Identifying novelties and anomalies for incremental learning in streaming time series forecasting

Engineering Applications of Artificial Intelligence 123 (2023) 106326 Contents lists available at ScienceDirect Engineering Applications of Artificial Intelligence journal homepage: www.elsevier.com/locate/engappai Identifying novelties and anomalies for incremental learning in streaming time series forecasting Laura Melgar-Garcíaa, David Gutiérrez-Avilésb, Cristina Rubio-Escuderob, Alicia Troncosoa,∗ aData Science & Big Data Lab, Pablo de Olavide University, ES-41013 Seville, Spain bDepartment of Computer Science, University of Seville, Avda. Reina Mercedes s/n, Seville, 41012, Spain ARTICLE INFO Dataset link:https://www.omie.es Keywords: Real-time forecasting Online incremental learning Novelties and anomalies Streaming time series Electricity demand ABSTRACT Time series data can be defined as a chronological sequence of observations on a variable of interest. A streaming time series is a time series that arrives continuously at high speed and has a data distribution that may change over time. Streaming time series data usually comes from electronic devices such as sensors and many of the applications dealing with streaming data in Industry 4.0 require real-time responses. Performing real-time forecasting offers the possibility to consider new types of patterns in the incoming streaming data, which is not possible when working with batch models. This paper presents a new approach to detect novelties and anomalies in real-time using a nearest-neighbors based forecasting algorithm. The algorithm works with an offline base model that is updated as stream data arrives following an incremental learning approach. It detects unknown patterns called novelties and anomalies. Novelties are included in the model in an online way and anomalies trigger an alarm as they present unexpected behaviors that need to be specifically analyzed. The algorithm has been tested with Spanish electricity demand data. Results show that the prediction errors obtained when the model is updated considering novelties and anomalies are lower than the errors obtained when the model is not updated. Thus, the model adjusts in real-time to the new patterns of data providing accurate errors and real-time predictions. 1. Introduction Forecasting consists of obtaining predictions of the future behavior of one or more variables. Time series forecasting is a field of research that has grown in recent years due to the numerous applications that deal with time series such as finance (Zhang et al.,2022;Alkhatib et al., 2022) or electricity consumption (Gul et al.,2021c,b,a). Nowadays, most of the data generated from fields as diverse as medicine, industry or renewable energies are streaming time series. Time series data received in streaming present its own particularities as streams need to be processed and modeled in a particular way considering specific requirements (Sahal et al.,2020). One of the most important characteristics for this type of data is the need to obtain timely responses and therefore, obtaining real-time predictions is crucial in order to predict behavior in the near future for decision making such as cost-saving or optimization of system performance (Wang et al.,2023). A streaming time series is a time series that arrives continuously at high speed and has a data distribution that may change over time. In this scenario, new patterns in the data may appear and known patterns may disappear or evolve into new patterns. These new patterns can be classified into novelties, which indicate emerging patterns that need to be incorporated as new normal patterns in the prediction model or ∗Corresponding author. E-mail address: [email protected] (A. Troncoso). anomalies, which are undesired patterns (Faria et al.,2016). Thus, a novelty will be a new recurring pattern over time while an anomaly is a new pattern that does not repeat over time because it is due to an exception. In addition to prediction models always being ready to provide realtime predictions, they must also adjust to new patterns that appear in the data when dealing with streaming time series, otherwise the prediction results would not be accurate (Bifet et al.,2019). Because of this, forecasting algorithms must incorporate incremental learning mechanisms so that they can adapt to take into account the data coming online, as it is not feasible to provide answers in time if the algorithm needs to be re-trained every time new patterns appear. This paper proposes a methodology based on a real-time prediction algorithm to detect both novelties and anomalies in the data. This prediction algorithm, called StreamWNNov, is based on the nearest neighbors and learns incrementally as the temporal data is streamed. This incremental learning is carried out in two distinct ways: internal and external learning. One is an internal incremental learning in which the prediction model updates the nearest neighbors of known patterns with streaming patterns, and an external learning in which new patterns such as novelties are incorporated into the model as normal https://doi.org/10.1016/j.engappai.2023.106326 Received 29 December 2022; Received in revised form 7 March 2023; Accepted 10 April 2023 Available online 17 April 2023 0952-1976/©2023 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 patterns. Results using electric power data in Spain are reported to assess the proposed algorithm performance, showing remarkable results when compared to other algorithms recently published in the literature. The results show that the incorporation of the novelties improves the accuracy of the prediction algorithm and furthermore the prediction algorithm is computationally efficient, which makes it suitable to obtain real-time predictions. This methodology is a pattern-based algorithm that does not take into account any calendar information. Its main contribution is the possibility of incrementally updating the learning model considering new patterns in the incoming data stream. In addition, the algorithm detects anomalies or outliers in the incoming patterns at high speed. This enables real-time alarms to be triggered when an anomaly or outlier is detected. The main advantages of the StreamWNNov over existing algorithms in the literature is that the entire process is performed in real-time in addition to the remarkable accuracy in terms of errors and its scalability to deal with big data. Thus, the main contributions can be summarized as: 1. Development of a forecasting algorithm based on k-nearest neighbors for time series received in streaming. 