Title: A Unified Time Series Event Detection Framework
Version: 1.2.747
Description: By analyzing time series, it is possible to observe significant changes in the behavior of observations that frequently characterize events. Events present themselves as anomalies, change points, or motifs. In the literature, there are several methods for detecting events. However, searching for a suitable time series method is a complex task, especially considering that the nature of events is often unknown. This work presents Harbinger, a framework for integrating and analyzing event detection methods. Harbinger contains several state-of-the-art methods described in Salles et al. (2020) <doi:10.5753/sbbd.2020.13626>.
License: MIT + file LICENSE
URL: https://cefet-rj-dal.github.io/harbinger/, https://github.com/cefet-rj-dal/harbinger
BugReports: https://github.com/cefet-rj-dal/harbinger/issues
Encoding: UTF-8
Depends: R (≥ 4.1.0)
RoxygenNote: 7.3.3
Imports: tspredit, changepoint, daltoolbox, forecast, ggplot2, hht, RcppHungarian, dplyr, dtwclust, rugarch, stats, stringr, strucchange, tsmp, wavelets, zoo
NeedsCompilation: no
Packaged: 2025-10-27 13:25:10 UTC; eduar
Author: Eduardo Ogasawara ORCID iD [aut, ths, cre], Antonio Castro [aut], Antonio Mello [aut], Diego Carvalho [ctb], Eduardo Bezerra [ctb], Ellen Paixão [aut], Fernando Fraga [aut], Heraldo Borges [aut], Janio Lima [aut], Jessica Souza [aut], Lais Baroni [aut], Lucas Tavares [aut], Michel Reis [aut], Rebecca Salles [aut], CEFET/RJ [cph]
Maintainer: Eduardo Ogasawara <eogasawara@ieee.org>
Repository: CRAN
Date/Publication: 2025-10-27 13:50:02 UTC

Detect events in time series

Description

Generic S3 generic for event detection using a fitted Harbinger model. Concrete methods are implemented by each detector class.

Usage

detect(obj, ...)

Arguments

obj

A harbinger detector object.

...

Additional arguments passed to methods.

Value

A data frame with columns: idx (index), event (logical), and type (character: "anomaly", "changepoint", or ""). Some detectors may also attach attributes (e.g., threshold) or columns (e.g., seq, seqlen).

Examples

# See detector-specific examples in the package site for usage patterns
# and plotting helpers.

Time series for anomaly detection

Description

A list of time series designed for anomaly detection tasks.

#'

Usage

data(examples_anomalies)

Format

A list of time series for anomaly detection.

Source

Harbinger package

References

Harbinger package

Ogasawara, E., Salles, R., Porto, F., Pacitti, E. Event Detection in Time Series. 1st ed. Cham: Springer Nature Switzerland, 2025. doi:10.1007/978-3-031-75941-3

Examples

data(examples_anomalies)
# Select a simple anomaly series
serie <- examples_anomalies$simple
head(serie)

Time series for change point detection

Description

A list of time series for change point experiments.

#'

Usage

data(examples_changepoints)

Format

A list of time series for change point detection.

Source

Harbinger package

References

Harbinger package

Ogasawara, E., Salles, R., Porto, F., Pacitti, E. Event Detection in Time Series. 1st ed. Cham: Springer Nature Switzerland, 2025. doi:10.1007/978-3-031-75941-3

Examples

data(examples_changepoints)
# Select a simple change point series
serie <- examples_changepoints$simple
head(serie)

Time series for event detection

Description

A list of time series for demonstrating event detection tasks.

#'

Usage

data(examples_harbinger)

Format

A list of time series.

Source

Harbinger package

References

Harbinger package

Ogasawara, E., Salles, R., Porto, F., Pacitti, E. Event Detection in Time Series. 1st ed. Cham: Springer Nature Switzerland, 2025. doi:10.1007/978-3-031-75941-3

Examples

data(examples_harbinger)
# Inspect a series (Seattle daily temperatures)
serie <- examples_harbinger$seattle_daily
head(serie)

Time series for motif/discord discovery

Description

A list of time series for motif (repeated patterns) and discord (rare patterns) discovery.

#'

Usage

data(examples_motifs)

Format

A list of time series for motif discovery.

