Model-Free Unsupervised Anomaly Detection Framework in Multivariate Time-Series of Industrial Dynamical Systems

TL;DR

This work tackles model-free unsupervised anomaly detection in industrial multivariate time-series by proposing a physics-inspired, quantization-based framework that constructs three normality characterizations and derives three residuals $r_{ extrm{trans}}$, $r_{ extrm{bound}}$, and $r_{ extrm{conf}}$ for transparent anomaly scoring. It introduces Incremental Learning to incorporate operator feedback without retraining from scratch, enabling normality-stamped and anomaly-stamped updates to the normality sets NP1–NP3. The approach is evaluated on two synthetic benchmarks (Lorentz attractor and Automotive Electronic Throttle Control), and is benchmarked against conventional methods (e.g., Lasso/LARS, LOF, Random Forest, Auto-Encoder), showing strong average performance and favorable explainability, albeit with some variance tied to hyper-parameter choices. The results support industrial relevance due to reduced data requirements, clear interpretability, and compatibility with operator-driven updates, while highlighting avenues for thresholding, threshold merging, and broader real-world benchmarking in future work.

Abstract

In this paper, a new model-free anomaly detection framework is proposed for time-series induced by industrial dynamical systems.The framework lies in the category of conventional approaches which enable appealing features such as a learning with reduced amount of training data, a high potential for explainability as well as a compatibility with incremental learning mechanism to incorporate operator feedback after an alarm is raised and analyzed. Although these are crucial features towards acceptance of data-driven solutions by industry, they are rarely considered in the comparisons that generally almost exclusively focus on performance metrics. Moreover, the features engineering step involved in the proposed framework is inspired by the time-series being implicitly governed by physical laws as it is generally the case in industrial time-series. Two examples are given to assess the efficiency of the proposed approach.

Figures (13)

• Figure 1: Classification of anomaly detection methods in time-series as suggested by Audibert2022.
• Figure 2: Example 1: Time-series representing the two sensors evolution and the associated values of the system's parameters. The green intervals represent normal behavior, while red ones represent faulty behavior. The bottom plot displays the parameters variations from the nominal values used for normal simulations.
• Figure 3: Example 1: Evolution of the family of residuals viewed by sensor $x_1$ and $x_3$ when both sensors are available for the construction of the anomaly detector associated to the hyper-parameters given by \ref{['lorentzparam1']}.
• Figure 4: Example 1: Evolution of the family of residuals viewed by sensor $x_1$ and $x_3$ when both sensors are available for the construction of the anomaly detector associated to the hyper-parameters given by \ref{['lorentzparam1']}except that $\mathbf{n_q=8}$ is used instead of $\mathbf{20}$.
• Figure 5: Example 1: Histograms of the cardinalities of the fitted sets of configuration $\mathcal{W}^{[x_1]}$ and $\mathcal{W}^{[x_3]}$ among the 281 transitions of quantized $x_1$ and 311 transitions of the quantized $x_3$. The anomaly detector's hyper-parameters are given by (\ref{['lorentzparam1']}).

Theorems & Definitions (5)

• Remark 1: on the explainability
• Remark 2: on the residuals complementarity
• Remark 3
• Remark 4: on the explainability
• Remark 5: on the high variance