Anomaly Detection

The foundational approach that models the normal operating envelope using parametric distributions. Z-score analysis flags points beyond a standard deviation threshold, while Grubbs' Test identifies a single outlier in a univariate dataset. Gaussian Mixture Models (GMMs) extend this by modeling complex, multi-modal normal behaviors. These methods are computationally lightweight and highly interpretable but assume data stationarity, making them brittle against dynamic industrial processes with shifting baselines.

Algorithms that identify anomalies by measuring the geometric separation between data points in high-dimensional space. k-Nearest Neighbors (k-NN) computes an anomaly score based on the distance to the k-th nearest neighbor; isolated points in sparse regions receive high scores. Local Outlier Factor (LOF) refines this by comparing the local density of a point to its neighbors, effectively detecting outliers in clusters of varying density—a common scenario in multi-modal sensor data from different operating regimes.

An unsupervised ensemble method that exploits the property that anomalies are 'few and different.' It constructs a forest of random binary trees by recursively partitioning the feature space. Anomalies require fewer splits to isolate because they reside in sparse regions, resulting in shorter average path lengths. Key advantages include linear time complexity, low memory footprint, and no requirement for a distance metric, making it highly effective for high-dimensional, streaming sensor data where defining a meaningful distance is challenging.

A neural network trained to compress and reconstruct normal operational data through a bottleneck layer. The core principle: the network learns the latent manifold of nominal behavior. When an anomalous data point is fed through, the reconstruction error spikes because the model cannot faithfully encode a pattern it has never seen. Variational Autoencoders (VAEs) add a probabilistic layer, modeling the latent space as a distribution, which provides a more robust and continuous anomaly score than the deterministic reconstruction error of a standard autoencoder.

A paradigm where the model is trained exclusively on normal operational data to define a tight boundary around the 'normal' class. One-Class SVM finds the maximum-margin hyperplane separating the data from the origin in a high-dimensional kernel space. Support Vector Data Description (SVDD) computes a minimal hypersphere enclosing the normal data. These methods are ideal when failure data is scarce or non-existent, a common constraint in high-reliability manufacturing environments where run-to-failure events are rare and expensive to generate.

Techniques designed to respect the temporal ordering and autocorrelation structure of sensor streams. ARIMA-based models predict the next value and flag significant deviations from the prediction interval. Seasonal-Hybrid ESD (S-ESD) robustly detects global and local anomalies while accounting for trend and seasonality. Matrix Profile computes the z-normalized Euclidean distance between every subsequence and its nearest neighbor, efficiently identifying discords—subsequences that are maximally different from all others—which often correspond to transient mechanical faults.

An unsupervised neural network architecture trained to reconstruct its input through a compressed bottleneck representation. In anomaly detection, the network learns the latent structure of normal operational data during training. When an anomalous data point is passed through the network, it produces a high reconstruction error because the model has never learned to encode the anomalous pattern. This reconstruction error serves as a continuous anomaly score, with thresholds set to trigger alerts when equipment behavior deviates from the learned manifold.

An unsupervised ensemble algorithm that isolates anomalies by recursively generating random partitions on feature subspaces. The core insight is that anomalous points are few and different, requiring fewer random splits to be isolated from the rest of the data. The algorithm builds an ensemble of isolation trees and computes an anomaly score based on the average path length. Key advantages for industrial applications include:

• Linear time complexity with low memory requirements
• No distance or density calculations required
• Effective on high-dimensional sensor streams without feature scaling
• Handles irrelevant attributes gracefully through random subspace sampling

The algorithmic identification of abrupt shifts in the statistical properties of a time-series sensor stream. Unlike point anomaly detection which flags individual outliers, change point detection identifies the precise moment when the underlying data-generating process transitions to a new regime. Common approaches include:

• CUSUM (Cumulative Sum): Tracks cumulative deviations from a target mean
• Bayesian Online Change Point Detection: Computes posterior probability of a change at each timestep
• PELT (Pruned Exact Linear Time): Optimally partitions a signal into homogeneous segments In predictive maintenance, a detected change point often signals the onset of a new degradation phase, enabling early intervention before catastrophic failure.

A specific type of model decay where the statistical relationship between sensor inputs and failure outputs changes over time, rendering the original anomaly detection logic invalid. Unlike data drift which only affects input distributions, concept drift means the same sensor reading may now indicate a different failure probability. Types include:

• Sudden drift: Abrupt change due to equipment retrofit or new operating mode
• Incremental drift: Gradual wear altering the normal operating envelope
• Recurring drift: Seasonal or cyclical shifts in production conditions Continuous monitoring of model performance against ground-truth failure events is essential to detect concept drift and trigger retraining pipelines.

A composite metric that fuses multiple heterogeneous sensor readings into a single, normalized value representing the overall degradation state of an asset. The health index abstracts away the complexity of multi-dimensional monitoring, providing operators with an intuitive 0-100% scale. Construction methods include:

• Weighted linear combination of normalized sensor values based on domain expertise
• Mahalanobis distance from a baseline healthy cluster in feature space
• Autoencoder latent space distance from the learned normal manifold A well-designed health index serves as the input to Remaining Useful Life models and enables consistent anomaly thresholds across diverse equipment fleets.

A game-theoretic approach to explaining the output of any anomaly detection model by computing the marginal contribution of each sensor feature to a specific prediction. Based on Shapley values from cooperative game theory, SHAP fairly distributes the prediction among input features. For anomaly detection, this enables:

• Root cause identification: Pinpointing which sensor (vibration, temperature, pressure) triggered the alert
• Operator trust: Providing transparent reasoning for automated maintenance recommendations
• Model debugging: Identifying when spurious correlations drive false positives SHAP values are particularly valuable in industrial settings where maintenance engineers require actionable explanations, not just anomaly scores.