Algorithm 2: Anomaly detection

Inputs: TD—testing data set, NDT—days that respect the baseline from the training data set, [c1,c2]—confidence interval, DSMax—duration similarity threshold. Outputs: AND—days deviated from baseline, APD—days that respect the baseline 1        ND ← []; 2        AND ← []; 3        APD ← []; 4        Davg ← computeAverageDuration(NDT); 5        foreach dayi in TD do 6        E ← computeEntropy(dayi); 7        if c1 ≤ E ≤ c2 then 8          append(ND, dayi); 9        else 10       append(AND, dayi); 11       end 12       end 13       foreach dayi in ND do 14       Dt ← Davg 15       if len(Davg)! = len(dayi) then 16       CA ← union(dayi, Davg); 17       dayi ← difference(dayi, difference(dayi, CA)); 18       Dt ← difference(Davg, difference(Davg, CA)); 19       endif 20       CS ← computeCosinesSimilarity(dayi, Dt); 21       if CS > DSMax then 22         append(APD, dayi); 23       else 24         append(AND, dayi); 25       end 26       end 27       return AND, APD