s2fieldsofstudy:
Computer Science
Mathematics

text:
A Regulatable Blockchain Transaction Model with Privacy Protection

Blockchain is a decentralized distributed ledger technology. The public chain represented by Bitcoin and Ethereum only realizes the limited anonymity of user identity, and the transaction amount is open to the whole network, resulting in user privacy leakage. Based on the existing anonymous technology, the concealment of the sender, receiver, amount of the transaction, and does not disclose any information, which makes the supervision difficult. Therefore, the design of blockchain scheme with privacy protection and supervision functions is of great significance. In this paper, a blockchain transaction model with both privacy and supervision function is proposed. It uses probability encryption to realize the hiding of the true identity of the blockchain transaction, and uses the commitment scheme and zero-knowledge proof technology to realize the privacy protection and guarantee legitimacy verification of the transaction. With the use of encryption technology, the regulators can supervise blockchain transactions without storing the users’ information, which greatly reduces the pressure on storage, computing and key management. In addition, it does not rely on specific consensus mechanism and can be used as an independent module. The security performance analysis shows that the proposed scheme has great practicability and has potential application in many fields.

INTRODUCTION
Blockchain technology first emerged as a tool to manage cryptocurrency in 2008 when Nakamoto introduced "Bitcoin" as first P2P digital cash system using blockchain [1]. It is a new application model for various computer technologies, such as data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. The blockchain also known as distributed ledger technology, which leads a new round of technological and industrial changes around the world, playing an important role in improving corporate productivity, reducing corporate costs, increasing customer satisfaction and expanding new markets. Some researchers are integrating blockchain technology into some areas of daily life. For example, the application of blockchain has extended from the financial to the physical field, including electronic information storage, copyright management and trading, product traceability, digital asset trading, Internet of Things, intelligent manufacturing, supply chain management and other fields [2]. All these applications show that blockchain will take over some major areas of daily life in the future. Moreover, the blockchain can bring people into a fair, safe and transparent environment. Obviously, as a trust system construction technology, blockchain has great potential and is * Corresponding author. Email: peide.liu@gmail.com expected to become the cornerstone of the new era of digital economy. Now, blockchain has begun to be used in various industries such as energy, finance, e-commerce, e-government and medical care. Especially in the field of privacy protection, a large number of experts and scholars have been attracted to achieve better results. With the further development and wide application of blockchain, it also faces more and more technical challenges, especially in privacy protection and supervision.
Blockchain works in the use of shared distributed ledger distribution system, which is basically a data structure that contains transaction lists in an orderly form. However, these decentralized transactions have produced certain privacy risks and attacks in daily life, which need to be solved before blockchain integration [3]. First of all, Conti et al. [4] gave one of the groundbreaking research articles on bitcoin security and privacy, which highlighted all the basic technologies of bitcoin and its feasibility and robustness analysis. Up to now, some research has been devoted to the study of Bitcoin, and a lot of results have been achieved. Later, with the development of blockchain technology, Ethereum began to appear, intended for the next generation of cryptocurrency and decentralized application platform. Ethereum is the representative of Blockchain 2.0, which uses smart contracts to solve the problem of decentralized application in the monetary field [5,6].
Neither Bitcoin nor Ethereum can guarantee the privacy of the transaction [7]. For a transaction on the blockchain, the sender, receiver and transaction amount are mainly involved. The identities of the sender and receiver are realized by the user's publickey address with a certain degree of anonymity, but some related information of the transaction subject can mine through data analysis or machine learning methods, and then combine some background knowledge to obtain the identity information of trader [8]. Hence, the transaction amount is completely exposed on the public chain, anyone can query and access it through the entire node of the blockchain. Attackers can obtain valuable information by analyzing transaction records, such as specific account fund balances, transaction details and specific capital flows, so the privacy of transactions cannot be guaranteed [9].
At the beginning of the design, the blockchain provides a certain degree of security for the designed system through a series of technologies to avoid damage, modification and data leakage due to external malicious attacks. In terms of privacy, the open and transparent nature of the blockchain has caused serious privacy issues such as transaction data and network node addresses. In order to further ensure the protection of user privacy, some related technologies have been applied in this field in recent years. In particular, anonymous digital currencies, such as Monero, Zcash and the newly launched Beam and Grin, etc., using ring signatures, zeroknowledge proofs, password commitments and other technologies to ensure the privacy of transaction senders, receivers and transaction amounts [10][11][12][13]. However, the privacy protection strategies are so strong that no one can supervise and control them, and they may be used in some illegal financial transaction activities, which is harmful to the society. Therefore, it is very valuable to find a suitable method that can protect privacy and facilitate supervision at the same time.
Blockchain, as a data structure that stores data in chronological order, can support different consensus mechanisms. The consensus mechanism is an important component of blockchain technology. The goal of the blockchain consensus mechanism is to enable all honest nodes to maintain a consistent view of the blockchain while satisfying consistency and effectiveness [14]. For example, there are plenty of consensus algorithms, such as proof of work (PoW), proof of importance (PoI), practical Byzantine fault tolerance (PBFT), measure of trust (MoT), proof of stake (PoS) and proof of space (PoSpace) [15,16]. In fact, the consensus mechanism is mainly used to eliminate trusted third parties or centralized entities. All nodes of the blockchain follow a specific consensus so that there will be no conflicts in the future, and the essence is to achieve privacy protection. However, the current consensus mechanism still has problems such as waste of computing power and energy, Matthew effect and low security. Therefore, adopting an effective consensus-based blockchain model to better solve the privacy protection is a current challenge.
To solve the above problems, this paper integrates multiple cryptographic technologies and proposes a blockchain transaction model with both privacy and supervision functions. First of all, we make use of the advantages of probabilistic public-key encryption to hide the real identity information of users. Then, with the help of the cryptographic commitment schemes and Zero-Knowledge Proof technology to verify the legality of blockchain transactions. Based on this, the regulators may obtain the real identity information of users through decryption, which fulfills the requirements of transaction privacy protection and the function of supervision. Moreover, regulators do not need to store the real identity and key information of user. Comparative analysis shows that the blockchain transaction model proposed in this paper is feasible and has practical value in various industrial scenarios such as digital currency, finance and energy.
The contributions of this paper are as follows: • We combine with the cryptographic commitment scheme and Zero-Knowledge Proof to complete the legality verification of privacy transactions for the first time. Therefore, the identity-based encryption system enables regulators to obtain transaction amounts through decryption calculations without storing the key information, which satisfies the requirements of transaction privacy protection and supervision functions.
• Taking advantage of probabilistic public-key encryption to hide the users' real identity information. The same real identity can be encrypted for unlimited times to generate different anonymous identities. Regulators can directly obtain the real information by decrypting the anonymous identity without storing identity information.
• The blockchain transaction model with privacy protection and supervision functions proposed in this paper does not rely on a specific consensus mechanism and can be used as an independent module in the existing blockchain technology.
The remainder of this paper is organized as follows. Section 2 describes recent advances in protecting the privacy of blockchain transactions. Section 3 describes background related to blockchain technology. Section 4 describes the overall methodology. Section 5 presents and discusses the experimental results. Section 6 summarizes and presents conclusions.

