Method and system for unsupervised anomaly detection and accountability with majority voting for high-dimensional sensor data
One embodiment can provide a system for detecting anomaly for high-dimensional sensor data associated with one or more machines. During operation, the system can obtain sensor data from a set of sensor associated with one or machines, apply data exploration techniques on the sensor data to automatically process sensor data to identify a subset of feature sensors from the available set of feature sensors, apply an unsupervised machine-learning technique to the identified subset of feature sensors and the target sensor to learn a set of pair-wise univariate models, and determine whether and how an anomaly occurs in the operation of the one or more machines based on the set of pair-wise univariate models.
1. A method for detecting an anomaly in operation of a machine, the method comprising:
recording, via a set of sensors associated with the machine, to obtain sensor data associated with the machine while the machine is operating, wherein the set of sensors include a target sensor and a set of feature sensors;
storing the sensor data in computing device;
performing data exploration on the stored sensor data including repairing missing values and ranking the set of feature sensors, wherein the data exploration comprises one or more of:
improving quality of the sensor data;
identifying a subset of feature sensors from the set of feature sensors that are relevant for subsequent processing; and
reducing amount of sensor data and hence computational cost involved in the subsequent processing;
performing, based on the identified subset of feature sensors and the target sensor, unsupervised machine-learning to build a set of pair-wise univariate models; and
determining whether and how an anomaly occurs in the operation of the machine based on the set of pair-wise univariate models.
2. The method of claim 1 , wherein performing data exploration on the stored sensor data further comprises one or more of:
applying a data pre-processing technique;
applying a data cleansing technique; and
applying a feature engineering technique.
3. The method of claim 2 , wherein applying the data cleansing technique comprises:
replacing missing values in the sensor data by linear interpolation, when an amount of the missing values during a recording period of target sensor data is less than a threshold value; and
dropping missing values in the sensor data, when the amount of missing values during the recording period of the target sensor data is more than the threshold value.
4. The method of claim 2 , wherein applying the feature engineering technique comprises:
adjusting a set of time delay between a set of feature sensors and target sensor data;
computing a correlation between the delay adjusted set of feature sensors and the target sensor; ranking the set of feature sensors based on their correlation values; and
selecting a subset of feature sensors from the ranked set of feature sensors.
5. The method of claim 1 , wherein each pair-wise univariate anomaly model from the set of pair-wise univariate anomaly models is associated with a feature sensor from the subset of feature sensors and a target sensor.
6. The method of claim 1 , wherein performing, based on the identified subset of feature sensors and the target feature sensor, unsupervised machine-learning to build the set of pair-wise univariate models comprises:
determining a set of regression coefficients for measuring a fitness of the set of pair-wise univariate anomaly models;
using the set of regression coefficients to compute a set of anomaly distances between the subset of feature sensors and the target sensor; and
training, based on the set of anomaly distances, a set of Gaussian Mixture Models by expectation-maximization to determine a set of voting scores.
7. The method of claim 1 , wherein performing, based on the identified subset of feature sensors and the target feature sensor, unsupervised machine-learning to build the set of pair-wise univariate models further comprises:
computing a set of voting scores associated with the set of pair-wise univariate anomaly models by applying a set clustering functions to a set of anomaly distances;
computing a set of weights for the set of voting scores;
combining the set of weights and the set of voting scores to detect the anomaly; and
computing each feature sensors' accountability for a detected anomaly event.
8. An apparatus for detecting an anomaly in operation of a machine, comprising:
one or more processors;
a set of sensors embedded in the one or more machines; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
recording, via a set of sensors associated with the machine, to obtain sensor data associated with the machine while the machine is operating, wherein the set of sensors include a target sensor and a set of feature sensors;
store the sensor data in the computing device;
perform data exploration on the stored sensor data including repairing missing values and ranking the set of feature sensors, wherein the data exploration comprises one or more of:
improving quality of the sensor data;
identifying a subset of feature sensors from the set of feature sensors that are relevant for subsequent processing; and
reducing amount of sensor data and hence computational cost involved in the subsequent processing;
perform, based on the identified subset of feature sensors and the target sensor, unsupervised machine-learning to build a set of pair-wise univariate models; and
determine whether and how an anomaly occurs in the operation of the machine based on the set of pair-wise univariate models.
9. The apparatus of claim 8 , wherein performing data exploration on the stored sensor data further comprises one or more of:
applying a data pre-processing technique;
applying a data cleansing technique; and
applying a feature engineering technique.
