of maritime supervision. Due to the harsh environment, marine observation equipment is relatively easy to damage. Ocean observing series anomaly detection can assist maritime department to �nd abnormal equipment in a timely manner, rather than costly periodic inspections, which is of great signi�cance for maintaining the safety and reliability of ocean engineering. Given the problems of the random of ocean systems and the lack of labeled data sets, the trend-based symbolic distance and dynamic time warping algorithm (DTW-TRSAX) were proposed for ocean observing time series anomaly detection. Finally, based on the data set issued by the National Ocean Test Site of China and public data set issued by the National Marine Data Center, our method was veri�ed. The results show that the method is reliable for ocean engineering, can work potentially in a real-time way, and will help ocean engineering managers to obtain informed decisions.


Introduction
A large amount of time series data is provided by a variety of ocean observation sensors and instruments every day, which is important for predicting climate change, preventing marine disasters, assisting in offshore construction, etc.However, the sensors and instruments are vulnerable to harsh conditions such as high humidity, salt spray, and vibration [1].Existing methods tend to check ocean observation equipment regularly, which wastes a lot of time and money.Considering the relationships between ocean sequences, the time series data was proposed for the anomaly detection.
In recent years, numerous studies have detected anomalies in time series data which can be roughly classi ed into mechanism-based and data-driven-based methods.Mechanism-based methods usually require fewer data to construct a mechanical model to describe the physical system or dynamic process [2].These methods have been widely employed in the eld with clearer physical/chemical principles.For instance, Dong and Lin [3] proposed an electro-thermal model to describe battery dynamic behaviors to detect anomalies of thermal parameters for lithium-ion batteries.Chen et al. [4] applied an equivalentcircuit model for the diagnosis of an external anomaly of batteries.In addition, model-based techniques have also been extensively used for anomaly detection of wind turbines [5,6].However, in the case of the Ocean Observing System (OOS), the marine system is characterized by complex interactions and random processes [7], so there is still a lack of satisfactory mechanism models that can accurately describe the behavior of the marine system.Data-driven-based approaches only use a large amount of historical or real-time data stream without prior knowledge [8,9], so they are exible and suitable for complex systems [10].The commonly used methods can be subdivided into two categories: statistics and machine learning.The statistical techniques are typically based on the given data that is supposed to accord with a certain distribution (e.g., normal distribution) and then use a hypothesis test to judge whether the anomaly follows the underlying distribution or not [11].The statistical solution can estimate outliers by deviation degree [12] or error residuals [13], as well as some unseen patterns.For instance, Tharrault et al. [14] and Peres et al. [15] used principal component analysis (PCA), as a dimensionality reduction statistical technique, to detect batch process faults.Nevertheless, the statistical techniques are still di cult to detect shape pattern anomalies in observing series and their performances of them depend heavily on the prede ned distribution.
Machine learning anomaly detection methods can usually be divided into two categories: predictionbased methods and classi cation-based methods.Prediction-based methods, including arti cial neural networks (ANNs), support vector machines (SVMs), deep learning, and more, indicate that the original time series data is re ected by data-driven model parameters and coe cients.To incorporate temporal characteristics, they can identify anomalies by comparing the actual and predicted results.For example, Shi et al.[16] presented a detecting framework integrating ANN as a predictor for identifying major features (i.e., anomalies of water quality time series) of water quality variations.Saravanan et al. [17] used SVMs and ANN to deal with the effectiveness of wavelet-based features for fault diagnosis of a gearbox.Based on a neural network trained through deep learning, Jia, et al. [18] proposed a fault detection and diagnosis method for rotating machinery.However, the accuracy of prediction-based anomaly detection methods mostly depends on the developed model [19], but these methods inevitably bring many prediction uncertainties from model structure, model parameters, and training data [20].