RELATED WORK
To protect the privacy of blockchain transactions and hide the information of the sender, receiver and transaction amount, many blockchain-based technologies have been proposed.
In 2015, DASH was proposed, the process of mixing coins is carried out by means of main node deposit, which can hide the mapping relationship between input address and output address to achieve the purpose of anonymity [17]. But this is a centralized processing method, so there may be problems such as denial of service attacks and mixed coin users of leaking the mixing process. Maurer et al. proposed CoinJoin, which merges multiple transactions into one transaction and hides the correspondence between input and output parties to enhance the privacy protection ability of users, but it also faces the threat of centralized mixing coins [18]. Compared with the mixing coins' scheme, Li et al. used a ring signature mechanism to implement privacy protection digital currency, and it no longer needs to interact with other users [10]. Users implement anonymous processing by themselves, which can effectively eliminate the problems faced by the centralized mixed coins scheme. However, due to the use of complex cryptography technology, the speed of system operation and verification process is reduced. Zcash is a new type of digital currency constructed on the basis of Zerocoin, which uses a cryptographic commitment scheme to encapsulate the sender, receiver and transaction amount of the transaction into parameters, and then uses zkSNARKs Zero-Knowledge Proof to prove the transaction and realize the concealment of the sender, receiver and transaction amount of blockchain transactions, it has the best privacy protection until now [11,19,20]. But the process of its proof is very slow, and there are bottlenecks in efficiency. In 2019, Beam and Grin went online, which used Mim-belWimble protocol and aggregated signatures to achieve the purpose of privacy protection of blockchain transactions [12,13,21]. However, both parties of the transaction need to perform an online interaction process, which is not convenient to use in practice. Therefore, we need to develop an effective and practical method to solve the problem of privacy protection.
Due to the strong privacy protection capabilities of anonymous digital currency, it is difficult for financial institutions and state agencies to supervise digital currency participants and transactions between them, making digital currency has gradually become the tool of money laundering, tax evasion and illegal transactions. Sun et al. proposed a multi-chain model suitable for central bank-supervised digital currencies, but the communication between chain nodes is more complicated, and the design of super chain makes it lose decentralized characteristics and cannot guarantee the privacy of transactions [22]. Zhang et al. proposed a digital currency supervision model with a double-chain structure, anchoring the alliance chain on a public chain [23]. As a consensus participant, the alliance chain guarantees the privacy of transactions through secret sharing, and provides the characteristics of supervision, while ensuring the decentralization and anonymity of digital currencies. Therefore, how to enable blockchain transactions to achieve both privacy capabilities and requirement of regulatory is a hot topic of current research, but the current research results are still very few.
This paper integrates a variety of cryptographic techniques to propose a blockchain transaction model that takes into account privacy protection and supervision functions. Among them, the probabilistic public-key encryption algorithm is used to hide users' real identity information and realize the identity anonymity of user transactions. The cryptographic commitment scheme and Zero-Knowledge Proof are used to realize the privacy protection of the blockchain transaction amount and ensure the legality of transaction verification. In addition, the use of identity-based encryption technology to realize the supervision function of transaction information. Based on the above advantages, the blockchain transaction model proposed in this paper is of great application value while ensuring the privacy of users' transactions, making it easier for regulators to track illegal financial transaction activities.

BACKGROUND
In this section, through detailed theoretical analysis, we will reveal the internal process of the blockchain technology, unspent transaction output (UTXO) model and cryptography applied in this paper, which are the basic components of the scheme.

Blockchain Technology
Blockchain is a decentralized distributed ledger, which can be simply understood as a distributed database that distributed on various nodes around the world, which is connected by blocks in chronological order to form a chain. If the data in any block was changed, it will cause subsequent changes to the blockchain, which makes it immutable [15,24]. Current mainstream blockchain platforms include Bitcoin, Ethereum and Hyperledger Fabric [1,5,25]. From Figure 1, we can see the structure of the blockchain, there are multiple transactions recorded in the block. Whether blockchain is licensed or multi-licensed depends on how individuals verify and send transactions or how entities are authorized to verify and execute transactions (or conduct transactions alone). Blockchain is based on cryptography rather than credit, allowing any two parties to reach an agreement to pay directly without the involvement of a third-party intermediary.
Transactions are written into the blockchain through a consensus mechanism. It is one of the core technologies of the blockchain and determines which node is responsible for accounting, and the accounting method will affect the security and reliability of the whole system. Common consensus mechanisms mainly include PoW, PoS, PBFT, etc. [26][27][28]. This paper mainly studies the blockchain transaction model and does not rely on specific consensus mechanisms.

UTXO Model
Blockchain technology is the bottom technology of bitcoin and the core and basic structure of Bitcoin. We define bitcoin transaction as a transfer of BTC ownership from the buyer's purse to the seller's purse in exchange for a product or service. The buyer's BTC wallet assembles a transaction using the buyer's UTXO stored in the blockchain. A BTC amount claimed in advance by a UTXO designated buyer for transactions previously processed. UTXO stands for the unspent transaction output and is the core concept of bitcoin transaction generation and verification. Multiple transactions are recorded on the bitcoin ledger, each of which has several transaction inputs (transferors), which is the source of funds; and several transaction outputs (receivers), which is the destination of funds. Figure 2 is an example of the Bitcoin UXTO model. We can see that the input of transaction 1 is 1 BTC, and the two outputs are 0.4 BTC and 0.5 BTC. The difference of 0.1 BTC between input and output is caused by transaction fee. Transaction 2 is similar to transaction 1, and its output is used as the input of transaction 3, thus forming a chain structure of the transaction.  In this paper, the blockchain transaction form mainly adopts bitcoin's UTXO model, and the transaction consists of sender, receiver and transaction amount. Transaction privacy refers to the protection of the sender's identity, receiver's identity and transaction amount without external disclosure; transaction supervision refers to the ability of regulators to query the information of the transaction sender, receiver and transaction amount by using curtain methods.

Cryptography
The cryptography is the most important invention and progress of modern cryptography. It is generally understood that cryptography is to protect the confidentiality of information transmission. The verification of the true identity of the sender and receiver of the information, the nonrepudiation of the sent/received information after the fact, and the protection of the integrity of the data are another aspect of modern cryptography. In blockchain transactions, it is necessary to adopt relevant cryptographic techniques to ensure security, we will introduce the probabilistic public-key cryptosystem, identity-based cryptographic algorithms and cryptographic commitment schemes in this subsection. These three technologies belong to classic cryptographic algorithms and play a vital role in ensuring the privacy of the transaction model proposed in this paper.

Probabilistic public-key cryptosystem
Probabilistic public-key encryption is a kind of nondeterministic cryptography. For the ciphertext generated by the same plaintext randomly changes, under the assumption of computational security, it is impossible to obtain any valid information of the plaintext through ciphertext related attacks in polynomial time.
Goldwasser et al. used the quadratic residue theorem to design a probabilistic public-key cryptographic scheme, but it has high ciphertext scalability [29]. Blum et al. gave a more effective probabilistic public-key encryption system, which greatly reduces the expansion of ciphertext data [30]. Therefore, based on the above theoretical analysis, we chose the Blum-Goldwasser (BG) scheme to encrypt the users' identity information, which is more effective and uses the Blum Blum Shub (BBS) generator to improve the randomness of the ciphertext [31]. The idea of BG's probabilistic public-key cryptosystem is as follows: A random seed s 0 uses a BBS generator to generate m pseudo-random bits z 1 , z 2 , … z m , and then uses z i as a key stream, i.e., they are XORed with l-length plaintext bits to form a ciphertext. At the same time, the m + 1th element mod n Transmit as part of the ciphertext. When the receiver receives the ciphertext, he can calculate s i+1 from s 0 ; then reconstruct the key stream, and finally XOR the key stream with m ciphertext bits to obtain the plaintext. The detailed algorithm process of BG is as follows: Parameter setting: Set n = pq, where p and q are large prime numbers, p ≡ q ≡ 3, then n is public key, and p and q are private keys. Suppose the plaintext space P = ( Encryption algorithm: n , the process of encryption is: • select the seed s 0 randomly, use the BBS generator to generate m random bits z 1 , z 2 , … z m as the keystream; • calculate s m+1 = ( s 0 ) 2 m+1 mod n; Decryption algorithm: To decrypt y, the following steps should be completed: • use Chinese Remainder Theorem calculates r and satisfies the following conditions: r ≡ b 1 mod p and r ≡ b 2 mod q; • use the BBS generator to calculate z 1 , z 2 , … z m from the seed S 0 = r; • the decrypted plaintext is x = x 1 , x 2 , ..., x m .

Identity-based cryptography
Identity-based cryptography (IBC) can effectively solve the problem of public key infrastructure (PKI) digital certificate management [32]. The security of cryptographic mechanisms mostly relies on the assumption of certain mathematical problems and achieves a certain security strength under a certain security model. Therefore, we first introduce the relevant theoretical hypothesis.

Definition 1.
The problem of Diffie-Hellman (DH) [33]. Given a large prime number q, a large integer generator g ∈ Z * q , and g a mod q and g b mod q generated by large random numbers a, b, g ab mod q is required to be found.

