Formation of a feature space for the anomaly detection problems in the behavior of objects with the use of data streams

We consider the problem of analyzing low-intensity streaming data (one measurement per day) to identify hidden anomalies in the behavior of complex objects using taxpayers' fiscal data obtained from cash registers as an example. A methodology for constructing a multidimensional feature space is proposed, incorporating statistical, structural, and dynamic characteristics of time series. The methodology is based on a system of five clearly formulated working hypotheses: a change in the stationary operating mode of the object, the concentration of the total indicator volume on a small number of time samples, a binary (two-mode) structure of the value distribution, the presence of long periods of inactivity, and increased variability of indicators. Each hypothesis is formalized as a set of quantitative features with accompanying mathematical expressions. Feature selection methods are described in detail: correlation analysis with a target variable (threshold |r| - 0.2), nonparametric Kolmogorov – Smirnov test (p < 0.05), one-way ANOVA (p < 0.01), removal of multicollinear features (|r| - 0.8), and a combined approach. A comparative analysis of eight classification models was conducted on fiscal data (2200 objects, 365 days). Combined feature selection made it possible to reduce the dimensionality from 96 to 28 while increasing the ROC-AUC from 0.85 to 0.94. Validation on an independent sample confirmed the effectiveness of the approach: the proportion of confirmed anomalies was 84 %. The proposed methodology can be scaled up to other anomaly detection tasks in technical and economic systems with low-intensity data streams.