How to label time series so that we can train it on machine learning models to classify data point as anomaly or not?
If I have time series, and anomaly occurs at time t, should I label that point 1 and other points as 0, or there are any other methods to label the time series?
Anomaly or Outlier detection are usually used when we have cases that happens rarely. So it is not easy to gather data for those cases. Then what we do is, we just train with our normal data. It is also the same for time series.
It is usually falls under Unsupervised learning, as there is no need to label your data. You feed all the data that you have to the model (For example one Class SVM) and it would try to understand or find clusters/groups in the data. Afterwards for test data, it would give you a number as a result of prediction/detection. This number would represent how close or far this test data is to normal group/clusters.
Of course you should have labeled data for the propose of testing the model. For this case you can either generate anomaly data manually just for the sake of testing or you should identify some anomalies by analysing the data. Then you can test the model with these labeled data and see if it can actually recognise them or not.
Of course you can tackle this issue as two-class classification but then this is not anomaly detection anymore, and it will be a normal classification model.
Hope this helps.
For further info you can take a look at these:
https://scikit-learn.org/stable/modules/outlier_detection.html
You can have a look on Automatic Anomaly Detection in the Cloud Via Statistical Learning developed by Twitter. Very powerful method to detect anomalies in time series data.
Also you can use it in production as it is implemented in R.
While Anomaly Detection is typically trained unsupervised (as mentioned in other answers), it is very beneficial to have a labeled dataset for validation and testing.
I would recommend labeling each time-period with an anomaly. If there are different kinds of anomalies (and these are known), then set up some classes of anomalies use those while labeling. This can for example be based on the subcomponent that had an anomaly, or the kind of anomaly, or the consequences. E.g. "bearing", "fan", or "output undersized" / "output oversized". When you make your anomaly detection model, you then have much better data for reporting performance and doing error analysis. You might map all kind of anomalies to "1" as the target (supervised learning). Or you might removed all anomalies from training data (unsupeervised training, using only "0"=normal).
