Overview of change detection techniques and implementation examples

About Change Detection Technology

<Overview>

Change detection technology (Change Detection) is a technique for detecting changes or anomalies in the state of data or systems. To detect changes in the state of data and systems, change detection compares two states: a learning period (past data) and a test period (current data). The mechanism is to model normal conditions and patterns using data from the learning period and compare them with data from the test period to detect abnormalities and changes. There are various methods for change detection, including statistical methods and machine learning models.

Examples of applications include the following.

<Applications of Change Detection Technology>

• Network Monitoring: Change detection is used to detect attacks and network anomalies by learning the characteristics and patterns of network traffic and comparing them to normal traffic.
• Sensor Networks: Anomaly and change detection is important in sensor networks where numerous sensors collect data. For example, in environmental monitoring and logistics systems, change detection is used to detect changes in sensor data and identify anomalous conditions or events.
• Infrastructure Monitoring: Infrastructure monitoring detects changes in system performance and status. For example, changes in server load or resource utilization, or unusual increases in network bandwidth can be detected to help provide early warning of problems or prevent failures.
• Environmental Change Detection: Environmental monitoring and weather forecasting detect changes in environmental data. This would involve monitoring data such as temperature, humidity, barometric pressure, wind speed, etc., to detect unusual changes and fluctuations in weather patterns.
• Business Analytics: Change detection is also used to analyze business data and customer behavior. This would involve, for example, monitoring changes in sales data or marketing metrics to detect unusual trends or shifts in trends.

Next, we discuss the algorithms used for change detection.

Algorithms used in change detection techniques

Change detection techniques use a variety of algorithms and methods to detect changes in data and system status. The following describes some common change detection algorithms.

• Criterion Model: A model that uses the following criteria to detect a change in the state of the data or system
  • Moving Average: Calculates the average of historical data and evaluates how much the new data deviates from the standard.
  • Standard deviation: Calculates the standard deviation of historical data and evaluates how much the new data deviates from the standard.
• Statistical Change Detection
  • CUSUM (Cumulative Sum): detects changes when data changes exceed the cumulative sum threshold.
  • EWMA (Exponentially Weighted Moving Average): detects changes by exponentially weighting historical data.
• Machine Learning-based Change Detection
  • General Machine Learning: a method that uses supervised learning models such as logistic regression and Support Vector Machines (SVM) to detect anomalous changes.
  • Deep learning: a technique that uses neural networks or deep learning models to detect changes in patterns.
• Sequence-based change detection: a method to detect changes in a sequence of events.
  • Health Change Point Detection: detects change points by assuming that changes occur at specific points in time series data.
  • Multiscale change detection: Analyzes data at different time scales to detect abnormal changes.

As with anomaly detection, these require the selection of an appropriate algorithm depending on the applicable area of change detection and the characteristics of the data, and it is also important to combine multiple methods.

Specific implementations using these algorithms are described below.

Python implementation of change detection using a reference model

An example Python implementation of change detection using a criterion model is shown below. The reference model learns patterns in past data and compares them to new data to detect anomalies.

import numpy as np

# Historical data (normal data)
past_data = [0, 1, 2, 3, 4, 5]

# New Data
new_data = [0, 1, 2, 10, 11, 12]

# Calculate mean and standard deviation
mean = np.mean(past_data)
std = np.std(past_data)

# Calculate anomaly scores for new data
anomaly_scores = np.abs((new_data - mean) / std)

# Abnormality score thresholds
threshold = 3.0

# Display Results
for i, score in enumerate(anomaly_scores):
    if score > threshold:
        print(f"Data: {new_data[i]}, anomaly score: {score} (abnormal)")
    else:
        print(f"Data: {new_data[i]}, anomaly score: {score} (normal)")

In the above example, the historical data (normal data) is used to calculate the mean and standard deviation, and then the difference from the mean is normalized by the standard deviation for the new data to calculate the anomaly score. The abnormality score is a value that indicates how much the new data deviates from the mean. A threshold value for this abnormality score is set to determine the criteria for judging abnormality, and when the abnormality score exceeds the threshold value, the data is judged to be abnormal.

Finally, the results are displayed, showing the value of each data and the abnormality score for it. Here, if the abnormality score exceeds the threshold value, it is displayed as “abnormal”; otherwise, it is displayed as “normal.

Change detection using the reference model is a relatively simple method, but the selection of an appropriate threshold value is important.

Python implementation of change detection using statistical change detection

Statistical change detection is a method of detecting changes in data using statistical methods. Below is an example of a Python implementation of statistical change detection.

import numpy as np
from scipy.stats import t

# Historical data (normal data)
past_data = [0, 1, 2, 3, 4, 5]

# New Data
new_data = [0, 1, 2, 10, 11, 12]

# Calculate mean and standard deviation
mean = np.mean(past_data)
std = np.std(past_data)

# Set threshold for change detection
threshold = 0.05

# Calculate anomaly scores for new data
anomaly_scores = np.abs((new_data - mean) / std)

# Calculate anomaly score thresholds using t-distribution
df = len(past_data) - 1
threshold_value = t.ppf(1 - threshold, df)

# Display Results
for i, score in enumerate(anomaly_scores):
    if score > threshold_value:
        print(f"Data: {new_data[i]}, anomaly score: {score} (abnormal)")
    else:
        print(f"Data: {new_data[i]}, anomaly score: {score} (normal)")

In the above example, the mean and standard deviation are calculated using historical data (normal data). Next, the difference from the mean is normalized by the standard deviation for the new data, and an abnormality score is calculated. This abnormality score is a value that indicates how much the new data deviates from the mean.

