Anomaly Detection Based on Sequence Indexation and CFOF Score Approximation
Résumé
This work focuses on the detection of anomalies in the message traces of the communication infrastructure of the information system of the French national railway company (SNCF). It shows that for this task a method can be designed by combining two recent and independent techniques. The first is the storage and indexation of time series in a tree called iSAX tree, and the second is an anomaly detection score named CFOF, that has been proven to resist to the concentration phenomenon in high dimension. We show in this paper, that it is possible to use the information structure of the iSAX tree to quickly determine an approximation of good quality of the CFOF score. We show that the approximate score is close to the exact score on both synthetic and real industrial datasets, and the first feedback indicates that this score is relevant for triggering alarms related to the anomalies observed in the activity of the SNCF information system.