Anomaly detection based on normal behavior modeling

1 . A method of behavior monitoring, the method comprising:

determining, by one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset;

determining one or more residual values based on a comparison of a predicted data sample of the output data to a corresponding input data value of input data;

selectively masking out at least one residual value of the one or more residual values to generate masked residual data, wherein the at least one residual value is masked out responsive to the corresponding input data value being generated by a particular pre-processing operation;

determining a risk score based on the masked residual data;

determining feature importance data based on the output data; and

determining whether to generate an alert based on the risk score and the feature importance data.

2 . The method of claim 1 , wherein the output data is determined based on input data including or based on sensor data from one or more sensors associated with the monitored asset.

3 . The method of claim 1 , wherein the one or more trained behavior models are configured to generate one or more predicted values based on sensor data from one or more sensors associated with the monitored asset.

4 . The method of claim 3 , wherein the one or more residual values are based on the one or more predicted values and sensor data.

5 . The method of claim 1 , further comprising:

obtaining sensor data for one or more sensors associated with the monitored asset, wherein the sensor data includes multiple time series of data samples, each time series representing output of a single sensor; and

performing one or more preprocessing operations to generate, based on the sensor data, input data for the one or more trained behavior models, wherein the one or more trained behavior models determine the output data based on the input data, the one or more preprocessing operations including the particular pre-processing operation.

6 . The method of claim 5 , wherein the masked residual data includes at least one second residual value associated with a second particular preprocessing operation distinct from the particular pre- processing operation.

7 . The method of claim 1 , wherein the at least one residual value is selectively masked out further based on a user configuration setting associated with a tolerance for false positive alerts.

8 . The method of claim 5 , wherein the one or more preprocessing operations includes one or more of: removing outlying data samples; removing data associated with particular events; denoising, imputation of one or more values; resampling data values;

scaling data values; normalizing data values; determining one or more data values based on one or more other data values; or performing one or more domain transformations.

9 . The method of claim 1 , further comprising:

concatenating the risk score for a particular feature and time step and the feature importance data for the particular feature and time step to generate concatenated data; and

providing the concatenated data as input to an alert generation model to determine whether to generate the alert.

10 . The method of claim 9 , further comprising, performing, by the alert generation model, a sequential probability ratio test based on a set of anomaly scores and a set of reference anomaly scores, wherein an anomaly score of the set of anomaly scores includes the concatenated data.

11 . The method of claim 1 , further comprising, responsive to a determination to generate the alert generating, outputting an alert indication that includes the feature importance data.

12 . The method of claim 1 , wherein the one or more trained behavior models include one or more dimensional reduction models, one or more autoencoders, one or more time series predictors, one or more feature predictors, or a combination thereof.

13 . The method of claim 1 , further comprising:

obtaining sensor data for one or more sensors associated with the monitored asset, wherein the sensor data indicate measurements of one or more physical characteristics, one or more electromagnetic characteristics, one or more radiologic characteristics, or a combination thereof, of the monitored asset; and

providing input data based on the sensor data as input to the one or more trained behavior models, wherein the one or more trained behavior models determine the output data based on the input data.

14 . A computing device comprising:

one or more memory devices storing instructions and one or more trained behavior models associated with a monitored asset; and

one or more processors configured to execute the instructions to perform operations comprising:

determining, using the one or more trained behavior models, output data indicative of operation of the monitored asset;

determining one or more residual values based on a comparison of a predicted data sample of the output data to a corresponding input data value of input data;

selectively masking out at least one residual value of the one or more residual values to generate masked residual data, wherein the at least one residual value is masked out responsive to the corresponding input data value being generated by a particular pre-processing operation;

determining a risk score based on the masked residual data;

determining feature importance data based on the output data; and

determining whether to generate an alert based on the risk score and the feature importance data.

15 . The computing device of claim 14 , wherein the operations further comprise:

obtaining sensor data for one or more sensors associated with the monitored asset, wherein the sensor data includes multiple time series of data samples, each time series representing output of a single sensor; and

performing one or more preprocessing operations to generate, based on the sensor data, input data for the one or more trained behavior models, wherein the one or more trained behavior models determine the output data based on the input data, the one or more pre-processing operations including the particular preprocessing operation.

16 . The computing device of claim 15 , wherein the at least one residual value is selectively masked out based on a user configuration setting associated with a tolerance for false positive alerts.

17 . A computer-readable storage device storing instructions that are executable by one or more processors to cause the one or more processors to:

determine, using one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset;

determine a risk score based on the output data;

determine feature importance data based on the output data, wherein the feature importance data comprises a plurality of feature importance values, and wherein each feature importance value corresponds to a different feature of the output data; and

determine whether to generate an alert based on the risk score and the feature importance data.

18 . The computer-readable storage device of claim 17 , wherein the feature importance data indicates a relative importance of each particular feature of the output data.

19 . The computer-readable storage device of claim 17 , wherein the feature importance data indicates a ranking of the corresponding features of the output data.

20 . The computer-readable storage device of claim 17 , wherein the feature importance data comprises a feature match score, the feature match score based on a difference between feature importance determined based on the output data and expected feature importance associated with the operation of the monitored asset.