Anomaly Detection

These methods model the normal behavior of sensor data using statistical distributions and flag data points that fall into low-probability regions. They are highly efficient and deterministic, making them ideal for TinyML.

• Gaussian Models: Assume data follows a normal distribution; anomalies are points beyond a set number of standard deviations from the mean.
• Interquartile Range (IQR): A non-parametric method where anomalies are points outside 1.5 * IQR from the data quartiles.
• Extreme Value Theory: Focuses on modeling the tails of a data distribution to detect rare, extreme events.

Use Case: Detecting sudden, univariate spikes in temperature or vibration readings from industrial equipment.

These techniques identify anomalies as points that are far from their nearest neighbors or located in regions of low data density. They work well for multivariate sensor data where relationships between features are important.

• k-Nearest Neighbors (k-NN): An anomaly score is based on the distance to its k-th nearest neighbor. Computationally expensive for large datasets.
• Local Outlier Factor (LOF): Measures the local density deviation of a point relative to its neighbors, identifying points with significantly lower density.
• Isolation Forest: An ensemble method that isolates anomalies by randomly selecting features and split values, requiring fewer partitions to isolate anomalous points.

Use Case: Identifying faulty sensor assemblies where multiple correlated readings (e.g., from an IMU) deviate together from the normal cluster.

This approach uses neural networks, typically autoencoders, trained to reconstruct normal data. Anomalies are detected by a high reconstruction error, as the model fails to accurately reproduce unseen anomalous patterns.

• Architecture: A bottleneck layer compresses the input into a latent representation, which is then decoded.
• Training: The model is trained exclusively on normal data, learning its compressed representation.
• TinyML Adaptation: Requires significant compression via quantization, pruning, and careful architecture design to fit on MCUs.

Use Case: Detecting complex, multi-sensor anomalies in vibration patterns for predictive maintenance, where the normal state has intricate temporal dependencies.

Specialized for sensor streams, these methods model temporal dependencies to detect contextual and collective anomalies where a sequence of points is anomalous even if individual points are not.

• Forecasting Models (e.g., ARIMA, LSTM): Predict the next value in a sequence; a significant deviation between prediction and actual value indicates an anomaly.
• Sliding Window Statistical Tests: Apply statistical methods (like CUSUM) to features extracted from windows of data to detect subtle shifts in the process mean.
• Symbolic Approximation: Convert time-series into symbolic sequences (using SAX) and detect rare patterns.

Use Case: Identifying gradual bearing wear in motors, manifested as a slow drift in vibration frequency spectra over time.

One-Class Support Vector Machines (OC-SVM) learn a tight boundary around normal training data in a high-dimensional feature space. Data points falling outside this boundary are classified as anomalies.

• Mechanism: Maps data into a high-dimensional space using a kernel function and finds a maximal margin hyperplane that separates the data from the origin.
• Kernel Trick: Allows modeling of complex, non-linear boundaries without explicit high-dimensional computation.
• Constraint: Inference complexity depends on the number of support vectors, which can be challenging for MCUs.

Use Case: Network intrusion detection on edge gateways, where only examples of normal network traffic are available for training.

The simplest approach, where domain experts define explicit thresholds or logical rules that signal an anomaly. It is highly interpretable, extremely low-cost, and commonly deployed as a first pass on ultra-constrained devices.

• Static Thresholds: "If temperature > 100°C, trigger alert."
• Rate-of-Change Rules: "If pressure drops by >10 psi/second, trigger alert."
• Compound Logic: Combine multiple sensor readings with AND/OR logic.

Limitation: Cannot detect novel or complex anomalies not envisioned by the rule-writer. Often used in conjunction with a more sophisticated ML model.

Use Case: Safety-critical shutdown logic in consumer appliances or basic condition monitoring in IoT sensors.

The foundational methodology for analyzing sequences of data points indexed in time order. For anomaly detection, this involves:

• Decomposing a signal into trend, seasonal, and residual components.
• Calculating autocorrelation to measure similarity between observations as a function of time lag.
• Applying forecasting models (e.g., ARIMA, Exponential Smoothing) to establish a baseline; significant deviations from the forecast are flagged as anomalies.
• Essential for preprocessing sensor streams before applying detection algorithms.

The process of transforming raw, high-dimensional sensor data into a compact set of informative, non-redundant values (features) that capture the signal's essential characteristics. For TinyML anomaly detection, efficient features are critical. Common extracted features include:

• Statistical moments: Mean, variance, skewness, kurtosis.
• Spectral features: Energy in specific frequency bands derived from an FFT.
• Temporal features: Zero-Crossing Rate (ZCR), Root Mean Square (RMS).
• Domain-specific features: Mel-Frequency Cepstral Coefficients (MFCCs) for audio. Effective feature extraction reduces model complexity and improves detection accuracy on microcontrollers.

A specialized machine learning paradigm where a model is trained solely on "normal" data to learn its distribution. During inference, it identifies data points that deviate from this learned norm as anomalies. This is ideal for sensor applications where anomalous events are rare or difficult to collect. Key algorithms include:

• One-Class SVM: Finds a hyperplane that separates normal data from the origin in a high-dimensional space.
• Isolation Forest: An ensemble method that isolates anomalies by randomly partitioning data; anomalies require fewer partitions.
• Autoencoders: Neural networks trained to reconstruct normal input data with low error; high reconstruction error indicates an anomaly.

The process of combining data from multiple, disparate sensors (e.g., IMU, microphone, temperature) to produce a more accurate, complete, and reliable state estimate than is possible from a single source. For anomaly detection, fusion enables:

• Corroboration: An event flagged by multiple sensors increases confidence in the anomaly.
• Context: Data from one sensor provides context for another (e.g., high vibration might be normal when motor RPM is also high).
• Robustness: Mitigates the failure or noise of any single sensor. Techniques range from simple voting systems to sophisticated probabilistic methods like the Kalman filter.

A traditional, rule-based methodology for monitoring and controlling a process to ensure it operates at its full potential. It provides the statistical foundation for many threshold-based anomaly detectors in industrial sensor systems. Core concepts include:

• Control Charts: Plots of a process metric over time with statistically derived upper and lower control limits (e.g., X-bar chart, Individuals chart).
• Rules for Detection: Anomalies are signaled by points outside control limits or specific patterns (e.g., 7 points in a row trending up).
• Process Capability: Measures how well the process output fits within specified limits. SPC is computationally lightweight, making it suitable for direct implementation on microcontrollers.

The problem of identifying points in a time-series where the underlying statistical properties of the process (e.g., mean, variance) change abruptly. This is a precursor or complementary technique to anomaly detection, as a change point often signifies the onset of a new regime that may contain anomalies. Methods include:

• Offline algorithms: Analyze an entire dataset retrospectively (e.g., Binary Segmentation, PELT).
• Online algorithms: Detect changes in real-time as new data arrives (e.g., CUSUM, Bayesian Online Change Point Detection).
• Crucial for detecting shifts in sensor behavior due to system degradation or external interventions.