Definition 2.
The problem of computational Diffie-Hellman (CDH) [33]. For randomly given < P, aP, bp >, where a, b belongs to the point group Z * q with order q, calculate the value of abP. Definition 3. The problem of computational decision Diffie-Hellman (DDH) [34]. Distinguish the distribution between a given tuple <P, aP, bp, abp> and <P, aP, bp, cp>, i.e., determine whether c is equal to ab mod q, where a, b, c belong to the point group Z with order Z * q . Definition 4. The problem of strong Diffie-Hellman inversion (q-SDH) [35]. Given q + 1 dimensional tuple < g, g x , g x 2 , ..., g x p >∈ G, calculate g 1∕x ∈ G. Definition 5. The problem of bilinear Diffie-Hellman (BDH) [36]. Let G 1 and G 2 be two point groups with prime order q, e ∶ G 1 × G 1 → G 2 is an acceptable bilinear mapping, P is the generator of G 1 , for a given <P, aP, bP, Cp>, where a, b, c ∈ Z * q , calculate W = e(P, P) abc ∈ G 2 .
IBC generates the master public key and master private key by key generation center (KGC), then KGC uses its own key to generate the users' private key according to the identity information ID (such as name, email, ID number, etc.), which is the public key without digital certificate binding. This paper mainly adopts SM9 standard algorithm of China as an example of the IBC cryptosystem. SM9 uses various unique identifiers as public keys for data encryption and identity authentication, which is very suitable for applications such as email protection, secure circulation of official documents, multimedia converged secure communications, identity authentication, secure communications in the Internet of Things, cloud data protection, etc. The SM9 algorithm uses the bilinear pairing on the elliptic curve as the basic mathematical tool, and constructs a security proof based on the relevant calculation complexity assumptions, which greatly improves the protection level of my country's information security. Such a system has a natural password delegation function, which is very suitable for a supervised application environment, and has considerable advantages in the management and control of a large number of interconnected devices. SM9 standard is divided into five parts: general principles, digital signature algorithm, key exchange protocol, key encapsulation mechanism, public-key encryption algorithm and parameter definition. The following mainly introduces SM9 digital signature algorithm.
Let P 1 be the generator of the elliptic curve additive cyclic group G 1 , P 2 is the generator of the elliptic curve additive cyclic group G 1 , H (⋅) is the Hash function and e (⋅) is the bilinear pair. Assuming that A is the signer and B is the verifier, the process of generating the SM9 digital signature is as follows:

Process of signing:
Suppose the message to be signed is M, the signature process of user A is as follows: • calculate g = e ( P 1 , P pub−s ) ; • choose a random number r ∈ [1, N − 1]; • calculate w = g r , h = H (M‖w, N), l = (r − h) mod N; ds A , then the signature of M is (h, S).

Process of verification:
In order to verify the signature ( h ′ , S ′ ) of message M', B performs the following process: • calculate g = e ( P 1 , P pub−s ) ; , if h 2 = h ′ , then sign verification passes, otherwise it fails.

Cryptographic commitment scheme
In this paper, cryptographic commitment scheme mainly adopts Pedersen commitment and is used in Monero to protect the privacy of transaction finance [10]. Pedersen commitment is a homomorphic commitment protocol that satisfies perfect concealment and computational binding. Its perfect concealment does not depend on any difficult assumptions. The computational binding relies on the discrete logarithm assumption (DLA). And its construction is divided into 3 stages.
• Setup: Select the multiplicative group G and generator with the order of large prime q, G =< g >=< h >, open tuple ( g, h, q ) ; • Commitment: The promise party chooses a random number r as the blind factor, calculates the promise value and then sends commitment to the receiver; • Open: The promiser chooses a random number r as the blind factor, calculates the promise value and then sends commitment to the receiver; open phase open: the promiser sends (v, r) to the receiver, and the receiver verifies whether commitment is equal to g v h r mod q, if they are equal, then accept, otherwise refuse to promise.
The complete data formula is expressed as follows: where g and H are the base points in elliptic curve cryptography (ECC), and r is the blind factor to protect the privacy of the value x.
In addition, it is necessary to use Bulletproofs Zero-Knowledge Proof to realize the range proof of the transaction amount in a more efficient way [36]. Bulletproofs is a more space-efficient form of zero-knowledge proofs. Importantly, for our purposes, these proofs also have native support for commit values such as Pedersen commitments and public keys. This allows us to implement functions such as range proofs in a general zero-knowledge framework, instead of implementing complex elliptic curve algorithms in zeroknowledge.

REGULATABLE BLOCKCHAIN TRANSACTION PRIVACY PROTECTION MODEL
This paper combines UXTO, BG, IBC, Pedersen commitment and other technologies to propose a regulatable blockchain transaction privacy protection model, which could be seen in Figure 3. From the Figure, we can describe the complete implementation process as the regulators first realize the identity anonymity of the sender and the receiver, UTXO ensures the security of the amount during the transaction and the miner is used to ensure the legitimacy of the identity of the trader and the transaction amount. Next, we will introduce the design process in detail.

Transaction Model
The participants of the transaction in this scheme are shown in Figure 4, mainly including (1) sender and receiver of the transaction, hoping to protect their identity anonymity and the privacy of the transaction amount through a secure transaction; (2) blockchain miner, verify the legitimacy of transactions and packing them into blocks and storing them on the blockchain through consensus mechanisms; (3) regulators, track relevant participants in transactions and transaction finance to combat financial illegality criminal activities if necessary; (4) third party, who steals transaction-related information through certain technical means to obtain improper benefits.
The blockchain transaction privacy protection is relative, which mainly prevents the third parties from maliciously collecting user information. However, for regulators, it's necessary to track some illegal transactions to combat illegal and criminal activities. Therefore, it is necessary to ensure that transactions are regulatable. The

Realization of Anonymous Identity
In the initial phase of the model, regulators need to generate three pairs of public and private keys: one pair is, regulators use BG to generate the corresponding private key Sk BG and public key Pk BG ; another one, regulators act as the KGC in the IBC cryptosystem and generates the master public key MPK and master private key MSK; the other one, regulators define the identity of the IBC as ID a , and sets ID a as the public key, based on the IBC algorithm, use MSK to generate the corresponding signature's private key Sk a .
Then the user in the system applies for key distribution to regulators through the uniquely identifying information ID u . ID u needs to be self-certified, which can be the user's email address, ID number and mobile phone number, etc. After authenticating the user's identity information, the regulators use the BG algorithm's public key Pk BG to encrypt the user's identity information ID u to generate AID 1 , as follows: To ensure that the user's ID u is certified by regulators, need regulators to perform signature verification on AID 1 and generate AID 2 , Define AID u = AID 1 ∥ AID 2 , because AID 1 is obtained by using ID u with BG, with good randomness. AID 2 is AID 1 obtained by IBC signature, so AID u also has good randomness, which can effectively hide the user's user real identity information ID u , realize identity anonymity.
Then use AID u as the public-key identity. Based on the IBC algorithm, regulators use MSK to generate the user's corresponding private key Sk u , which is Users' self-certified real identity information is ID u , the calculated anonymous identity information is AID u , and the corresponding private key is Sk u . Due to the BG probabilistic public-key encryption algorithm, the same ID u can be encrypted to generate different AID u , ID u and AID u have a one-to-many relationship, and theoretically the same ID u can generate an unlimited number of AID u , enabling users to continuously update AID u , thereby achieving good anonymity of users' identity.
In order to facilitate the subsequent description, we define the identities of the sender and receiver of the transaction as ID s and ID r respectively. The corresponding anonymous identities are calculated as AID s and AID r , the private keys are Sk s and Sk r . When the sender conducts a transaction with the receiver, he only needs to use Sk s to unlock the UTXO input script and use AID r as the receiver's address to achieve identity anonymity. In order to prevent the sender from sending the transaction to an illegal address that does not exist, resulting in asset loss, it is necessary to verify the legitimacy of the receiver's address with the help of miners.

