<figure><img src="image_1.png" /></figure>

HAL
open science

# Operator Feedback-compatible Fault Detection Framework for Industrial Time-series Data Streams

Raphaël Dion, Mazen Alamir

► To cite this version:

Raphaël Dion, Mazen Alamir. Operator Feedback-compatible Fault Detection Framework for Industrial Time-series Data Streams. CINTI 2024 - IEEE 24th International Symposium on Computational Intelligence and Informatics (CINTI 2024), Óbuda University, Nov 2024, Budapest, Hungary. pp.000227-000232, 10.1109/CINTI63048.2024.10830841. hal-04758507

HAL Id: hal-04758507

https://hal.science/hal-04758507v1

Submitted on 29 Oct 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Operator Feedback-compatible Fault Detection Framework for Industrial Time-series Data Streams

Raphaël Dion, Mazen Alamir

Univ. Grenoble Alpes, CNRS, Grenoble INP, GIPSA-Lab

F-38400 Saint Martin d'Hères, France

`{raphael.dion, mazen.alamir}@grenoble-inp.fr`

***Abstract***—While Time-Series Anomaly Detection is an ever-growing field, there is still a gap between its commonly adopted offline learning, update-less behavior and the requirements of real-time predictive maintenance that represents its main industrial goal. The Incremental Learning paradigm attempts to address this issue conjugating an initial modeling with a continuous local enhancing ability to tackle the frequent normality drifts of a data stream as labelled through an operator's feedback. In this paper, a streaming-compatible extension of a recently proposed model-free, explainable algorithm is proposed, which is compatible with both drift adaptation and anomalous instance learning despite an unsupervised initial setting. Moreover, as a general industrial algorithm, the feature engineering process involved in the proposed framework is heavily inspired by the implicit physical laws that should govern machinery-sourced time-series. Two examples are explored in order to assess the online-learning abilities along a streaming scenario.

***Index Terms***—Fault Detection, Time-Series, Industry, Nonlinear Systems, Incremental Learning

## I. INTRODUCTION

With the rapid emergence of industrial connected equipments [1], [2], the need to monitor machine failures has tremendously grown in the recent past years. Across a large variety of fields, such as fraud prevention, medical monitoring [3] or industrial predictive maintenance [4], [5], this need has resulted in a burgeoning interest in *Time-Series Anomaly Detection (TSAD)* [6].

While observer-based TSAD is a common tool in some specific operational cases, it is more realistic for a general industrial TSAD to be *model-free* and unsupervised, as there are usually no mathematical model available nor labelled anomalous instances in sufficient quantity [7].

As one of the main use cases is *real-time* predictive maintenance, it is not unusual to apply TSAD algorithm to data streams [8]. In this context of *online* TSAD, algorithms are continuously exposed to potential *normality drift* [9] in the upcoming data requiring these algorithms to maintain the ability to detect novelties on one hand while offering an adaptation mechanism to accommodate for these drifts on the other hand. This is referred to as the *Incremental Learning* in this contribution [10].

The contribution of this work is twofold:

✓ An extension of a previously proposed model-free, explainable, TSAD algorithm [11] is proposed in order to enhance its ability to incrementally adapt to normality

drift while enforcing its novelty detection capability using streaming anomalous instances despite an initial *one-class* [12] framework.

✓ A realistic evaluation of the proposed framework is disclosed using industrial time-series. Thanks to the instance diversity of these datasets, various displays of online learning are proposed as well as a streaming scenario.

The remainder of this paper is organized as follows: section II presents an overview of existing related Incremental Learning algorithms while relatively positioning the proposed one, section III goes through the model principles and their transition to online learning and section IV discusses two illustrative use-cases. Finally, section V concludes the paper and brings up some leads for future works.

## II. BACKGROUND

### A. Overview of Anomaly Detection Algorithms

Due to the large and growing variety of Anomaly Detection (AD) algorithms [13] an obvious need for a comprehensive categorization has emerged. Several works attempted to address this challenging task such as [6], [14], [15]. The classification discussed below is based on [16] which splits AD algorithms in three main categories, namely the *Conventional*, *Machine Learning* and *Deep Neural Networks* ones (see Figure 1). More precisely:

<figure><img src="image_3.png" /><figcaption>Fig. 1. Example-based illustration of the TSAD classification suggested by [16].</figcaption></figure>

* Conventional: These methods are denoted so since they do not involve any Machine Learning or *black-box* component,
they often show remarkable explainability level. They are usually split in four categories.

*   **Control-chart:** Features are based on statistical characterization of straightforward properties. Using an estimation of the values normal range, a residual is defined as the distance from it.

*   **Forecasting:** The residuals is computed from the reconstruction error of a linear auto-regressive model.