2. Results using electric power data in Spain are reported to assess the proposed algorithm performance, showing remarkable results when compared to other algorithms published in the literature. 3. An incremental learning based on both the update of the nearest neighbors and the incorporation of novelties is proposed. Thus, novelties are not only detected in real time but also taken into account by the forecasting algorithm to predict new data. 4. The incorporation of the novelties improves the accuracy of the prediction algorithm and furthermore the prediction algorithm is computationally efficient due to the incremental learning, which makes it suitable to obtain real-time predictions. 5. Finally, the forecasting algorithm also identifies anomalies and in such cases triggers an alert. 6. To the best of our knowledge most novelty detection algorithms are focused on classification but not on time series forecasting, and only detect novelties but not as used to predict in real time. The rest of the paper is structured as follows. Section 2presents a review of novelties detection algorithms and forecasting approaches for streaming time series. In Section 3the methodology to detect novelties and anomalies is introduced along with the StreamWNNov algorithm and how its incremental learning is carried out. Section 4 defines the electricity dataset used and includes the discussion of the forecasting results for different type of updating of the prediction model and execution time results for different prediction horizons. The paper finishes with some final conclusions and ideas for future approaches in Section 5. 2. Related work The research field of streaming time series forecasting has made significant progress in the last ten years. The efforts can be divided into two distinct groups: developing efficient algorithms to forecast data streams and methodologies for novelty and anomaly detection from these data streams. Regarding forecasting algorithms for data streaming, finding patterns in the stream and matching them with the newly arriving data emerge as an effective strategy. The authors in Jiménez-Herrera et al. (2022) proposed a methodology for streaming time series forecasting based on finding similar patterns along the data streams. First, they combined a k-means clustering model with a Naive-Bayes classifier in an offline phase to determine the different patterns from historical data. Then, the forecast is obtained by applying a nearest similar patterns-based methodology in the online phase. In order to evaluate the performance of the framework a comparative study was applied to electricity demand consumption in a big data scenario. To deal with a time variable, the pattern recognition can be extended to the third dimension as made in Melgar-García et al. (2021), where the authors developed the STriGen triclustering algorithm to discover 3D patterns from data streams in real time. The proposal applies an adhoc genetic algorithm to build an initial model in an offline phase. When streaming data arrives, the model is updated by applying genetic operators systematically. The algorithm is exhaustively evaluated using synthetic and real-world datasets from environmental sensors and compared to a batch triclustering algorithm. Also, in Park and Kim (2021), specific structures to find patterns were developed, presenting an incremental methodology to label forecasting in real time. It is based on a data structure, called online incremental hierarchical classification resonance network (OIHCRN), which scales online according to the classes, thus allowing real-time classification. This structure was tested in several problems, such as text and image categorization, protein function prediction, and a multimedia recommendation system. Results were compared to another online classification algorithm, showing the efficiency of the proposed structure to find patterns. Ensemble models show a well-known outstanding performance in the time series forecasting domain. Focusing on the data streaming scenario, an effort to adapt and improve the dynamic ensemble selection approach for data stream time series forecasting can be found in Boulegane et al. (2020). The authors presented a new system, called MTR-DES, to enhance the selection of the ensemble model as the data stream arrives. MTR-DES takes into account the dependencies of the model pool and applies an incremental multi-target regression approach to make the selections. The proposal was tested using several real scenarios, such as hospital energy loads, solar radiation, or river flow streaming data. Its efficiency was compared to a collection of other dynamic ensemble selection solutions in terms of prediction accuracy and computational costs. Streaming forecasting algorithms are also closely linked to the big data environment. In Pandya et al. (2020), the authors claim the improvement of Vector Autoregression (VAR) for time series forecasting, making it online and concept-drift sensible through a big data Lambda architecture. They used the Apache Spark framework to develop a batch-stream combining system