Privacy Protection of Transaction Amount
When the sender AID s needs to conduct a transaction with the receiver AID r , the generality is not lost, as shown in Figure 5: In the transaction, AID s has two inputs, the amount is V in1 and V in2 ; there are two outputs, which are the transaction using AID r , the amount is V out1 , and the change fee returned to itself is V out1 , and the other part of V fee is the handling fee, i.e., the cost of the miner's package transaction.
The scheme in this paper mainly adopts Pedersen commitment to realize the privacy protection of the transaction amount , and the handling fee V fee is publicly disclosed. For transaction's input, the previous output needs to be introduced, then can be decrypted by AID s with the private key Sk s .
For output, the sender AID s selects two random numbers b 1 , b 2 and then calculate P out1 and P out2 are mainly for miners to verify the legality of transactions. In order for the receiver to obtain they need to be encrypted with receiver's public key respectively, then get To ensure the legality of the transaction, it is necessary to calculate them. Moreover, we can define the public key of the transaction and calculate the private key of the transaction. Making use of the ECC to sign the transaction, we get the relevant results: In addition, it is necessary to prove the range of transaction amount to avoid negative value. It can be realized through Bulletproofs Zero-Knowledge Proof, which exists as an assistive technology in the blockchain. It means that the verifier cannot obtain any additional information other than the result of the judgment (wrong or right). In the late 1980s, Blum and others further proposed the concept of "Bulletproofs Zero-Knowledge Proof, " replacing the interactive process with a short random string and realizing zeroknowledge proof [30,37]. Therefore, the final transaction can be expressed as follows: where P range is the relevant content of the proof of transaction amount range. Broadcast T x through the network to the outside world. After the miners verify its legitimacy, it is packaged into blocks and recorded on the blockchain ledger through the consensus mechanism. The receiver can confirm receipt of the transaction according to AID r and then use the private key Sk r decrypts C out1 and obtains the transaction information. In summary, we have completed the entire transaction process while hiding the transaction amount. The legality of the transaction amount is verified in two aspects by miners: the input and output amounts are equal and the output amount is within the valid range.

EXPERIMENTAL ANALYSIS AND DISCUSSION
A thorough experimental and analytical analyses were carried out on the proposed model. Specifically, privacy tests on the blockchain model and analyzes the privacy protection capabilities of the proposed scheme and compares it with the existing blockchain privacy protection transaction schemes.

The Ability of Privacy Protection
For users' identity information, AID u privacy users' real information ID u , if AID u is used frequently (e.g., in a transaction), set AID u as the transaction input and output address at the same time, it is easy to infer that this is the change information given by traders. In order to improve privacy, this paper uses BG so that different seed s 0 can be randomly selected for each encryption, the same ID u can generate countless anonymous AID u addresses and AID u cannot be distinguished from each other. Therefore, the user can generate AID u in batches by regulators without changing ID u , and replace the AID u in each transaction. The third party cannot recognize the changes of output in a trading and track the whole process of trading, or even speculate any effective information, so this scheme can realize the strong ability of privacy protection.

Baselines Schemes
In this subsection, we compare the performance using 8 baseline models to test our proposed scheme.
• Bitcoin: Public key is used to realize identity anonymity and transaction amount is disclosed.
• Ethereum: Public key is used to realize identity anonymity and transaction amount is disclosed.
• Dash: The scheme is simple and mainly depends on the master node.
• Monero: The ring signature relies on other public keys and the verification is complicated.
• Zcash: Strong anonymity, but the parameter initialization is complicated, and the proof generation is time-consuming.
• Beam/Grin: Using MimbleWimble protocol, the implementation is simple, but requires an interactive process.
• Literature 22: With the multi-chain architecture, the node communication is more complicated, and the decentralization characteristic is lost.
• Literature 23: The double-chain structure is adopted to ensure the privacy of transactions. The chain structure is more complicated.
• Our model: The solution is simple to implement, but requires initial user authentication.

Comparison and Analysis
This subsection compares and analyzes the proposed regulatable blockchain anonymous transaction scheme in this paper with the existing blockchain transaction scheme, as shown in Table 1. At the same time, in order to observe the performance of all methods more intuitively, Figure 6 shows them in the form of images. Different colors represent different baseline models, and we classify them according to their performance. To further verify the performance of the solution proposed in this article, we have added three additional indicators, namely, protection against Identification attack, low storage usage and independence. They are used to verify the sender and receiver's identity protection and the storage size of privacy protection models. Among the existing cryptocurrencies, Bitcoin and Ethereum have a weak realization of the anonymity of identities, and the transaction amount has been completely disclosed to the outside world without privacy protection. Dash uses hybrid coin technology to mix the input and output of multiple transactions through the master node, but there is a risk of centralization, it may lead to the disclosure of user privacy. Therefore, when the Dash model faces an identity attack, it is difficult to avoid the risk. However, Monero adopts hidden address and ring signature technology, which no longer relies on centralized nodes, but needs to be mixed with other users' public keys and verification is relatively complicated. Zcash adopts the zkSNARKs Zero-Knowledge Proof scheme, which can achieve very strong anonymous privacy protection and make the model unable to be effectively supervised and has certain supervision loopholes. Moreover, the zkSNARKs scheme is very complicated to implement and requires initial trusted parameter settings. The generation of the proof is very time-consuming, which affects the practical efficiency. This feature of zkSNARKs makes it require higher storage usage. Both Beam and Grin use Pedersen commitment and aggregate signature technology to use the MimbleWimble protocol, which makes the implementation of the two simple, but requires an interactive process between the two parties, so it is more inconvenient to use. The above features make the two parties unable to deal with identity attacks. None of the above blockchain transaction privacy protection schemes have regulatable functions, which is indispensable in the transaction model and can greatly reduce risks. Therefore, a trading plan with regulatory functions is an indispensable indicator for us. Literature [22] proposed a multi-chain model suitable for supervision, but the communication between chain nodes is more complicated, and the super chain structure also makes it lose the decentralization characteristics and cannot protect the privacy of transactions. Literature [23] proposed a digital currency supervision model that adopts a double-chain structure, which combines alliance chains and public chains to ensure the privacy of transactions through secret sharing, while providing regulatable features, but the realization of the double-chain structure is more complicated. Both the model and the method proposed in this article are used to improve the privacy protection and supervision of blockchain transactions, which allows them to obtain basically satisfactory results. However, the solution we proposed is simpler in comparison, and has low storage characteristics, which can be conveniently applied to physical places such as health monitoring and bank transactions. Through comparison, it can be found that our proposed method is superior to other traditional methods, which fully verifies the validity of the above argument and the superiority of our scheme. As far as independence is concerned, the abovementioned baseline method and our scheme have this characteristic, but their degree of independence is slightly different.
By comparing with the existing schemes, it can be seen that the scheme proposed in this paper does not need to rely on a centralized master node, does not need to introduce other public keys for ring signatures, does not need to implement a complex zkSNARKs certification process, does not require a cumbersome interaction process and no complex multi-chain structure is required. Through the use of probabilistic public-key encryption, IBC cryptosystem and Pedersen commitments, the scheme have both privacy protection and regulatable functions, which make regulators do not need to store users' real identity and key information and greatly reduces the storage and calculation pressure. The abovementioned features make it possible to protect the user's identity, thereby avoiding attacks. Nowadays, more and more researchers are committed to the development of lightweight models, which are not only convenient, but also have certain application value. The scheme proposed in this paper has this characteristic, so it has great application prospects.