*   **Decomposition:** Variables go through dimensionality reduction, using paradigms such as PCA (Principal Component Analysis) or SSA (Singular Spectrum Analysis). The lower-dimension reconstruction error is used as residual.

*   **Similarity:** Sub-sequences are extracted from the data. For each sub-sequence the lowest distance from other sub-sequences is used as residual.

*   **Machine Learning:** These methods use at one step or another a machine learning tool, while staying away from Neural Networks. They are usually split in three categories.

*   **Isolation:** Decision trees are used to isolate a lone sample from the dataset. The shorter the path, the higher the outlier probability.

*   **Neighborhood:** Clustering paradigms are used to estimate the neighborhood density of a point. The lower the density, the higher the outlier probability.

*   **Domain:** Points are projected in a higher dimension hyperspace (often a hyper sphere or cube) in order to construct a normality space. The further a point from the hyperspace, the higher the outlier probability.

*   **Deep NNs:** These methods are usually advanced versions of the AutoEncoder. Using specific Neural Network architectures based on an intermediate low-dimension layer, these algorithms aim at reconstructing the input data and thus output a reconstruction error residual. These algorithms generally suffer from the lack of explainability despite a continuous effort.

## B. Positioning of the proposed model

The proposed model-free algorithm has been designed following a list of specifications as it should

(i) Exploit industrial time-series specificities.

(ii) Propose a fully multivariate solution.

(iii) Be robust to sensor incompleteness.

(iv) Display a high degree of explainability.

(v) Take into account operators' feedbacks.

While item (iv) eliminates the use of Deep-NNs, it is unclear if the item (i) seems to be absent in Machine Learning-based algorithms which view time-series as simple dots in corresponding high-dimensional spaces. The proposed model can be qualified as **Conventional** although it might optionally involve a small ML-like step that is not mandatory.

## C. Incremental Learning

As streaming data often involves normality drift (also called concept drift [25]), several algorithms have been designed with the notion of incremental rectification in mind.

More precisely, these attempts can be split into two categories:

*   **Model-batch Online Learning:** Most offline TSAD algorithms can be adapted to online use. In this case, while an initial and immutable offline model is run on the data stream, a feedback trigger on this model prediction can isolate short time windows where it performs poorly. New micro-models can be then trained on these time-frames to be aggregated in a bigger **Ensemble Model** all together with the initial offline one. This approach typically relies on the algorithm's ability to learn on small datasets.

*   **Passive / Active Online Learning:** On the other hand, some TSAD algorithms include an online learning mode themselves. One interesting property of these algorithms is that, as they are not divided in the multiple components of an extensive ensemble model, they maintain their explainability performances.

*   **Passive Online Learning:** After an initial offline learning step the model continues to adjust itself while processing the streaming data, under the hypothesis that in the absence of alarm-confirming feedback all points are inliners. In the presence of such feedback, the model stops its learning for the anomaly duration.

*   **Active Online Learning:** In this feedback-dependent approach, TSAD algorithms refine their parameters only on short time windows selected for poor performances. Despite a common methodology with the model-batch online learning, this approach is usually used with short datasets learning in mind. For Neural Networks, this approach is typically called *Fine Tuning*.

While both approaches can achieve similar performances, they mainly differ by their degrees of *explainability* which favors the Active online learning that induces *on-the-fly* updates that keep invariant the initial level of explainability. This is the reason why the proposed algorithms falls in the **Active Online Learning** category.

# III. THE PROPOSED MODEL

As this work is an extension of an existing one, its algorithmic foundations will be quickly skimmed over. A detailed description can be found in the original work [11].

## A. Notations

As explained below, the proposed algorithm addresses the case of $N_s$ sensors. The set of values of each sensor is clustered into several ($n_q$) representative values. This induces the need for the following notation:

*   $N_s$: Number of sensors in the given dataset.

*   $n_q$: Number of quantization clusters.

*   $T_{train}$: Time intervals used for the training part.

*   $s_t^{[i]}$: Value at instant $t$ of the $i$-th sensor.

*   $q_t^{[i]}$: Cluster at instant $t$ of the $i$-th sensor.

