Figure 3.

A demonstration of the multivariate time-series anomaly detection method. A bivariate example with toy data is presented to demonstrate how anomaly detection is performed at the daily level. The blue lines represent the sum of the overall trend and weekly components for each time series, with the remaining ε is regarded as the error. Red vertical lines show the specific error for day 19 for each univariate time series. After the rank(·) function ranks the errors, and the probability integral transforms these ranks to normally distributed adjusted errors, the multivariate time series across all features becomes multivariate normal, and the Hotelling’s T² test is used to test them simultaneously for anomalies. Here, m represents the number of days in the time series and Φ is the standard normal cumulative distribution function