CONCLUSIONS AND FUTURE WORK
The application of blockchain technology not only protect the privacy of user transactions, but also ensure the legality of user transactions. Therefore, it is necessary to achieve a balance between privacy protection and regulatory requirements. While providing convenience to users, it strictly combats certain illegal transactions. Therefore, we integrate a variety of cryptographic techniques, using probabilistic public-key cryptography, IBC cryptography, Pedersen commitment, Bulletproofs Zero-Knowledge Proof, etc., to form a blockchain transaction model with privacy and supervision functions. With the advantages of probabilistic public-key encryption, the users' real identity information can be hidden and transaction anonymous identities can be generated, and the same real identity can be encrypted for unlimited times to generate different anonymous identities, which is convenient for users to realize the privacy protection of user transaction identity information by changing their anonymous identities. Pedersen promise and Bulletproofs technology are used to verify the legality of blockchain transactions. Regulators can use decryption to obtain the user's real identity information, and obtain the transaction amount through IBC cryptography, which satisfies the requirements of transaction privacy protection and supervision functions.
The blockchain transaction model proposed in this paper can be used as an independent module in the existing blockchain technology. Security performance analysis shows that the blockchain transaction scheme in this paper is simple and practical, and has a wide range of applications in the fields of digital assets and energy transactions.
Based on the above analysis, we find that the method proposed in this article can well balance privacy protection and supervision. We also believe that a lot of research is needed to enhance security and privacy protection. Typical network attacks and privacy issues can be used to undermine the stability of the blockchain system. Currently, all evolving solutions may slightly improve security and privacy, but usually accompanied by price increases make users suspicious of using such systems. However, with the help of this method to optimize the decision-making of users and regulators, further improvements are needed to realize the application. The fuzzy decision algorithm can evaluate the algorithm well and successfully capture the uncertainty, which is of great significance to improve the performance of the algorithm, and thus is applied to many industries [38]. Combining the solution proposed in this article with Pythagorean fuzzy uncertain environments will be our main research direction in the future.


extfieldsofstudy:
Computer Science
Mathematics

text:
Merlion: A Machine Learning Library for Time Series

We introduce Merlion, an open-source machine learning library for time series. It features a unified interface for many commonly used models and datasets for anomaly detection and forecasting on both univariate and multivariate time series, along with standard pre/post-processing layers. It has several modules to improve ease-of-use, including visualization, anomaly score calibration to improve interpetability, AutoML for hyperparameter tuning and model selection, and model ensembling. Merlion also provides a unique evaluation framework that simulates the live deployment and re-training of a model in production. This library aims to provide engineers and researchers a one-stop solution to rapidly develop models for their specific time series needs and benchmark them across multiple time series datasets. In this technical report, we highlight Merlion's architecture and major functionalities, and we report benchmark numbers across different baseline models and ensembles.

Introduction
Time series are ubiquitous in monitoring the behavior of complex systems in real-world applications, such as IT operations management, manufacturing industry and cyber security (Hundman et al., 2018;Mathur and Tippenhauer, 2016;Audibert et al., 2020). They can represent key performance indicators of computing resources such as memory utilization or request latency, business metrics like revenue or daily active users, or feedback for a marketing campaign in the form of social media mentions or ad clickthrough rate. Across all these applications, it is important to accurately forecast the trends and values of key metrics (e.g. predicting quarterly sales or planning the capacity required for a server), and to rapidly and accurately detect anomalies in those metrics (e.g. an anomalous number of requests to a service can indicate a malicious attack). Indeed, in software industries, anomaly detection, which detects unexpected observations that deviate from normal behaviors and notifies the operators timely to resolve the underlying issues, is one of the critical machine learning techniques to automate the identification of issues and incidents for improving IT system availability in AIOps (AI for IT Operations) (Dang et al., 2019).
Given the wide array of potential applications for time series analytics, numerous tools have been proposed (Van Looveren et al., 2019;Jiang, 2021;Seabold and Perktold, 2010;Alexandrov et al., 2020;Law, 2019;Guha et al., 2016;Hosseini et al., 2021;Taylor and Letham, 2017;Smith et al., 2017). However, there are still many pain points in today's industry workflows for time series analytics. These include inconsistent interfaces across datasets and models, inconsistent evaluation metrics between academic papers and industrial applications, and a relative lack of support for practical features like post-processing, autoML, and model combination. All of these issues make it challenging to benchmark diverse models across multiple datasets and settings, and subsequently make a data-driven decision about the best model for the task at hand. This work introduces Merlion, a Python library for time series intelligence. It provides an end-to-end machine learning framework that includes loading and transforming data, building and training models, post-processing model outputs, and evaluating model performance. It supports various time series learning tasks, including forecasting and anomaly detection for both univariate and multivariate time series. Merlion's key features are • Standardized and easily extensible framework for data loading, pre-processing, and benchmarking for a wide range of time series forecasting and anomaly detection tasks.
• A library of diverse models for both anomaly detection and forecasting, unified under a shared interface. Models include classic statistical methods, tree ensembles, and deep learning methods. Advanced users may fully configure each model as desired.
• Abstract DefaultDetector and DefaultForecaster models that are efficient, robustly achieve good performance, and provide a starting point for new users ( §5).
• Practical, industry-inspired post-processing rules for anomaly detectors that make anomaly scores more interpretable, while also reducing the false positive rate ( §4.2).
• Easy-to-use ensembles that combine the outputs of multiple models to achieve more robust performance ( §4.3).
• Flexible evaluation pipelines that simulate the live deployment & re-training of a model in production ( §2.5), and evaluate performance on both forecasting ( §3.4) and anomaly detection ( §4.4).
• Native support for visualizing model predictions.

Architecture and Design Principles
At a high level, Merlion's module architecture is split into five layers: the data layer loads raw data, converts it to Merlion's TimeSeries data structure, and performs any desired pre-processing; the modeling layer supports a wide array of models for both forecasting and anomaly detection, including autoML for automated hyperparameter tuning; the postprocessing layer provides practical solutions to improve the interpetability and reduce the false positive rate of anomaly detection models; the next ensemble layer supports transparent model combination and model selection; and the final evaluation layer implements relevant evaluation metrics and pipelines that simulate the live deployment of a model in production. Figure 1 provides a visual overview of the relationships between these modules.

Data Layer
Merlion's core data structure is the TimeSeries, which represents a generic multivariate time series T as a collection of UnivariateTimeSeries U (1) , . . . , This formulation reflects the reality that individual univariates may be sampled at different rates, or contain missing data at different timestamps. For example, a cloud computing system may report its CPU usage every 10 seconds, but only report the amount of free disk space once per minute.
We allow users to initialize TimeSeries objects directly from pandas dataframes, and we implement standardized loaders for a wide range of datasets in the ts_datasets package.
Once a TimeSeries has been initialized from raw data, the merlion.transform module supports a host of pre-processing operations that can be applied before passing a TimeSeries to a model. These include resampling, normalization, moving averages, temporal differencing, and others. Notably, multiple transforms can be composed with each other (e.g. resampling followed by a moving average), and transforms can be inverted (e.g. the normalization f (x) = (x − µ)/σ is inverted as f −1 (y) = σy + µ).

Models
Since no single model can perform well across all time series and all use cases, it is important to provide users the flexibility to choose from a broad suite of heterogenous models. Merlion implements many diverse models for both forecasting and anomaly detection. These include statistical methods, tree-based models, and deep learning approaches, among others. To transparently expose all these options to an end user, we unify all Merlion models under two common API's, one for forecasting, and one for anomaly detection. All models are initialized with a config object that contains implementation-specific hyperparameters, and support a model.train(time_series) method. Given a general multivariate time series T = (U (1) , . . . , U (d) ), forecasters are trained to predict the values of a single target univariate U (k) . One can then obtain a model's forecast of U (k) for a set of future time stamps by calling model.forecast(time_stamps).
Analogously, one can obtain an anomaly detector's sequence of anomaly scores for the time series T by simply calling model.get_anomaly_score(time_series). The handling of univariate vs. multivariate time series is implementation-specific (e.g. some algorithms look for an anomaly in any of the univariates, while others may look for anomalies in specific univariates). Notably, forecasters can also be used for anomaly detection by treating the residual between the true and predicted value of a target univariate U (k) as an anomaly score. These forecast-based anomaly detectors support both model.forecast(time_stamps) and model.get_anomaly_score(time_series).
For models that require additional computation, we implement a Layer interface that is the basis for the autoML features we offer. Layer is used to implement additional logic on top of existing model definitions that would not be properly fitted into the model code itself. Examples include seasonality detection and hyperparameter tuning (see §3.2 for more details). The Layer is an interface that implements three methods: generate_theta for generating hyperparameter candidates θ, evaluate_theta for evaluating the quality of θ's, and set_theta for applying the chosen θ to the underlying model. A separate class ForecasterAutoMLBase implements forecast and train methods that leverage methods from the Layer class to complete the forecasting model.
Finally, all models support the ability to condition their predictions on historical data time_series_prev that is distinct from the data used for training. One can obtain these conditional predictions by calling model.forecast(time_stamps, time_series_prev) or model.get_anomaly_score(time_series, time_series_prev).

