Temporal Characterization and Filtering of Sensor Data to Support Anomaly Detection

Abstract

We present an approach for characterizing complex temporal behavior in the sensor measurements of a system in order to support detection of anomalies in that system. We first characterize typical behavior by extending a hidden Markov model-based approach to time series alignment. We then use a trace of that learned behavior to develop a particle filter that enables efficient estimation of the filtering distribution on the state space. This produces filtered residuals that can then be used in an anomaly detection framework. Our motivating example is the daily behavior of a building’s heating, ventilation, and air conditioning (HVAC) system, using sensor measurements that arrive every minute and induce a state space with 15,120 states. We provide an end-to-end demonstration of our approach showing improved performance of anomaly detection after application of alignment and filtering compared to the unaligned data. The proposed model is implemented as a computationally efficient R package alignts (align time series) built with R and Fortran 95 with OpenMP support.

Keywords:

• Hidden Markov models
• Particle filtering
• Streaming data
• Time series alignment

Supplementary Materials

The supplemental materials contain (1) the derivation of the closed-form solution for optimizing the scale state parameters of the CPM model in each E-M step and (2) the algorithm for performing residual adjustment for heteroscedasticity proposed by Tsay (1988) and discussed in Section 4.7.

Data Availability Statement

Code and data for available examples at https://github.com/lanl/alignts.

Additional information

Funding

Research presented in this article was supported by the Laboratory Directed Research and Development program of Los Alamos National Laboratory under project number 20150215DR.