to manage data streams and outperform the VAR algorithm. The batch-stream framework performance was compared separately to the batch and streaming base architectures that Apache Spark provides. Experiments were conducted in four different streaming scenarios: without, gradual, abrupt, and mixed concept drifts data, showing the proposal the best performance. Not only strict machine learning approaches can be found, but statistical and meta-heuristics-based solutions also provide good performance. The authors in Mochinski et al. (2020) stated that combining statistical methods with machine learning ones outperforms the isolated solutions in the streaming time series forecasting scenario. They showed that fact by conducting several experiments. In particular, they applied their hybrid proposal to data streams from the International Institute of Forecasters, combining the ARIMA statistical method with well-known machine learning ones, such as AdaGrad and AmRules Regressor. Furthermore, in Ma and Ma (2019), a new streaming time series data modeling and forecasting method was presented. The data modeling is based on dividing the streams in a double-sliding window and, in a second step, a gene expression algorithm was applied to mine the model from the data composing of these windows of variable length. Furthermore, the colony climbing algorithm was used to improve the adaptation of the model to concept-drift. The proposal was compared to the hierarchical temporal memory algorithm using synthetic data. For novelty and anomaly detection, there are a plethora of approaches to accomplish this problem in many application domains (Faria et al.,2016). Focusing on both machine learning approaches and data streaming scenarios, several strategies emerge such as neighborbased approaches, ensemble, and neural network models. Neighborbased strategies model the novelty detection problem as a k-nearest 2 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 neighbor problem using different similarity measures to detect a new pattern from the stream. In that sense, the authors in Al-Falouji et al. (2022) developed an anomaly detection algorithm using a k-nearest neighbor graph. The performance of the method was evaluated using synthetic and real-world datasets, outperforming the methods to which it was compared. In Carreno et al. (2022), the authors proposed a sophisticated novelty detection algorithm for streaming data based on a mixture of Gaussian distributions. In order to update the model with the newly discovered patterns, they implemented an Expectation Maximization algorithm along with a meta-regression model based on random forest and a k-nearest neighbor algorithm. A comparative experimental study using real-world datasets showed outstanding results. Authors in Al-Khateeb et al. (2016) proposed a novel approach to distinguish recurring classes from novel classes. This differentiation is performed with an ensemble of micro-classifiers for each class of the data. In Razavi-Far et al. (2019) a framework for detecting and classifying faults in streams with drifts is proposed. An Extended CU- mulative (E-CUSUM) technique is followed by a novelty detector. Thus, the former technique detects abrupt changes and the latter detects unseen classes. In addition, in Cejnek and Bukovsky (2018) a study of two methods for adaptive novelty detection in streams with drift is presented. Authors demonstrated that the learning entropy-based method (LE) performed better than the error and learning-based novelty detection (ELBND), especially in cases of high specificity, as well as for outlier detection. The ensemble approach also stands out as a competitive strategy to deal with novelties and anomalies. On this matter, the ensemble solution presented in Cano and Krawczyk (2022) is remarkable, which proposed an architecture that maintains a fixed-size pool of updated classifiers. The classifier pool is combined with the ADWIN drift detector (Bifet and Gavaldà,2007) to adapt the system to incoming novelties and update the models if these novelties mean a change in the data stream. The ensemble solution proposed in Jain and Kaur (2021) adds the distributed characteristic to the implementation of the ensemble. The authors combined Random Forest, Logistic Regression, and Support Vector Machines as a stacking ensemble learner. To deal with anomaly detection, a k-means clustering algorithm was applied. The system was implemented using the Apache Spark framework and was tested in different big data streaming scenarios, being its application domain the network intrusion detection. In Hallaji et al. (2022), a novel ensemble learner is proposed for the classification of false data injection attacks in power systems. First, a detection module is used for pattern deviation identification. Then, the signal retrieval module allows the removal of injected false data. The last module of the ensemble is the attack type classifier. Neural networks have been used as a promising approach due to their adaptation capability to the problem domain. Thus, the authors in Korycki and Krawczyk (2022) presented a solution for a specific situation with novelties, the malicious injection of false novelties in the data stream. A system based on a restricted Boltzmann machine combined with online gradient calculation and extended energy function was developed to accomplish this problem, providing robustness against adversarial novelties. The proposal was tested using a data stream benchmark, showing its effectiveness in terms of novelty detection and poisoning data filtering. Finally, an exhaustive updated literature review of novelty detection can be found in Souiden et al. (2022). The authors point out the particular characteristics of the data streaming environment: concept drift, limited time and space requirements, and the curse of dimensionality in high dimensional space, combining these four concepts to present a state-of-the-art analysis. Furthermore, in Din et al. (2021), a discussion of different algorithms for novelty management was presented. The authors provided a detailed overview of evaluation measures and datasets used for evaluating these algorithms. 