Anomaly Detection

Anomaly Detection in ThingWorx is implemented via built-in ThingWatcher functionality. ThingWatcher detects anomalies by monitoring a data stream from a device, calculating an expected distribution of data, and validating that the current data point is a member of the expected distribution. For example, the image below shows data being read from a sensor on a pump. The histogram for that data presents itself as a standard looking bell curve. As new data points stream in, ThingWatcher attempts to determine the likelihood that the new data fits within the current distribution. In the example below, the new data is from a very different distribution. The extreme difference in the distributions might indicate an anomaly.

ThingWatcher can detect anomalies on high and low data rate signals.

Each time you create and save an Anomaly Alert on a Thing property, a new ThingWatcher instance is created. The new ThingWatcher must complete specific tasks as it works its way through the following statuses:

• Calibrating – If initialized successfully, the new ThingWatcher collects data to build an anomaly model and generate a set of validation data (about 20% of the collected data). As part of the data collection process, the sampling rate is determined and any small gaps in the data are filled in so that there are no missing values.

• Buffering – The ThingWatcher pauses until enough streaming data has been acquired to begin monitoring. Also, the validation data (collected during Calibrating) is used to build an expected distribution of values.

• Monitoring – ThingWatcher scores incoming data against the anomaly model. For each new set of data points, the ThingWatcher builds a distribution of values and evaluates the likelihood that a given value is anomalous based on a comparison to the expected distribution of values.