Real-Time Anomaly Detection using Double Exponential

Smoothing (DES)

Shikhar Sharma
October 15, 2024

1 Introduction
This document provides an explanation and the LaTeX representation of the implementation of real-
time anomaly detection using Double Exponential Smoothing (DES). The system detects anomalies in a
simulated data stream by utilizing DES to reduce lag in trend detection and allows for faster identification
of anomalies compared to Simple Moving Averages (SMA).

2 Task Overview
The task is to implement an anomaly detection system for a data stream with the following features:
• A simulated data stream containing a sine wave with periodicity, random noise, and occasional
anomalies.

• Double Exponential Smoothing (DES) is used to smooth the data and reduce lag in trend detection.
• A real-time plotting mechanism to visualize the data stream, the smoothed values (using DES),
and anomalies detected based on a z-score threshold.

3 Double Exponential Smoothing (DES)

Double Exponential Smoothing (DES) is an extension of Simple Exponential Smoothing. It accounts not
only for the level (overall data trend) but also the trend (direction of the trend), using two smoothing
factors:
• Alpha (α): The smoothing factor for the level (data’s current state).

• Beta (β): The smoothing factor for the trend (direction of the data’s movement).
The DES method helps reduce the lag seen with other smoothing methods like SMA and is more respon-
sive to sudden changes.

4 Code Implementation
The following sections outline the Python implementation of the task.

4.1 SignalStream Class

This class simulates a real-time data stream. It generates values based on a periodic sine wave with
added random noise, and it also introduces occasional anomalies.
1 im po rt random # For random number g e n e r a t i o n
2
3 # Data g e n e r a t o r t h a t s i m u l a t e s a stream o f data with o c c a s i o n a l a n o m a l i e s
4 c l a s s SignalStream :
5 def init ( self ) :
6 s e l f . s t e p = 0 # Time s t a r t s from 0

1
 7
8 def next value ( s e l f ) :
9 ”””
10 Produces t h e n e x t v a l u e i n t h e s i g n a l with p e r i o d i c b e h a v i o r , n o i s e ,
11 and i n f r e q u e n t a n o m a l i e s .
12 ”””
13 # G e n e r a t e a p e r i o d i c p a t t e r n with added n o i s e
14 p e r i o d i c v a l u e = 50 ∗ ( s e l f . s t e p % 3 6 5 ) / 3 6 5 . 0
15 r a n d o m n o i s e = random . g a u s s ( 0 , 1 )
16
17 # I n t r o d u c e o c c a s i o n a l a n o m a l i e s (2% c ha nc e )
18 anomaly = random . g a u s s ( 1 5 , 5 ) i f random . random ( ) < 0 . 0 2 e l s e 0
19 s e l f . s t e p += 1
20
21 r e t u r n 100 + p e r i o d i c v a l u e + r a n d o m n o i s e + anomaly
Listing 1: Signal Stream Generator

4.2 DESAnomalyDetector Class

The anomaly detection is performed using Double Exponential Smoothing (DES). The smoothing factors
α and β control the level and trend of the data, respectively. Anomalies are detected when the deviation
from the smoothed value exceeds a certain threshold.
1 # Smoothing and anomaly d e t e c t i o n u s i n g Double E x p o n e n t i a l Smoothing (DES)
2 c l a s s DESAnomalyDetector :
3 def init ( s e l f , a l p h a = 0 . 5 , b e t a = 0 . 3 , t h r e s h o l d =2 , cooldown =2) :
4 ”””
5 I n i t i a l i z e s t h e DES−based anomaly d e t e c t o r :
6 − a l p h a : Smoothing f a c t o r f o r l e v e l ( 0 < a l p h a < 1 ) .
7 − b e t a : Smoothing f a c t o r f o r t r e n d ( 0 < b e t a < 1 ) .
8 − t h r e s h o l d : Z−s c o r e t h r e s h o l d t o f l a g a n o m a l i e s .
9 − cooldown : P e r i o d t o s k i p anomaly d e t e c t i o n a f t e r d e t e c t i n g an anomaly .
10 ”””
11 s e l f . alpha = alpha
12 s e l f . beta = beta
13 s e l f . l e v e l = None
14 s e l f . t r e n d = None
15 s e l f . threshold = threshold
16 s e l f . c o o l d o w n d u r a t i o n = cooldown
17 s e l f . cooldown counter = 0
18 s e l f . s i g n a l w i n d o w = deque ( maxlen =50) # S l i d i n g window f o r anomaly d e t e c t i o n
19
20 def detect anomaly ( s e l f , current value ) :
21 ”””
22 D e t e c t s a n o m a l i e s u s i n g Double E x p o n e n t i a l Smoothing (DES) .
23 Returns :
24 − s m o o t h e d v a l u e : The DES smoothed v a l u e .
25 − i s o u t l i e r : Boolean i n d i c a t i n g whether t h e c u r r e n t v a l u e i s an anomaly .
26 ”””
27 i f s e l f . l e v e l i s None : # I n i t i a l i z e t h e l e v e l and t r e n d
28 s e l f . level = current value
29 s e l f . trend = 0
30 smoothed value = c u r r e n t v a l u e
31 else :
32 # Update l e v e l and t r e n d u s i n g DES f o r m u l a s
33 previous level = self . level
34 s e l f . l e v e l = s e l f . alpha ∗ c u r r e n t v a l u e + (1 − s e l f . alpha ) ∗ ( s e l f . l e v e l +
s e l f . trend )
35 s e l f . trend = s e l f . beta ∗ ( s e l f . l e v e l − p r e v i o u s l e v e l ) + (1 − s e l f . beta ) ∗
s e l f . trend
36 smoothed value = s e l f . l e v e l + s e l f . trend
37
38 # Add t h e new v a l u e t o t h e s l i d i n g window
39 s e l f . s i g n a l w i n d o w . append ( c u r r e n t v a l u e )
40
41 # Compute t h e Z−s c o r e f o r anomaly d e t e c t i o n
42 i f len ( s e l f . signal window ) > 1:
43 d e v i a t i o n = c u r r e n t v a l u e − smoothed value
44 s t d d e v = ( sum ( [ ( v − s m o o t h e d v a l u e ) ∗∗ 2 f o r v i n s e l f . s i g n a l w i n d o w ] ) /
l e n ( s e l f . s i g n a l w i n d o w ) ) ∗∗ 0 . 5
45 z s c o r e = d e v i a t i o n / ( std dev i f std dev > 0 e l s e 1)