3. Methodology In this Section, the StreamWNNov proposed algorithm is presented. First, an overview of the entire methodology is given. Subsequently, the two main parts of the methodology are presented in detail in Sections 3.1 and 3.2. Let be a time series’ dataset consisting of 𝑁instances that can be represented as: 𝑋𝑡= {(𝑥1, 𝑦1),…,(𝑥𝑁, 𝑦𝑁)} 𝑥𝑖∈R𝑤𝑦𝑖∈Rℎ(1) where 𝑥𝑖are the features of the 𝑖th instance corresponding to 𝑤past values of the time series and 𝑦𝑖are the classes of the 𝑖th instance corresponding to ℎfollowing values of the time series. Considering (𝑥𝑖, 𝑦𝑖), the goal is to forecast the next ℎclasses (𝑦𝑖) of the 𝑤streaming incoming features (𝑥𝑖) in real-time. The proposed methodology for streaming data is composed of two phases. In a first offline phase, an initial prediction model is built and in a second online phase, this model is updated incrementally in real time as predictions are made in real time. The proposed algorithm StreamWNNov predicts streaming data using 𝐾weighted nearest neighbors and updates the model based on novelty detection. In particular, the incremental updating consists of both updating the nearest neighbors and detecting novelties and adding them to the model. The algorithm includes the parameter 𝐾that refers to the number of neighbors, or time series, associated with each instance in the model. Neighbors contribute both in the offline and online forecasting process. One of the main problems of the traditional K- nearest neighbors is the required time to build the model. However, in StreamWNNov the model is created only once, during its first phase or offline phase, and in a distributed and efficient way. The second phase or online phase forecasts in real-time, keeps the model updated with incremental learning considering streaming data, identifies anomalies and adds novelties to the model. Fig. 1 presents an overview of the methodology. First, the model 𝑀 is created in an offline way from historical data and from the stream 𝑥𝑠𝑡 the forecasting along with its error is obtained in real time. This prediction is based on the nearest neighbors of the closest pattern to 𝑥𝑠𝑡 located at the 𝑑𝑚𝑖𝑛 distance. Depending on the magnitude of the error, the stream is considered normal or unknown pattern, concretely novelty or anomaly. If the stream 𝑥𝑠𝑡 is normal but is a closer neighbor than the nearest neighbors stored in the model 𝑀, the stream is stored in a buffer 𝐵in order to update the nearest neighbors. If the stream is a novelty, it is incorporated as a new pattern into the model, and if the stream is an anomaly an alarm is raised. As shown in the Figure, the algorithm continues to run the online phase until there is no more incoming streaming data. Fig. 2 illustrates a general outline of the online phase only. These steps of the methodology are described in detail in the following sections. The process for computing the offline model and the online forecast is in Section 3.1. Section 3.2 explains the methodology developed to detect streaming time series novelties and to identify streaming anomalies in real-time. In addition, this Section presents the procedure to update the model in real-time using incremental learning based on neighbors and novelties. 3.1. StreamWNNov algorithm This Section presents the StreamWNNov algorithm for streaming time series forecasting. The offline phase to build an initial prediction model is described in Section 3.1.1 and how real-time forecasting is performed in Section 3.1.2. 3 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 Fig. 1. Overview of StreamWNNov. 3.1.1. Offline stage Historical offline data is divided into two sets: neighbors and patterns, denoted 𝑠𝑒𝑡𝑛and 𝑠𝑒𝑡𝑝from now on. These sets correspond to 70% and 30% of the chronologically ordered offline data respectively. Both sets of time series follow the above definition (see Eq. (1)). For each feature instance of the 𝑠𝑒𝑡𝑝pattern set, the algorithm searches for the 𝐾closest instances from the 𝑠𝑒𝑡𝑛neighbors’ set. In this study, the distance metric used is the euclidean distance between features. The offline model with 𝑡instances of the 𝑠𝑒𝑡𝑝is represented as: 𝑀=⟨⟨𝑥1,⟨𝑦(𝑛1(𝑥1)),…, 𝑦(𝑛𝐾(𝑥1))⟩⟩, ..., ⟨𝑥𝑡,⟨𝑦(𝑛1(𝑥𝑡)),…, 𝑦(𝑛𝐾(𝑥𝑡))⟩⟩⟩ (2) where 𝑥𝑖corresponds to the features of the 𝑖th instance of the 𝑠𝑒𝑡𝑝and 𝑦(𝑛𝑗(𝑥𝑖)) is the class of the 𝑗th closest neighbor of 𝑥𝑖from the 𝑠𝑒𝑡𝑛. The last step of the offline phase consists of calculating the error obtained in the learning process of the model 𝑀known as training error. For this purpose, the error obtained by the model 𝑀when predicting the 𝑠𝑒𝑡𝑝is computed. For each 𝑖th instance 𝑥𝑖in the model 𝑀and for each 𝑙th value in the prediction horizon ℎ, the prediction based on the 𝐾nearest neighbors (Talavera-Llames et al.,2019,2016) is defined by: 𝑦𝑖(𝑙) = 1 ∑𝐾 𝑗=1 𝛼𝑗 × 𝐾 ∑ 𝑗=1 𝛼𝑗𝑦(𝑛𝑗(𝑥𝑖))(𝑙) 1 ≤𝑙≤ℎ(3) 4 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 Fig. 2. Summary of the online stage of StreamWNNov. Fig. 3. Representation of the offline phase where the 𝑠𝑒𝑡𝑝is made up of 𝑡instances and 𝐾is two. where 𝛼𝑗is the inverse squared euclidean distance 𝑑2 𝑗between the 𝑥𝑡 pattern feature and the 𝑛𝑗(𝑥𝑡)neighbor feature, i.e. 