Anomaly detection - TIBCO Data Science Central

Michael O’Connell, Chief Analytics Officer, TIBCO Software
Steven Hillion, Sr. Director of Data Science, TIBCO Software
June 2019
AI in Action:
Anomaly Detection

• Applications of Anomaly Detection
• Historical Context
• Deep Learning Methods
• Example: Anomaly Detection on Time Series
• Getting Started with TIBCO
Agenda
© Copyright 2000-2019 TIBCO Software Inc.

3
Applications of
Anomaly Detection

Applications of Anomaly Detection
• Financial fraud detection
• Event detection in sensor networks
• Network security
• Health monitoring
• Data cleansing
• Manufacturing:
• Defect imaging
• Unusual Process Conditions
• Atypical Product Characteristics
Key Issue – Understand Variability

Detecting Anomalies with Machine Learning
• Supervised (need labeled data) and Unsupervised Learning
Some Types of Anomalies
• Facilities Equipment - Sensor & environmental data
• Process Equipment – Sensor fault detection data
• Process Results – Process history and measurements
• Physical Defects – Defect images & characteristics
• Product – Product Test characteristics
A General Method
1. Detect anomalies and incidents
2. Classify anomalies/incidents as fingerprints or signatures
3. Determine causes of the anomalies/incident classes
4. Develop Action Plans to address the causes
5. Predict on new data and intervene to mitigate potential problems
6. Case manage the incidents to resolution
Anomaly Detection in IoT
Key Issue – Understand Variability

Univariate
Statistical Process Control SPC
Multivariate – Linear Methods
• Multiple X variables (columns)
• No Y variable (unsupervised learning)
• Principle Components Analysis (PCA)
• Kmeans cluster analysis on PCA space
• Measure distance of each record (row) to
closest centroid => extent of anomaly
Multivariate – Non-Linear Methods
Deep Learning - Autoencoders
• Unsupervised learning
• Measure distance of each record (row) to its
autoencoder-computed-value (reconstruction
error) => extent of anomaly
Univariate & Multivariate Anomaly Detection
X /Y / TimeTime
PCA + Cluster Analysis Autoencoder
Unsupervised Learning Methods

Real-time equipment anomaly prediction & clustering
High Tech Manufacturing
Accelerator
https://community.tibco.com/modules/high-tech-manufacturing-accelerator
M
6

Univariate Statistical Process Control
Detect changes from
baseline variability
• One variable at a time
Shewhart Process Control
Charts
• Statistically derived Control
Limits
• Western Electric or Nelson rules
• Automated Alerting
Individual – Moving Range Control Charts

• Suppose we measured 2 parameters y1 and y2 (e.g. pressure and temperature )
• Univariate charts would not detect some obvious outliers
• This happens in many real applications
The Power of Multivariate Control Charts
Bad
Tester

• Also called Virtual Sensors
• Multivariate model for underlying virtual dimensions
that capture the “good” and in-control process data
• Relations can be linear, non-linear, follow patterns
• Apply that model to the ongoing process to detect
• Shift, drift, outliers in underlying components, virtual dimensions
Virtual sensor is working, and senses shift, drift, outliers.
• Shift, drift, outliers in prediction (of “normal”) residuals
Virtual sensor is no longer working, “universe changed”
• Root causes among parameters, inputs
What specific parameters contribute most to the problem?
Machine-Learning Based Process Monitoring:
Using Virtual Models of “Normal” Operations

• Linear model (PLS), predicting maturation from multivariate data
• Model defines dimensions (“factors”) describing “normal” maturation
• Use model to monitor new batches; dimensions and prediction residuals
Example: Model-Based SPC for a
Multivariate Batch Maturation Process
Predictions/dimensions: One of
the batches did not trend correctly
over time
Residuals: Given elapsed time,
parameter values cannot be
reproduced (universe changed)

Univariate
• Statistical Process Control SPC
Multivariate - Linear Methods
• Multiple Y variables and multiple X variables
• PCA Regression (PCA on X variables, regress
Principal Components on Y variables)
• PLS and SIMCA (project to new space)
• Popularized by Svante Wold, John
MacGregor
• Comprehensively implemented in TIBCO
Data Science - Statistica
• SIMCA: multivariate continuous processes
across time eg Manufacturing Biologics
• Nonlinear relationships, non-normal
distributions not well captured
Multivariate – Non-Linear Methods
• Deep Learning - Autoencoders
Univariate & Multivariate Anomaly Detection
X /Y / TimeTime

Deep Learning Breakthroughs
2019 Turing Award
Yann LeCun, AT&T, NYU, Facebook
• Optical character recognition
• Convolutional Networks (CNNs)
• Computer Vision, handwriting, OCR, bank checks
Geoffrey Hinton, U Toronto, Google Brain
• Backpropagation for multi-layer nets
• Alexnet – image recognition (Imagenet challenge)
• Computer Vision
Yoshua Bengio, U Montreal, Element AI
• Recurrent Networks (RNNs)
• Autoregression, autoencoders
• Medical image analysis, speech, robotics
• AI for social good

Breakthroughs
• Image Recognition // Speech Recognition //
• Natural Language Processing // Computer Vision
Why the explosion?
• New algorithms and techniques
• Convolutional NN, Recursive NN, Generative Adversarial NNs
• New Hardware capabilities
• GPU
• Multicore
• Clusters
• More Data
• New Tools from the Open Source world
• Cloud compute environments
From Neural Networks to Deep Learning
cs231n.github.io/neural-networks-1