2
46 else :
47 z score = 0 # No anomaly d e t e c t i o n f o r a s i n g l e v a l u e
48
49 # D e t e c t a n o m a l i e s i f o u t s i d e t h e t h r e s h o l d and cooldown i s i n a c t i v e
50 i f s e l f . cooldown counter > 0:
51 s e l f . c o o l d o w n c o u n t e r −= 1
52 return smoothed value , False
53 else :
54 i f abs ( z s c o r e ) > s e l f . t h r e s h o l d :
55 s e l f . cooldown counter = s e l f . cooldown duration
56 r e t u r n s m o o t h e d v a l u e , True
57 return smoothed value , False
Listing 2: DES Anomaly Detector

4.3 RealTimeGraph Class

This class visualizes the real-time signal and anomalies using matplotlib. It updates the graph dynami-
cally with the signal values, smoothed values, and any anomalies detected.
1 # C l a s s t o v i s u a l i z e t h e stream and a n o m a l i e s i n r e a l −time
2 c l a s s RealTimeGraph :
3 def init ( s e l f , d i s p l a y w i n d o w =50) :
4 ”””
5 I n i t i a l i z e s t h e p l o t f o r v i s u a l i z i n g t h e data :
6 − d i s p l a y w i n d o w : Number o f r e c e n t p o i n t s t o d i s p l a y on t h e p l o t .
7 ”””
8 s e l f . display window = display window
9 s e l f . x points = [ ]
10 self . signal values = [ ]
11 s e l f . smooth values = [ ]
12 s e l f . anomalies x = [ ]
13 s e l f . anomalies y = [ ]
14 s e l f . f i g , s e l f . ax = p l t . s u b p l o t s ( f i g s i z e =(10 , 6 ) )
15
16 d e f u p d a t e g r a p h ( s e l f , index , s i g n a l , s m o o t h v a l u e , i s o u t l i e r ) :
17 ”””
18 Updates t h e c h a r t with t h e l a t e s t s i g n a l and smoothed v a l u e s .
19 Marks a n o m a l i e s on t h e p l o t .
20 ”””
21 s e l f . x p o i n t s . append ( i n d e x )
22 s e l f . s i g n a l v a l u e s . append ( s i g n a l )
23 s e l f . s m o o t h v a l u e s . append ( s m o o t h v a l u e )
24
25 if is outlier :
26 s e l f . a n o m a l i e s x . append ( i n d e x )
27 s e l f . a n o m a l i e s y . append ( s i g n a l )
28
29 # C l e a r p r e v i o u s p l o t and redraw with updated data
30 s e l f . ax . c l e a r ( )
31 s e l f . ax . p l o t ( s e l f . x p o i n t s [− s e l f . d i s p l a y w i n d o w : ] , s e l f . s i g n a l v a l u e s [− s e l f .
d i s p l a y w i n d o w : ] , l a b e l=” S i g n a l ” , c o l o r= ’ b l u e ’ )
32 s e l f . ax . p l o t ( s e l f . x p o i n t s [− s e l f . d i s p l a y w i n d o w : ] , s e l f . s m o o t h v a l u e s [− s e l f .
d i s p l a y w i n d o w : ] , l a b e l=”DES” , c o l o r= ’ g r e e n ’ , l i n e s t y l e= ’−− ’ )
33 s e l f . ax . s c a t t e r ( s e l f . a n o m a l i e s x , s e l f . a n o m a l i e s y , c o l o r= ’ r e d ’ , l a b e l=”
Anomalies ” , marker= ’ o ’ )
34
35 # Set p l o t l i m i t s
36 s e l f . ax . s e t x l i m (max ( 0 , i n d e x − s e l f . d i s p l a y w i n d o w ) , i n d e x + 1 )
37 s e l f . ax . s e t y l i m ( min ( min ( s e l f . s i g n a l v a l u e s [− s e l f . d i s p l a y w i n d o w : ] ) , min ( s e l f .
s m o o t h v a l u e s [− s e l f . d i s p l a y w i n d o w : ] ) ) − 5 ,
38 max(max( s e l f . s i g n a l v a l u e s [− s e l f . d i s p l a y w i n d o w : ] ) , max( s e l f .
s m o o t h v a l u e s [− s e l f . d i s p l a y w i n d o w : ] ) ) + 5 )
39
40 # Add t i t l e s and l a b e l s
41 s e l f . ax . s e t t i t l e ( ” Real−Time S i g n a l with DES Anomaly D e t e c t i o n ” )
42 s e l f . ax . s e t x l a b e l ( ”Time Step ” )
43 s e l f . ax . s e t y l a b e l ( ” S i g n a l Value ” )
44 s e l f . ax . l e g e n d ( )
45
46 p l t . pause ( 0 . 0 1 )
Listing 3: Real-Time Graph