10. The apparatus of claim 9 , wherein applying the data cleansing technique comprises:
replacing missing values in the sensor data by linear interpolation, when an amount of the missing values during a recording period of target sensor data is less than a threshold value; and
dropping missing values in the sensor data, when the amount of missing values during the recording period of the target sensor data is more than the threshold value.
11. The apparatus of claim 9 , wherein applying the feature engineering technique comprises:
adjusting a set of time delay between a set of feature sensors and target sensor data;
computing a correlation between the delay adjusted set of feature sensors and the target sensor;
ranking the set of feature sensors based on their correlation values; and
selecting a subset of feature sensors from the ranked set of feature sensors.
12. The apparatus of claim 8 , wherein each pair-wise univariate anomaly model from the set of pair-wise univariate anomaly models is associated with a feature sensor from the subset of feature sensors and a target sensor.
13. The apparatus of claim 8 , wherein performing based on the identified subset of feature sensors and the target feature sensor, unsupervised machine-learning to build the set of pair-wise univariate models comprises:
determining a set of regression coefficients for measuring a fitness of the set of pair-wise univariate anomaly models;
using the set of regression coefficients to compute a set of anomaly distances between the subset of feature sensors and the target sensor; and
training, based on the set of anomaly distances, a set of Gaussian Mixture Models by expectation-maximization to determine a set of voting scores.
14. The apparatus of claim 8 , wherein performing, based on the identified subset of feature sensors and the target feature sensor, unsupervised machine-learning to build the set of pair-wise univariate models further comprises:
computing a set of voting scores associated with the set of pair-wise univariate anomaly models by applying a set clustering functions to thea set of anomaly distances;
computing a set of weights for the set of voting scores;
combining the set of weights and the set of voting scores to detect the anomaly; and
computing each feature sensors' accountability for a detected anomaly event.
15. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for detecting an anomaly in operation of a machine, the method comprising:
recording, via a set of sensors associated with the machine, to obtain sensor data associated with the machine, wherein the set of sensors include a target sensor and a set of feature sensors;
storing the sensor data in the computing device;
performing data exploration on the stored sensor data including repairing missing values and ranking the set of feature sensors, wherein the data exploration comprises one or more of:
improving quality of the sensor data;
identifying a subset of feature sensors from the set of feature sensors that are relevant for subsequent processing; and
reducing amount of sensor data and hence computational cost involved in the subsequent processing;
performing, based on the identified subset of feature sensors and the target sensor, unsupervised machine-learning to build a set of pair-wise univariate models; and
determining whether and how an anomaly occurs in the operation of the machine based on the set of pair-wise univariate models.
16. The non-transitory computer-readable storage medium of claim 15 , wherein performing data exploration on the stored sensor data further comprise one or more of:
applying a data pre-processing technique;
applying a data cleansing technique; and
applying a feature engineering technique.
17. The non-transitory computer-readable storage medium of claim 16 , wherein applying the feature engineering technique comprises:
adjusting a set of time delays between a set of feature sensors and target sensor data;
computing a correlation between the delay adjusted set of feature sensors and the target sensor;
ranking the set of feature sensors based on their correlation values; and
selecting a subset of feature sensors from the ranked set of feature sensors.
18. The non-transitory computer-readable storage medium of claim 15 , wherein each pair-wise univariate anomaly model from the set of pair-wise univariate anomaly models is associated with a feature sensor from the subset of feature sensors and a target sensor.
19. The non-transitory computer-readable storage medium of claim 15 , wherein performing, based on the identified subset of feature sensors and the target feature sensor, unsupervised machine-learning technique to build the set of pair-wise univariate models comprises:
determining a set of regression coefficients for measuring a fitness of the set of pair-wise univariate anomaly models;
using the set of regression coefficients to compute a set of anomaly distances between the subset of feature sensors and the target sensor; and
training, based on the set of anomaly distances, a set of Gaussian Mixture Models by expectation-maximization to determine a set of voting scores.
20. The non-transitory computer-readable storage medium of claim 15 , wherein performing, based on the identified subset of feature sensors and the target feature sensor, the unsupervised machine-learning technique to build the set of pair-wise univariate models further comprises:
computing a set of voting scores associated with the set of pair-wise univariate anomaly models by applying a set clustering functions to a set of anomaly distances;
computing a set of weights for the set of voting scores;
combining the set of weights and the set of voting scores to detect the anomaly; and
computing each feature sensors' accountability for a detected anomaly event.