Path Models for Time Series Anomaly Detection

1
Path Models for Time Series Anomaly Detection

• Matt Mahoney

2
Problem How to Detect Anomalies in Time Series
Data

• Normal Marotta Fuel Valve Solenoid Current (Used
  on Space Shuttle)

• Abnormal (poppet partially blocked)

3
Manual Rule Specification

• Identify features (zero crossings, peaks)
• Specify correct behavior using SCL rules

4
Automatic Rule Generation(Stan Salvador)

• Segment training data (GECKO)
• Rule induction (RIPPER) to map data points to
  segments
• Create linear state machine table in SCL

5
Problem State Machine May Underconstrain Model
Training Segment 1 x 0, dx 0 Segment 2 0 lt
x lt 1, dx 1
Test Segment 1 x 0, dx 0 Segment 2 0 lt x lt
1, dx 3
dx gt 0.5
State 1
State 2
Accept
6
Derivative Path Model Algorithm

• Compute first and second derivative of each
  training point
• Store points in 3-D (x, dx, d2x) space
• Scale to unit cube (max min 1)
• Compute first and second derivative of each test
  point
• Anomaly score d2, d distance to closest
  training point

7
Derivative Path Model
dx
Test Path (d2 4)
3
2
Training Path (scaled to unit cube)
1
x
1 2 3
8
Derivative Path Example
Training Training Normal Too steep
Too low
dx
d2x
x
Anomaly Score
9
Filter Path Model Algorithm

• As before, but replace derivatives with low pass
  (LP) filters with time constant T
• LP(xt) (1 1/T)LP(xt-1) xt/T

10
Filtered Path Model
Delayed x
1
Training Path
Test Path
x
1
11
Filter Path Example
T 100
T 20
Anomaly Score
Training (2000 samples) Test -------gt
12
Experimental Data

• TEK 0-17 Marotta Valve Solenoid Current 12 x
  1000 x 1 ms
• TEK 0 Training
• TEK 1 Control (normal)
• TEK 2-3, 10-17 Various forced failures
• Voltage Test 1 7 x 2000 x 1 ms (110
  undersampled Hall effect sensor current)
• 1 training, 2 normal (32 V), 1 hot (70 C), 1 low
  voltage (30V), 2 poppet partially blocked (4.5
  and 9 mils)
• Battery 20 x 1000 (simulated), battery 1
  voltage
• 10 training (various noise added)
• 6 abnormal (high or low voltage, some with noise)
• 4 normal (some with noise)

13
Experimental Setup3 models
Derivative Model
Diff
Diff
T5
T5
T5
T5
Filtered, short delay
T5
T5
T10
T20
Filtered, long delay
T20
T100
14
TEK Anomaly Scores0 training, 1 normal
15
TEK Results, Derivative Model
TEK 0 TEK 1 TEK 10 TEK 11
TEK 12 (Training) (Normal)
16
TEK Results, Filter, Short Delay
TEK 0 TEK 1 TEK 10 TEK 11
TEK 12 (Training) (Normal)
17
Voltage Test 1 Anomaly ScoresNor normal
18
Voltage Test 1 DetailsHot, 30V removed
19
Voltage Test 1, Derivative Model
Training (32 V) 9 mil block
30 V
20
Battery Test Anomaly ScoresH high voltage, L
low, N normal
21
Battery Test DetailsH removed
22
Battery Test, Derivative Model
Training
H N H L N H N H L N No noise
Noise No noise
Noise
23
Summary

• Path modeling compares test point features to
  training data
• Features may be derivatives or filtered data
• Numeric anomaly score (user threshold)
• Constrains all data in all directions
• Straightforward extension to more dimensions
  (either features or inputs)

24
Limitations

• No long term state
• But filters provide a short term state
• No concise (SCL) representation
• Point set could have piecewise polynomial
  approximation
• O(n2) test speed
• Must compare each test point with all training
  points
• Could be faster with piecewise model
• Does not generalize to unseen data
• Considers all dimensions equally important

25
Future Work

• Replace point list with piecewise linear model
• Segment path with Gecko or similar
• SCL function to compute distance
• Extend to multiple dimensions/features
• Variable delay filters to add state
• May worsen generalization, too many irrelevant
  dimensions
• Tube model to improve generalization
• Initial training data defines path
• Additional training stretches tube (scaling
  matrix) around path to fit

26
More information

• Open source implementation of path modeling
  (tsad1.cpp, tsad3.cpp)
• Technical report of this presentation
• http//cs.fit.edu/mmahoney/nasa/