3
 4.4 AnomalyDetectionRunner Class
This class orchestrates the signal generation, anomaly detection, and real-time plotting by integrating
the classes defined above.
1 # Main c o n t r o l l e r c l a s s f o r r u n n i n g t h e s i g n a l g e n e r a t i o n , anomaly d e t e c t i o n , and
visualization
2 c l a s s AnomalyDetectionRunner :
3 def init ( s e l f , s i g n a l s t r e a m , a n o m a l y d e t e c t o r , v i s u a l i z e r , t o t a l s t e p s =1000) :
4 ”””
5 I n i t i a l i z e s t h e system with :
6 − s i g n a l s t r e a m : Instance of the SignalStream .
7 − a n o m a l y d e t e c t o r : I n s t a n c e o f t h e DESAnomalyDetector .
8 − v i s u a l i z e r : I n s t a n c e o f t h e RealTimeGraph .
9 − t o t a l s t e p s : Number o f p o i n t s t o v i s u a l i z e .
10 ”””
11 s e l f . signal stream = signal stream
12 s e l f . anomaly detector = anomaly detector
13 self . visualizer = visualizer
14 self . total steps = total steps
15
16 def start ( s e l f ) :
17 ”””
18 S t a r t s t h e r e a l −time anomaly d e t e c t i o n and v i s u a l i z a t i o n l o o p .
19 ”””
20 p r i n t ( ” S t a r t i n g r e a l −time d e t e c t i o n . . . ” )
21
22 f o r i in range ( s e l f . t o t a l s t e p s ) :
23 signal = s e l f . signal stream . next value ()
24 smooth , i s o u t l i e r = s e l f . a n o m a l y d e t e c t o r . d e t e c t a n o m a l y ( s i g n a l )
25 s e l f . v i s u a l i z e r . u p d a t e g r a p h ( i , s i g n a l , smooth , i s o u t l i e r )
26
27 p r i n t ( ” Detection complete . ” )
Listing 4: Anomaly Detection Runner

5 Running the System

The anomaly detection system can be run by instantiating the signal generator, anomaly detector, and
visualizer, then passing them into the main runner class. The system runs for a predefined number of
steps and visualizes the results in real time.
1 # Run t h e d e t e c t i o n system
2 if name == ” m a i n ” :
3 # I n i t i a l i z e components
4 s i g n a l g e n = SignalStream ()
5 d e t e c t o r = DESAnomalyDetector ( a l p h a = 0 . 5 , b e t a = 0 . 3 , t h r e s h o l d =2)
6 p l o t t e r = RealTimeGraph ( d i s p l a y w i n d o w =50)
7
8 # S e t up and run t h e system
9 d e t e c t i o n s y s t e m = AnomalyDetectionRunner ( s i g n a l g e n , d e t e c t o r , p l o t t e r , t o t a l s t e p s
=1000)
10 detection system . start ()
Listing 5: Main Function to Run the System

6 Conclusion
This document outlines a real-time anomaly detection system that uses Double Exponential Smoothing
to efficiently smooth a data stream while minimizing lag. The system can detect anomalies and plot the
results in real time.