Scalable and bottom-up approach to automated anomaly detection

1. A method comprising:

receiving, using one or more processors, first sensor data from a first plurality of sensors, the first plurality of sensors associated with a first asset at a first time;

receiving, using the one or more processors, second sensor data from the first plurality of sensors, the second sensor data associated with the first asset at a second time;

generating, using the one or more processors, a first asset state space associated with the first asset at the first time;

generating, using the one or more processors, a second asset state space associated with the first asset at the second time;

determining, based on the first asset state space associated with the first asset, the second asset state space associated with the first asset, and a third asset state space associated with a second asset, one or more asset-level behavioral groups including a first group of one or more assets; and

training, using the one or more processors, a base model particular to the first group of one or more assets, the first group of one or more assets including the first asset.

2. The method of claim 1 further comprising:

training, using the one or more processors and the base model, a final model particular to the first asset.

3. The method of claim 1 , wherein the first asset state space associated with the first asset embeds information about one or more sub-components of the first as set.

4. The method of claim 1 , wherein the first asset state space associated with the first asset includes a string generated by concatenating, for each sensor in the first plurality of sensors, one or more of:

a sensor identifier,

a sensor group identifier,

a sensor stage, and

whether anomalous behavior was detected in that sensor's data at the first time.

5. The method of claim 4 further comprising:

determining a set of sensors that have a strong correlation and covariance with one another; and

assigning the set of sensors to a first group of sensors.

6. The method of claim 4 further comprising:

determining a set of sensor stages using change point detection; and

assigning the first sensor data to a first sensor stage.

7. The method of claim 6 further comprising:

smoothing the sensor data before applying change point detection to determine the set of sensor stages; and

merging similar stages to reduce a number of sensor stages in the set of sensor stages.

8. The method of claim 1 , wherein determining the one or more asset-level behavioral groups includes:

calculating one or more distance measures between candidate assets, wherein the candidate assets include the first and second asset; and

minimizing the one or more distance measures.

9. The method of claim 1 , wherein determining the one or more asset-level behavioral groups includes determining those assets that have a strong correlation and covariance with each other and grouping those assets together.

10. The method of claim 1 further comprising:

identifying, based on asset state space information, a rare asset state, wherein the asset state space information includes a plurality of asset state spaces associated with one or more assets.

11. A system comprising:

one or more processors; and

a memory storing instructions, that when executed by the one or more processors, cause the system to:

receive first sensor data from a first plurality of sensors, the first plurality of sensors associated with a first asset at a first time;

receive second sensor data from the first plurality of sensors, the second sensor data associated with the first asset at a second time;

generate a first asset state space associated with the first asset at the first time;

generate a second asset state space associated with the first asset at the second time;

determine, based on the first asset state space associated with the first asset, the second asset state space associated with the first asset, and a third asset state space associated with a second asset, one or more asset-level behavioral groups including a first group of one or more assets; and

train a base model particular to the first group of one or more assets, the first group of one or more assets including the first asset.

12. The system of claim 11 , wherein the instructions, when executed further cause the system to:

train, using the base model, a final model particular to the first asset.

13. The system of claim 11 , wherein the first asset state space associated with the first asset embeds information about one or more sub-components of the first as set.

14. The system of claim 11 , wherein the first asset state space associated with the first asset includes a string generated by concatenating, for each sensor in the first plurality of sensors, one or more of:

a sensor identifier,

a sensor group identifier,

a sensor stage, and

whether anomalous behavior was detected in that sensor's data at the first time.

15. The system of claim 14 , wherein the instructions, when executed further cause the system to:

determine a set of sensors that have a strong correlation and covariance with one another; and

assign the set of sensors to a first group of sensors.

16. The system of claim 14 , wherein the instructions, when executed further cause the system to:

determine a set of sensor stages using change point detection; and

assign the first sensor data to a first sensor stage.

17. The system of claim 16 , wherein the instructions, when executed further cause the system to:

smooth the sensor data before applying change point detection to determine the set of sensor stages; and

merge similar stages to reduce a number of sensor stages in the set of sensor stages.

18. The system of claim 11 , wherein determining the one or more asset-level behavioral groups includes:

calculating one or more distance measures between candidate assets, wherein the candidate assets include the first and second asset; and

minimizing the one or more distance measures.

19. The system of claim 11 , wherein determining the one or more asset-level behavioral groups includes determining those assets that have a strong correlation and covariance with each other and grouping those assets together.

20. The system of claim 11 , wherein the instructions, when executed further cause the system to:

identify, based on asset state space information, a rare asset state, wherein the asset state space information includes a plurality of asset state spaces associated with one or more assets.