Siberian Aerospace JournalSiberian Aerospace JournalSiberian Aerospace JournalSiberian Aerospace JournalСибирский аэрокосмический журналSiberian Aerospace Journal2712-89702782-5760Reshetnev Siberian State University of Science and Technology71412510.31772/2712-8970-2026-27-2-194-211Section 1. Computer Science, Computer Engineering and ManagementРаздел 1. Информатика, вычислительная техника и управлениеResearch ArticleFormation of a feature space for the anomaly detection problems in the behavior of objects with the use of data streamsФормирование признакового пространства для задач обнаружения аномалий в поведении объектов по потоковым даннымhttps://orcid.org/0009-0003-7611-6712VasilyevDenis I.ВасильевДенис Игоревич
Russian Federation

Researcher, Bauman Moscow State Technical University; applicant, Reshetnev Siberian State University of Science and Technology

научный сотрудник, Московский государственный технический университет имени Н. Э. Баумана; соискатель, Сибирский государственный университет науки и технологий имени академика М. Ф. Решетнева

denys.vasyliev@bk.ruhttps://orcid.org/0000-0002-9648-2395BorodulinAleksey S.БородулинАлексей Сергеевич
Russian Federation

Cand. Sc., Director, Scientific and Educational Center of the Federal Tax Service

кандидат технических наук, директор НОЦ ФНС России

bas@bmstu.ruhttps://orcid.org/0000-0002-0667-4001KazakovtsevLev A.КазаковцевЛев Александрович
Russian Federation

Dr. Sc., Professor, Researcher, Scientific and Educational Center of the Federal Tax Service, Bauman Moscow State Technical University; Full Professor of the Department of Systems Analysis and Operations Research, Reshetnev Siberian State University of Science and Technology

доктор технических наук, профессор, ведущий научный сотрудник, НОЦ ФСН России, Московский государственный технический университет имени Н. Э. Баумана; профессор кафедры системного анализа и исследования операций, Сибирский государственный университет науки и технологий имени академика М. Ф. Решетнева

levk@bk.ruBauman Moscow State Technical UniversityМосковский государственный технический университет имени Н. Э. БауманаReshetnev Siberian State University of Science and TechnologyСибирский государственный университет науки и технологий имени академика М. Ф. Решетнева060720262721942110507202605072026Copyright ©; 2026, Vasilyev D.I., Borodulin A.S., Kazakovtsev L.A.Copyright ©; 2026, Васильев Д.И., Бородулин А.С., Казаковцев Л.А.2026Vasilyev D.I., Borodulin A.S., Kazakovtsev L.A.Васильев Д.И., Бородулин А.С., Казаковцев Л.А.https://creativecommons.org/licenses/by/4.0https://journals.eco-vector.com/2712-8970/article/view/714125

We consider the problem of analyzing low-intensity streaming data (one measurement per day) to identify hidden anomalies in the behavior of complex objects using taxpayers' fiscal data obtained from cash registers as an example. A methodology for constructing a multidimensional feature space is proposed, incorporating statistical, structural, and dynamic characteristics of time series. The methodology is based on a system of five clearly formulated working hypotheses: a change in the stationary operating mode of the object, the concentration of the total indicator volume on a small number of time samples, a binary (two-mode) structure of the value distribution, the presence of long periods of inactivity, and increased variability of indicators. Each hypothesis is formalized as a set of quantitative features with accompanying mathematical expressions. Feature selection methods are described in detail: correlation analysis with a target variable (threshold |r| > 0.2), nonparametric Kolmogorov – Smirnov test (p < 0.05), one-way ANOVA (p < 0.01), removal of multicollinear features (|r| > 0.8), and a combined approach. A comparative analysis of eight classification models was conducted on fiscal data (2200 objects, 365 days). Combined feature selection made it possible to reduce the dimensionality from 96 to 28 while increasing the ROC-AUC from 0.85 to 0.94. Validation on an independent sample confirmed the effectiveness of the approach: the proportion of confirmed anomalies was 84 %. The proposed methodology can be scaled up to other anomaly detection tasks in technical and economic systems with low-intensity data streams.