Furthermore, a threshold for change detection is set to determine the criteria for determining an abnormality. In the example above, the threshold for the anomaly score is calculated using the t distribution. The degree of freedom (df) is the number of samples of past data minus 1. The percentile of the t-distribution corresponding to the specified threshold value (0.05) is calculated, and that value is used as the threshold value.

Finally, the resulting values for each data and the anomaly score for it are displayed. Here, if the anomaly score exceeds the threshold value, it is displayed as “abnormal”; otherwise, it is displayed as “normal.

In statistical change detection, changes are detected based on the distribution of data and statistical characteristics. There, the selection of appropriate threshold values and data preprocessing are important, and these require appropriate settings for specific requirements and data sets.

Python implementation of machine learning-based change detection

Machine learning-based change detection can use time series or feature data to detect changes. Below is an example of a Python implementation of change detection using machine learning.

For time-series data (e.g., change detection using LSTM)

import numpy as np
from tensorflow import keras

# Historical data (normal data)
past_data = ...

# New Data
new_data = ...

# Data Preprocessing
# ...

# LSTM Model Construction
model = keras.Sequential([
    keras.layers.LSTM(64, input_shape=(timesteps, features)),
    keras.layers.Dense(1)
])

# Model Learning
model.compile(optimizer='adam', loss='mse')
model.fit(past_data, past_labels, epochs=10, batch_size=32)

# Predicts anomaly scores for new data
anomaly_scores = model.predict(new_data)

# Display Results
for i, score in enumerate(anomaly_scores):
    if score > threshold:
        print(f"Data: {new_data[i]}, anomaly score: {score} (abnormal)")
    else:
        print(f"Data: {new_data[i]}, anomaly score: {score} (normal)")

For feature data (e.g., change detection using One-class SVM):.

from sklearn.svm import OneClassSVM

# Historical data (normal data)
past_data = ...

# New Data
new_data = ...

# Data Preprocessing
# ...

# Building a One-class SVM model
model = OneClassSVM(kernel='rbf', nu=0.05)

# Model Learning
model.fit(past_data)

# Predicts anomaly scores for new data
anomaly_scores = model.decision_function(new_data)

# Display Results
for i, score in enumerate(anomaly_scores):
    if score < threshold:
        print(f"Data: {new_data[i]}, anomaly score: {score} (abnormal)")
    else:
        print(f"Data: {new_data[i]}, anomaly score: {score} (normal)")

In the above example, the LSTM model desribed in “Overview of LSTM and Examples of Algorithms and Implementations” is used for time series data and One-class SVM is used for feature data. The method of building and training the model depends on the type of data and the library used. Finally, the resulting values for each data and the anomaly score for it are displayed. Here, if the anomaly score exceeds a threshold value, it is displayed as “abnormal”; otherwise, it is displayed as “normal. In these machine learning-based change detection, it is important to select appropriate models and adjust hyperparameters.

Sequence-based change detection python implementation

Sequence-based change detection is a method for detecting changes by learning patterns in sequential data (e.g., time series data). Below is an example of a Python implementation of sequence-based change detection.

import numpy as np
from tensorflow import keras

# Past sequence data (normal data)
past_sequences = ...

# New sequence data
new_sequences = ...

# Data Preprocessing
# ...

# LSTM Model Construction
model = keras.Sequential([
    keras.layers.LSTM(64, input_shape=(timesteps, features)),
    keras.layers.Dense(1)
])

# Model Learning
model.compile(optimizer='adam', loss='mse')
model.fit(past_sequences, past_labels, epochs=10, batch_size=32)

# Predicts anomaly scores for new sequence data
anomaly_scores = model.predict(new_sequences)

# Display Results
for i, score in enumerate(anomaly_scores):
    if score > threshold:
        print(f"sequence data: {new_sequences[i]}, anomaly score: {score} (abnormal)")
    else:
        print(f"sequence data: {new_sequences[i]}, anomaly score: {score} (normal)")

The above example uses an LSTM model to perform sequence-based change detection. The model construction and training is similar to a regular LSTM model, but sequence data is used as input data.

Data preprocessing and model structure may vary depending on the specific data set and problem, and should be done appropriately based on data normalization, feature engineering, and model architecture selection. Here, at the end, the resulting anomaly scores are displayed for each sequence of data and its anomaly score. If the anomaly score exceeds a threshold value, it is displayed as “abnormal”; otherwise, it is “normal.

Sequence-based change detection can capture temporal patterns and dependencies in the data, but as with the machine learning approach, it is important to select appropriate models and adjust hyperparameters.