Post-Processing
All anomaly detectors have a post_rule which applies important post-processing to the output of model.get_anomaly_score(time_series). This includes calibration ( §4.2.1), which ensures that anomaly scores correspond to standard deviation units and are therefore interpretable and consistent between different models, and thresholding ( §4.2.2) rules to reduce the number of false positives. One can directly obtain post-processed anomaly scores by calling model.get_anomaly_label(time_series).

Ensembles and Model Selection
Ensembles are structured as a model that represents a combination of multiple underlying models. For this purpose we have a base EnsembleBase class that abstracts the process of obtaining predictions Y 1 , . . . , Y m from m underlying models on a single time series T , and a Combiner class that then combines results Y 1 , . . . , Y m into the output of the ensemble. These combinations include traditional mean ensembles, as well as model selection based on evaluation metrics like sMAPE. Concrete implementations implement the forecast or get_anomaly_score methods on top of the tools provided by EnsembleBase, and their train method automatically handles dividing the data into train and validation splits if needed (e.g. for model selection).

Evaluation Pipeline
When a time series model is deployed live in production, training and inference are usually not performed in batch on a full time series. Rather, the model is re-trained at a regular cadence, and where possible, inference is performed in a streaming mode. To more realistically simulate this setting, we provide a EvaluatorBase class which implements the following evaluation loop: 1. Train an initial model on recent historical training data.
2. At a regular interval (e.g. once per day), retrain the entire model on the most recent data. This can be either the entire history, or a more limited window (e.g. 4 weeks).
3. Obtain the model's predictions (forecasts or anomaly scores) for the time series values that occur between re-trainings. Users may customize whether this should be done in batch, streaming, or at some intermediate cadence.
4. Compare the model's predictions against the ground truth (actual values for forecasting, or labeled anomalies for anomaly detection), and report quantitative evaluation metrics.
We also provide a wide range of evaluation metrics for both forecasting and anomaly detection, implemented as the enums ForecastMetric and TSADMetric, respectively. Finally, we provide scripts benchmark_forecast.py and benchmark_anomaly.py which allow users to use this logic to easily evaluate model performance on any dataset included in the ts_datasets module. We report experimental results using these scripts in §5.

Time Series Forecasting
In this section, we introduce Merlion's specific univariate and multivariate forecasting models, provide algorithmic details on Merlion's autoML and ensembling modules for forecasting, and describe the metrics used for experimental evaluation in §5.1 and §5.2.

Models
Merlion contains a number of models for univariate time series forecasting. These include classic statistcal methods like ARIMA (AutoRegressive Integrated Moving Average), SARIMA (Seasonal ARIMA) and ETS (Error, Trend, Seasonality), more recent algorithms like Prophet (Taylor and Letham, 2017), our previous production algorithm MSES (Cassius et al., 2021), and a deep autoregressive LSTM (Hochreiter and Schmidhuber, 1997), among others.
The multivariate forecasting models we use are based on autoregression and tree ensemble algorithms. For the autoregression algorithm, we adopt the Vector Autoregression model (VAR, Lütkepohl (2005)) that captures the relationship between multiple sequences as they change over time. For tree ensembles, we consider Random Forest (RF, Ho (1995)) and Gradient Boosting (GB, Ke et al. (2017)) as the base models. However, without appropriate modifications, tree ensemble models can be unsuitable for the general practice of time series forecasting. First, their output is a fixed-length vector, so it is not straightforward to obtain their forecasts for arbitrary prediction horizons. Second, these multivariate forecasting models often have incompatible data workflows or APIs that make it difficult to directly apply them for univariate prediction.
To overcome these obstacles, we propose an autoregressive forecasting strategy for our tree ensemble models, RF Forecaster and GB Forecaster. For a d-variable time series, these models forecast the value of all d variables in the time series for time t k , and they condition on this prediction to autoregressively forecast for time t k+1 . We thus enable these models to produce a forecast for an arbitrary prediction horizon, similar to more traditional models like VAR. Additionally, all our multivariate forecasting models share common APIs with the univariate forecasting models, and are therefore universal for both the univariate and the multivariate forecasting tasks. A full list of supported models can be found in the API documentation.

AutoML and Model Selection
The AutoML module for time series forecasting models is slightly different from autoML for coventional machine learning models, as we consider not only conventional hyperparameter optimization, but also the detection of some characteristics of time series. Take the SARIMA(p, d, q) × (P, Q, D) m model as an example. Its hyperparameters include the autoregressive parameter p, difference order d, moving average parameter q, seasonal autoregressive parameter P , seasonal difference order D, seasonal moving average parameter Q, and seasonality m. While we use SARIMA as a motivating example, note that automatic seasonality detection can directly enhance other models like ETS and Prophet (Taylor and Letham, 2017). Meanwhile, choosing the appropriate (seasonal) difference order can yield a representation of the time series that makes the prediction task easier for any model.
Typically, we first analyze the time series to choose the seasonality m. Following the idea from the theta method (Assimakopoulos and Nikolopoulos, 2000), we say that a time series has seasonality m at significance level a if where r k is the lag-k autocorrelation, m is the number of periods within a seasonal cycle, n is the sample size, and Φ −1 is the quantile function of the standard normal distribution. By default, we set the significance at a = 0.05 to reflect the 95% prediction intervals. Next, we select the seasonal difference order D by estimating the strength of the seasonal component with the time series decomposition method (Cleveland et al., 1990). Suppose the time series can be written as y = T + S + R, where T is the smoothed trend component, S is the seasonal component and R is the remainder. Then, the strength of the seasonality (Wang et al., 2006) is Note that a time series with strong seasonality will have F S close to 1 since Var(R) is much smaller than Var(S + R). If F S is large, we adopt the seasonal difference operation. Thus, we choose D by successviely decomposing the time series and differencing it based on the detected seasonality until F S is relatively small. We can then choose the difference order d by applying successive KPSS unit-root tests to the seasonally differenced data. Once m, D, and d are selected, we can choose the remaining hyperparameters p, q, P , and Q by minimizing the AIC (Akaike Information Criterion) via grid search. Because the parameter space is exponentially large if we exhastively enumerate all the hyperparameter combinations, we follow the step-wise search method of Hyndman and Khandakar (2008).
To further speed up the training time of the autoML module, we propose the following approximation strategy: we obtain an initial list of candidate models that achieve good performance after relatively few optimization iterations; we then re-train each of these candidates until model convergence, and finally select the best model by AIC.

Ensembles
Ensembles of forecasters in Merlion allow a user to transparently combine models in two ways. First, we support traditional ensembles that report the mean or median value predicted by all the models at each timestamp. Second, we support automated model selection. When performing model selection, we divide the training data into train and validation splits, train each model on the training split, and obtain its predictions for the validation split. We then evaluate the quality of those predictions using a user-specified evaluation metric like sMAPE or RMSE ( §3.4), and return the model that achieved the best performance after re-training it on the full training data. These features are useful in many practical scenarios, as they can greatly reduce the amount of human intervention needed when deploying a model.

Evaluation Metrics
There are many ways to evaluate the accuracy of a forecasting model. Given a time series with n observations, let y t denote the observed value at time t andŷ t denote the corresponding predicted value. Then the forecasting error e t at time t is y t −ŷ t . Error measures based on absolute or squared errors are widely used, and they are formuated as respectively. Unfortunately, these measures cannot be compared across time series that are on different scales. To achive scale-independence, one alternative approach is to use percentage errors based on the observed values. One typical measure is sMAPE (Makridakis and Hibon, 2000), defined as: Unfortunately, sMAPE has the disadvantage of being ill-defined if y t andŷ t are both close to zero. To address this issue, one alternative measure is MARRE, which is defined as However, MARRE is not always suitable for non-stationary time series, where the scale of the data may evolve over time. Merlion's ForecastMetric enum supports all the above classes of evaluation metrics, as well as others detailed in the API documentation. By default, we evaluate forecasting results by sMAPE, but users may manually specify alternatives if their application calls for it.