Рассматривается задача анализа потоковых данных низкой интенсивности (одно измерение в сутки) для выявления скрытых аномалий в поведении сложных объектов на примере фискальных данных налогоплательщиков, получаемых с контрольно-кассовой техники. Предложена методология построения многомерного признакового пространства, включающая статистические, структурные и динамические характеристики временных рядов. В основе методологии лежит система из пяти явно сформулированных рабочих гипотез: о смене стационарного режима функционирования объекта, концентрации суммарного объема показателя на малом количестве временных отсчетов, бинарной (двухрежимной) структуре распределения значений, наличии длительных периодов бездействия, повышенной вариативности показателей. Каждая гипотеза формализована в виде набора количественных признаков с приведением математических выражений. Детально описаны методы отбора признаков: корреляционный анализ с целевой переменной (порог |r| > 0,2), непараметрический тест Колмогорова – Смирнова (p < 0,05), однофакторный дисперсионный анализ ANOVA (p < 0,01), удаление мультиколлинеарных признаков (|r| > 0,8), а также комбинированный подход. Проведен сравнительный анализ восьми моделей классификации на фискальных данных (2200 объектов, 365 дней). Комбинированный отбор признаков позволил сократить размерность с 96 до 28 при повышении ROC-AUC с 0,85 до 0,94. Валидация на независимой выборке подтвердила эффективность подхода: доля подтверждённых аномалий составила 84 %. Предложенная методология может быть масштабирована на другие задачи обнаружения аномалий в технических и экономических системах с низкоинтенсивными потоками данных.

