Anomaly Detection

Overview

What Does It Do?

Anomaly Detection in ThingWorx is implemented via built-in anomaly monitor functionality. This functionality detects anomalies by monitoring a data stream from a device, calculating an expected distribution of data, and validating that the current data point is a member of the expected distribution. For example, the image below shows data being read from a sensor on a pump. The histogram for that data presents itself as a standard looking bell curve. As new data points stream in, the anomaly monitor attempts to determine the likelihood that the new data fits within the current distribution. In the example below, the new data is from a very different distribution. The extreme difference in the distributions might indicate an anomaly.

Anomaly Detection can detect anomalies on high and low data rate signals.

How Does it Work?

Each time you create and save an Anomaly Alert on a Thing property, the anomaly alert must complete specific tasks as it works its way through the following alert statuses:

• Calibrating – If initialized successfully, the anomaly monitor collects data to build an anomaly model and generate a set of validation data (about 20% of the collected data). As part of the data collection process, the sampling rate is determined and any small gaps in the data are filled in so that there are no missing values.

• Training – The collected data is used in an external process to build an anomaly model.

• Buffering – The anomaly monitor pauses until enough streaming data has been acquired to begin monitoring. Also, the validation data (collected during Calibrating) is used to build an expected distribution of values.

• Monitoring – The anomaly monitor scores incoming data against the anomaly model. For each new set of data points, the anomaly monitor builds a distribution of values and evaluates the likelihood that a given value is anomalous based on a comparison to the expected distribution of values.

The diagram below shows the progression through the anomaly alert statuses.