Detecting anomalies in sensor events is a requirement for a wide variety of use cases in the industrial IoT. Examples include predicting failures of HVAC systems and elevators for property management to identifying potential signals of malfunction in aircraft engines to schedule preventive maintenance. Unlike prediction models for customer churn, inventory forecasts, etc. that rely on multiple sources of data and a wide range of domain-specific parameters, it is possible to detect anomalies for many types of time-series data using statistical techniques alone. In this presentation, we will discuss the types of anomalies and some available models for anomaly detection.

1. Anomaly Detection for
Preventive Maintenance
Founder & CEO
Shanti Subramanyam
Orzota, Inc.
1

2. Agenda
§Preventive Maintenance
§Anomaly Detection
§Definition and Types
§Complexities
§Algorithms
2

3. Preventive Maintenance Definition
• Preventive Maintenance is Maintenance performed
specifically to prevent faults from occurring
• Parts Adjustments
• Parts Cleaning
• Parts Replacement
• Can be achieved through
• Planned Maintenance
• Recognizing Anomalous Behaviors

4. Anomaly Detection Definition
Anomaly Detection is the identification of events that do not
conform to the expected pattern

5. Domain Example Use Case
IT Operations Detect heavy load to keep systems running smoothly
Security
Detect network breach attempts, fraudulent
transactions
Health Care Detect anomalies in heart beats
Industrial Detect imminent machine and part failures
Anomaly Detection Uses Cases

6. Anomaly Types

7. Types of Anomalies
§Point Anomalies
§Contextual Anomalies
§Collective Anomalies
§Local and Global Anomalies
7

8. Point Anomaly
If an individual data instance can be considered as anomalous with
respect to the rest of the data, the instance is a point anomaly
8

9. Contextual Anomaly
If an individual data instance is anomalous in a specific context
then it is a contextual or temporal anomaly
9

10. Collective Anomaly
If an collection of related data instances is anomalous with respect
to the rest of the data, it is termed a collective anomaly
10

11. Local and Global Anomaly
11

12. Local and Global Anomaly
If an anomaly occurs within a seasonal pattern is termed a
local anomaly
12

13. Anomaly Detection: Challenges

14. Anomaly Detection Challenges
§Concept Drift
§ Behavior change - Requires continuous learning
14

15. Anomaly Detection Challenges
§Early Detection
§ Can’t wait for metric
to go out of bounds
§ Requires detection of
subtle variations
15

16. Anomaly Detection Modes
§Batch Mode
§ Suitable where degradation is graceful and/or takes time
§Real-time / Streaming Mode
§ Required for use cases where anomaly is very close to failure point
§ Must learn continuously without need to store the data
§ Determine if xt is anomalous before processing xt+1
16

17. Anomaly Detection Requirements
§Adapt to Concept Drift
§Detect Anomalies as early as possible
§Requires little or no Parameter Tuning
§Minimizes
§False Positives – Can cause disruption and degradation in
productivity
§False Negatives – Will lead to failures and expensive repairs
17

18. Anomaly Detection: Techniques

19. Supervised AD
19

20. Semi-supervised AD
§ Training Data contains only “normal” events without anomalies
§ Model “learns” what is “normal” so it can detect anomalies
§ One-class SVMs, Auto-Encoders
§ LSTM and Density Estimation Models - beware the Gaussian!
20

21. Unsupervised AD
21
Source: http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0152173#sec008

22. Unsupervised Techniques
§ Outlier Detection
§ Exponential Smoothing, ARIMA, Generalized ESD
§ Local Anomaly Detection
§ LOF, COF, INFLO, LoOP - Nearest Neighbor based algorithms
§ Global Anomaly Detection
§ kNNs – most perform well even on local anomalies
§ Hybrid Algorithms
§ Example: Twitter’s S-H-ESD (Seasonal Hybrid ESD) handles anomalies in local/global on TS data that has both
seasonality and trends
22

23. AD Implementations
§ Forecast package in R
§ ARIMA, Tsoutliers – outlier detection and correction
§ DMwR package in R: lofactor (LOF)
§ AnomalyDetection in R – Twitter’s AD
§ Anomalize package in R - Scalable version of Twitter’s AD
§ RapidMiner Anomaly Detection Extension
§ LOF, COF, INFLO, LoOP, CBLOF, HBOS
§ NAB – implementations of several algorithms
23

24. Algorithm Evaluation
§Choose algorithm based on requirements
§Local/Global, batch/streaming, performance
§Benchmark, Tune, Rinse, Repeat
§NAB For Streaming AD Evaluation
§Benchmark lets you plug in different algorithms and data
24

25. Anomaly Detection: Results

26. Test Data
26

27. Knn-CAD
27

28. Numenta HTM
28

29. Relative Entropy
29

30. Twitter AdVec
31

31. Detecting Concept Drift
32

32. Detecting Temporal Anomalies
33

33. Conclusion
• Preventive Maintenance can reduce cost of maintenance
significantly
• Anomaly Detection is key to Preventive Maintenance
• Choose AD technique based on:
• Use Case
• Typical Time Series Pattern
• Performance Requirement