Source

Harbinger package

References

Harbinger package

Ogasawara, E., Salles, R., Porto, F., Pacitti, E. Event Detection in Time Series. 1st ed. Cham: Springer Nature Switzerland, 2025. doi:10.1007/978-3-031-75941-3

Examples

data(examples_motifs)
# Select a simple motif series
serie <- examples_motifs$simple
head(serie)

Anomaly detector using autoencoders

Description

Trains an encoder-decoder (autoencoder) to reconstruct sliding windows of the series; large reconstruction errors indicate anomalies.

Usage

han_autoencoder(input_size, encode_size, encoderclass = autoenc_base_ed, ...)

Arguments

input_size

Integer. Input (and output) window size for the autoencoder.

encode_size

Integer. Size of the encoded (bottleneck) representation.

encoderclass

DALToolbox encoder-decoder constructor to instantiate.

...

Additional arguments forwarded to encoderclass.

Value

han_autoencoder object

References

Examples

library(daltoolbox)
library(tspredit)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure an autoencoder-based anomaly detector
model <- han_autoencoder(input_size = 5, encode_size = 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Inspect detected anomalies
print(detection[detection$event, ])

Anomaly detector based on ML classification

Description

Supervised anomaly detection using a DALToolbox classifier trained with labeled events. Predictions above a probability threshold are flagged.

A set of preconfigured classification methods are listed at https://cefet-rj-dal.github.io/daltoolbox/ (e.g., cla_majority, cla_dtree, cla_knn, cla_mlp, cla_nb, cla_rf, cla_svm).

Usage

hanc_ml(model, threshold = 0.5)

Arguments

model

A DALToolbox classification model.

threshold

Numeric. Probability threshold for positive class.

Value

hanc_ml object.

References

Examples

library(daltoolbox)

# Load labeled anomaly dataset
data(examples_anomalies)

# Use train-test example
dataset <- examples_anomalies$tt
dataset$event <- factor(dataset$event, labels=c("FALSE", "TRUE"))
slevels <- levels(dataset$event)

# Split into training and test
train <- dataset[1:80,]
test <- dataset[-(1:80),]

# Normalize features
norm <- minmax()
norm <- fit(norm, train)
train_n <- daltoolbox::transform(norm, train)

# Configure a decision tree classifier
model <- hanc_ml(cla_dtree("event", slevels))

# Fit the classifier
model <- fit(model, train_n)

# Evaluate detections on the test set
test_n <- daltoolbox::transform(norm, test)

detection <- detect(model, test_n)
print(detection[(detection$event),])

Anomaly detector using DTW

Description

Anomaly detection using DTW The DTW is applied to the time series. When seq equals one, observations distant from the closest centroids are labeled as anomalies. When seq is grater than one, sequences distant from the closest centroids are labeled as discords. It wraps the tsclust presented in the dtwclust library.

Usage

hanct_dtw(seq = 1, centers = NA)

Arguments

seq

sequence size

centers

number of centroids

Value

hanct_dtw object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure DTW-based detector
model <- hanct_dtw()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

Anomaly detector using kmeans

Description

Anomaly detection using kmeans The kmeans is applied to the time series. When seq equals one, observations distant from the closest centroids are labeled as anomalies. When seq is grater than one, sequences distant from the closest centroids are labeled as discords. It wraps the kmeans presented in the stats library.

Usage

hanct_kmeans(seq = 1, centers = NA)

Arguments

seq

sequence size

centers

number of centroids

Value

hanct_kmeans object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure k-means detector
model <- hanct_kmeans()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

Anomaly detector using ARIMA

Description

Fits an ARIMA model to the series and flags observations with large model residuals as anomalies. Wraps ARIMA from the forecast package.

Usage

hanr_arima()

Details

The detector estimates ARIMA(p,d,q) and computes standardized residuals. Residual magnitudes are summarized via a distance function and thresholded with outlier heuristics from harutils().

Value

hanr_arima object.

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure ARIMA anomaly detector
model <- hanr_arima()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector using EMD

Description

Empirical Mode Decomposition (CEEMD) to extract intrinsic mode functions and flag anomalies from high-frequency components. Wraps hht::CEEMD.

Usage

hanr_emd(noise = 0.1, trials = 5)

Arguments

noise

Numeric. Noise amplitude for CEEMD.

trials

Integer. Number of CEEMD trials.

