Anomaly Detection

The foundational approach that assumes normal data points occur within high-probability regions of a stochastic model. These parametric techniques flag observations as anomalous if they deviate beyond a defined threshold from the mean.

• Z-Score Analysis: Measures how many standard deviations a point is from the mean; a simple, effective method for univariate sensor data.
• Gaussian Mixture Models (GMMs): Models data as a combination of multiple Gaussian distributions, capturing more complex, multi-modal normal behavior.
• Interquartile Range (IQR): A non-parametric method that defines outliers as points falling below Q1 - 1.5IQR or above Q3 + 1.5IQR, robust to non-normal distributions.
• Mahalanobis Distance: A multivariate metric that measures the distance between a point and a distribution, accounting for covariance between variables, ideal for correlated sensor readings.

These algorithms operate on the assumption that normal data points occur in dense neighborhoods, while anomalies are isolated in sparse regions of the feature space. They are non-parametric and do not assume an underlying data distribution.

• k-Nearest Neighbors (k-NN): An anomaly score is computed as the distance to the k-th nearest neighbor. Points with a large distance to their neighbors are flagged as outliers.
• Local Outlier Factor (LOF): A density-based technique that compares the local density of a point to the local densities of its neighbors. Anomalies have a substantially lower density than their peers.
• Isolation Forest: An ensemble method that explicitly isolates anomalies instead of profiling normal points. It constructs random trees and identifies anomalies as points with a short average path length, making it highly efficient for high-dimensional telemetry data.

Deep learning models trained to compress and reconstruct normal data. The core principle is that these models learn a compact latent representation of nominal behavior and will produce a high reconstruction error when attempting to encode an anomalous sample they have not seen before.

• Autoencoders (AEs): A neural network architecture with an encoder that compresses input data into a latent bottleneck and a decoder that reconstructs the original input. The reconstruction error serves as the anomaly score.
• Variational Autoencoders (VAEs): A probabilistic twist on the autoencoder that learns the parameters of a latent distribution, allowing for the measurement of reconstruction probability, a more principled anomaly metric.
• Generative Adversarial Networks (GANs): Using a generator-discriminator framework, models like AnoGAN learn the manifold of normal data and identify anomalies by finding the closest latent representation, flagging points that cannot be convincingly generated.

A paradigm that trains a discriminative boundary around the entire normal class, treating any point falling outside this boundary as an anomaly. This is particularly useful when anomalous examples are rare or non-existent during training.

• One-Class SVM: Finds a hyperplane that separates the normal data from the origin in a high-dimensional kernel space, creating a tight boundary around the inlier class.
• Support Vector Data Description (SVDD): Computes a hypersphere with minimum volume that encloses the normal data. Points outside the sphere are classified as anomalies.
• Deep SVDD: A neural extension of SVDD that jointly learns a feature representation and a minimal enclosing hypersphere, leveraging deep networks to handle complex, high-dimensional industrial sensor data.

Methods designed explicitly for temporally dependent data, where anomalies are not just point outliers but can be contextual, collective, or pattern-based deviations in a sequence of sensor readings.

• ARIMA Residual Analysis: An autoregressive integrated moving average model predicts the next value in a series. A significant deviation between the predicted and actual value flags an anomaly.
• LSTM/Transformer Forecasting: Deep sequence models learn complex temporal dependencies to forecast future windows. Anomalies are detected when the actual signal diverges from the prediction interval.
• Spectral Residual (SR): A fast, unsupervised method that analyzes the saliency of a signal in the frequency domain. It applies a Fourier Transform to identify unexpected spikes in the spectral residual, excelling at detecting point anomalies in streaming data.
• Discord Discovery: The process of finding the subsequence within a long time series that has the maximum distance to its nearest non-self match, identifying the most unusual shape or pattern.

Leveraging large, pre-trained models that have learned universal representations from massive datasets. These models can be adapted to anomaly detection with minimal labeled data, offering superior generalization across diverse manufacturing tasks.

• Pre-trained Vision Transformers (ViTs): Models like DINOv2 or CLIP extract rich, general-purpose visual features. Anomalies are detected by comparing the feature distribution of a test image against a reference set of nominal images.
• PatchCore: A state-of-the-art method that uses a memory bank of locally-aware patch features from a pre-trained model to detect anomalous regions in images with pixel-level precision.
• Multimodal Foundation Models: Models that fuse vision and language can be prompted with textual descriptions of defects (e.g., 'scratch on metal surface') to perform zero-shot anomaly detection without any task-specific training images.

A core paradigm where a model identifies inputs that differ fundamentally from its training distribution. In manufacturing, a vision model trained on nominal product images flags a sample with a novel defect as OOD. This is distinct from in-distribution classification errors. Key techniques include:

• Density estimation using normalizing flows
• Distance-based methods in feature space
• Energy-based models that assign low scores to anomalies

A modeling approach trained exclusively on nominal data to learn a decision boundary that encapsulates the 'normal' class. Any point falling outside this boundary is an anomaly. One-Class SVM and Support Vector Data Description (SVDD) are classical methods. Modern deep variants use autoencoders trained on normal operational telemetry, where a high reconstruction error on a faulty bearing's vibration signature signals a deviation.

The process of identifying abnormal patterns across multiple, interdependent sensor streams simultaneously. A single temperature spike may be normal, but a concurrent drop in pressure and rise in vibration is an anomaly. Key architectures:

• LSTM Autoencoders: Learn temporal dependencies of normal behavior
• Transformers: Capture long-range correlations across sensor modalities
• Graph Deviation Networks: Model sensor relationships as a graph structure

Leveraging pre-trained models to detect anomalies without any labeled defect data. A foundation model like a Vision Transformer (ViT) extracts rich feature embeddings from nominal product images. At inference, Mahalanobis distance or k-Nearest Neighbors in this feature space quantifies deviation. PaDiM (Patch Distribution Modeling) and PatchCore are state-of-the-art algorithms that use pre-trained backbones to build a memory bank of nominal patch features for pixel-level anomaly localization.

A statistical technique focused on identifying the exact moment a system's generative process shifts. Unlike general anomaly detection which flags individual outliers, change point detection finds structural breaks in a time series. Applications:

• Detecting tool wear onset from spindle load data
• Identifying regime changes in a chemical batch process
• Bayesian Online Change Point Detection (BOCPD) runs in real-time on streaming data

An ensemble method that isolates anomalies by randomly partitioning the feature space. Anomalies are few and different, requiring fewer random splits to be isolated, resulting in shorter path lengths in the tree structure. Advantages for industrial use:

• Linear time complexity, suitable for high-volume sensor data
• No density estimation, handles high-dimensional telemetry
• Robust for cold-start scenarios before sufficient labeled data exists