system analysisstreaming dataanomaly detectionfeature selectiontime seriesmachine learningKolmogorov – Smirnov testANOVAсистемный анализпотоковые данныеобнаружение аномалийселекция признаковвременные рядымашинное обучениетест Колмогорова – СмирноваANOVAChandola V., Banerjee A., Kumar V. Anomaly detection: A survey. ACM Computing Surveys. 2009, Vol. 41, No. 3, P. 1–58.Chandola V., Banerjee A., Kumar V. Anomaly detection: A survey // ACM Computing Surveys. 2009. Vol. 41, No. 3. P. 1–58.Pang G., Shen C., Cao L., Hengel A. Deep learning for anomaly detection: A review. ACM Computing Surveys. 2021, Vol. 54, No. 2, P. 1–38.Pang G., Shen C., Cao L., Hengel A. Deep learning for anomaly detection: A review // ACM Computing Surveys. 2021. Vol. 54, No. 2. P. 1–38.Ruff L., Kauffmann J. R., Vandermeulen R. A. et al. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE. 2021, Vol. 109, No. 5, P. 756–795.A unifying review of deep and shallow anomaly detection / L. Ruff, J. R. Kauffmann, R. A. Vandermeulen et al. // Proceedings of the IEEE. 2021. Vol. 109, No. 5. P. 756–795.Zolotov S. Yu. [Methods of anomaly detection in time series: review and comparative analysis]. Informatsionnye tekhnologii. 2023, Vol. 29, No. 4, P. 187–196 (In Russ.).Золотов С. Ю. Методы обнаружения аномалий во временных рядах: обзор и сравнительный анализ // Информационные технологии. 2023. Т. 29, № 4. С. 187–196.Cook A. A., Misirli G., Fan Z. Anomaly detection for IoT time-series data: A survey. IEEE Internet of Things Journal. 2020, Vol. 7, No. 7, P. 6481–6494.Cook A. A., Misirli G., Fan Z. Anomaly detection for IoT time-series data: A survey // IEEE Internet of Things Journal. 2020. Vol. 7, No. 7. P. 6481–6494.Tuli S., Casale G., Jennings N. R. TranAD: deep transformer networks for anomaly detection in multivariate time series data. Proceedings of the VLDB Endowment. 2022, Vol. 15, No. 6, P. 1201–1214.Tuli S., Casale G., Jennings N. R. TranAD: deep transformer networks for anomaly detection in multivariate time series data // Proceedings of the VLDB Endowment. 2022. Vol. 15, No. 6. P. 1201–1214.Blázquez-García A., Conde A., Mori U., Lozano J. A. A review on outlier/anomaly detection in time series data. ACM Computing Surveys. 2021, Vol. 54, No. 3, P. 1–33.Blázquez-García A., Conde A., Mori U., Lozano J. A. A review on outlier/anomaly detection in time series data // ACM Computing Surveys. 2021. Vol. 54, No. 3. P. 1–33.Schmidl S., Wenig P., Papenbrock T. Anomaly detection in time series: a comprehensive evaluation. Proceedings of the VLDB Endowment. 2022, Vol. 15, No. 9, P. 1779–1792.Schmidl S., Wenig P., Papenbrock T. Anomaly detection in time series: a comprehensive evaluation // Proceedings of the VLDB Endowment. 2022. Vol. 15, No. 9. P. 1779–1792.Malashin I. P., Masich I. S., Tynchenko V. S. et al. Anomaly detection in restaurant receipts data. IEEE Access. 2024, Vol. 12, P. 145590–145607.Anomaly detection in restaurant receipts data / I. P. Malashin, I. S. Masich, V. S. Tynchenko et al. // IEEE Access. 2024. Vol. 12. P. 145590–145607.Vasin A. A., Kozlov S. V. [Detection of anomalous patterns in fiscal data using machine learning methods]. Prikladnaya informatika. 2024, Vol. 19, No. 2, P. 54–68 (In Russ.).Васин А. А., Козлов С. В. Выявление аномальных паттернов в фискальных данных с использованием методов машинного обучения // Прикладная информатика. 2024. Т. 19, № 2. С. 54–68.Li Z., Zhao Y., Botta N. et al. COPOD: copula-based outlier detection. Proceedings of the 20th IEEE International Conference on Data Mining (ICDM). 2020, P. 362–371.COPOD: copula-based outlier detection / Z. Li, Y. Zhao, N. Botta et al. // Proceedings of the 20th IEEE International Conference on Data Mining (ICDM). 2020. P. 362–371.Asuero A. G., Sayago A., González A. G. The correlation coefficient: an overview. Critical Reviews in Analytical Chemistry. 2006, Vol. 36, No. 1, P. 41–59.Asuero A. G., Sayago A., González A. G. The correlation coefficient: an overview // Critical Reviews in Analytical Chemistry. 2006. Vol. 36, No. 1. P. 41–59.Hodges J. L. The significance probability of the Smirnov two-sample test. Arkiv for Matematik. 1958, Vol. 3, No. 5, P. 469–486.Hodges J. L. The significance probability of the Smirnov two-sample test // Arkiv för Matematik. 1958. Vol. 3, No. 5. P. 469–486.Aggarwal C. C. Outlier analysis. 2nd ed. Cham: Springer, 2017, 466 p.Aggarwal C. C. Outlier analysis. 2nd ed. Cham: Springer, 2017. 466 p.Goswami M., Saha S., Dutta S., Chakraborty S. A survey on anomaly detection in streaming data: algorithms and applications. ACM Computing Surveys. 