*   $c_T^{[i]}$: Ensemble of transition pairs for the $i$-th sensor given some $T$ time intervals.
## B. Normality characterizations over a measurement window

Working with a given training interval of measurements $\mathcal{T}_{train}$, for each sensor the time-series are discretized in $n_q$ balanced clusters of values named quantized versions. Then, at a given time instant $t \in \mathcal{T}_{train}$ and for a sensor $i$, quantized versions couples $c_t^{[i]}$ are created aggregating a starting quantized version $q_t^{[i]}$ and the quantized version $\Delta$-time units later, $q_{t+\Delta}^{[i]}$, such as:

$$c_t^{[i]} := (q_t^{[i]}, q_{t+\Delta}^{[i]}) \qquad (1)$$

These couples are called transitions pairs and represent the foundations of the proposed model. More precisely, for a sensor $i$, to represent the diversity of data paths that bring the time-series from a starting to a final quantized version in a given transition $c_t^{[i]} \in c_{\mathcal{T}_{train}}^{[i]}$, a configuration vector $w_t^{[i]}$ is defined by:

$$w_t^{[i]} := \{s_{t-\Delta+1}^{[i]}, \dots, s_{t-1}^{[i]}\} \cup \{s_t^{[1]}, \dots, s_t^{[N_s]}\} \qquad (2)$$

For a given sensor $i$ and a given visited transition $c \in c_{\mathcal{T}_{train}}^{[i]}$, the following notation is used:

$$\mathcal{W}_c^{[i]}(\mathcal{T}_{train}) := \{w_t^{[i]} | t \in [\mathcal{T}_{train}]_c^{[i]}\} \quad \text{where} \qquad (3)$$

$$[\mathcal{T}_{train}]_c^{[i]} := \{t \in \mathcal{T}_{train} | c_t^{[i]} = c\} \qquad (4)$$

to denote the set of configurations $\mathcal{W}_c^{[i]}(\mathcal{T}_{train})$ corresponding to the sensor $i$ witnessing a transition $c$ and the set of associated timestamps $[\mathcal{T}_{train}]_c^{[i]}$. From then, three sets of normality parameters (NP) are computed:

* **NP-1: The set of transitions:** Given a sensor $i$, its visited transitions are concatenated in a list. This list usually does not contain every theoretically possible cluster pairs, and its maximum length is $n_q^2$.

* **NP-2: The transition-labelled bounds on excursions:** Given a sensor $i$ and a transition $c \in c_{\mathcal{T}_{train}}^{[i]}$, a set of normality parameters can be extracted from the bounds of their domains of variations, namely $b_c^{[i]}$ and $\overline{b}_c^{[i]}$. More precisely, denoting by $w_j$ the $j$-th component of a given configuration vector $w$:

$$b_c^{[i]} := [\min_{w_j \in \mathcal{W}_c^{[i]}(\mathcal{T}_{train})} w_j]_{1 \le j \le \Delta + N_s} \in \mathbb{R}^{\Delta + N_s - 1} \qquad (5)$$

$$\overline{b}_c^{[i]} := [\max_{w_j \in \mathcal{W}_c^{[i]}(\mathcal{T}_{train})} w_j]_{1 \le j \le \Delta + N_s} \in \mathbb{R}^{\Delta + N_s - 1} \qquad (6)$$

Alternatively, percentiles can be used instead of extremums.

* **NP-3: The transition-labelled sensors configurations:** Given a sensor $i$ and a transition $c \in c_{\mathcal{T}_{train}}^{[i]}$, the cardinality of the configuration ensemble $\mathcal{W}_c^{[i]}(\mathcal{T}_{train})$ is reduced by representing each group of vectors showing a correlation greater than $\eta \in [0, 1]$ by a single representative vector. Optionally, a cutoff cardinality $n_v$ can be set up such as that any configuration ensemble exceeding it is to be clustered using a KMeans algorithm. In this case only, the proposed model flirts with the Machine Learning frontier.

The reduced configuration ensemble is written $\tilde{\mathcal{W}}_c^{[i]}(\mathcal{T}_{train})$.

## C. Definition of Residuals

Given a sensor $i$, three complementary residuals can be computed in association to the sets normality parameters defined in Section III-B. Each residual is computed as a single value over a time-frame $\mathcal{T}_{pred}$ containing $n_{pred}$ consecutive measurement samples:

* **Transitions-related residual $r_{trans}$:** It measures the number of unknown transitions appearing in $\mathcal{T}_{pred}$:

$$r_{\text{trans}}^{[i]}(\mathcal{T}_{\text{pred}}) := \left| \left\{ t \in \mathcal{T}_{\text{pred}} \mid c_t^{[i]} \notin c_{\mathcal{T}_{\text{train}}}^{[i]} \right\} \right| \qquad (7)$$

* **Domain-related residual $r_{bound}$:** It measures the deviation from the configuration ensemble excursion bounds in $\mathcal{T}_{pred}$:

$$r_{\text{bound}}^{[i]}(\mathcal{T}_{\text{pred}}) := \frac{1}{n_{\text{pred}}} \sum_{t \in \mathcal{T}_{\text{pred}}} \delta^{[i]}(t) \quad \text{where} \qquad (8)$$

$$\delta^{[i]}(t) := \frac{1}{N_s + \Delta - 1} \mathbf{dist} \left( w_t^{[i]}, \left[ \overline{b_c^{[i]}}, \overline{b_c^{[i]}} \right] \right) \qquad (9)$$

