Extrema-preserved ensemble averaging for ML anomaly detection
Systems, methods, and other embodiments associated with associated with preserving signal extrema for ML model training when ensemble averaging time series signals for ML anomaly detection are described. In one embodiment, a method includes identifying locations and values of extrema in a training signal; ensemble averaging the training signal to produce an averaged training signal; placing the values of the extrema into the averaged training signal at respective locations of the extrema to produce an extrema-preserved averaged training signal; placing the values of the extrema into the averaged training signal at respective locations of the extrema to produce an extrema-preserved averaged training signal; and training a machine learning model using the extrema-preserved averaged training signal to detect anomalies in a signal.
1 . A computer-implemented method, comprising:
storing, in a data structure, locations and values of extrema of a training signal, wherein the extrema are a largest signal value in the training signal and a least signal value in the training signal;
ensemble averaging the training signal to produce an averaged training signal, wherein the extrema are eliminated in the averaged training signal by the ensemble averaging;
placing the values of the extrema back into the averaged training signal at respective locations of the extrema by overwriting averaged values at the respective locations with the respective stored values of the extrema to produce an extrema-preserved averaged training signal; and
training a machine learning model to detect anomalies in a signal without false alarms for values between the extrema and outside a range of the averaged training signal using the extrema-preserved averaged training signal.
2 . The computer-implemented method of claim 1 , wherein placing the values of the extrema into the averaged training signal at the respective locations of the extrema further comprises:
determining an ensemble average window within which one of the extrema appears; and
substituting an ensemble averaged value corresponding to the ensemble average window with the value of the one of the extrema.
3 . The computer-implemented method of claim 1 , wherein the ensemble averaging the training signal further comprises:
selecting a length of an ensemble average window;
determining a number of the ensemble average windows to cover the length of the training signal; and
for the number of ensemble average windows,
averaging the signal values within the ensemble average window to create an averaged signal value,
appending the averaged signal value to the averaged training signal, and
shifting the ensemble average window by the length of the ensemble average window.
4 . The computer-implemented method of claim 1 , further comprising:
ensemble averaging a surveillance signal to produce an averaged surveillance signal; and
monitoring the averaged surveillance signal for anomalies with the trained machine learning model.
5 . The computer-implemented method of claim 4 , further comprising receiving the surveillance signal as a stream of surveillance data arriving from a sensor in a real-time flow, wherein the surveillance signal is ensemble averaged as the surveillance signal arrives.
6 . The computer-implemented method of claim 1 , further comprising:
parsing values of the training signal in a first pass to identify the locations and values of the extrema; and
parsing values of the training signal in a second pass to ensemble average the training signal.
7 . The computer-implemented method of claim 1 , wherein the machine learning model is a multivariate machine learning model.
8 . A non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer cause the computer to:
identify a location and value of one minimum for a training signal and a location and value of one maximum for the training signal, and preserve the minimum value and the maximum value in a storage data structure;
ensemble average the training signal in the training set to produce an averaged training signal, wherein the ensemble averaging eliminates the minimum value and maximum value in the averaged training signal;
place the minimum value back into the averaged training signal by overwriting a first averaged value at the location of the minimum with the minimum value and place the maximum value back into the averaged training signal by overwriting a second averaged value at the location of the maximum with the maximum value to produce an extrema-preserved averaged training signal; and
train a machine learning model to detect anomalies in a signal accurately for values that approach the extrema using with the extrema-preserved averaged training signal.
9 . The non-transitory computer-readable medium of claim 8 , wherein the instructions to place the value of the minimum into the averaged training signal at the location of the minimum and place the value of the maximum into the averaged signal at the location of the maximum further cause the computer to:
determine whether the minimum appears within a first ensemble average window;
substitute a first ensemble averaged value corresponding to the first ensemble average window in which the minimum appears with the value of the minimum;
determine whether the maximum appears within a second ensemble average window; and
substitute a second ensemble averaged value corresponding to the second ensemble average window in which the maximum appears with the value of the maximum.
10 . The non-transitory computer-readable medium of claim 8 , wherein the instructions to ensemble average the signal further cause the computer to:
select a length of an ensemble average window; and
for a number of ensemble average windows of the length that covers the training signal,
average the values of the training signal within the window to create an averaged signal value,
append the averaged signal value to the averaged training signal, and
shift the window by the length.
11 . The non-transitory computer-readable medium of claim 8 , wherein the instructions further cause the computer to:
ensemble average a surveillance signal to produce an averaged surveillance signal; and
monitor the averaged surveillance signal for anomalies with the trained machine learning model.
12 . The non-transitory computer-readable medium of claim 11 , wherein the instructions further cause the computer to receive the surveillance signal as a stream of surveillance data arriving from a sensor in a real-time flow, wherein the surveillance signal is ensemble averaged as the surveillance signal arrives.
13 . The non-transitory computer-readable medium of claim 8 , wherein the instructions further cause the computer to:
parse values of the training signal in a first pass to identify the location and value of the minimum and the location and value of the maximum; and
parse values of the training signal in a second pass to ensemble average the training signal.
14 . The non-transitory computer-readable medium of claim 8 , wherein the machine learning model is a multivariate state estimation technique model.
15 . A computing system, comprising:
at least one processor;
at least one memory operably connected to the processor; and
a non-transitory computer readable medium including instructions stored thereon that when executed by at least the processor cause the computing system to:
identify locations and values of extrema in a training signal, and preserve the extrema values in a storage data structure, wherein the extrema are one maximum over the entire training signal and one minimum over the entire training signal;
average the training signal to produce an averaged training signal, wherein the averaging eliminates the extrema values in the averaged training signal;
generate an extrema-preserved averaged training signal by placing the preserved values of the extrema back into the averaged training signal at respective locations of the extrema by replacing averaged values at the respective locations with the respective extrema values from the storage data structure;
train a machine learning model to detect anomalies in a signal accurately for values that approach the extrema using the extrema-preserved averaged training signal; and
detect anomalies in other averaged signals using the trained machine learning model.
16 . The computing system of claim 15 , wherein the instructions to place the values of the extrema into the averaged training signal at respective locations of the extrema further cause the computing system to:
determine whether one extreme of the extrema appears within an average window;
substitute an ensemble averaged value for the average window in which the extreme appears with the value of the one extreme.
17 . The computing system of claim 15 , wherein the instructions to average the training signal further cause the computing system to:
select a length of an average window;
average the values of the training signal within the average window to create an averaged signal value;
append the averaged signal value to the averaged training signal; and
shift the average window by the length.
18 . The computing system of claim 15 , wherein the instructions to detect anomalies in other averaged signals further cause the computing system to:
average a surveillance signal to produce an averaged surveillance signal;
monitor the averaged surveillance signal for anomalies with the trained machine learning model by predicting values for the averaged surveillance signal and comparing the predicted values to actual values of the averaged surveillance signal; and
detect an anomaly in the averaged surveillance signal that indicates that an anomaly is present in the surveillance signal; wherein the anomaly in the averaged signal is detected based on a difference between the predicted values and the actual values.
19 . The computing system of claim 18 , wherein the instructions further cause the computing system to receive the surveillance signal as a stream of surveillance data arriving from a sensor in a real-time flow, wherein the surveillance signal is averaged as the surveillance signal arrives.
20 . The computing system of claim 15 , wherein the instructions further cause the computing system to:
parse values of the training signal in a first pass to identify the locations and values of the extrema; and
parse values of the training signal in a second pass to average the training signal.