𝛼𝑗=1 𝑑2 𝑗 . Thus, the mean absolute percentage error for each 𝑖th instance in the model 𝑀,𝑀𝐴𝑃 𝐸𝑖, considering the forecast 𝑦𝑖(𝑙)and the real 𝑦𝑖(𝑙) classes is computed by the equation: 𝑀𝐴𝑃 𝐸𝑖= 100 × 1 ℎ ℎ ∑ 𝑙=1 ||||| 𝑦𝑖(𝑙) − 𝑦𝑖(𝑙) 𝑦𝑖(𝑙)||||| (4) and the training error, 𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒, is obtained by averaging all the 𝑀𝐴𝑃 𝐸𝑖as follows: 𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒 =1 𝑡 𝑡 ∑ 𝑖=1 𝑀𝐴𝑃 𝐸𝑖(5) Fig. 3 illustrates a graphical representation of the offline phase considering that there are 𝑡instances in the 𝑠𝑒𝑡𝑝and 𝐾is two, i.e., each pattern of the 𝑠𝑒𝑡𝑝is associated with its two nearest neighbors from the 𝑠𝑒𝑡𝑛in the model 𝑀. Forecasts 𝑦𝑖and the 𝑀𝐴𝑃 𝐸𝑖metric for each 𝑖th streaming instance 𝑥𝑖in the 𝑠𝑒𝑡𝑝are computed following the Eqs. (3) and (4), respectively, and the MAPE of the offline phase is calculated from Eq. (5). 3.1.2. Real-time forecasting Once the offline base model is computed and the MAPE value of the offline stage is obtained, StreamWNNov is ready to start receiving real-time data. In the online phase all streaming requirements are fulfilled (Benczúr et al.,2019). The general procedure consists of associating each streaming data 𝑥𝑠𝑡 to the closest pattern feature instance 𝑥𝑖in the model 𝑀, named 𝑥𝑚𝑖𝑛. In other words, it can be said that the nearest neighbor of 𝑥𝑠𝑡 is the instance 𝑥𝑚𝑖𝑛. Then, the 𝐾nearest neighbors of the 𝑥𝑚𝑖𝑛 are recovered from the model 𝑀and are considered as the nearest neighbors of the streaming 𝑥𝑠𝑡. Thus, the online forecast of the classes of the 𝑥𝑠𝑡,𝑦𝑠𝑡, for each 𝑙th value in the prediction horizon ℎcan be computed as: 𝑦𝑠𝑡(𝑙) = 1 ∑𝐾 𝑗=1 𝛼𝑗+𝛼𝑚𝑖𝑛 ×(𝐾 ∑ 𝑗=1 𝛼𝑗𝑦(𝑛𝑗(𝑥𝑚𝑖𝑛))(𝑙) + 𝛼𝑚𝑖𝑛𝑦(𝑥𝑚𝑖𝑛)(𝑙))(6) where 𝛼𝑚𝑖𝑛 =1 𝑑2 𝑚𝑖𝑛 and 𝑑𝑚𝑖𝑛 is the euclidean distance between 𝑥𝑠𝑡 and 𝑥𝑚𝑖𝑛. The strategy of using the 𝐾nearest neighbors of my nearest neighbor in the model 𝑀as nearest neighbors ensures that the prediction can be computed in real time as neighbors are already stored in the model and do not need to be calculated. This online forecast 𝑦𝑠𝑡 takes into consideration the nearest neighbor 𝑥𝑚𝑖𝑛 of the 𝑥𝑠𝑡 and the 𝐾nearest neighbors of 𝑥𝑚𝑖𝑛 in the current model. In particular, the classes of 𝑥𝑚𝑖𝑛 are 𝑦(𝑥𝑚𝑖𝑛)and the classes of the neighbors of 𝑥𝑚𝑖𝑛 are 𝑦(𝑛𝑗(𝑥𝑚𝑖𝑛)) in Eq. (6). Finally, the MAPE metric for 𝑦𝑠𝑡, called 𝑀𝐴𝑃 𝐸𝑠𝑡, is calculated each time the real values 𝑦𝑠𝑡 are received in the stream, i.e., a real-time error value is obtained for each ℎpredicted data. 5 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 3.2. Detection of novelties and anomalies in real-time StreamWNNov adds the possibility to incorporate novelties into the model and identify anomalies in the streaming data during the online phase of the algorithm. The detection of novelties and anomalies is explained in Section 3.2.1. The process for updating the model adding novelties to the model as well as updating the 𝐾closest neighbors in the model 𝑀is described in Section 3.2.2. 3.2.1. Identifying and differentiating unknown streaming patterns Novelties and anomalies are highly correlated terms that identify a different pattern from the known concepts of the model. However, each of them implies its own meaning and treatment. On the one hand, novelties in streaming flow of data represent new and emergent behaviors. Novelties must be incorporated into the model for the algorithm to produce results considering these new patterns. On the other hand, anomalies do not conform to expected behaviors and therefore do not need to be added to the model. Anomalies usually require a particular analysis (Faria et al.,2016). Novelties and anomalies should be differentiated from concept drift in data streams. The first two concepts refer to new classes or patterns appearing in the incoming data. The latter concept refers to changes in classes already existing in the learning model. If concept drift occurs in existing patterns, the model needs to be adapted. In this work, the neutralization of concept drift is performed by updating the neighbors of the patterns already included in the model. This identification in online data presents many challenges considering, in addition, that it has to provide timely responses. In StreamWNNov a 𝑥𝑠𝑡 is considered an unknown pattern if its 𝑀𝐴𝑃 𝐸𝑠𝑡, computed after receiving the real 𝑦𝑠𝑡 class, is higher than a defined threshold. In particular, the process of distinguishing unknown patterns between novelties and anomalies is based on two thresholds, an upper threshold (𝑢𝑝𝑡ℎ𝑟) and a lower threshold (𝑙𝑜𝑤𝑡ℎ𝑟). These two thresholds must be defined after an analysis of the errors obtained in the offline stage. In Chandola et al. (2009) authors reviewed some anomaly detection techniques used in nearest neighbors-based models. They concluded with the assumption that anomalies occur far away from their closest neighbors. This idea is the basis of the StreamWNNov algorithm for anomaly detection. Thus, if the 𝑀𝐴𝑃 𝐸𝑠𝑡 obtained when predicting the streaming class 𝑦𝑠𝑡 is greater than the 𝑢𝑝𝑡ℎ𝑟 threshold, the specific incoming feature 𝑥𝑠𝑡 is considered as an anomaly. When an anomaly is detected, the StreamWNNov triggers a real-time alert. On the other hand, when the error 𝑀𝐴𝑃 𝐸𝑠𝑡 is lower than the 𝑢𝑝𝑡ℎ𝑟 threshold but higher than the 𝑙𝑜𝑤𝑡ℎ𝑟 threshold, online feature data 𝑥𝑠𝑡 are considered as novelties. In this case, the model 𝑀is updated by incorporating the new streaming pattern identified as novelty with its corresponding 𝐾closest neighbors from historical data. Therefore, it can be said that the model is updated externally. Section 3.2.2 describes in detail the whole process of adding novelties to the model. For this research work, if the prediction error when predicting 𝑦𝑠𝑡 is greater than the training error, 𝑥𝑠𝑡 will be considered as an unknown pattern. Thus, the lower threshold is the MAPE of the offline phase, i.e. 𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒. On the other hand, the upper threshold is defined as the 𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒 plus three times its standard deviation. The pseudocode for identifying anomalies and novelties in real-time is described in Algorithm 1. 