Value

hanr_emd object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure EMD-based anomaly detector
model <- hanr_emd()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector using FBIAD

Description

Anomaly detector using FBIAD

Usage

hanr_fbiad(sw_size = 30)

Arguments

sw_size

Window size for FBIAD

Value

hanr_fbiad object Forward and Backward Inertial Anomaly Detector (FBIAD) detects anomalies in time series. Anomalies are observations that differ from both forward and backward time series inertia doi:10.1109/IJCNN55064.2022.9892088.

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure FBIAD detector
model <- hanr_fbiad()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector using FFT

Description

High-pass filtering via FFT to isolate high-frequency components; anomalies are flagged where the filtered magnitude departs strongly from baseline.

Usage

hanr_fft()

Details

The spectrum is computed by FFT, a cutoff is selected from the power spectrum, low frequencies are nulled, and the inverse FFT reconstructs a high-pass signal. Magnitudes are summarized and thresholded using harutils().

Value

hanr_fft object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure FFT-based anomaly detector
model <- hanr_fft()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly Detector using FFT with AMOC Cutoff

Description

This function implements an anomaly detection method that uses the Fast Fourier daltoolbox::transform (FFT) combined with an automatic frequency cutoff strategy based on the AMOC (At Most One Change) algorithm. The model analyzes the power spectrum of the time series and detects the optimal cutoff frequency — the point where the frequency content significantly changes — using a changepoint detection method from the changepoint package.

All frequencies below the cutoff are removed from the spectrum, and the inverse FFT reconstructs a filtered version of the original signal that preserves only high-frequency components. The resulting residual signal is then analyzed to identify anomalous patterns based on its distance from the expected behavior.

This function extends the HARBINGER framework and returns an object of class hanr_fft_amoc.

Usage

hanr_fft_amoc()

Value

hanr_fft_amoc object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure FFT+AMOC detector
model <- hanr_fft_amoc()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Inspect detected anomalies
print(detection[detection$event, ])

Anomaly Detector using FFT with AMOC and CUSUM Cutoff

Description

This function implements an anomaly detection method based on the Fast Fourier daltoolbox::transform (FFT) and a changepoint-based cutoff strategy using the AMOC (At Most One Change) algorithm applied to the cumulative sum (CUSUM) of the power spectrum.

The method first computes the FFT of the input time series and extracts the power spectrum. It then applies a CUSUM transformation to the spectral data to emphasize gradual changes or shifts in spectral energy. Using the AMOC algorithm, it detects a single changepoint in the CUSUM-transformed spectrum, which serves as a cutoff index to remove the lower-frequency components.

The remaining high-frequency components are then reconstructed into a time-domain signal via inverse FFT, effectively isolating rapid or local deviations. Anomalies are detected by evaluating the distance between this filtered signal and the original series, highlighting points that deviate significantly from the expected pattern.

This method is suitable for series where spectral shifts are subtle and a single significant change in behavior is expected.

This function extends the HARBINGER framework and returns an object of class hanr_fft_amoc_cusum.

Usage

hanr_fft_amoc_cusum()

Value

hanr_fft_amoc_cusum object

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure FFT+CUSUM+AMOC detector
model <- hanr_fft_amoc_cusum()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Inspect detected anomalies
print(detection[detection$event, ])

Anomaly Detector using FFT with Binary Segmentation Cutoff

Description

This function implements an anomaly detection method that combines the Fast Fourier daltoolbox::transform (FFT) with a spectral cutoff strategy based on the Binary Segmentation (BinSeg) algorithm for changepoint detection.

The method analyzes the power spectrum of the input time series and applies the BinSeg algorithm to identify a changepoint in the spectral density, corresponding to a shift in the frequency content. Frequencies below this changepoint are considered part of the underlying trend or noise and are removed from the signal.

The modified spectrum is then transformed back into the time domain via inverse FFT, resulting in a high-pass filtered version of the series. Anomalies are identified by measuring the distance between the original and the filtered signal, highlighting unusual deviations from the dominant signal behavior.

This function is part of the HARBINGER framework and returns an object of class hanr_fft_binseg.

Usage

hanr_fft_binseg()

Value

hanr_fft_binseg object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure FFT+BinSeg detector
model <- hanr_fft_binseg()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Inspect detected anomalies
print(detection[detection$event, ])

Anomaly Detector using FFT with BinSeg and CUSUM Cutoff

Description

This function implements an anomaly detection method that combines the Fast Fourier daltoolbox::transform (FFT) with a changepoint-based cutoff strategy using the Binary Segmentation (BinSeg) method applied to the cumulative sum (CUSUM) of the frequency spectrum.

