{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T16:57:27Z","timestamp":1770742647224,"version":"3.49.0"},"posted":{"date-parts":[[2026]]},"group-title":"SSRN","reference-count":31,"publisher":"Elsevier BV","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>Motivation: As enterprise information systems collect increasingly diverse event streams, the automatic detection of anomalous events is essential for applications like network security, system monitoring, and fraud detection.Methods: This study aims to develop robust techniques for automatically and computationally efficiently identifying anomalous behavior within high-dimensional event sequences, where events occur at specific timestamps (e.g., number of events per hour). The proposed frameworkleverages machine learning to detect anomalies within high-dimensional, high-frequency event sequence time series. By dynamically grouping time series based on shared categorical dimensions, the framework enables scalable anomaly detection across varying levels of aggregation, while maintaining detection sensitivity and specificity.Results: The framework has been validated using real-world telecommunications event data sets and evaluated against the case where no aggregation is performed (\u2018fully disaggregated\u2019). In the case of our \u2018minimum aggregation\u2019 method, the training time is reduced by a factor of\u223c 300, and inference time is reduced by a factor of 8. For our other method, \u2018ideal aggregation\u2019, the training time is reduced by a factor of 6.5, and the inference time is reduced by a factor of 7.6. The quality of anomaly detection is generally preserved across different aggregation levels of grouped high-dimensional data.Conclusions: This research advances anomaly detection techniques in grouped high-dimensional event sequence data, a complex yet increasingly common data format in fields like network security and system monitoring. The framework\u2019s dimensional aggregation techniques enable efficient pattern recognition while maintaining detection sensitivity and specificity, critical for applications requiring faster anomaly detection response.<\/jats:p>","DOI":"10.2139\/ssrn.6206936","type":"posted-content","created":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T23:41:30Z","timestamp":1770680490000},"source":"Crossref","is-referenced-by-count":0,"title":["Anomaly detection in aggregates of grouped time series, composed of high-dimensional and high-frequency event sequences"],"prefix":"10.2139","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8425-3501","authenticated-orcid":true,"given":"Nuno Miguel","family":"Cerqueira da Costa","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1517-9328","authenticated-orcid":true,"given":"Armindo","family":"Lobo","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3883-373X","authenticated-orcid":true,"given":"Suelma","family":"Pina","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1542-8735","authenticated-orcid":true,"given":"Francisco","family":"Franco","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0510-2351","authenticated-orcid":true,"given":"Andrew","family":"Humphrey","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5581-1279","authenticated-orcid":true,"given":"Ali","family":"Abbasi","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7986-3754","authenticated-orcid":true,"given":"Ricardo","family":"Rodrigues","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9736-5812","authenticated-orcid":true,"given":"Duarte","family":"Fernandes","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2774-5040","authenticated-orcid":true,"given":"Negin","family":"Mehrbod","sequence":"additional","affiliation":[]},{"given":"Miguel","family":"Alves","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7785-2047","authenticated-orcid":true,"given":"Emanuel","family":"Gouveia","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"ref1","article-title":"Fourth industrial revolution for the earth harnessing artificial intelligence for the earth","author":"C Herweijer","year":"2018","journal-title":"A report of PricewaterhouseCoopers"},{"issue":"3","key":"ref2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3444690","article-title":"A review on outlier\/anomaly detection in time series data","volume":"54","author":"A Bl\ufffdzquez-Garc\ufffda","year":"2021","journal-title":"ACM computing surveys (CSUR)"},{"key":"ref3","doi-asserted-by":"crossref","first-page":"1409","DOI":"10.1609\/aaai.v33i01.33011409","article-title":"A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data","volume":"33","author":"C Zhang","year":"2019","journal-title":"Proceedings of the AAAI conference on artificial intelligence"},{"key":"ref4","doi-asserted-by":"crossref","first-page":"3395","DOI":"10.1145\/3394486.3403392","article-title":"Usad: Unsupervised anomaly detection on multivariate time series","author":"J Audibert","year":"2020","journal-title":"Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining"},{"issue":"19","key":"ref5","doi-asserted-by":"crossref","DOI":"10.3390\/electronics11193205","article-title":"Deep learning-based time-series analysis for detecting anomalies in internet of things","volume":"11","author":"S Gopali","year":"2022","journal-title":"Electronics"},{"key":"ref6","first-page":"1317","article-title":"Matrix profile i: All pairs similarity joins for time series: A unifying view that includes motifs, discords and shapelets","author":"C.