3.2.2. Incremental learning This Section describes the procedure for updating the model with data streams using incremental learning, which consists of both updating the neighbors of the patterns that form the model and incorporating new patterns. The incremental learning based on neighbors consists of replacing nearest neighbors of the pattern 𝑥𝑖in the model 𝑀by streaming patterns 𝑥𝑠𝑡 when these streaming patterns are closer to 𝑥𝑖than their Algorithm 1: Unknown patterns identification Result: updated M model and identification of unknown patterns 𝑀←Current model 𝑙𝑜𝑤𝑡ℎ𝑟 ←𝑀𝐴𝑃 𝐸𝑜𝑓 𝑓 𝑙𝑖𝑛𝑒 𝑢𝑝𝑡ℎ𝑟 ←𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒 + 3⋅𝑠𝑡𝑑(𝑀𝐴𝑃 𝐸𝑜𝑓𝑓𝑙𝑖𝑛𝑒) for each 𝑥𝑠𝑡 that arrives do 𝑦𝑠𝑡 ←predict(M, 𝑥𝑠𝑡) (see Equation (6)) 𝑀𝐴𝑃 𝐸𝑠𝑡 ←MAPE(𝑦𝑠𝑡,𝑦𝑠𝑡) if 𝑀𝐴𝑃 𝐸𝑠𝑡 > 𝑙𝑜𝑤𝑡ℎ𝑟 then 𝑥𝑠𝑡 is an unknown pattern if 𝑢𝑝𝑡ℎ𝑟 > 𝑀𝐴𝑃 𝐸𝑠𝑡 then 𝑥𝑠𝑡 is a novelty 𝑀←Add novelty to the model (see Equation (7)) else Anomaly identification Alert created by the model end end end neighbors. In this way, the distances of the nearest neighbors to the pattern 𝑥𝑖will decrease as the incremental learning is carried out and therefore the nearest neighbors will be closer and closer to the pattern 𝑥𝑖(Melgar-García et al.,2021;Melgar-García et al.,2022). Right after finding the nearest pattern to 𝑥𝑠𝑡 in the model 𝑀,𝑥𝑚𝑖𝑛, if the distance between 𝑥𝑚𝑖𝑛 and 𝑥𝑠𝑡 is lower than the distance between 𝑥𝑚𝑖𝑛 and its current farthest neighbor 𝑛𝐾(𝑥𝑚𝑖𝑛)in the current model, then 𝑥𝑠𝑡 is added as a new potential nearest neighbor of 𝑥𝑚𝑖𝑛 in an online buffer. In order to comply all data streaming requirements, only a few real-time instances can be kept in a buffer. The online buffer is checked temporarily, in particular daily, monthly or quarterly. Each pattern feature instance 𝑥𝑖in the model can be updated by changing its 𝐾nearest neighbors with online incoming data 𝑥𝑠𝑡 from the online buffer. In such a case, the 𝐾nearest neighbors are selected from the nearest neighbors of 𝑥𝑖from the current model and the streaming patterns whose nearest neighbor is 𝑥𝑖from the buffer. Fig. 4 represents an example of this online update of the model where 𝑛𝑗are the 𝑗th nearest neighbors of 𝑥𝑖from historical offline data. The online buffer contains the closest pattern instance 𝑥𝑚𝑖𝑛 of each 𝑥𝑠𝑡 and the distance between them 𝑑(𝑥𝑚𝑖𝑛, 𝑥𝑠𝑡). All the instances in this buffer must meet the requirement that 𝑑(𝑥𝑚𝑖𝑛, 𝑥𝑠𝑡)is less than the distance between 𝑥𝑚𝑖𝑛 and its farthest neighbor in the model 𝑛𝐾. In Fig. 4, after the update process, the nearest neighbors of 𝑥6are the two data streams instances 𝑥𝑠𝑡80 and 𝑥𝑠𝑡21 and the neighbor instance 𝑛1. Incremental learning based on the incorporation of new patterns consists of the detection of novelties. The model follows an incremental learning procedure to discover new patterns in the incoming realtime data. These new patterns need to be added to the model to keep it always up to date. This is a very important task in online algorithms (Bifet et al.,2019). During the online phase, the proposed methodology identifies online feature data 𝑥𝑠𝑡 as novelty when the 𝑀𝐴𝑃 𝐸𝑠𝑡 metric is greater than the defined 𝑙𝑜𝑤𝑡ℎ𝑟 threshold but lower than the 𝑢𝑝𝑡ℎ𝑟 threshold. In particular, for each online data identified as novelty 𝑥𝑠𝑡, the 𝐾nearest neighbors are searched from the offline historical data (both 𝑠𝑒𝑡𝑝and 𝑠𝑒𝑡𝑛) and added to the model 𝑀. In this way, the online model increases in external dimension each time a streaming instance is identified as novelty. The idea behind this is that new streaming patterns may include neighbors that were not selected as 𝐾nearest neighbors for any of the patterns from 𝑠𝑒𝑡𝑝in the offline phase. 6 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 Fig. 4. Representation of an example of the incremental learning based on neighbors. Fig. 5. Representation of an example of the incremental learning based on novelties. A representation of the update process with the 𝑥𝑠𝑡 streaming feature as a novelty is as follows: 𝑀=⟨⟨𝑥1,⟨𝑦(𝑛1(𝑥1)),…, 𝑦(𝑛𝐾(𝑥1))⟩⟩, ..., ⟨𝑥𝑡,⟨𝑦(𝑛1(𝑥𝑡)),…, 𝑦(𝑛𝐾(𝑥𝑡))⟩⟩, ⟨𝑥𝑠𝑡,⟨𝑦(𝑛1(𝑥𝑠𝑡)),…, 𝑦(𝑛𝐾(𝑥𝑠𝑡))⟩⟩⟩ (7) where 𝑦(𝑛𝑗(𝑥𝑠𝑡)) corresponds to the class of the 𝑗th closest feature to 𝑥𝑠𝑡 from the offline historical data. The Algorithm 2represents the updating of the model 𝑀with the feature 𝑥𝑠𝑡 identified as a novelty. Algorithm 2: Model update with novelties Result: updated M model with novelty 𝑀←Current model distances ←[ ] 𝑠𝑒𝑡𝑜𝑓𝑓𝑙𝑖𝑛𝑒 ←𝑠𝑒𝑡𝑛∪𝑠𝑒𝑡𝑝 𝑥𝑠𝑡 ←Novelty for each 𝑥𝑖in 𝑠𝑒𝑡𝑜𝑓𝑓𝑙𝑖𝑛𝑒 do distances ←add(distances, d(𝑥𝑠𝑡,𝑥𝑖)) end {𝑛1(𝑥𝑠𝑡), ..., 𝑛𝐾(𝑥𝑠𝑡)} ←K_smallest(distances, 𝐾) 𝑀←add(𝑀,< 𝑥𝑠𝑡,< 𝑦(𝑛1(𝑥𝑠𝑡)), ..., 𝑦(𝑛𝐾(𝑥𝑠𝑡)) >> Fig. 5 represents a graphical example of the online update of the model. The example shows a case where the streaming instance 𝑥𝑠𝑡8 needs to be included into the current model because its error metric 𝑀𝐴𝑃 𝐸𝑠𝑡8is lower than the defined upper threshold 𝑢𝑝𝑡ℎ𝑟 but larger than the defined lower threshold 𝑙𝑜𝑤𝑡ℎ𝑟. The current model before the novelty update is made up of 𝑡patterns instances. The first nearest neighbor of the 𝑡th instance 𝑥𝑡of the current model is updated by the streaming data 𝑥𝑠𝑡2and the novelty is added including a new pattern 𝑥𝑠𝑡8into the model. This new pattern includes as neighbors the two closest instances from the whole offline historical data. Next, the forecast 𝑦𝑠𝑡8and its 𝑀𝐴𝑃 𝐸𝑠𝑡8can be computed. 4. Results This Section reports the forecasts obtained by StreamWNNov for different prediction horizons using an electricity consumption time series as well as a comparative analysis between several forecasting algorithms. In particular, Section 4.1 describes the division of the data and the parameters selected for the experimentation. The results are presented and discussed in Section 4.2. The analysis of the anomalies and novelties identified can be found in Section 4.3. Finally, the execution times of the online phase is presented in Section 4.4. 