The method first computes the FFT of the input time series and obtains its power spectrum. Then, it applies a CUSUM transformation to the spectral density to enhance detection of gradual transitions or accumulated changes in energy across frequencies. The Binary Segmentation method is applied to the CUSUM-transformed spectrum to identify a changepoint that defines a cutoff frequency.

Frequencies below this cutoff are removed from the spectrum, and the signal is reconstructed using the inverse FFT. This produces a filtered signal that retains only the high-frequency components, emphasizing potential anomalies.

Anomalies are then detected by measuring the deviation of the filtered signal from the original one, and applying an outlier detection mechanism based on this residual.

This function extends the HARBINGER framework and returns an object of class hanr_fft_binseg_cusum.

Usage

hanr_fft_binseg_cusum()

Value

hanr_fft_binseg_cusum object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

#Using simple example
dataset <- examples_anomalies$simple
head(dataset)

# setting up time series fft detector
model <- hanr_fft_binseg_cusum()

# fitting the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# filtering detected events
print(detection[(detection$event),])

Anomaly Detector using Adaptive FFT and Moving Average

Description

This function implements an anomaly detection model based on the Fast Fourier daltoolbox::transform (FFT), combined with an adaptive moving average filter. The method estimates the dominant frequency in the input time series using spectral analysis and then applies a moving average filter with a window size derived from that frequency. This highlights high-frequency deviations, which are likely to be anomalies.

The residuals (original signal minus smoothed version) are then processed to compute the distance from the expected behavior, and points significantly distant are flagged as anomalies. The detection also includes a grouping strategy to reduce false positives by selecting the most representative point in a cluster of consecutive anomalies.

This function extends the HARBINGER framework and returns an object of class hanr_fft_sma.

Usage

hanr_fft_sma()

Value

hanr_fft_sma object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

#Using simple example
dataset <- examples_anomalies$simple
head(dataset)

# setting up time series fft detector
model <- hanr_fft_sma()

# fitting the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# filtering detected events
print(detection[(detection$event),])

Anomaly detector using GARCH

Description

Fits a GARCH model to capture conditional heteroskedasticity and flags observations with large standardized residuals as anomalies. Wraps rugarch.

Usage

hanr_garch()

Details

A sGARCH(1,1) with ARMA(1,1) mean is estimated. Standardized residuals are summarized and thresholded via harutils().

Value

hanr_garch object.

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure GARCH anomaly detector
model <- hanr_garch()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector using histograms

Description

Flags observations that fall into low-density histogram bins or outside the observed bin range.

Usage

hanr_histogram(density_threshold = 0.05)

Arguments

density_threshold

Numeric between 0 and 1. Minimum bin density to avoid being considered an anomaly (default 0.05).

Value

hanr_histogram object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure histogram-based detector
model <- hanr_histogram()

# Fit the model (no-op)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector based on ML regression

Description

Trains a regression model to forecast the next value from a sliding window and flags large prediction errors as anomalies. Uses DALToolbox regressors.

A set of preconfigured regression methods are described at https://cefet-rj-dal.github.io/daltoolbox/ (e.g., ts_elm, ts_conv1d, ts_lstm, ts_mlp, ts_rf, ts_svm).

Usage

hanr_ml(model, sw_size = 15)

Arguments

model

A DALToolbox regression model.

sw_size

Integer. Sliding window size.

Value

hanr_ml object.

References

Examples

library(daltoolbox)
library(tspredit)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure a time series regression model
model <- hanr_ml(tspredit::ts_elm(tspredit::ts_norm_gminmax(),
                   input_size=4, nhid=3, actfun="purelin"))

# Fit the model
model <- daltoolbox::fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly detector using REMD

Description

Anomaly detection using REMD The EMD model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the forecast library.

Usage

hanr_remd(noise = 0.1, trials = 5)

Arguments

noise

nosie

trials

trials

Value

hanr_remd object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure REMD detector
model <- hanr_remd()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Anomaly and change point detector using RTAD

Description

Anomaly and change point detection using RTAD The RTAD model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the hht library.