-C M Yeh","year":"2016","journal-title":"IEEE 16th International Conference on Data Mining (ICDM)"},{"key":"ref7","doi-asserted-by":"crossref","first-page":"3009","DOI":"10.1145\/3292500.3330680","article-title":"Time-series anomaly detection service at microsoft","author":"H Ren","year":"2019","journal-title":"Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining"},{"key":"ref8","doi-asserted-by":"crossref","first-page":"278","DOI":"10.1016\/j.future.2015.01.001","article-title":"A survey of anomaly detection techniques in financial domain","volume":"55","author":"M Ahmed","year":"2016","journal-title":"Future Generation Computer Systems"},{"key":"ref9","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A comprehensive survey on network anomaly detection","volume":"70","author":"G Fernandes","year":"2019","journal-title":"Telecommunication Systems"},{"issue":"4","key":"ref10","doi-asserted-by":"crossref","first-page":"64","DOI":"10.18080\/jtde.v8n4.307","article-title":"A review of current machine learning approaches for anomaly detection in network traffic","volume":"8","author":"W A Ali","year":"2020","journal-title":"Journal of Telecommunications and the Digital Economy"},{"issue":"7","key":"ref11","doi-asserted-by":"crossref","first-page":"6481","DOI":"10.1109\/JIOT.2019.2958185","article-title":"Anomaly detection for iot time-series data: A survey","volume":"7","author":"A A Cook","year":"2019","journal-title":"IEEE Internet of Things Journal"},{"key":"ref12","author":"R J Hyndman","year":"2021","journal-title":"Forecasting: principles and practice"},{"key":"ref13","article-title":"Forecasting economic aggregates using dynamic component grouping","author":"M Cobb","year":"2017"},{"issue":"2","key":"ref14","doi-asserted-by":"crossref","first-page":"765","DOI":"10.1007\/s00181-013-0685-6","article-title":"Understanding and forecasting aggregate and disaggregate price dynamics","volume":"46","author":"C Bermingham","year":"2014","journal-title":"Empirical Economics"},{"key":"ref15","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.csda.2015.11.007","article-title":"Fast computation of reconciled forecasts for hierarchical and grouped time series","volume":"97","author":"R J Hyndman","year":"2016","journal-title":"Computational Statistics & Data Analysis"},{"issue":"3","key":"ref16","doi-asserted-by":"crossref","DOI":"10.3390\/en13030641","article-title":"A review on time series aggregation methods for energy system models","volume":"13","author":"M Hoffmann","year":"2020","journal-title":"Energies"},{"key":"ref17","doi-asserted-by":"crossref","first-page":"1857","DOI":"10.1016\/j.procs.2022.01.386","article-title":"An anomaly detection method for multiple time series based on similarity measurement and louvain algorithm","volume":"200","author":"S Li","year":"2022","journal-title":"Procedia Computer Science"},{"key":"ref18","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1145\/3465480.3468292","article-title":"Explainable anomaly detection on high-dimensional time series data","author":"B Rad","year":"2021","journal-title":"Proceedings of the 15th ACM International Conference on Distributed and Event-based Systems"},{"issue":"49","key":"ref19","doi-asserted-by":"crossref","DOI":"10.21105\/joss.02179","article-title":"Mpa: a novel cross-language api for time series analysis","volume":"5","author":"A H Van Benschoten","year":"2020","journal-title":"Journal of Open Source Software"},{"key":"ref20","author":"I Jolliffe","year":"2005","journal-title":"Principal component analysis, Encyclopedia of statistics in behavioral science"},{"key":"ref21","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1007\/s00357-014-9161-z","article-title":"Ward's hierarchical agglomerative clustering method: which algorithms implement ward's criterion?","volume":"31","author":"F Murtagh","year":"2014","journal-title":"Journal of classification"},{"issue":"301","key":"ref22","doi-asserted-by":"crossref","first-page":"236","DOI":"10.1080\/01621459.1963.10500845","article-title":"Hierarchical grouping to optimize an objective function","volume":"58","author":"J H Ward","year":"1963","journal-title":"Journal of the American statistical association"},{"key":"ref23","first-page":"162","volume":"170","author":"M J G Williams","year":"2023","journal-title":"Modern advances in clustering techniques: A comparative review"},{"issue":"4","key":"ref24","first-page":"1043","article-title":"Hierarchical clustering algorithms: A survey of recent developments","volume":"38","author":"J M Lee","year":"2024","journal-title":"Data Mining and Knowledge Discovery"},{"issue":"1","key":"ref25","doi-asserted-by":"crossref","first-page":"116","DOI":"10.1093\/mnrasl\/slac120","article-title":"Machine-learning classification of astronomical sources: estimating f1score in the absence of ground truth","volume":"517","author":"A Humphrey","year":"2022","journal-title":"Monthly Notices of the Royal Astronomical Society: Letters"},{"issue":"11","key":"ref26","article-title":"Visualizing data using t-sne","volume":"9","author":"L Van Der Maaten","year":"2008","journal-title":"Journal of machine learning research"},{"key":"ref27","author":"P Malhotra","year":"2016","journal-title":"Lstm-based encoder-decoder for multi-sensor anomaly detection"},{"key":"ref28","doi-asserted-by":"crossref","DOI":"10.1145\/3219819.3219845","article-title":"Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding","author":"K Hundman","year":"2018","journal-title":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining"},{"key":"ref29","author":"R Chalapathy","year":"2019","journal-title":"Deep learning for anomaly detection: A survey"},{"key":"ref30","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2017.04.070","article-title":"Unsupervised real-time anomaly detection for streaming data","volume":"262","author":"S Ahmad","year":"2017","journal-title":"Neurocomputing"},{"key":"ref31","doi-asserted-by":"crossref","DOI":"10.1145\/3178876.3185996","article-title":"Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications","author":"H Xu","year":"2018","journal-title":"Proceedings of the 2018 World Wide Web Conference"}],"container-title":[],"original-title":[],"deposited":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T23:43:08Z","timestamp":1770680588000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.ssrn.com\/abstract=6206936"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":31,"URL":"https:\/\/doi.org\/10.2139\/ssrn.6206936","relation":{},"subject":[],"published":{"date-parts":[[2026]]},"subtype":"preprint"}}