Time Series Anomaly Detection
In this section, we introduce Merlion's specific univariate and multivariate anomaly detection models, provide algorithmic details on Merlion's post-processing and ensembling modules for anomaly detection, and describe the metrics used for experimental evaluation in §5.3 and §5.4.

Models
Merlion contains a number of models that are specialized for univariate time series anomaly detection. These fall into two groups: forecasting-based and statistical. Because forecasters in Merlion predict the value of a specific univariate in a general time series, they are straightforward to adapt for anomaly detection. The anomaly score is simply the residual between the predicted and true time series value, optionally normalized by the underlying forecaster's predicted standard error (if it produces one). For univariate statistical methods, we support Spectral Residual (Ren et al., 2019), as well as two simple baselines WindStats and ZMS. WindStats divides each week into windows (e.g. 6 hours), and computes the anomaly score s t = (x t − µ(t))/σ(t), where µ(t) and σ(t) are the historical mean and standard deviation of the window in question (e.g. 12pm to 6pm on Monday). ZMS computes k-lags ∆ 1, 2, 4, 8, . . ., and computes the anomaly score s t = max k (∆ (k) t − µ (k) )/σ (k) , where µ (k) and σ (k) are the mean and standard deviation of each k-lag.
In addition to models that are specialized for univariate anomaly detection, we support both statistical methods and deep learning models that can handle both univariate and multivariate anomaly detection. The statistical methods include Isolation Forest (Liu et al., 2008) and Random Cut Forest Guha et al. (2016), while the deep learning models include an autoencoder (Baldi, 2012), a Deep Autoencoding Gaussian Mixture Model (DAGMM, Zong et al. (2018)), a LSTM encoder-decoder (Sutskever et al., 2014), and a variational autoencoder (Kingma and Welling, 2013). A full list can be found in the API documentation.

Post-Processing
Merlion supports two key post-processing steps for anomaly detectors: calibration and thresholding. Calibration is important for improving model intepretability, while thresholding converts a sequence of continuous anomaly scores into discrete labels and reduces the false positive rate.

Calibration
All anomaly detectors in Merlion return anomaly scores s t such that |s t | is positively correlated with the severity of the anomaly. However, the scales and distributions of these anomaly scores vary widely. To successfully use a model, one must be able to interpret the anomaly scores it returns. However, this prevents many models from being immediately useful to users who are unfamiliar with their specifc implementations. Calibration bridges this gap by making all anomaly scores interpretable as z-scores, i.e. values drawn from a standard normal distribution.
Let Φ : R → [0, 1] be the cumulative distribution function (CDF) of the standard normal distribution. A calibrator C : R → R converts a raw anomaly score s t into a calibrated score z t such that P[|z t | > α] = Φ(α) − Φ(−α) = 2Φ(α) − 1, i.e. |z t | follows the same distribution as the absolute value of a standard normal random variable. If F s : R → [0, 1] is the CDF of the absolute raw anomaly scores |s t |, we can compute the recalibrated score as Notably, this is also the optimal transport map between the two distributions, i.e. the mapping which transfers mass from one distribution to the other in a way that minimizes the 1 transportation cost (Villani, 2003).
In practice, we estimate the calibration function C using the empirical CDFF s and a monotone spline interpolator (Fritsch and Butland, 1984) for intermediate values. This simple post-processing step dramatically increases the intepretability of the anomaly scores returned by individual models. It also enables us to create ensembles of diverse anomaly detectors as discussed in §4.3. This functionality is enabled by default for all anomaly detection models.

Thresholding
The most common way to decide whether an individual timestamp t as anomalous, is to compare the anomaly score s t against a threshold τ . However, in many real-world systems, a human is alerted every time an anomaly is detected. A high false positive rate will lead to fatigue from the end users who have to investigate each alert, and may result in a system whose users think it is unreliable.
A common way to circumvent this problem is including additional automated checks that must pass before a human is alerted. For instance, our system may only fire an alert if there are two timestamps t 1 , t 2 within a short window (e.g. 1 hour) with a high anomaly score, i.e. |s t 1 | > τ and |s t 2 | > τ . Moreover, if we know that anomalies typically last 2 hours, our system can simply suppress all alerts occurring within 2 hours of a recent one, as those alerts likely correspond to the same underlying incident. Often, one or both of these steps can greatly increase precision without adversely impacting recall. As such, they are commonplace in production systems.
Merlion implements all these features in the user-configurable AggregateAlarms postprocessing rule, and by default, it is enabled for all anomaly detection models.

Ensembles
Because both time series and the anomalies they contain are incredibly diverse, it is unlikely that a single model will be the best for all use cases. In principle, a heterogenous ensemble of models may generalize better than any individual model in that ensemble. Unfortunately, as mentioned in §4.2.1, constructing an ensemble is not straightforward due to the vast differences in anomaly scores returned by various models.
However, because we can rely on the anomaly scores of all Merlion models to be interpretable as z-scores, we can construct an ensemble of anomaly detectors by simply reporting the mean calibrated anomaly score returned by each individual model, and then applying a threshold (a la §4.2.2) on this combined anomaly score. Empirically, we find that ensembles robustly achieve the strongest or competitive performance (relative to the baselines considered) across multiple open source and internal datasets for both univariate (Table 10) and multivariate (Table 13) anomaly detection.

Evaluation Metrics
The key challenge in designing an appropriate evaluation metric for time series anomaly detection lies in the fact that anomalies are almost always windows of time, rather than discrete points. Thus, while it is easy to compute the pointwise (PW) precision, recall, and F1 score of a predicted anomaly label sequence relative to the ground truth label sequence, these metrics do not reflect a quantity that human operators care about. Xu et al. (2018) propose point-adjusted (PA) metrics as a solution to this problem: if any point in a ground truth anomaly window is labeled as anomalous, all points in the segment are treated as true positives. If no anomalies are flagged in the window, all points are labeled as false negatives. Any predicted anomalies outside of anomalous windows are treated as false positives. Precision, recall, and F1 can be computed based on these adjusted true/false positive/negative counts. However, the disadvantage of PA metrics is that they are biased to reward models for detecting long anomalies more than short ones. Hundman et al. (2018) propose revised point-adjusted (RPA) metrics as a closely related alternative: if any point in a ground truth anomaly window is labeled as anomalous, one true positive is registered. If no anomalies are flagged in the window, one false negative is recorded. Any predicted anomalies outside of anomalous windows are treated as false positives. These metrics address the shortcomings of PA metrics, but they do penalize false positives more heavily than alternatives.
Merlion's TSADMetric enum supports all 3 classes of evaluation metrics (PW, PA, and RPA), as well as the mean time to detect an anomaly. By default, we evaluate RPA metrics, but users may manually specify alternatives if their application calls for it.

Experiments
In the experiments section, we show benchmark results generated by using Merlion with popular baseline models across several time series datasets. The purpose of this section is not to obtain state-of-the-art results. Rather, most algorithms listed are strong baselines. To avoid the possible risk of label leaking through manual hyperparameter tuning, for all experiments, we evaluate all models with a single choice of sensible default hyperparameters and data pre-processing, regardless of dataset.

Datasets and Evaluation
We primarily evaluate our models on the M4 benchmark (Makridakis et al., 2018(Makridakis et al., , 2020, an influential time series forecasting competition. The dataset contains 100, 000 time series from diverse domains including financial, industry, and demographic forecasting. It has sampling frequencies ranging from hourly to yearly. Table 2 summarizes the dataset. We additionally evaluate on three internal datasets of cloud KPIs, which we describe in Table 3. For all datasets, models are trained and evaluated in the offline batch prediction setting, with a pre-defined prediction horizon equal to the size of the test split. To mitigate the effect of outliers, we report both the mean and median sMAPE for each method.

