one of these images is not like the
other Can you spot which one
all right so this is pretty easy but how
about in Time series data which of these
data streams is the odd one out
okay fine that's also pretty simple but
what about these images
or these time series can you tell which
is the expected behavior and which is
anomalous Behavior
it can get pretty tough to identify
events or patterns that differ from the
expected Behavior through inspection
alone and as I'm going to show you later
in this video with a demonstration it's
especially difficult to find very subtle
changes in the behavior of hardware and
this is where anomaly detection can be
beneficial
anomalies are deviations from the
expected behavior and anomaly detection
algorithms are trying to find those
deviations
now deviations don't necessarily mean
that a fault has occurred or that
something is broken or not performing to
within its spec it's simply a difference
and understanding when those differences
occur in your data can be really helpful
so let's talk about that I'm Brian and
welcome to a Matlab Tech talk
anomaly detection is useful for many
applications including looking for fraud
in financial transactions checking for
defects in manufacturing production
lines and looking for unusual movements
in video surveillance footage
however what I want to expand on more in
this video is how anomaly detection can
be used for finding the sort of
low-hanging fruit in predictive
maintenance applications with predictive
maintenance and algorithms looking for
specific fault Trends in a machine and
is trying to come up with an estimate of
how much time is left before failure and
this estimate will help you determine
when to schedule maintenance and which
parts of your system require it
but the downside of predictive
maintenance is that it typically
requires a lot of historical data in
order to train the algorithm to predict
those faults that is we need to know
what failure looks like from similar
machines that have failed in the past
now obviously we don't want machines to
fail and so we go to Great Lengths to
prevent those failures but that means
that some faults happen so infrequently
that you might not have enough data to
successfully learn to classify them
now on the other hand anomaly detection
isn't looking for faults it's looking
for deviations from the nominal system
and to detect when a system is behaving
differently than expected for any reason
you just need data for the normal
behavior and that is usually pretty easy
to come by since hopefully your system
runs normally most of the time and this
makes anomaly detection easier to set up
than a full up predictive maintenance
algorithm and if ultimately you do want
to set up predictive maintenance then
running anomaly detection is still
beneficial because it's a good way to
flag possible failure data that you can
then use for predictive maintenance
training
all right so if I've convinced you that
anomaly detection is worthwhile let's
now talk about how it works and I'm
going to keep this rather generic
because there are a lot of different
ways to approach anomaly detection
algorithmically
for example you could set a threshold on
a particular metric and then just check
to see if it's ever exceeded and
thresholding is a very simple and
straightforward approach especially for
single variate data
now for anomalies that require looking
across multiple variables or for ones
that have multiple types of features
that indicate the anomaly then something
a little more robust might be needed
for example you can use machine learning
approaches like one class support Vector
machines or isolation forests or
autoencoders just to name a few each of
these all have the same basic structure
in some way they learn a model using
data of the expected behavior and then
use that model to determine if the
observed Behavior Falls outside of what
the model considers normal
for one class svms the model is a
hyperplane that maximizes the distance
between expected and unexpected Behavior
for isolation forests the model is a
tree that isolates each observation into
a leaf and the more decisions it takes
to isolate an observation the less
likely it is to be an anomaly
and with autoencoders the model is a
deep neural network that is trained to
reconstruct the input data and the
better it does at reconstruction the
more likely it is that the data is
expected
and there's more than just these three
algorithms but I just want to give you a
sense of how different ways to model the
expected Behavior can help you determine
when an anomaly has occurred
all right so I think at this point it
might be easier to understand anomaly
detection if we can watch one of the
algorithms in action using some real
hardware and for this example I'm going
to use the cube Servo 2 from quonser
this is a rotary inverted pendulum and
I'm controlling it with a feedback
controller that's trying to keep the red
arm upright while also following a
reference angle for the silver arm and
the reference is just a square wave that
is stepping back and forth and back and
forth over and over again
now I'm using four measurements to
control the system but I'm only
recording two of those measurements the
motor voltage in volts and the angle off
vertical of the red pendulum in degrees
and these are the only two that I'm
going to use for anomaly detection and
right now you can see that for the most
part the motor voltage is very low and
the Pendulum angle is near zero degrees
except for when the reference steps to a
new location and then both the voltage
and the angle increase slightly to
follow that reference before settling
back down
this is the nominal Hardware Behavior
since I know that it's functioning as I
designed it
now I don't know every type of failure
for this system and so instead of
checking explicitly for very specific
failures I'm just going to check to see
if any anomalies occur going forward so
my first step in anomaly detection is to
define the nominal behavior in some way
so that I can determine if the behavior
deviates from it going forward and for
this example I'm going to use an auto
encoder to model the nominal Behavior an
autoencoder is a type of deep neural
network that attempts to reduce the
dimensionality of the input data and
what that means is that it takes the
high dimension input data encodes it
into a lower Dimension by representing
it with less information and then it
decodes it again to reconstruct the
original data and if the data is
dominated by low dimensional behaviors
like the predictable dynamics of the
pendulum then the autoencoder will
capture those Dynamics in the encoding
process and essentially ignore other
things like sensor noise since that
would take more Dimensions to recreate
those random motions perfectly
so if we train the autoencoder on this
nominal Behavior we would expect the
