MACHINE-LEARNING BASED BEHAVIOR MODELING

1 . A device comprising:

one or more processors configured to:

process a portion of time-series data using a trained encoder network to generate a dimensionally reduced encoding of the portion of the time-series data;

process the dimensionally reduced encoding using a trained decoder network to determine decoder output data; and

set parameters of a predictive machine-learning model based on the decoder output data, wherein the predictive machine-learning model is configured to, based on the parameters, determine a predicted future value of the time-series data.

2 . The device of claim 1 , wherein the one or more processors are further configured to, after setting the parameters of the predictive machine-learning model, provide input data based on the portion of the time-series data as input to the predictive machine-learning model to generate the predicted future value of the time-series data.

3 . The device of claim 1 , wherein the one or more processors are further configured to:

receive a subsequent portion of the time-series data; and

determine, based on a comparison of the predicted future value to a corresponding future value of the subsequent portion of the time-series data, whether a monitored system associated with the time-series data has deviated from a particular operational state.

4 . The device of claim 3 , wherein determining whether the monitored system has deviated from the particular operational state comprises:

determining an error value based on the comparison; and

determining whether the error value satisfies a detection criterion that indicates that the monitored system has deviated from the particular operational state.

5 . The device of claim 3 , wherein the one or more processors are further configured to determine whether to generate an alert based on the comparison.

6 . The device of claim 1 , wherein the predictive machine-learning model includes a neural network, and wherein setting the parameters of the predictive machine-learning model includes setting a link weight of the neural network to a value indicated by the decoder output data.

7 . The device of claim 1 , wherein the trained encoder network, the trained decoder network, and the predictive machine-learning model are trained together based on training data associated with a monitored system.

8 . The device of claim 1 , wherein the one or more processors are further configured to generate an output to a control system based on the predicted future value of the time-series data.

9 . The device of claim 8 , wherein the output includes a control signal to modify operation associated with a monitored system.

10 . The device of claim 8 , wherein the output includes a display including an indication of the predicted future value of the time-series data, an indication of an inferred operating state of a monitored system, or both.

11 . The device of claim 1 , wherein processing the portion of the time-series data using the trained encoder network includes determining a value of a particular latent-space feature based, at least in part, on a probability distribution associated with the particular latent-space feature to generate a value of the dimensionally reduced encoding.

12 . The device of claim 1 , wherein the one or more processors are further configured to:

determine an inferred operating state of a monitored system based on the dimensionally reduced encoding;

based on the inferred operating state, select a behavior model from among a plurality of behavior models associated with the monitored system; and

provide input data based on the time-series data to the behavior model to generate an output indicating whether the monitored system has deviated from the inferred operating state.

13 . The device of claim 12 , wherein determining the inferred operating state of the monitored system includes comparing a location of the dimensionally reduced encoding in a latent space to a location in the latent space associated with a detectable operating state.

14 . The device of claim 13 , wherein the location in the latent space associated with the detectable operating state corresponds to a boundary of a cluster of points representing the detectable operating state or to a representative location of the cluster of points.

15 . The device of claim 13 , wherein comparing the location of the dimensionally reduced encoding to the location in the latent space associated with the detectable operating state comprises determining whether a distance between the location of the dimensionally reduced encoding and the location in the latent space associated with the detectable operating state satisfies a distance threshold.

16 . A method comprising:

processing a portion of time-series data using a trained encoder network to generate a dimensionally reduced encoding of the portion of the time-series data;

processing the dimensionally reduced encoding using a trained decoder network to determine decoder output data; and

setting parameters of a predictive machine-learning model based on the decoder output data, wherein the predictive machine-learning model is configured to, based on the parameters, determine a predicted future value of the time-series data.

17 . The method of claim 16 , further comprising, after setting the parameters of the predictive machine-learning model, providing input data based on the portion of the time-series data as input to the predictive machine-learning model to generate the predicted future value of the time-series data.

18 . The method of claim 16 , further comprising:

receiving a subsequent portion of the time-series data; and

determining, based on a comparison of the predicted future value to a corresponding future value of the subsequent portion of the time-series data, whether a monitored system associated with the time-series data has deviated from a particular operational state.

19 . The method of claim 18 , wherein determining whether the monitored system has deviated from the particular operational state comprises:

determining an error value based on the comparison; and

determining whether the error value satisfies a detection criterion that indicates that the monitored system has deviated from the particular operational state.

20 . The method of claim 18 , further comprising determining whether to generate an alert based on the comparison.

21 . The method of claim 16 , wherein the predictive machine-learning model includes a neural network, and wherein setting the parameters of the predictive machine-learning model includes setting a link weight of the neural network to a value indicated by the decoder output data.

22 . The method of claim 16 , wherein the trained encoder network, the trained decoder network, and the predictive machine-learning model are trained together based on training data associated with a monitored system.

23 . The method of claim 16 , further comprising generating an output to a control system based on the predicted future value of the time-series data.