Autoencoder
• Represents multivariate data in a smaller number
of dimensions / variables / attributes / features
• Analogous to Principal Components
• non-linear dimensions => more accurate
Anomalies from Autoencoder
• Anomaly: Rows / records / observations that are
multivariate outliers
• Autoencoder: rows are reconstructed from input
rows
• Reconstruction Error => extent of anomaly
• Anomaly = row not well represented by lower
dimensional approximation
Autoencoders and Anomalies
By Chervinskii - Own work, CC BY-SA 4.0
https://commons.wikimedia.org/w/index.php?curid=45555552
X f (X) z f ’(z) Xhat

Sparse Autoencoders
• More hidden units than inputs, sampled inclusion
Denoising Autoencoders
• With corrupted/noisy inputs
Generative Adversarial Networks
• Two networks compete (LeCun speaking about these)
Variational Autoencoders
• Assumptions on the latent variables (z)
X f (X) z f ’(z) Xhat
Autoencoder Variants

H2O DeepLearning function( )
• Simple Structure of networks – specify number of fully-connected layers (and
optionally dropout)
• Settings for Sparse Data can outperform GPU
• For GPU, H2O Deep Water Project uses GPU but no longer being developed
• H2O recommends Keras for new projects with GPU
• Predict function for autoencoder used to compute reconstruction error on
incoming new observation
Keras and Tensorflow
• Keras as front end for Tensorflow, CNTK, Theano, MXNet
• Tensorflow 2.0 has Keras included
• Specify complex network topologies
• Use different types of layers – CNN, RNN,…
• Can leverage GPU throughout
Deep Learning in R and Python

19
Example:
Anomaly Detection on
Time Series

Industrial Plant: Raw Time Series Data

Industrial Plant: Raw Time series Data

Tag Training, Validation & Test Data Sets

Variable Selection

Model Configuration & Evaluation
Validation Error has clear minimum
Note Distribution of Reconstruction Error
Problems Converging

Anomaly Detection & Components
High Reconstruction Error = Anomaly
Sensor Trace Components and
Anomalies for Case Management

Anomalies & Component Signatures

Issues with Univariate Analysis Highlighted
Incident not detected on
Univariate Chart

Reconstruction
Error
Identify Incidents Programmatically
Incident = Persistent Anomaly
• Like univariate Western Electric
Rules
• Can be parameterized e.g. 10
sequential anomalies = 1
incident
• Package as autoencoder for
anomaly detection + rules for
incidents
• Characterize incidents as
signatures via kmeans
• Root cause on (future) incidents
Time

Cluster Similar Incidents, View Signatures

Reconstruction
Error
Identify Incidents - Batch and Event Stream
Batch and Event Stream
Inference
• Autoencoder => reconstruction
error => anomaly
• Rules for incident = persistent
anomaly
• Apply in Batch – on clock or on
trigger
• Score on Event Stream for real-
time intervention
• Classify incident via signature
(from kmeans)
• Case manage identified
incident to resolution
• Close loop and rebase model
Time

TIBCO Data Science – TIBCO Cloud Integration - TIBCO Live Apps
Identifying Anomalies on the Event Stream

Modeling
+ Visual composition
+ Notebook
+ Native ML/DL & OS
integrations
Operations Deployment
+ Model lifecycle mgt
+ Visual analytics & BI
+ Batch automation
+ Real-time event processing
Data Access / Data Prep
+ Distributed compute
+ Dedicated host
+ Feature Engineering
BI eg medics for
epidemic monitoring
Engineer eg
O&G production
optimization
Quant eg trading
desk reconciliation
Data Engineer
Data Scientist
Citizen Data Scientist
Data Scientist
Citizen Data Scientist
Analytics Operations
IT / Software Engineer
FUNCTION
USER
Business User
IT / Administration
Business Applications
+ Predictive maintenance
+ Engineering/IoT/IIoT
+ Customer Analytics
+ Supply Chain ...
TIBCO Data Science

Value = Find + Act on Critical
Business Moments
Critical business moments occur
in every facet of enterprise
operations.
They drive competitive
differentiation, customer
satisfaction and
business success.
smart cross-sell
offers
predict impending
equipment failure
real-time inventory
management
optimize
routes
anticipate and
handle disruptions
optimize
pricing
prevent
fraud
deliver proactive
customer service

TIBCO Connected Intelligence
Information
Management
Data Fabric
UNIFY
Data Science
Analytics
AUGMENT
Event-driven
Applications
API-led
Integration
CONNECT

TIBCO Community the platform for our users
TIBCO Community the platform for our users! community.tibco.com

TIBCO Data Science - strength in SPC, PLS, SIMCA
Spotfire Template w Data Science for QC/SPC
Spotfire Function for calling TIBCO Data Science
AutoML in TIBCO Data Science
Learn & Do More with TIBCO Analytics
https://community.tibco.com/wiki/tibco-labshttps://community.tibco.com/exchange

Visit the Anomaly Detection page
on the TIBCO Community and see
autoencoding with TIBCO Data
Science and using SageMaker
Learn & Do More with TIBCO Data Science
Visit the TIBCO Community
Manufacturing Solutions page
Download AI & Machine Learning
Manufacturing Solutions from the
TIBCO Exchange

41
Questions & Contact
Thank you!
Michael O’Connell
Chief Analytics Officer
TIBCO
moconnell@tibco.com
@MichOConnell
TIBCO Community
community.tibco.com
TIBCO Exchange
community.tibco.com/exchange
Spotfire Trial
www.tibco.com/products/tibco-spotfire

Anomaly detection - TIBCO Data Science Central

More Related Content

What's hot (20)

Similar to Anomaly detection - TIBCO Data Science Central (20)

Recently uploaded (20)

Anomaly detection - TIBCO Data Science Central