reconstructed data to match the general
behavior of the pendulum but ignore more
of the high frequency noise and other
motions
so let's do that
I found this Matlab example called time
series anomaly detection using deep
learning which uses an auto encoder on
time series data which is exactly what I
want to do so for the most part I'm
following along with this example and
then just tweaking it slightly for my
particular problem and the main
difference is that instead of three data
channels I only have the two motor
voltage and pendulum angle
and the reason why I like this example
is that it's training the autoencoder
directly on the raw data which is
something that I want to try first
anomalies are often difficult to detect
in raw data even for machine learning
since the raw data can have high
dimensionality and therefore the
algorithm has to learn completely on its
own how to narrow down all of that
information into patterns that indicate
normal behavior but on the other hand I
could do a little feature engineering
and pre-process the data in such a way
that highlights the features that I
think are most likely to indicate
anomalies and then the machine learning
algorithm only needs to learn using just
those particular features again I'm
going to try the raw data approach in
this example and see how it does however
the derived feature approach is very
popular for real world problems
all right so to begin I collected 10
minutes of nominal data from my hardware
and then just like the example I split
it up into training data and validation
data and I left the autoencoder
architecture the exact same as it was in
the example as well as all of the
training options and then I just trained
this network with the train Network
Matlab function
and overall this whole thing took about
a minute or so to run
but now that I have a network that does
a pretty good job of reconstructing the
nominal input data I can run that model
on new incoming data with the predict
function so the predict function output
is the Network's attempt at
reconstructing the input data
and if we go back to the real time
running of the hardware that's exactly
what we see over here the blue lines are
the reconstructed data from the trained
autoencoder given these raw data inputs
and this third figure down here just
plots the raw data in the reconstructed
data on the same chart so that we can
see how well the network was able to
capture the essential dynamics of the
system
and Visually it appears to do a pretty
decent job however we can quantify how
good of a job it's doing by looking at
the mean absolute error between these
two signals so I'm taking this four
seconds of raw data and reconstructed
data and I'm calculating the mean
absolute error between the two and then
showing it over here
notice that when the pendulum is
stationary the error is pretty low it's
less than 0.1 and when it performs those
fast Dynamic Maneuvers the error
increases a bit to about 0.18 or so and
this is telling me that the auto encoder
probably hasn't perfectly captured the
nominal dynamics of this system
otherwise I would expect the mean error
to be about the same in both situations
but perhaps it's good enough we'll soon
find out
this red line is at the maximum error
that the autoencoder has produced in
recreating the nominal data and so with
this red line as a threshold we now have
a way to check for anomalies
we can assume that as long as the system
is behaving nominally the autoencoder
network will be able to reconstruct the
data to within this error threshold
however if new Dynamics crop up in the
system or if there are new external
influences on this system then we would
expect that the network would not be
able to reconstruct the data as well and
therefore the error would be greater
than this threshold
in this way to detect anomalies going
forward we just need to look at this
error term and compare it to the
threshold
so let's try it out
I have the pendulum running nominally
and as you can see the error is below
the threshold
however let me disturb the pendulum
now even though the controller was able
to compensate for that disturbance and
the arm stayed upright the autoencoder
network was unable to reconstruct those
strange Dynamics as well and the error
jumped above the threshold indicating an
anomaly
now poking it with my finger is a pretty
obvious disturbance but the nice thing
about anomaly detection is that the
anomaly itself can be very subtle to a
human and still produce more error
through the network than the nominal
system does for example watch what
happens when I use this twine to add
just a small amount of friction to the
pendulum arm
this particular anomaly is one that is
quite common for motor-based systems
bearing drag often increases over time
and you want to be able to detect that
increase and flag it for further action
and as you can see it didn't take much
of a deviation to trigger a detection
the pendulum angle and the motor voltage
don't appear to visually change very
much but this additional drag produced a
signal that the autoencoder network
couldn't reconstruct as well and an
anomaly was triggered
all right so lastly I want to show you
that this algorithm can also detect
other types of anomalies like a change
in the load on the motor and I'm going
to create this error by adding a small
amount of
well change onto the tip of the pendulum
and notice how when I first drop them
into the little cup there's a slight
force from them that trips the detector
so far so good but we should also be
able to catch the change in Dynamics
when the pendulum swings to the other
side
all right yeah it uh caught it
um that might have been too much change
for this controller to handle
all right so I'm not going to add any
new anomalies into this system but
hopefully this demonstration shows you
how anomaly detection Works to find any
deviations from the nominal system
rather than looking for a specific
deviation
and what's really cool about this is
that this algorithm could be run real
time like I'm doing here or run
periodically on saved data to check for
historical anomalies
also anomaly detection could be tied
into a larger design where something is
counting the number of times an anomaly
occurs in say a week and an operator is
just looking at how fast that counter is
growing to determine when to intervene
it's all really cool and the number of
uses is sort of unlimited so I hope you
go and try it out yourself all of the
references and resources that I used in
this video are linked below
all right that's where I'm going to
leave this video if you don't want to
miss any other future Tech talk videos
don't forget to subscribe to this
Channel and if you want to check out my
channel control system lectures I cover
more controlled theory topics there as
well thanks for watching and I'll see
you next time