Classi cation-based methods usually develop a classi er using similarity measurements and then apply the classi er to detect whether a data point belongs to the anomalous class or not.The classi ers, such as the K-nearest neighbor method [21], decision tree [22], support vector machine [23], and arti cial neural network [24], can be satisfactory when there is enough training marked data.However, in the case of ocean observing streaming data, there are likely few or no anomaly agged data [7].Furthermore, some classi ers (e.g., distance-based KNN or one-class SVM) may be di cult to identify periodic and seasonal anomaly patterns since they cannot capture the temporal characteristics (e.g., distortion, stretching, timelag) between the different hydrometeorological observing time series [25].
For it is di cult to use conventional methods for anomaly monitoring, this paper conducts anomaly monitoring by studying the correlation between buoy observation time series, which can be measured by the dynamic time warping algorithm (DTW).When directly applied to time series analysis, DTW, introduced by Berndt and Clifford [26] to measure the similarity of two time series of any length, has been employed in lots of anomaly-detecting research in recent years.DTW is robust to the synchronization problem of time series and it can better deal with expansion, distortion, and delay on the time axis [27].
However, the calculation of DTW will be di cult and time-consuming when the data stream series is massive [28].Data representation is a type of method for extracting characteristics of original series and representing them in different domains [29].It can help to reduce the dimensionality of time series and improve the accuracy of anomaly detection [30].The symbolic aggregate approximation (SAX) is a commonly used method of time series similarity measure by converting the original numeric series to a string format, which can overcome the di culty of anomaly detection.The SAXs apply piecewise aggregate approximation (PAA) to divide time series into several equal-sized segments with their corresponding representation symbols (i.e., average values of the subsequences) [31].Some improved SAX methods of time series data representation based on extreme and trend features have emphasized that the improved SAXs take advantage of the higher computational e ciency of SAX and perform better than conventional SAX with time trend properties [32][33][34].Using SAXs as a core detector is becoming a new research branch in the eld of detecting anomalies.For example, Park and Jung [35] presented a SAX-based approach for discovering the rules to describe deviant event patterns from multivariate time series with high complexity.Zhang et al. [36] presented a new feature extraction approach using improved SAX for machinery intelligent diagnosis, in which the SAX algorithm was improved by investigating multi-domain to extract comprehensive fault information.The approaches demonstrated the SAXs were exible and suitable for multivariate time series analysis.In the ocean observing system, there are various associations between different marine variables [37], thus the SAX-based method is given priority to study multivariate ocean observing series.
The main contributions of this paper are: A DTW-TRSAX method is formulated for detecting anomalies in multivariate ocean observing series, which can greatly reduce data volume and improve the accuracy of anomaly detection.
The anomaly classifying threshold is determined by the tracking distance value of the sliding window, which can capture the temporal characteristics (e.g., distortion, stretching, time delay) between different ocean observing time series.
The rest of the paper is organized as follows: Firstly, we introduced the DTW-TRSAX method.Secondly, we propose a detection framework based DTW-TRSAX method.Thirdly, we simulate and analyze the method with data sets.Finally, conclusions are drawn.