Usage

hanr_rtad(sw_size = 30, noise = 0.001, trials = 5, sigma = sd)

Arguments

sw_size

sliding window size (default 30)

noise

noise

trials

trials

sigma

function to compute the dispersion

Value

hanr_rtad object

References

Examples

library(daltoolbox)
library(zoo)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure RTAD detector
model <- hanr_rtad()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

Anomaly detector using Wavelets

Description

Multiresolution decomposition via wavelets; anomalies are flagged where aggregated wavelet detail coefficients indicate unusual energy.

Usage

hanr_wavelet(filter = "haar")

Arguments

filter

Character. Available wavelet filters: haar, d4, la8, bl14, c6.

Details

The series is decomposed with MODWT and detail bands are aggregated to compute a magnitude signal that is thresholded using harutils().

Value

hanr_wavelet object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure wavelet-based anomaly detector
model <- hanr_wavelet()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected anomalies
print(detection[(detection$event),])

Harbinger Ensemble

Description

Majority-vote ensemble across multiple Harbinger detectors with optional temporal fuzzification to combine nearby detections.

Usage

har_ensemble(...)

Arguments

...

One or more detector objects.

Value

A har_ensemble object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use a simple example
dataset <- examples_anomalies$simple
head(dataset)

# Configure an ensemble of detectors
model <- har_ensemble(hanr_arima(), hanr_arima(), hanr_arima())
# model <- har_ensemble(hanr_fbiad(), hanr_arima(), hanr_emd())

# Fit all ensemble members
model <- fit(model, dataset$serie)

# Run ensemble detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

Evaluation of event detection

Description

Hard evaluation of event detection producing confusion matrix and common metrics (accuracy, precision, recall, F1, etc.).

Usage

har_eval()

Value

har_eval object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

dataset <- examples_anomalies$simple
head(dataset)

# Configure a change-point detector (GARCH)
model <- hcp_garch()

# Fit the detector
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

# Evaluate detections
evaluation <- evaluate(har_eval(), detection$event, dataset$event)
print(evaluation$confMatrix)

# Plot the results
grf <- har_plot(model, dataset$serie, detection, dataset$event)
plot(grf)

Evaluation of event detection (SoftED)

Description

Soft evaluation of event detection using SoftED doi:10.48550/arXiv.2304.00439.

Usage

har_eval_soft(sw_size = 15)

Arguments

sw_size

Integer. Tolerance window size for soft matching.

Value

har_eval_soft object

References

Examples

library(daltoolbox)

# Load anomaly example data
data(examples_anomalies)

# Use the simple series
dataset <- examples_anomalies$simple
head(dataset)

# Configure a change-point detector (GARCH)
model <- hcp_garch()

# Fit the detector
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected events
print(detection[(detection$event),])

# Evaluate detections (SoftED)
evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event)
print(evaluation$confMatrix)

# Plot the results
grf <- har_plot(model, dataset$serie, detection, dataset$event)
plot(grf)

Plot event detection on a time series

Description

Convenience plotting helper for Harbinger detections. It accepts a detector, the input series, an optional detection data.frame, and optional ground-truth events to color-code true positives (TP), false positives (FP), and false negatives (FN). It can also mark detected change points and draw reference horizontal lines.

Usage

har_plot(
  obj,
  serie,
  detection = NULL,
  event = NULL,
  mark.cp = TRUE,
  ylim = NULL,
  idx = NULL,
  pointsize = 0.5,
  colors = c("green", "blue", "red", "purple"),
  yline = NULL
)

Arguments

obj

A harbinger detector used to produce detection.

serie

Numeric vector with the time series to plot.

detection

Optional detection data.frame as returned by detect().

event

Optional logical vector with ground-truth events (same length as serie).

mark.cp

Logical; if TRUE, marks detected change points with dashed vertical lines.

ylim

Optional numeric vector of length 2 for y-axis limits.

idx

Optional x-axis labels or indices (defaults to seq_along(serie)).

pointsize

Base point size for observations.

colors

Character vector of length 4 with colors for TP, FN, FP, and motif segments.

yline

Optional numeric vector with y values to draw dotted horizontal lines.

Value

A ggplot object showing the time series with detected events highlighted.

