Anomaly Detection

An ensemble method that explicitly isolates anomalies rather than profiling normal data points. It constructs an ensemble of random decision trees and exploits the property that anomalous instances are few and different—they require fewer random splits to be isolated from the rest of the data.

• Anomaly Score: Derived from the average path length across all trees; shorter paths indicate higher anomaly likelihood.
• Linear Time Complexity: Scales efficiently to high-dimensional sensor telemetry with low memory requirements.
• No Distance Metric: Unlike k-Nearest Neighbors, it does not rely on pairwise distance calculations, making it robust to the curse of dimensionality.

Manufacturing Use Case: Detecting a sudden deviation in vibration frequency from a CNC spindle that has never failed before, without a pre-labeled failure dataset.

A neural network architecture trained to compress high-dimensional input data into a lower-dimensional latent bottleneck and then reconstruct the original input. The core assumption is that the network will learn the dominant patterns of normality.

• Anomaly Score: The Mean Squared Error (MSE) between the input and its reconstruction. Normal data reconstructs with low error; anomalous data, containing unseen patterns, yields high error.
• Non-Linear Manifold Learning: Captures complex, non-linear relationships between sensor readings that linear methods like PCA miss.
• Variational Autoencoders (VAEs): A probabilistic variant that learns a distribution over the latent space, providing a more principled anomaly score via reconstruction probability.

Manufacturing Use Case: A convolutional autoencoder processing images of pristine circuit boards will produce a high reconstruction error when presented with a board containing a subtle, previously unseen solder bridge.

A kernel method that learns a decision boundary encapsulating the region of the feature space where normal data points are densely concentrated. It separates the normal data distribution from the origin in a high-dimensional space.

• Nu Parameter: Controls the upper bound on the fraction of training errors and the lower bound on the fraction of support vectors, effectively setting the sensitivity to outliers.
• Kernel Trick: Using a Radial Basis Function (RBF) kernel allows the algorithm to learn complex, non-spherical decision boundaries around the normal class.
• Unsupervised by Design: Trained exclusively on data assumed to be normal, making it ideal for cold-start scenarios where failure data is nonexistent.

Manufacturing Use Case: Modeling the normal operating envelope of a hydraulic press's pressure and temperature curves to detect a slow internal leak that manifests as a subtle drift outside the learned boundary.

A density-based algorithm that computes the local density deviation of a given data point with respect to its neighbors. It identifies anomalies as points that have a substantially lower density than their neighbors, rather than just being far from the global mass of data.

• Local vs. Global: Excels at detecting anomalies in datasets with varying density clusters, where a point might be normal in one region but anomalous in another.
• Reachability Distance: The core metric, which is the maximum of the k-distance of a neighbor and the actual distance to that neighbor, used to stabilize density estimates.
• LOF Score ~1: Indicates a point has similar density to its neighbors. A score significantly greater than 1 flags a local outlier.

Manufacturing Use Case: Identifying a specific production batch that, while within global spec limits, exhibits a unique combination of process parameters that is locally sparse compared to all other batches, indicating a subtle process drift.

A multivariate distance metric that measures the distance between a point and a distribution. Unlike Euclidean distance, it accounts for the covariance structure of the data, effectively measuring distance in units of standard deviation along each principal component.

• Correlation-Aware: A deviation in a highly correlated variable is weighted less than a deviation in an independent variable, preventing false alarms from normal correlated fluctuations.
• Ellipsoidal Threshold: The decision boundary forms a hyper-ellipsoid around the mean of the normal data, defined by the chi-squared distribution.
• Computationally Lightweight: Requires only the inverse covariance matrix and mean vector of the training data, making it suitable for real-time edge inference on a PLC.

Manufacturing Use Case: Monitoring a motor's current and rotational speed simultaneously. A high-current, low-speed reading might be normal, but a high-current, high-speed reading is a multivariate anomaly flagged by the Mahalanobis distance.

A probabilistic model that represents the normal data as a weighted sum of multiple Gaussian distributions. It assumes the data is generated from a mixture of a finite number of Gaussian distributions with unknown parameters.

• Log-Likelihood Score: Anomalies are identified as data points with a very low probability density under the learned mixture model, falling in low-density regions between or far from the Gaussian components.
• Soft Clustering: Unlike k-means, GMMs provide a probability of a point belonging to each component, capturing the multi-modal nature of complex manufacturing processes with distinct operating modes.
• Expectation-Maximization (EM): The iterative algorithm used to fit the model, alternating between assigning points to components and updating the Gaussian parameters.

Manufacturing Use Case: Modeling a furnace's temperature profile, which has distinct normal distributions for 'ramp-up,' 'steady-state,' and 'cool-down' phases. A temperature reading that is improbable under any of these learned modes is flagged as anomalous.

A support vector machine variant trained exclusively on normal samples to learn a decision boundary that encapsulates the normality distribution. During inference, any data point falling outside this boundary is flagged as anomalous.

• Learns a hypersphere around normal data in high-dimensional space
• Effective for high-dimensional, low-sample-size problems
• Kernel trick enables non-linear boundary fitting
• Common use: detecting novel defect patterns never seen in training

An ensemble method that isolates observations by randomly selecting a feature and a split value, exploiting the property that anomalous points are few and different.

• Anomalies require fewer random splits to isolate
• Linear time complexity with low memory footprint
• Does not rely on distance or density measures
• Well-suited for high-velocity streaming sensor data

A neural network trained to compress and reconstruct input data. The model learns to accurately reconstruct normal patterns but produces high reconstruction error on anomalies it has never encountered.

• Encoder compresses input into latent bottleneck
• Decoder reconstructs from latent representation
• Mean squared error between input and output serves as anomaly score
• Effective for high-dimensional image and waveform data

A probabilistic model that represents the normal data distribution as a weighted sum of multiple Gaussian components. Anomalies are identified by their low likelihood under the learned density.

• Models multi-modal normal distributions
• Outputs interpretable probability scores
• Expectation-Maximization algorithm for parameter estimation
• Useful when normal operation has distinct modes or states

A multivariate distance metric that measures how many standard deviations a point is from the mean of a distribution, accounting for covariance between variables.

• Unlike Euclidean distance, it accounts for feature correlations
• Assumes data follows a multivariate Gaussian distribution
• Computationally efficient for real-time scoring
• Foundation for Hotelling's T² control charts in SPC

A density-based algorithm that computes the local density deviation of a data point relative to its neighbors. Points with substantially lower density than their neighbors are labeled as anomalies.

• Detects local anomalies missed by global methods
• Effective for clustered normal data with varying densities
• Score of ~1 indicates normal, >>1 indicates anomalous
• Sensitive to the choice of k-neighbors parameter