Dynamic time warping algorithm
Due to the different physical attributes of marine environmental element sequences and the different monitoring principles of different buoy equipment, there may be distortion, stretching, and ectopic characteristics between marine element sequences.When there are expansions, distortions, and heterotopias on the time axis, the DTW algorithm can better measure the similarity of the two-time series.The principle of the DTW algorithm is shown in Fig. 1.It allows different lengths of time series and allows corresponding calculation of asynchronous points.
Given two time series and , their lengths are and , and a distance matrix of can be constructed such that and depend on the distance measurement method used.When using the dynamic time bending distance for measurement, the parts with similar relative positions in each time series can be better matched after being shifted by an appropriate time axis, and their lengths are also enlarged to the same length.The essence of the dynamic time bending distance is to nd an optimal matching path in the distance matrix , which can minimize the total bending cost, where any point indicates that the k-th element on the path is composed of points and matching.The dynamic time warping distance can be expressed by ( 4): 4 The dynamic regularization time algorithm is generally based on Euclidean distance, which relies much on the data values of the time series and ignores the morphological characteristics of the local data of the time series.Therefore, this paper combines the improved symbol approximate aggregation distance and the dynamic time warping algorithm to measure the distance between time series of marine elements more accurately.

Trend-based symbol approximate aggregation distance
In the traditional symbolic distance calculation, the time series with dense data points should be converted into a relatively simple string form, and then the distance between string sequences should be solved according to the character distance [38].The process of sequence symbolization is based on the transformation method of Euclidean distance.Firstly, the original time series is transformed into a sequence that satis es the standard normal distribution by standardizing the time series.Secondly, the average value of each segment is taken as the corresponding character according to the length of each segment based on the idea of piecewise aggregation approximation (PAA) [39], and the average value of each segment is taken as the corresponding character by the probability representation method such as SAX.The distance between characters is realized by querying the normal distribution table of equal probability division.Finally, the character distance query table is obtained.In our previous study [40], an improved trend SAX (TRSAX) was de ned by integrating a weighted trend distance into the original SAX distance, which has better performance.Therefore, this article further considers the trend characteristics of the segmented sequence and uses the improved trend symbol approximate aggregation distance (TRSAX) to calculate.
As shown in Fig. 2, the three points (i.e., the starting point, the middle point, and the ending point) of each segment sequence after standardization are used to construct two trend characteristic triangles.Then two sine function values are used to quantitatively measure the trends of the left and right sub-segments.The sine function value space corresponding to the trend feature triangle is .The positive value of means that the segment has an upward trend and an increasing value, which indicates the faster-increasing trend (slight up or obvious up).On the contrary, the negative value means the segment has a downward trend and the smaller value indicates the faster decreasing trend (slight down or obvious down).
Afterwards, given two data time series with time series length of p and divided into w equal-length segmented series , , and converted into character sequence as , , then the trend distance of the two sub-segmented series can be calculated as: Where and are trend characteristics of sub-segment s; and are trend characteristics of sub-segment q.The TRSAX distance between the two ocean feature sequences S and Q is 3 where is the character distance between characters and , which can be obtained through the character distance lookup table.n is the length of the original data and the number w of equal segments of the time series.For different segment numbers w, the calculated TRSAX distance is different, so choosing the appropriate segment number w, that is, the length p of each segment, is very important for the distance measurement between time series.

Anomaly detection threshold
The historical time series of hydro-meteorological parameters, representing the normal behaviors of marine system, are selected to be incorporated with the sliding window w to track the DTW-TRSAX distance change.The detecting threshold value is determined by the con dence level of 99% for the sliding window tracking distance value distribution.Afterwards, the DTW-TRSAX distance between different ocean observing series is tracked through the same size w, and the anomalies can be detected by comparing with the threshold .
In summary, we need to 1) select and standardize these ocean observing series with strong correlation; 2) set the segmented aggregation length p for the reason that different segment lengths have different effects on the measurement of the DTW-TRSAX distance; 3) set the length w of the sliding window; 4) used DTW-TRSAX algorithm to measure and track the dynamic distance between different ocean observing series; 5) calculated the distance threshold based on normal series.

Framework For Identifying Anomalies Of Multiple Observing Series
The anomaly of marine element sequences refers to one or more element sequences that deviate from the normal uctuation sequence at a certain time.Due to the complexity of the marine environment and the physical correlation between buoy monitoring instruments, there is a certain correlation between the changes of different marine element sequences, which can be used for anomaly detection by using the Step1.Determine the correlation time series to be detected.The premise of multi-ocean observing series anomaly detection based on similarity measurement is that there is a correlation between multi-observing sequences.If there is no correlation between the sequences, the similarity between the sequences can be changed randomly without reference.When performing correlation analysis on two variable sequences, the commonly used method is the Pearson Correlation Coe cient (PCC).Assuming that there are two time series X and Y with the a length of n, the PCC can be calculated as: 1 The bigger the absolute value of the PCC is, the stronger the correlation is.It is generally believed that when the correlation coe cient is greater than 0.7, there is a strong correlation between the two sequences, so the ocean observation series with a correlation coe cient greater than 0.7 is selected for analysis.
Step2.Determining the length p of each segment and standardizing the observing time series.For a marine parameter S, then the original series is divided into sub-sequences (tn is the total number) by the PAA algorithm to extract the mean feature and trend feature in the sequence segment.Afterwards, the sub-sequences are converted to symbolic sub-sequences by the improved symbolic distance (TRSAX).
Step3.Before using the DTW-TRSAX algorithm to measure distance, it is necessary to choose the reasonable width of the sliding window.Due to the existence of distortion, expansion, and heterotopia among marine environment elements, the setting of a sliding window should ensure that the time series in the window contains as much feature information as possible, and can effectively control the amount of data in the window, which can avoid the waste of calculation time.Set the sliding window widths ws and wq for marine parameters S and Q, respectively.Then use the DTW-TRSAX and sliding windows of S (i.e., W ws = {LS 1 , LS 2 , … LS ws }) and Q (i.e., W wq = {LQ 1 , LQ 2 , … LQ wq }) to calculate the distance.For each parameter, keep the window width unchanged, move the window to the right for a moment, and continue to calculate the distance value in the window.Repeat this cycle until the right window coincides with the end position of the feature sequence, and a series of distance sequences changing with time are obtained.
Step4.According to the historical normal data, determine the normal distance threshold between the ocean observing series, and then whether the current marine element sequence is abnormal can be judged.