References

Examples

library(daltoolbox)

# Load an example anomaly dataset
data(examples_anomalies)

# Use the simple time series
dataset <- examples_anomalies$simple
head(dataset)

# Set up an ARIMA-based anomaly detector
model <- hanr_arima()

# Fit the detector
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Inspect detected events
print(detection[(detection$event),])

# Evaluate detections (soft evaluation)
evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event)
print(evaluation$confMatrix)

# Plot the results
grf <- har_plot(model, dataset$serie, detection, dataset$event)
plot(grf)

Harbinger

Description

Base class for time series event detection in the Harbinger framework. It provides common state handling and helper methods used by anomaly, change point, and motif detectors. Concrete detectors extend this class and implement their own fit() and/or detect() S3 methods.

Usage

harbinger()

Details

Internally, this class stores references to the original series, indices of non-missing observations, and helper structures to restore detection results in the original series index space. It also exposes utility hooks for distance computation and outlier post-processing provided by harutils().

Value

A harbinger object that can be extended by detectors.

References

Examples

# See the specific detector examples for anomalies, change points, and motifs
# at https://cefet-rj-dal.github.io/harbinger

Harbinger Utilities

Description

Utility object that groups common distance measures, threshold heuristics, and outlier grouping rules used by Harbinger detectors.

Usage

harutils()

Details

Provided helpers include:

These utilities centralize common tasks and ensure consistent behavior across detectors.

Value

A harutils object exposing the helper functions.

References

Examples

# Basic usage of utilities
utils <- harutils()

# Compute L2 distance on residuals
res <- c(0.1, -0.5, 1.2, -0.3)
d2 <- utils$har_distance_l2(res)
print(d2)

# Apply 3-sigma outlier rule and keep only first index of contiguous runs
idx <- utils$har_outliers_gaussian(d2)
flags <- utils$har_outliers_checks_firstgroup(idx, d2)
print(which(flags))

At Most One Change (AMOC)

Description

Change-point detection method focusing on identifying at most one change in mean and/or variance. This is a wrapper around the AMOC implementation from the changepoint package.

Usage

hcp_amoc()

Details

AMOC detects a single most significant change point under a cost function optimized for a univariate series. It is useful when at most one structural break is expected.

Value

hcp_amoc object.

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure the AMOC detector
model <- hcp_amoc()

# Fit the detector (no-op for AMOC)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change point(s)
print(detection[(detection$event),])

Binary Segmentation (BinSeg)

Description

Multi-change-point detection via Binary Segmentation on mean/variance using the changepoint package.

Usage

hcp_binseg(Q = 2)

Arguments

Q

Integer. Maximum number of change points to search for.

Details

Binary Segmentation recursively partitions the series around the largest detected change until a maximum number of change points or stopping criterion is met. This is a fast heuristic widely used in practice.

Value

hcp_binseg object.

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure the BinSeg detector
model <- hcp_binseg()

# Fit the detector (no-op for BinSeg)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Change Finder using ARIMA

Description

Change-point detection by modeling residual deviations with ARIMA and applying a second-stage smoothing and thresholding, inspired by ChangeFinder doi:10.1109/TKDE.2006.1599387. Wraps ARIMA from the forecast package.

Usage

hcp_cf_arima(sw_size = NULL)

Arguments

sw_size

Integer. Sliding window size for smoothing/statistics.

Value

hcp_cf_arima object.

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure ChangeFinder-ARIMA detector
model <- hcp_cf_arima()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Change Finder using ETS

Description

Change-point detection by modeling residual deviations with ETS and applying a second-stage smoothing and thresholding, inspired by ChangeFinder doi:10.1109/TKDE.2006.1599387. Wraps ETS from the forecast package.

Usage

hcp_cf_ets(sw_size = 7)

Arguments

sw_size

Integer. Sliding window size for smoothing/statistics.

Value

hcp_cf_ets object.

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure ChangeFinder-ETS detector
model <- hcp_cf_ets()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Change Finder using Linear Regression

Description

Change-point detection by modeling residual deviations with linear regression and applying a second-stage smoothing and thresholding, inspired by ChangeFinder doi:10.1109/TKDE.2006.1599387.

Usage

hcp_cf_lr(sw_size = 30)

Arguments

sw_size

Integer. Sliding window size for smoothing/statistics.

Value

hcp_cf_lr object.

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure ChangeFinder-LR detector
model <- hcp_cf_lr()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Chow Test (structural break)

Description

Change-point detection for linear models using F-based structural break tests from the strucchange package doi:10.18637/jss.v007.i02. It wraps the Fstats and breakpoints implementation available in the strucchange library.