2024, Vol. 56, No. 7, P. 1–35.Goswami M., Saha S., Dutta S., Chakraborty S. A survey on anomaly detection in streaming data: algorithms and applications // ACM Computing Surveys. 2024. Vol. 56, No. 7. P. 1–35.Fasano G., Franceschini A. A multidimensional version of the Kolmogorov–Smirnov test. Monthly Notices of the Royal Astronomical Society. 1987, Vol. 225, No. 1, P. 155–170.Fasano G., Franceschini A. A multidimensional version of the Kolmogorov – Smirnov test // Monthly Notices of the Royal Astronomical Society. 1987. Vol. 225, No. 1. P. 155–170.Belyashov N. P., Kazakovtsev V. L., Rezova N. L., Kazakovtsev L. A. [Prediction of population outbreaks of organisms using machine learning methods on the example of Siberian silkworm]. Sistemy upravleniya i informatsionnye tekhnologii. 2025, No. 1 (99), P. 82–87 (In Russ.).Прогнозирование всплесков популяций организмов с использованием методов машинного обучения на примере сибирского шелкопряда / Н. П. Беляшов, В. Л. Казаковцев, Н. Л. Резова, Л. А. Казаковцев // Системы управления и информационные технологии. 2025. № 1 (99). С. 82–87.Kim S., Choi J., Lee J. Anomaly detection in multivariate time series using deep learning: a comprehensive review. IEEE Access. 2023, Vol. 11, P. 76234–76255.Kim S., Choi J., Lee J. Anomaly detection in multivariate time series using deep learning: a comprehensive review // IEEE Access. 2023. Vol. 11. P. 76234–76255.Egorova L. D., Kazakovtsev L. A. [Application of the Hurst exponent and R/S-analysis of electroencephalography signals in tasks of automatic recognition of pathological conditions]. Sistemy upravleniya i informatsionnye tekhnologii. 2021, No. 2 (84), P. 34–39 (In Russ.). DOI: 10.36622/ VSTU.2021.84.2.008Егорова Л. Д., Казаковцев Л. А. Применение показателя Херста и R/S-анализа сигналов электроэнцефалографии в задачах автоматического распознавания патологических состояний // Системы управления и информационные технологии. 2021. № 2 (84). С. 34–39. DOI 10.36622/ VSTU.2021.84.2.008.Hardstone R., Poil S. S., Schiavone G. et al. Detrended Fluctuation Analysis: A Scale-Free View on Neuronal Oscillations. Frontiers in Physiology. 2012, Vol. 3, P. 450. DOI: 10.3389/fphys. 2012.00450.Hardstone R., Poil S. S., Schiavone G. et al. Detrended Fluctuation Analysis: A Scale-Free View on Neuronal Oscillations // Frontiers in Physiology. 2012. Vol. 3. P. 450. DOI: 10.3389/ fphys.2012.00450Rezova N. L., Kazakovtsev L. A., Shkaberina G. Sh., Tsepkova M. I. [Preliminary data processing for analyzing the behavior of complex systems]. Sistemy upravleniya i informatsionnye tekhnologii. 2022, No. 2 (88), P. 40–45 (In Russ.). DOI: 10.36622/VSTU.2022.88.2.008Предварительная обработка данных для анализа поведения сложных систем / Н. Л. Резова, Л. А. Казаковцев, Г. Ш. Шкаберина, М. И. Цепкова // Системы управления и информационные технологии. 2022. № 2 (88). С. 40–45. DOI: 10.36622/VSTU.2022.88.2.008Keren G., Schuller B. Convolutional RNN: An enhanced model for extracting features from sequential data. 2016 International Joint Conference on Neural Networks (IJCNN). Vancouver, BC, Canada, 2016, P. 3412–3419. DOI: 10.1109/IJCNN.2016.7727636Keren G., Schuller B. Convolutional RNN: An enhanced model for extracting features from sequential data // 2016 International Joint Conference on Neural Networks (IJCNN), Vancouver, BC, Canada. 2016. P. 3412–3419. DOI: 10.1109/IJCNN.2016.7727636Kazakovtsev L. A. [Deterministic algorithm for the k-means and k-medoids problem]. Sistemy upravleniya i informatsionnye tekhnologii. 2015, No. 1 (59), P. 95–99 (In Russ.).Казаковцев Л. А. Детерминированный алгоритм для задачи k-средних и k-медоид // Системы управления и информационные технологии. 2015. № 1 (59). С. 95–99.Likas A., Vlassis N., Verbeek J. J. The global k-means clustering algorithm. Pattern Recognition. 2003, Vol. 36, No. 2, P. 451–461.Likas A., Vlassis N., Verbeek J. J. The global k-means clustering algorithm // Pattern Recognition. 2003. Vol. 36, No. 2. P. 451–461.Ester M., Kriegel H.-P., Sander J., Xu X. A density-based algorithm for discovering clusters in large spatial databases with noise. Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD'96). 1996, P. 226–231.A density-based algorithm for discovering clusters in large spatial databases with noise / M. Ester, H.-P. Kriegel, J. Sander, X. Xu // Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD'96). 1996. P. 226–231.Cuevas A., Febrero M., Fraiman R. An ANOVA test for functional data. Computational Statistics & Data Analysis. 