4.1. Dataset and experimental setting The proposed methodology is tested using a dataset of electrical energy demand (in megawatt) of Spain from 2007 to 2016. The data is recorded every 10 min and also contains the date and time. This dataset is split into two sets, offline and stream or online data, which correspond to approximately 70% and 30% of the whole data. As explained in Section 3, the offline data is also separated in 70% and 30% of the data resulting in the above-mentioned 𝑠𝑒𝑡𝑛and 𝑠𝑒𝑡𝑝, respectively. 7 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 Table 1 MAPE error metric (in percentage) obtained by the StreamWNNov for each type of update (a) Mean metrics of errors for ℎ=24 Type of update Mean Std Best Worst No update 2.4288 2.0745 0.2464 33.0031 Online daily 2.1982 2.0138 0.2198 33.0031 Novelties 2.3139 2.1403 0.2464 21.5966 Online daily +novelties 2.0703 1.9974 0.2463 22.8013 (b) Mean metrics of errors for ℎ=48 Type of update Mean Std Best Worst No update 2.7617 2.0842 0.4101 31.2720 Online daily 2.5499 2.0878 0.3207 31.2720 Novelties 2.6486 2.0339 0.4101 31.2720 Online daily +novelties 2.4296 2.0886 0.2685 31.2720 (c) Mean metrics of errors for ℎ=72 Type of update Mean Std Best Worst No update 3.3535 2.8200 0.6002 33.3860 Online daily 3.1350 2.8039 0.4493 33.3860 Novelties 3.2692 2.7467 0.6002 33.3860 Online daily +novelties 2.9914 2.7813 0.4493 33.3860 (d) Mean metrics of errors for ℎ=144 Type of update Mean Std Best Worst No update 3.8466 3.6137 0.6548 29.3278 Online daily 3.5741 3.5292 0.6267 27.0206 Novelties 3.7585 3.5271 0.6548 29.3278 Online daily +novelties 3.4099 3.4238 0.6302 29.3278 In this work, four prediction horizons are analyzed, in particular ℎ =24, ℎ=48, ℎ=72 and ℎ=144. The optimal size of the 𝑤window and the optimal number of nearest neighbors for each horizon used are exactly the same as in Melgar-García et al. (2021), Melgar-García et al. (2022) with the objective of making a comparison between the results. The four groups of parameters are: (1) ℎ=24, 𝑤=144 and 𝐾=4, (2) ℎ=48, 𝑤=288 and 𝐾=2, (3) ℎ=72, 𝑤=576 and 𝐾=4 and (4) ℎ =144, 𝑤=864 and 𝐾=4. The experiments are carried out on a cluster with 1 master node and 3 slaves, with 4 Processor Intel(R) Core(TM) i7-5820K CPU with 48 cores and 120 GB of RAM memory. 4.2. Discussion of the results The experimentation is performed with the four different sets of parameters presented in Section 4.1.Table 1 presents the MAPE error metric results in percent of the forecasts obtained by the StreamWNNnov when predicting the stream data during the online phase. The four types of updates of the model refer to the following: •No update: Forecasting algorithm without online updates or identification of novelties or anomalies (Melgar-García et al.,2021). •Online daily: When only an incremental learning based on neighbors is applied, being the buffer checked every day. Worse results are obtained if the buffer is checked monthly or quarterly (Melgar-García et al.,2022). •Novelties: When only an incremental learning based on novelties is applied. •Online daily +novelties: The above two updates together, depicted in Fig. 1. The metrics in the columns of Table 1 correspond to the mean value, the standard deviation and the best and worst errors achieved when predicting the stream data during the online phase. As shown in Table 1, the best forecasting metrics are achieved, for all ℎprediction horizons, with the updating of the model using incremental learning that includes both the daily updating of neighbors and the detection and incorporation of novelties. This means that the model is able to find different types of patterns in the online incoming data and forecasts are improved by considering all of them. The most accurate results are achieved with a horizon of 24 values, i.e. 4 h, which suggests that the more times the model is updated, the best results are achieved. In addition, results in Table 1 show that the online daily update of neighbors is more accurate than just updating the model by incorporating the novelties. The explanation behind this is that the goal of the first-mentioned type of update is to keep the model up to date, i.e., to change the model’s own patterns. As showed in Melgar-García et al. (2023), with this online daily update of neighbors, the distance between the patterns and their neighbors decreases each time the model is updated. In other words, the patterns found in the online incoming data represent the model better than the patterns in the offline phase. The goal of the novelties detection and incorporation is to increase the accuracy of the forecasting model and to include in it patterns that did not exist before. When both updates are used together, the StreanWNNov algorithm takes advantage of both, achieving the best results. Finally, StreamWNNov provides better results compared to other techniques using the same distribution of Spanish electricity demand data (Jiménez-Herrera et al.,2020;Castán-Lascorz et al.,2022) except for the AMRulesReg or StreamNSP methods where the errors obtained by the StreamWNNov are similar. Table 2 presents the results of the different streaming and batch models for the prediction horizon of 4 h or 24 values. AdaGrad is an adaptative gradient algorithm that adjust dynamically the current model considering the previous data (Duchi et al.,2011). FIMTDD uses regression trees to identify drift changes in the streaming data (Ikonomovska et al.,2011). AM- RulesReg approaches the streaming forecast with learning rules based on linear models (Almeida et al.,2013). StreamNSP clusters the data in different groups and forecasts the demand value using an algorithm based on the traditional nearest neighbor (Jiménez-Herrera et al., 2020). ARIMA-SVM and LSTM-SVM are hybrid algorithms proposed in Castán-Lascorz et al. (2022) based on a combination of the SVM model and the ARIMA or LSTM regressor, respectively. First, the data 8 L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero et al. Engineering Applications of Artificial Intelligence 123 (2023) 106326 Table 2 Comparison with other streaming and batch models published in Jiménez-Herrera et al. (2020). Type Algorithm MAPE (%) AdaGrad 12.05 FIMTDD 4.91 AMRulesReg 2.21 Streaming StreamNSP 2.34 StreamWNNov (Online daily) 2.19 StreamWNNov (Online daily +novelties) 2.07 ARIMA-SVM 4.00 Batch LSTM-SVM 3.20 GBM 4.49 are clustered using the SVM, and an ARIMA or LSTM regressor trained for each cluster previously obtained is applied to make the final prediction. GBM is an algorithm based on gradient boosting with Gaussian distribution (Ridgeway,2020). 