Evaluation index of anomaly detection model
This paper selects Accuracy and F1-score as evaluation indexes.As is shown in the table below, the confusion matrix was useful for the performance evaluation of the classi cation problems [41].Accuracy is the most important factor for a model.The more accurate the model, the more precise the results it will give.The F1-score is a comprehensive evaluation metric for a classi cation.Generally, the F1-score is used to compare different algorithms for the same data.The Accuracy and F1-score can be calculated as follows.5 6

Simulation of anomaly detection based on buoy data sets
For the simulation based on the 3m comprehensive data buoy, rstly, preprocess the data with the PAA algorithm.The segment length p is set to 8, that is, a group of 8 consecutive data triplets is a segment, and 12000 triplets of data are divided into 1500 segments.Taking wind speed data as an example, the original data from 0 to 2000 and its results of processing are shown in Fig. 4.
The DTW-TRSAX algorithm is used to track the change of distance between wave height and wave period, wind speed, and wave period.The threshold value is determined according to the dynamic distance value in the rst 250 sub-segments (i.e., the dynamic distance between the rst 2000 groups of feature sequences), and the threshold value is used to judge whether there are anomalies between marine feature sequences.The detection results are shown in Fig. 5.
After testing, when the w = 10 and p = 8, the Accuracy and F1-score of abnormal detection of wave-high and wave-period sequence are 89.9% and 73.1%, and the accuracy rate of abnormal detection of wind speed and wave periodic sequence is 97%, which can meet the anomaly detection requires.

Simulation of anomaly detection based on station data sets
For the ocean station dataset, after preprocessing the data with PAA, selected and for the DTW-TRSAX algorithm.Firstly, use the data dynamic distance from January 1, 2021 to May 31, 2021 to determine the threshold for the algorithm.And then, use the threshold to determine whether there is an anomaly in the data from June 1, 2021 to August 31, 2021.The test results are shown in Fig. 6.
After testing, when the w = 6 and p = 4, he accuracy and F1-score of abnormal detection of wave-high wave periodic sequence are 95.6% and 74.5%, which can meet the needs of practical applications.

Effect of segmented aggregation length p
The in uence of the length of sub-segment p in TRSAX on the results of anomaly detection was studied in this part.Figures 7 (A Overall, with the change of p, the accuracy index results are satisfactory.The F1-score re ects the algorithm performance.It can be seen from the F1 -score that the selection of p is related to the amount of data provided by the dataset in unit time.The larger the p is, the more likely to determine the trend of time series, which can avoid the effect of noise from environmental factors.However, excessive p will lead to the loss of time series details, which would make it di cult to quantitatively describe the change in the trend of the sub-segment.It is therefore possible to judge the non-abnormal segment as abnormal and prone to misjudgment.Therefore, we should determine the reasonable value of p according to the characteristics of the data set.

The effect of sliding window width
In this part, the study further investigated the effects of different window widths on the anomaly detection results.The DTW-TRSAX algorithm uses sliding windows to track changes in the correlated sequences.Figure 7 (C) and (D) show the effects of different w on the accuracy and F1-score indexes.
With the increasing w, the accuracy value is always high in both experiments based on ocean xed-point observation buoy data and experiments based on Chinese oceanic stations data, and its change is not obvious.It indicates that a bigger window width brings a higher F1-score.The reason is that the bigger window width contains more information in each corresponding sliding window, which is makes it easier to capture the correlated changes of ocean observing series.Conversely, a smaller window width may make it di cult to describe the changes in each sequence, and it is easy to cause false negatives.But when the window width is too big, many features of the sequence will be ignored, resulting in a decrease in the F1-score, which can be seen in Fig. 7 (C).For the , when the , the F1-score is 80.3% and when the , the F1-score is 80.1%.However, the in uence of w and p is coupled.In engineering applications, we need to comprehensively consider the in uence of the two and select the most suitable w and p.

