## Moving Average

The moving average algorithm predicts the value for the next time step based on an average of the values in the last W time steps, where W is the window size.

More precisely, a moving average algorithm predicts the following:

In order to compute the alarm level for the moving average algorithm, we first fit a Gaussian distribution to the counts from the recent W days. We estimate the mean and standard deviation for this Gaussian from the W observations within the window using Eqs. 1 and 2. We then calculate the alarm level using the cumulative distribution function of this fitted Gaussian as in Eq. 4.

On the physician data, moving average avoids both the problems of control charts and the problems of comparison against yesterday. Figure 14.10 shows the algorithm nicely mimicking the human eye, and signaling surprise on the Monday with the large rise. Notice how the upper limit is much lower than in the control chart approach of Figures 14.6 and 14.7.This reduction is because the estimate of o (the standard deviation) is now based only on recent data, instead of all data throughout history, and the recent data does not contain the variation caused by seasonality. As a result, the Monday jump is well above the upper limit, leading to a strong alert signal. It is interesting to note that although the ramp outbreak gets more substantial after Monday, the alarm strength begins to decrease (indicated by the drop of the bars on the top right). This phenomenon reveals a weakness of this and several other methods: the predictions (the "predict'' line) become accustomed to increased counts during an outbreak. Since expected counts are higher, so is the upper limit and alarms become less substantial. This problem is a prime motivation for the CUSUM approach in the next section.

Figure 14.11 shows moving average in action over the entire three-year period. It shows how the baseline nicely follows the recent average of the data, and so the upper limit adapts to seasonal variation. As a result, over the entire three-year period, by far the largest alarm level occurs during the simulated outbreak.

Bars show alarm levels; max = 10