24 . The method of claim 23 , wherein the output includes a control signal to modify operation associated with a monitored system.

25 . The method of claim 23 , wherein the output includes a display including an indication of the predicted future value of the time-series data, an indication of an inferred operating state of a monitored system, or both.

26 . The method of claim 16 , wherein processing the portion of the time-series data using the trained encoder network includes determining a value of a particular latent-space feature based, at least in part, on a probability distribution associated with the particular latent-space feature to generate a value of the dimensionally reduced encoding.

27 . The method of claim 16 , further comprising:

determining an inferred operating state of a monitored system based on the dimensionally reduced encoding;

based on the inferred operating state, selecting a behavior model from among a plurality of behavior models associated with the monitored system; and

providing input data based on the time-series data to the behavior model to generate an output indicating whether the monitored system has deviated from the inferred operating state.

28 . The method of claim 27 , wherein determining the inferred operating state of the monitored system includes comparing a location of the dimensionally reduced encoding in a latent space to a location in the latent space associated with a detectable operating state.

29 . The method of claim 28 , wherein the location in the latent space associated with the detectable operating state corresponds to a boundary of a cluster of points representing the detectable operating state or to a representative location of the cluster of points.

30 . The method of claim 28 , wherein comparing the location of the dimensionally reduced encoding to the location in the latent space associated with the detectable operating state comprises determining whether a distance between the location of the dimensionally reduced encoding and the location in the latent space associated with the detectable operating state satisfies a distance threshold.

31 . A computer-readable storage device storing instructions that are executable by one or more processors to cause the one or more processors to perform operations comprising:

processing a portion of time-series data using a trained encoder network to generate a dimensionally reduced encoding of the portion of the time-series data;

processing the dimensionally reduced encoding using a trained decoder network to determine decoder output data; and

setting parameters of a predictive machine-learning model based on the decoder output data, wherein the predictive machine-learning model is configured to, based on the parameters, determine a predicted future value of the time-series data.

32 . The computer-readable storage device of claim 31 , wherein the operations further comprise, after setting the parameters of the predictive machine-learning model, providing input data based on the portion of the time-series data as input to the predictive machine-learning model to generate the predicted future value of the time-series data.

33 . The computer-readable storage device of claim 31 , wherein the operations further comprise:

receiving a subsequent portion of the time-series data; and

determining, based on a comparison of the predicted future value to a corresponding future value of the subsequent portion of the time-series data, whether a monitored system associated with the time-series data has deviated from a particular operational state.

34 . The computer-readable storage device of claim 33 , wherein determining whether the monitored system has deviated from the particular operational state comprises:

determining an error value based on the comparison; and

determining whether the error value satisfies a detection criterion that indicates that the monitored system has deviated from the particular operational state.

35 . The computer-readable storage device of claim 33 , wherein the operations further comprise determining whether to generate an alert based on the comparison.

36 . The computer-readable storage device of claim 31 , wherein the predictive machine-learning model includes a neural network, and wherein setting the parameters of the predictive machine-learning model includes setting a link weight of the neural network to a value indicated by the decoder output data.

37 . The computer-readable storage device of claim 31 , wherein the trained encoder network, the trained decoder network, and the predictive machine-learning model are trained together based on training data associated with a monitored system.

38 . The computer-readable storage device of claim 31 , wherein the operations further comprise generating an output to a control system based on the predicted future value of the time-series data.

39 . The computer-readable storage device of claim 38 , wherein the output includes a control signal to modify operation associated with a monitored system.

40 . The computer-readable storage device of claim 38 , wherein the output includes a display including an indication of the predicted future value of the time-series data, an indication of an inferred operating state of a monitored system, or both.

41 . The computer-readable storage device of claim 31 , wherein processing the portion of the time-series data using the trained encoder network includes determining a value of a particular latent-space feature based, at least in part, on a probability distribution associated with the particular latent-space feature to generate a value of the dimensionally reduced encoding.

42 . The computer-readable storage device of claim 31 , wherein the operations further comprise:

determining an inferred operating state of a monitored system based on the dimensionally reduced encoding;

based on the inferred operating state, selecting a behavior model from among a plurality of behavior models associated with the monitored system; and

providing input data based on the time-series data to the behavior model to generate an output indicating whether the monitored system has deviated from the inferred operating state.

43 . The computer-readable storage device of claim 42 , wherein determining the inferred operating state of the monitored system includes comparing a location of the dimensionally reduced encoding in a latent space to a location in the latent space associated with a detectable operating state.

44 . The computer-readable storage device of claim 43 , wherein the location in the latent space associated with the detectable operating state corresponds to a boundary of a cluster of points representing the detectable operating state or to a representative location of the cluster of points.

45 . The computer-readable storage device of claim 43 , wherein comparing the location of the dimensionally reduced encoding to the location in the latent space associated with the detectable operating state comprises determining whether a distance between the location of the dimensionally reduced encoding and the location in the latent space associated with the detectable operating state satisfies a distance threshold.