2004, Vol. 47, No. 1, P. 111–122.Cuevas A., Febrero M., Fraiman R. An ANOVA test for functional data // Computational Statistics & Data Analysis. 2004. Vol. 47, No. 1. P. 111–122.Hosmer D. W., Lemeshow S., Sturdivant R. X. Applied logistic regression. Hoboken, Wiley, 2013, 528 p.Hosmer D. W., Lemeshow S., Sturdivant R. X. Applied logistic regression. Hoboken : Wiley, 2013. 528 p.Quinlan J. R. Induction of decision trees. Machine Learning. 1986, Vol. 1, No. 1, P. 81–106.Quinlan J. R. Induction of decision trees // Machine Learning. 1986. Vol. 1, No. 1. P. 81–106.Rish I. An empirical study of the naive Bayes classifier. IJCAI 2001 Workshop on Empirical Methods in Artificial Intelligence. 2001, Vol. 3, No. 22, P. 41–46.Rish I. An empirical study of the naive Bayes classifier // IJCAI 2001 Workshop on Empirical Methods in Artificial Intelligence. 2001. Vol. 3, No. 22. P. 41–46.Abbasifard M. R., Ghahremani B., Naderi H. A survey on nearest neighbor search methods. International Journal of Computer Applications. 2014, Vol. 95, No. 25, P. 39–52.Abbasifard M. R., Ghahremani B., Naderi H. A survey on nearest neighbor search methods // International Journal of Computer Applications. 2014. Vol. 95, No. 25. P. 39–52.Kazakovtsev V., Plekhanov M., Naumchev A. et al. Fast adaptive approximate nearest neighbor search with cluster-shaped indices. Big Data and Cognitive Computing. 2025, Vol. 9, No. 10, P. 254. DOI: 10.3390/bdcc9100254Kazakovtsev V., Plekhanov M., Naumchev A. et al. Fast adaptive approximate nearest neighbor search with cluster-shaped indices // Big Data and Cognitive Computing. 2025. Vol. 9, No. 10. P. 254. DOI: 10.3390/bdcc9100254Cover T., Hart P. Nearest neighbor pattern classification. IEEE Transactions on Information Theory. 1967, Vol. 13, No. 1, P. 21–27.Cover T., Hart P. Nearest neighbor pattern classification // IEEE Transactions on Information Theory. 1967. Vol. 13, No. 1. P. 21–27.Cortes C., Vapnik V. Support-vector networks. Machine Learning. 1995, Vol. 20, No. 3, P. 273–297.Cortes C., Vapnik V. Support-vector networks // Machine Learning. 1995. Vol. 20, No. 3. P. 273–297.Breiman L. Random forests. Machine Learning. 2001, Vol. 45, P. 5–32.Breiman L. Random forests // Machine Learning. 2001. Vol. 45. P. 5–32.Chen T., Guestrin C. XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, 2016, P. 785–794.Chen T., Guestrin C. XGBoost: A scalable tree boosting system // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. San Francisco, 2016. P. 785–794.Ke G., Meng Q., Finley T. et al. LightGBM: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems. 2017, Vol. 30, P. 3146–3154.LightGBM: A highly efficient gradient boosting decision tree / G. Ke, Q. Meng, T. Finley et al. // Advances in Neural Information Processing Systems. 2017. Vol. 30. P. 3146–3154.Zhu X., Ghahramani Z. Learning from labeled and unlabeled data with label propagation. Technical Report CMU-CALD-02-107, Carnegie Mellon University, 2002.Zhu X., Ghahramani Z. Learning from labeled and unlabeled data with label propagation. Technical Report CMU-CALD-02-107. Carnegie Mellon University, 2002.Zhou D., Bousquet O., Lal T. N. et al. Learning with local and global consistency. Advances in Neural Information Processing Systems. 2003, Vol. 16, 8 p.Learning with local and global consistency / D. Zhou, O. Bousquet, T. N. Lal et al. // Advances in Neural Information Processing Systems. 2003. Vol. 16. 8 р.Malashin I., Masich I., Tynchenko V. et al. Forecasting Dendrolimus sibiricus Outbreaks: Data Analysis and Genetic Programming-Based Predictive Modeling. Forests. 2024, Vol. 15, No. 5, P. 800. DOI: 10.3390/f15050800Forecasting Dendrolimus sibiricus Outbreaks: Data Analysis and Genetic Programming-Based Predictive Modeling / I. Malashin, I. Masich, V. Tynchenko et al. // Forests. 2024. Vol. 15, No. 5. P. 800. DOI: 10.3390/f15050800Gama J., Žliobaitė I., Bifet A. et al. A survey on concept drift adaptation. ACM Computing Surveys. 2014, Vol. 46, No. 4, P. 1–37.A survey on concept drift adaptation / J. Gama, I. Žliobaitė, A. Bifet et al. // ACM Computing Surveys. 2014. Vol. 46, No. 4. P. 1–37.Sakurada M., Yairi T. Anomaly detection using autoencoders with nonlinear dimensionality reduction. Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis. Gold Coast, Australia, 2014, P. 4–11.Sakurada M., Yairi T. Anomaly detection using autoencoders with nonlinear dimensionality reduction // Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis. Gold Coast, Australia, 2014. P. 4–11.