Multivariate Anomaly Detection

Unlike univariate thresholding, multivariate detection captures inter-variable dependencies that define normal operating states. When pressure and temperature rise together within individual limits, a univariate system sees normalcy—but a multivariate model recognizes the correlated deviation as an anomaly.

• Uses covariance matrices to model linear relationships
• Employs autoencoders and variational autoencoders for non-linear dependencies
• Detects contextual anomalies where values are normal individually but abnormal jointly
• Critical for processes where variables exhibit multicollinearity

High-dimensional sensor data from modern factories creates the curse of dimensionality, where distance-based anomaly scores become meaningless. Multivariate systems apply dimensionality reduction to project data into lower-dimensional latent spaces where anomalies become separable.

• Principal Component Analysis (PCA) projects data onto orthogonal components ranked by variance
• t-SNE and UMAP preserve local neighborhood structures for visualization
• Autoencoder bottleneck layers learn compressed representations
• Reconstruction error in the original space serves as an anomaly score

Anomaly detection operates by comparing observed behavior against a learned model of normality. The residual—the difference between predicted and actual values—becomes the primary anomaly signal. Large residuals across multiple variables indicate a departure from the golden batch profile.

• Mahalanobis distance measures deviation accounting for variable covariance
• Reconstruction error from autoencoders quantifies how poorly a sample fits the learned manifold
• Log-likelihood scores from Gaussian Mixture Models assess probability under the normal distribution
• Dynamic thresholds adapt to process drift to reduce false positives

Manufacturing anomalies often manifest as deviations in temporal patterns rather than instantaneous value excursions. Multivariate systems incorporate time-series architectures to model expected trajectories and detect subtle drifts in process dynamics.

• Long Short-Term Memory (LSTM) networks capture long-range temporal dependencies
• Transformer-based architectures with self-attention model complex sequence interactions
• Dynamic Time Warping (DTW) aligns and compares process trajectories of varying speeds
• Enables detection of slowly developing faults before threshold violations occur

Detecting an anomaly is insufficient—operators need to know which variable or subsystem triggered the alert. Advanced multivariate systems incorporate explainability mechanisms to isolate contributing factors and accelerate root cause analysis.

• SHAP (SHapley Additive exPlanations) values decompose anomaly scores across input features
• Attention weights from transformer models highlight influential time steps and variables
• Reconstruction error per variable from autoencoders pinpoints offending sensors
• Enables direct integration with Corrective Action/Preventive Action (CAPA) workflows

Manufacturing processes evolve due to tool wear, material lot changes, and seasonal conditions. Static models degrade over time, generating false positive alerts. Production-grade multivariate systems incorporate mechanisms to adapt without full retraining.

• Exponential moving average updates to statistical models accommodate gradual drift
• Sliding window retraining maintains relevance on recent operational data
• Ensemble methods combine stable long-term models with adaptive short-term models
• Change point detection algorithms distinguish between normal drift and genuine anomalies

The critical distinction between monitoring a single variable and a correlated system. Univariate methods use individual thresholds (e.g., temperature > 80°C), which fail to detect subtle faults where variables drift together within acceptable limits. Multivariate techniques model the covariance structure, identifying a broken correlation between pressure and flow rate as an anomaly even if both readings are individually normal. This is essential for detecting incipient failures in complex machinery.

A foundational dimensionality reduction technique for anomaly detection. PCA transforms correlated process variables into a set of linearly uncorrelated principal components. The first few components capture normal operating variance. Anomalies are detected by monitoring the Q-statistic (squared prediction error) and Hotelling's T² metric. A high Q-statistic indicates a breakdown in the normal correlation structure, flagging a novel fault pattern not seen in training data.

A multivariate distance metric that measures how many standard deviations a point is from the mean of a distribution, accounting for covariance. Unlike Euclidean distance, it is scale-invariant and considers correlations. In manufacturing, a high Mahalanobis distance for a real-time sensor vector from the golden batch centroid signals a multivariate outlier. It forms the statistical backbone of many Hotelling's T² control charts.

A deep learning approach using neural networks for non-linear anomaly detection. An autoencoder is trained to compress and reconstruct normal operational data. The core assumption: it will reconstruct normal patterns with low error but fail on anomalous data. The reconstruction error becomes the anomaly score. Variational autoencoders (VAEs) add a probabilistic layer, modeling the distribution of normal states for more robust scoring.

An effective, tree-based algorithm that isolates anomalies instead of profiling normal points. It exploits the fact that anomalies are 'few and different.' By randomly partitioning data, anomalous points require fewer splits to be isolated, resulting in shorter path lengths. This method is computationally efficient, handles high-dimensional data well, and does not require a pre-defined distance metric, making it robust for streaming industrial telemetry.

A kernel-based algorithm that learns a decision boundary around the 'normal' data class. It maps data to a high-dimensional feature space and finds the maximal-margin hyperplane separating normal points from the origin. Points falling outside this boundary are flagged as anomalies. OC-SVMs are powerful for defining the complex, non-linear envelope of a golden batch profile when only normal training data is available.