Models
We compare ARIMA (AutoRegressive Integrated Moving Average), Prophet (Taylor and Letham, 2017), ETS (Error, Trend, Seasonality), and MSES (the previous production solution, Cassius et al. (2021)). For ARIMA, Prophet and ETS, we also consider our autoML variants that perform automatic seasonality detection and hyperparameter tuning, as described in §3.2. These are implemented using the merlion.models.automl module. Table 4 and 5 respectively show the performance of each model on the public and internal datasets. Table 6 shows the average improvement achieved by using the autoML module. For ARIMA, we find a clear improvement by using the AutoML module for all datasets. While the improvement is statistically significant for Prophet and AutoETS overall, the actual change is small on most datasets except M4_Hourly and Int_UF2. This is because many of the other datasets don't contain well-defined seasonalities; additionally, Prophet already has     some pre-defined seasonality detection (daily, weekly, and yearly), but these datasets contain time series with hourly seasonalities. While there is no clear winner across all datasets, AutoSarima and AutoETS consistently outperform other methods. The overall performance of AutoSarima is slightly better than AutoETS, but AutoSarima is much slower to train. Therefore, we believe that AutoETS is a good "default" model for new users or early exploration.

Datasets and Evaluation
We collect public and internal datasets (Table 7) and train models on a training split of the data. For some datasets, we resample the data with given granularities. For each time series, we train the models on the training split to predict the first univariate as a target sequence. While we don't re-train the model, we use the evaluation pipeline described in §2.5 to incrementally obtain predictions for the test split using a rolling window. We predict time series values for the next 3 timestamps, while conditioning the prediction on the previous 21 timestamps. We obtain these 3-step predictions at every timestamp in the test split, and evaluate the quality of the prediction using sMAPE where possible, and RMSE otherwise.

Models
The multivariate forecasting models we use are based on the autoregression and tree ensemble algorithms. We compare VAR (Lütkepohl, 2005), GB Forecaster based on the Gradient Boosting algorithm (Ke et al., 2017) and RF Forecaster based on the Random Forest algorithm (Ho, 1995). We discuss the implementation details of these models in §3.1. For the GB Forecster and RF Forecaster, we use our proposed autoregression strategy to enable them to forecast for an arbitrary prediction horizon. Table 8 reports the performance of each model. We find that our proposed autogression-based tree ensemble model GB Forecaster achieves the best results on three of the four datasets and is competitive with the best result on the fourth. While the VAR model shows competitive   performance on some datasets, it is not as robust. For example, the Seattle Trail dataset has large outliers (several orders of magnitude larger than the mean) that dramatically impact the performance of VAR. For this reason, we believe that GB Forecaster is a good "default" model for new users or early exploration.

Datasets and Evaluation
We report results on four public and internal datasets (Table 9). For the internal dataset and the Numenta Anomaly Benchmark (NAB, Lavin and Ahmad (2015)), we choose a single (calibrated) detection threshold for all time series and all algorithms. For the AIOps challenge (aio, 2018), we use the labeled anomalies in the training split of each time series to choose the detection threshold that optimizes F1 on the training split; for the UC Riverside Time Series Anomaly Archive (Dau et al., 2018), we choose the detection threshold that optimizes F1 on the test split. This is because the dataset is incredibly diverse (so a single threshold doesn't apply to all time series), and there are no anomalies present in the training split. Table 9 summarizes these datasets and evaluation choices. We use the evaluation pipeline described in §2.5 to evaluate each model. After training an initial model on the training split of a time series, we re-train the model unsupervised  Table 10: F1 scores achieved by univariate anomaly detection models. All models were evaluated using batch prediction, daily re-training, and hourly re-training; we report the best F1 achieved by any of the re-training schedules. We also report the average gap (over datasets) in F1 between each model and the best model. Best results are in bold.
either daily or hourly on the full data until that point (without adjusting the calibrator or threshold). We then incrementally obtain predicted anomaly scores for the full time series, in a way that simulates a live deployment scenario. We also consider batch prediction, where the initial trained model predicts anomaly scores for the entire test split in a single step, without any re-training. Note that the UCR dataset does not contain timestamps; we treat it as if it is sampled once per minute, but this is an imperfect assumption. We consider only batch prediction and "daily" retraining for this dataset for efficiency reasons.

Models
We evaluate two classes of models: forecast-based anomaly detectors and statistical methods. For forecast-based methods, we use ARIMA, AutoETS, and AutoProphet (as described in §5.1). For statistical methods, we use Isolation Forest (Liu et al., 2008), Random Cut Forest (Guha et al., 2016), and Spectral Residual (Ren et al., 2019), as well as two simple baselines WindStats and ZMS ( §4.1). We also consider an ensemble of AutoETS, RRCF, and ZMS (using the algorithm described in §4.3).

Results
Table 10 reports the revised point-adjusted F1 score achieved by each model on each dataset. We report the best F1 score achieved by any of the 3 re-training schedules (for efficiency reasons, we only consider batch prediction and daily re-training for AutoProphet). We find that our proposed ensemble of AutoETS, RRCF, and ZMS achieves the best performance on two of the four datasets, and the second-best on the others; overall, it has the smallest average gap in F1 score relative to the best model for each dataset (along with the smallest variance in this gap). For this reason, we believe that it is a good "default" model for new users or early exploration. Table 11 examines the impact of the re-training schedule for each model, averaged across all datasets. We find that daily and hourly re-training of forecasting-based models and our   proposed ensemble can greatly improve their anomaly detection performance. However, in practice, the ideal re-training frequency may require some experimentation to choose. Interestingly, the impact of frequent re-training is unclear for most statistical models.

Datasets and Evaluation
The evaluation setting for multivariate anomaly detection is nearly identical to that for univariate anomaly detection. Table 12 describes the multivariate time series anomaly detection datasets in this epxeriment. Note that we treat anomaly detection on all these datasets as a fully unsupervised learning task. The main difference from the univariate setting is that we consider only batch predictions and weekly retraining (rather than batch predictions, daily re-training, and hourly retraining) for efficiency reasons.  Table 13: F1 scores achieved by multivariate anomaly detection models. All models were evaluated using batch prediction and weekly re-training; we report the best F1 achieved by any of the re-training schedules. We also report the average gap (over datasets) in F1 between each model and the best model. Best results are in bold.  Table 14: Average change in F1 (relative to no re-training) achieved by re-training models weekly. p-value is from a 2-sided paired sample t-test. The changes are not statistically significant at p = 0.05 for any models besides DAGMM.

Models
We consider two classes of models: statistical methods and deep learning models. For statistical methods, we evaluate Isolation Forest (Liu et al., 2008) and Random Cut Forest (Guha et al., 2016) as in §5.3. For deep learning approaches, we evaluate an autoencoder (Baldi, 2012), a Deep Autoencoding Gaussian Mixture Model (DAGMM, Zong et al. (2018)), a LSTM encoder-decoder (Sutskever et al., 2014), and a variational autoencoder (Kingma and Welling, 2013). We also consider an ensemble of a Random Cut Forest and a Variational Autoencoder (using the algorithm described in §4.3). Table 13 reports the revised point-adjusted F1 score achieved by each model. While there is no clear winner across all datasets, our proposed ensemble consistently achieves a small gap in F1 score relative to the best model for each dataset. The LSTM encoder-decoder achieves a similar average gap, but it has a larger variance. Therefore, we believe the ensemble to be a good "default" model for new users or early exploration, as it robustly obtains reasonable performance across multiple datasets. Finally, like the univariate case, Table 14 shows that the impact of re-training is ambiguous for all the multivariate statistical models considered (first block), as well as the deep learning models (second block).

Conclusion and Future Work
We introduce Merlion, an open source machine learning library for time series, which is designed to address many of the pain points in today's industry workflows for time series anomaly detection and forecasting. It provides unified, easily extensible interfaces and implementations for a wide range of models and datasets, an autoML module that consistently improves the performance of multiple forecasting models, post-processing rules for anomaly detectors that improve interpretability and reduce the false positive rate, and transparent support for ensembles that robustly achieve good performance on multiple benchmark datasets. These features are tied together in a flexible pipeline that quantitatively evaluates the performance of a model and a visualization module for more qualitative analysis. We continue to actively develop and improve Merlion. Planned future work includes adding support for more models including the latest deep learning models and online learning algorithms, developing a streaming platform to facilitate model deployment in a real production environment, and implementing advanced features for multivariate time series analysis. We welcome and encourage any contributions from the open source community.