Usage

hcp_chow()

Value

hcp_chow object

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure the Chow detector
model <- hcp_chow()

# Fit the detector (no-op for Chow)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Change Finder using GARCH

Description

Change-point detection is related to event/trend change detection. Change Finder GARCH detects change points based on deviations relative to linear regression model doi:10.1109/TKDE.2006.1599387. It wraps the GARCH model presented in the rugarch library.

Usage

hcp_garch(sw_size = 5)

Arguments

sw_size

Sliding window size

Value

hcp_garch object

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a volatility example
dataset <- examples_changepoints$volatility
head(dataset)

# Configure ChangeFinder-GARCH detector
model <- hcp_garch()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Generalized Fluctuation Test (GFT)

Description

Structural change detection using generalized fluctuation tests via strucchange::breakpoints() doi:10.18637/jss.v007.i02.

Usage

hcp_gft()

Value

hcp_gft object

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure the GFT detector
model <- hcp_gft()

# Fit the detector (no-op for GFT)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Pruned Exact Linear Time (PELT)

Description

Multiple change-point detection using the PELT algorithm for mean/variance with a linear-time cost under suitable penalty choices. This function wraps the PELT implementation in the changepoint package.

Usage

hcp_pelt()

Details

PELT performs optimal partitioning while pruning candidate change-point locations to achieve near-linear computational cost.

Value

hcp_pelt object.

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure the PELT detector
model <- hcp_pelt()

# Fit the detector (no-op for PELT)
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Seminal change point

Description

Change-point detection is related to event/trend change detection. Seminal change point detects change points based on deviations of linear regression models adjusted with and without a central observation in each sliding window <10.1145/312129.312190>.

Usage

hcp_scp(sw_size = 30)

Arguments

sw_size

Sliding window size

Value

hcp_scp object

References

Examples

library(daltoolbox)

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Configure seminal change-point detector
model <- hcp_scp()

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected change points
print(detection[(detection$event),])

Discord discovery using Matrix Profile

Description

Discovers rare, dissimilar subsequences (discords) using Matrix Profile as implemented in the tsmp package doi:10.32614/RJ-2020-021.

Usage

hdis_mp(mode = "stamp", w, qtd)

Arguments

mode

Character. Algorithm: one of "stomp", "stamp", "simple", "mstomp", "scrimp", "valmod", "pmp".

w

Integer. Subsequence window size.

qtd

Integer. Number of discords to return (>= 3 recommended).

Value

hdis_mp object.

References

Examples

library(daltoolbox)

# Load motif/discord example data
data(examples_motifs)

# Use a simple sequence example
dataset <- examples_motifs$simple
head(dataset)

# Configure discord discovery via Matrix Profile
model <- hdis_mp("stamp", 4, 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected discords
print(detection[(detection$event),])

Discord discovery using SAX

Description

Discord discovery using SAX doi:10.1007/s10618-007-0064-z

Usage

hdis_sax(a, w, qtd = 2)

Arguments

a

alphabet size

w

word size

qtd

number of occurrences to be classified as discords

Value

hdis_sax object

References

Examples

library(daltoolbox)

# Load motif/discord example data
data(examples_motifs)

# Use a simple sequence example
dataset <- examples_motifs$simple
head(dataset)

# Configure discord discovery via SAX
model <- hdis_sax(26, 3, 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected discords
print(detection[(detection$event),])

Motif discovery using Matrix Profile

Description

Discovers repeated subsequences (motifs) using Matrix Profile methods as implemented in the tsmp package doi:10.32614/RJ-2020-021.

Usage

hmo_mp(mode = "stamp", w, qtd)

Arguments

mode

Character. Algorithm: one of "stomp", "stamp", "simple", "mstomp", "scrimp", "valmod", "pmp".

w

Integer. Subsequence window size.

qtd

Integer. Minimum number of occurrences to classify as a motif.

Value

hmo_mp object.

References

Examples

library(daltoolbox)

# Load motif example data
data(examples_motifs)

# Use a simple sequence example
dataset <- examples_motifs$simple
head(dataset)

# Configure motif discovery via Matrix Profile
model <- hmo_mp("stamp", 4, 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected motifs
print(detection[(detection$event),])

Motif discovery using SAX

Description

Discovers repeated subsequences (motifs) using a Symbolic Aggregate approXimation (SAX) representation doi:10.1007/s10618-007-0064-z. Subsequences are discretized and grouped by symbolic words; frequently occurring words indicate motifs.