Reliability analysis
The receiver operating characteristic (ROC) curve is the most widely used to evaluate the quality and reliability of algorithms for anomaly detection.A ROC curve is drawn with false positive rate (FPR) as the abscissa and true positive rate (TPR) as the ordinate.The area of the graph surrounded by the curve and horizontal axis and the straight line is called the Area under ROC Curve (AUC).The larger the area under the ROC curve is, the better the performance of the algorithm is.In addition, the diagonal line drawn from the origin means the result of a random decision, so the ROC curve of an algorithm should be on the upper left of the diagonal line to show that the method is effective.To further verify the reliability of the algorithm, we compared the DTW-TRSAX algorithm with the Pearson correlation coe cient (PCC), which is the most commonly used measure of the similarity between the two variables.For marine parameters and , after the original series are divided into sub-sequences and } ( is the total number of sub-sequences), the PCC similarity are calculated by using the sliding windows of (i.e. ) and (i.e. ).For each parameter, and then keep the window width unchanged, move the window to the right for a moment, and continue to calculate the distance value in the window.Repeat this cycle until the right window coincides with the end position of the feature sequence, and a series of distance sequences changing with time are obtained.
Figure 8 shows the ROC curve comparison between the DTW-TRSAX algorithm used in this paper and the ROC curve of wave height and wave period anomaly detection based on the PCC method.Among them, three color curves are ROC curves obtained by PCC under sliding windows with different widths , and black curves are ROC curves obtained by the DTW-TRSAX coupling algorithm with a sliding window width of .In addition, as Fig. 9 shows, the PCC-based method is more reliable when the width of the sliding window is increasing.However, the FPR is higher and the TPR is lower than the DTW-TRSAX, indicating that the Pearson correlation measurement of time series with a sliding window would bring bias since the PCC does not allow time series to be distorted and ectopic on the time axis.

Discussion
This method can be applied in many applications, including marine engineering and ocean observing equipment failure diagnosis.Note that the ocean observing time series of various hydrometeorological parameters is supposed to represent the normal behavior of the ocean observing system in this method.Similarly, the impacts of marine systems on multivariate ocean observing series with strong correlation are conceptualized as consistent, which implies that the signi cant changes in the correlations between different ocean observing series are only caused by equipment failure but not speci c oceanic phenomena.However, the effects of marine events on any two hydrometeorological parameters are different, even though the correlation between two different observing time series seems very strong (e.g., correlation rate > 0.7).Thus, the correlation between the observing series is prone to non-stationarity.
In fact, the marine system is characterized by complicated interactions among different dynamical and random processes, so it is very important to systematically study the relationships among multiple ocean observing series at one position and the relations between adjacent spatially correlated observing sequences.However, this paper concentrates on multi-observations at a xed site.The multi-observations in different spatial-correlated sites and more application studies will be conducted in the near future.Furthermore, the balance between cost and bene t is an eternal topic.In our previous study (Yang et al., 2020), the computational loads (e.g., computational time, algorithm e ciency) of different SAXs as well as single DTW were compared based on the experiments on 12 different time series data sets which come from the UCR time series repository.The running time of parameter-free DTW is not in uenced by the parameter, but the running time of SAX, TRSAX and ESAX increases with the increase of parameter.According to the two time series and ( ), the computational complexities of SAXs, including SAX-Person and traditional SAX-EU(Euclidean distance), are the same level, i.e.O(n), but the DTW is O(mn).Thus, it can be inferred that the computational time of DTW-TRSAX must be between the time of DTW and TRSAX.Compared with other anomaly detecting method, DTW-TRSAX method has no need to training models or updating parameters frequently, which is time-consuming.Thus, this approach introduced here can work potentially in a real-time way and will help ocean engineering managers to obtain informed decisions.

Conclusions
In view of the complex correlation between ocean observing series and the fact that the existing anomaly detection methods do not make full use of the inherent correlation between marine parameter sequences, this paper proposes a method for anomaly detection of ocean observing series based on the dynamic correlation between different marine parameters.By coupling the DTW algorithm and the improved symbol approximation aggregation (TRSAX) algorithm, the dynamic distances between different marine sequences are tracked to determine the anomaly detection threshold, thereby judging whether the current ocean observing sequence is abnormal.The results show that the DTW-TRSAX method can effectively capture the internal relationship between different ocean observing series, and can identify the anomalies caused by the buoy equipment anomalies with a low false positive rate.In addition, this method can better overcome the interference caused by the inconsistent performance of different marine element sequences on the time axis, and can realize more accurate and timely detection of ocean observing series anomalies.

Declarations
Acknowledgement supervision, project administration, project administration and funding acquisition.Figure 8 ROC curves of DTW-TRSAX and PCC method for detecting ocean observing series.
) and (B) show the trends in Accuracy and F1-score as p increases in two experiments.

Funding
Figures

Figure 7 (
Figure 7 This study uses the data measured in two ways.One is collected by the 3-meter (3m) comprehensive data buoy of the China National Offshore test site, and the other is collected by the National Marine Beishuang station.The speci c information is shown in Table1.

Table 2 ,
the True Positive (TP) indicates the number of positive examples classi ed correctly.Similarly, the True Negative (TN) is the number of negative examples classi ed correctly.The False Negative (FN) stands for the number of actual positive examples classi ed as negative, and the False Positive (FP) identi es the number of actual negative examples classi ed as positive.