4.3. Analysis of anomalies and novelties found As explained in Section 3.2, the main objective of identifying new patterns in the incoming data that are not in the model, i.e., novelties, is to adjust to the evolution of patterns in the incoming data. The main objective of the anomaly detection carried out by the StreamWNNov is to trigger a real-time alarm to adjust the energy demand in the next few seconds. Anomalies are expected to be identified right at the really alarming moments. This anomaly and novelty identification process follows an unsupervised approach, since the dataset does not include the ground-truth about the type of each incoming data, which could be identified as normal, anomaly or novelty. To evaluate the accuracy of this process, some particular cases are discussed in this Section. 4.3.1. Novelties in July 2015 Fig. 6 depicts the average electrical energy demand per month along with forecasts by the StreamWNNnov algorithm using only online daily update of neighbors, forecasts using only online novelties update and forecasts with the two previous ones together for the whole dataset used in the online phase. Fig. 6 corresponds to a prediction horizon of one day (ℎ=144) and a past data window of one week (𝑤=864). Results for the other parameters follow the same pattern and therefore the same conclusions can be drawn. In the entire dataset used for the streaming forecast, the month with the highest number of novelties is July 2015. Fig. 6 shows how the average demand value in July 2014 differs tremendously compared to the average demand value in July 2015. Specifically, the average real demand were 28375.6622 MW and 31544.5781 MW, respectively. Electricity demand increases with temperature in urban areas (Romitti and Wing,2022). The Meteorological Space Agency (AEMET) recorded 26.5 degree Celsius as the average temperature for the month of July 2015 in Spain, 2.5 degree Celsius higher than the mean temperature for this month for the reference period from 1981 to 2010. The AEMET classified July 2015 as the warmest July in the historical series. This characteristic means that the model does not have many similar patterns in the historical data. Therefore, the update of the model with the novelties carried out by the StreamWNNov is key to get accurate results. Fig. 6 shows that the update of the prediction model that achieves a demand value closest to the actual in July 2015 is the daily +novelties update. Table 3 represents the average of the daily MAPE metric for July 2015 for each update type of the model. The best results are always achieved for the model update including both neighbors and novelties performed by the StreamWNNov. Fig. 7 depicts the two days in July 2015, July 20th and July 21st, with the worst forecast when no model update is applied. On both Table 3 Mean of the daily MAPE (in %) for July 2015. Updating ℎ=24 ℎ=48 ℎ=72 ℎ=144 No update 3.2451 4.0598 5.2845 5.5693 Online daily 3.0544 3.9487 5.2256 5.5740 Novelties 3.1273 3.5282 4.0773 4.3776 Online daily +novelties 2.5284 3.1622 3.5613 3.1257 Fig. 6. Monthly value of electricity demand for the prediction horizon ℎ=144. days, the forecast for the model without update and with online daily update of neighbors is the same. In the case of July 20th 2015, the worst prediction coincides for the option without update of the model, for daily update of the neighbors in the model and for update based on novelties only, as shown in Fig. 7(a). The average MAPE error achieved is above 8.3%. However, the MAPE error value of the online daily +novelties update is 4.0017% and 2.9% for July 20th and 21st respectively, which corresponds to a very good improvement of the error and much more accurate forecast values. 4.3.2. Anomalies By definition of the anomaly detection procedure, anomalies are the worst forecast of the StreamWNNov algorithm. They occur occasionally. In this case, the goal of finding anomalies in real-time is to manually correct the energy demand in the next seconds. Fig. 8 shows four anomalies detected when using 𝑤=288 and ℎ=48, i.e., a window composed of the two past days values and eight hours to predict in realtime, respectively. The rest of experiments with different parameters present similar behavior. In general, weekdays present higher energy demand than weekends. The incoming actual data for Tuesday June 24th 2014 from 8:00 am to 3:50 pm presents an energy demand lower than expected as can be seen in Fig. 8(b). The discussion on the correct classification of this incoming pattern as an anomaly is similar to that in Fig. 8(a) since this same day is not classified as an anomaly neither for 2015 nor for 2016. Fig. 8(c) depicts an anomaly on December 27th from 8:00 am to 3:50 pm. Both the actual and anomaly demand follow a similar behavior but the anomaly detected presents a lower value. The main reason could be that it was a Sunday and three days after Christmas holidays. The behavior of the actual demand on January 4th, 2016 between 10:00 am and 2:00 pm and between 6:30 pm and 9:30 pm maintain an almost constant value. This performance is not very usual during the working hours of a Monday. The anomaly detected between 8:00 am and 3:50 pm would have helped adjust the demand to a nearly stable value for the remaining business hours of the day and for the following day. 9