Usage

hmo_sax(a, w, qtd = 2)

Arguments

a

Integer. Alphabet size.

w

Integer. Word/window size.

qtd

Integer. Minimum number of occurrences to classify as a motif.

Value

hmo_sax object.

References

Examples

library(daltoolbox)

# Load motif example data
data(examples_motifs)

# Use a simple sequence example
dataset <- examples_motifs$simple
head(dataset)

# Configure SAX-based motif discovery
model <- hmo_sax(26, 3, 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected motifs
print(detection[(detection$event),])

Motif discovery using XSAX

Description

Discovers repeated subsequences (motifs) using an extended SAX (XSAX) representation that supports a larger alphanumeric alphabet.

Usage

hmo_xsax(a, w, qtd)

Arguments

a

Integer. Alphabet size.

w

Integer. Word/window size.

qtd

Integer. Minimum number of occurrences to be classified as motifs.

Value

hmo_xsax object.

References

Examples

library(daltoolbox)

# Load motif example data
data(examples_motifs)

# Use a simple sequence example
dataset <- examples_motifs$simple
head(dataset)

# Configure XSAX-based motif discovery
model <- hmo_xsax(37, 3, 3)

# Fit the model
model <- fit(model, dataset$serie)

# Run detection
detection <- detect(model, dataset$serie)

# Show detected motifs
print(detection[(detection$event),])

Multivariate anomaly detector using PCA

Description

Projects multivariate observations onto principal components and flags large reconstruction errors as anomalies. Based on classical PCA.

Usage

hmu_pca()

Details

The series is standardized, PCA is computed, and data are reconstructed from principal components. The reconstruction error is summarized and thresholded.

Value

hmu_pca object.

References

Examples

library(daltoolbox)

# Load multivariate example data
data(examples_harbinger)

# Use a multidimensional time series
dataset <- examples_harbinger$multidimensional
head(dataset)

# Configure PCA-based anomaly detector
model <- hmu_pca()

# Fit the model (example uses first two columns)
model <- fit(model, dataset[,1:2])

# Run detection
detection <- detect(model, dataset[,1:2])

# Show detected anomalies
print(detection[(detection$event),])

# Evaluate detections
evaluation <- evaluate(model, detection$event, dataset$event)
print(evaluation$confMatrix)

Moving average smoothing

Description

The mas() function returns a simple moving average smoother of the provided time series.

Usage

mas(x, order)

Arguments

x

A numeric vector or univariate time series.

order

Order of moving average smoother.

Details

The moving average smoother transformation is given by

(1/k) * ( x[t] + x[t+1] + ... + x[t+k-1] )

where k=order, t assume values in the range 1:(n-k+1), and n=length(x). See also the ma of the forecast package.

Value

Numerical time series of length length(x)-order+1 containing the simple moving average smoothed values.

References

R.H. Shumway and D.S. Stoffer, 2010, Time Series Analysis and Its Applications: With R Examples. 3rd ed. 2011 edition ed. New York, Springer.

Examples

# Load change-point example data
data(examples_changepoints)

# Use a simple example
dataset <- examples_changepoints$simple
head(dataset)

# Compute a 5-point moving average
ma <- mas(dataset$serie, 5)

SAX transformation

Description

Symbolic Aggregate approXimation (SAX) discretization of a numeric time series. The series is z-normalized, quantile-binned, and mapped to an alphabet of size alpha.

Usage

trans_sax(alpha)

Arguments

alpha

Integer. Alphabet size (2–26).

Value

A trans_sax transformer object.

References

Examples

library(daltoolbox)
vector <- 1:52
model <- trans_sax(alpha = 26)
model <- fit(model, vector)
xvector <- transform(model, vector)
print(xvector)

XSAX transformation

Description

Extended SAX (XSAX) discretization using a larger alphanumeric alphabet for finer symbolic resolution.

Usage

trans_xsax(alpha)

Arguments

alpha

Integer. Alphabet size (2–36).

Value

A trans_xsax transformer object.

References

See Also

trans_sax

Examples

library(daltoolbox)
vector <- 1:52
model <- trans_xsax(alpha = 36)
model <- fit(model, vector)
xvector <- transform(model, vector)
print(xvector)