Visual Analysis of Time-Series Similarities for Anomaly Detection in Sensor Networks

• Published in: Computer graphics forum Vol. 33; no. 3; pp. 401 - 410
• Main Authors: Steiger, Martin, Bernard, Jürgen, Mittelstädt, Sebastian, Lücke-Tieke, Hendrik, Keim, Daniel, May, Thorsten, Kohlhammer, Jörn
• Format: Journal Article
• Language: English
• Published: Oxford Blackwell Publishing Ltd 01.06.2014
• Subjects: Analysis; Anomalies; C.2.3 [Computer-Communication Networks]: Network Operations-Network monitoring; Categories and Subject Descriptors (according to ACM CCS); Data visualization; H.5.2 [Information Interfaces and Presentation]: User Interfaces-User-centered design; I.3.6 [Computer Graphics]: Methodology and Techniques-Interaction techniques; Information processing; Networks; Recording; Sensors; Studies; Tasks; Temporal logic; Time series; Visual; Visualization; Wireless networks
• ISSN: 0167-7055; 1467-8659
• DOI: 10.1111/cgf.12396

We present a system to analyze time‐series data in sensor networks. Our approach supports exploratory tasks for the comparison of univariate, geo‐referenced sensor data, in particular for anomaly detection. We split the recordings into fixed‐length patterns and show them in order to compare them over time and space using two linked views. Apart from geo‐based comparison across sensors we also support different temporal patterns to discover seasonal effects, anomalies and periodicities. The methods we use are best practices in the information visualization domain. They cover the daily, the weekly and seasonal and patterns of the data. Daily patterns can be analyzed in a clustering‐based view, weekly patterns in a calendar‐based view and seasonal patters in a projection‐based view. The connectivity of the sensors can be analyzed through a dedicated topological network view. We assist the domain expert with interaction techniques to make the results understandable. As a result, the user can identify and analyze erroneous and suspicious measurements in the network. A case study with a domain expert verified the usefulness of our approach.