Anomaly Detection in Electrocardiogram Readings with Stacked LSTM Networks Markus Thill 1 , Sina Däubener, Wolfgang Konen 1 , and Thomas Bäck 2 1 TH Köln – Cologne University of Applied Sciences, 51643 Gummersbach, Germany, {markus.thill, wolfgang.konen}@th-koeln.de 2 Leiden University, LIACS, 2333 CA Leiden, The Netherlands, t.h.w.baeck@liacs.leidenuniv.nl Abstract: Real-world anomaly detection for time series is still a challenging task. This is especially true for periodic or quasi-periodic time series since automated approaches have to learn long-term correlations before they are able to detect anomalies. Electrocardiography (ECG) time series, a prominent real-world example of quasi-periodic signals, are investigated in this work. Anomaly detection algo- rithms often have the additional goal to identify anomalies in an unsupervised manner. In this paper we present an unsupervised time series anomaly detection algorithm. It learns with recurrent Long Short-Term Memory (LSTM) networks to predict the nor- mal time series behavior. The prediction error on several prediction horizons is used to build a statistical model of normal behavior. We propose new methods that are es- sential for a successful model-building process and for a high signal-to-noise-ratio. We apply our method to the well-known MIT-BIH ECG data set and present first re- sults. We obtain a good recall of anomalies while having a very low false alarm rate (FPR) in a fully unsupervised procedure. We compare also with other anomaly detectors (NuPic, ADVec) from the state-of-the-art. 1 Introduction Anomaly detection in time series is of increasing impor- tance in many application areas, e.g. health care [6, 4], sensor networks [20, 14] or predictive maintenance [7]. Anomaly detection is a very active research area (for an overview see [3]), yet it is not easy to come up with a gen- eral definition of an anomaly. The notion of an anomaly greatly depends on the application area and on character- istics of the time series in question. To learn the char- acteristics of nominal and anomalous behavior from data it is often necessary to apply sophisticated methods from natural computing (evolutionary neural networks [11] and immune systems [26]). While some anomalies are simple to detect (e.g. a sudden spike in a relatively constant sig- nal may be detected by simple threshold heuristics), other anomalies are subtle and more complex to detect. This is Copyright c 2019 for this paper by its authors. Use permitted un- der Creative Commons License Attribution 4.0 International (CC BY 4.0). especially the case for periodic or quasi-periodic time se- ries where the anomaly may be a time-shifted peak, a peak with a different form or other patterns which only emerge from a long-range analysis of the signal. Electrocardiography (ECG) time series constitute a prominent real-world example of quasi-periodic signals. Anomaly detection in ECG readings plays an important role in health care and medical diagnosis. There exist well-maintained databases, e.g. the MIT-BIH database [9], where a large body of data is annotated with numerous types of anomalies which are characterized and verified by medical experts. Automated anomaly detection in such ECG data is still a challenging topic, because the devia- tions from nominal behavior are often subtle and require long-range analysis. Furthermore, there are considerable signal variations from patient to patient or even within an ECG time series. Long short-term memory (LSTM) networks [13], which are a special form of recurrent neural networks (RNN) and thus belong to the class of deep learning methods, have proven to be particularly useful in learning sequences with long-range dependencies. They avoid the vanishing gra- dient problem [12] and are more stable and better scal- able [10] than other RNN architectures. LSTMs have been successfully advanced the state-of-the-art in many applica- tion areas like language modeling and translation, acoustic modeling of speech, analysis of audio data, handwriting recognition and others [10]. We will use stacked LSTMs as the building block for our ECG time series prediction. It is the purpose of the present paper to investigate whether anomaly detection in quasi-periodic ECG time series can be trained in an unsupervised manner, hence, without the usage of the anomaly class labels. We will describe in Sec. 2 an LSTM prediction model which is trained to predict over multiple horizons and is applied to time series containing nominal and also rare anomalous data. We observe multidimensional error vectors (one vec- tor for each point in time) and fit a multivariate Gaussian distribution to them. Based on the Mahalanobis distance we can assign to each point in time a probability of be- ing anomalous. Sec. 3 describes our experimental setup and the MIT-BIH Arrhythmia Database used in our exper- iments. Sec. 4 presents and discusses our results, while Sec. 5 concludes.