Where **dist** is the distance between a vector $w_t^{[i]} \in \mathbb{R}^{\Delta+N_s-1}$ and the normal hypercube in $\mathbb{R}^{\Delta+N_s-1}$ which is, for a real $\xi$ and a scalar interval $[\underline{\xi}, \overline{\xi}]$:

$$\mathbf{dist}(\underline{\xi}, \overline{\xi}) := \frac{\max\{0, \underline{\xi} - \xi\} + \max\{0, \xi - \overline{\xi}\}}{\overline{\xi} - \underline{\xi} + \epsilon} \qquad (10)$$

* **Configuration-related residual $r_{conf}$:** It measures the decorrelation between the clustered configuration ensembles and the time-frame configurations:

$$r_{\text{conf}}^{[i]}(\mathcal{T}_{\text{pred}}) := 1 - \min_{c \in c_{\mathcal{T}_{\text{pred}}}^{[i]}} \left( \frac{C_{\mathcal{T}_{\text{train}}}^{[i]}(\mathcal{T}_{\text{pred}}, c)}{\left| \mathcal{W}_{\mathcal{T}_{\text{pred}}}^{[i]} \right|} \right) \quad \text{where} \qquad (11)$$

$$C_{\mathcal{T}_{\text{train}}}^{[i]}(\mathcal{T}_{\text{pred}}, c) := \sum_{w \in \mathcal{W}_{\mathcal{T}_{\text{pred}}}^{[i]}} \max \left( \left| \text{corr}(w, \tilde{\mathcal{W}}_c^{[i]}(\mathcal{T}_{\text{train}})) \right| \right) \qquad (12)$$

## D. Incremental learning

Due to the explainability of the model, the steps needed to include Incremental Learning are quite straightforward. As a matter of fact, its IL ability relies on the two following updating mechanisms:

* **Updating following normality drift:** Upon normality drift confirmation, this mechanism extracts non-redundant normality characterizations from a selected time-frame $\mathcal{T}_{IL}$ and use them to update the associated characterization. In other words, the memorized transition sets and the configuration ensembles are concatenated with (respectively) the unseen transitions observed and the configuration vectors obtained from the selected time-frame, while the excursion bounds
are widened using the freshly-enhanced configuration ensembles $W_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL})$. More rigorously:

$$c_{\mathcal{T}_{train}, \mathcal{T}_{IL}}^{[i]} := c_{\mathcal{T}_{train}}^{[i]} \cup \{c \in c_{\mathcal{T}_{IL}}^{[i]} | c \notin c_{\mathcal{T}_{train}}^{[i]}\} \quad (13)$$

$$W_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL}) := \tilde{W}_c^{[i]}(\mathcal{T}_{train}) \cup \{w_t^{[i]} | t \in [\mathcal{T}_{IL}]_c^{[i]}\} \quad (14)$$

$$\underline{b}_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL}) := \left[ \min_{w \in W_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL})} w_j \right]_{1 \le j \le \Delta + N_s - 1} \quad (15)$$

$$\overline{b}_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL}) := \left[ \max_{w \in W_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL})} w_j \right]_{1 \le j \le \Delta + N_s - 1} \quad (16)$$

Moreover, a de-correlated (clustered) configuration ensemble can be computed from $W_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL})$ which is denoted hereafter by $\tilde{W}_c^{[i]}(\mathcal{T}_{train}, \mathcal{T}_{IL})$.

* Anomaly-informed normality correction: This is a much harder task than the previous one and far less commonly present despite of its relevance to industry. More precisely, the role of the updating algorithm here is to accommodate for undetected anomalies that are underlined by the operator's feedback. Two options are possible:

○ Manual updating: While analysing the sensor's transitions occurrences across the training set and selected time-frame, it might be possible to detect obvious anomalous patterns. In this case, for a given sensor, the model is able to surgically remove the pattern-compatible transitions from its normality characterization so that an alarm is raised should the fault materialize again.

○ Automatic updating: This is the case where the updating algorithm estimates an absolute correlation cutoff parameter $\eta_{IL}$ such that all memorized configuration vectors more correlated than $\eta_{IL}$ to any configuration vector of the anomalous time-frame are discarded:

$$\tilde{W}_c^{[i]}' = \{w \in \tilde{W}_c^{[i]} | \max|corr(w, W_c^{[i]}(\mathcal{T}_{IL}))| < \eta_{IL}\} \quad (17)$$

while minimizing the train set False Alarms and IL time-frame False Negatives across all sensors and sensor's transitions. Alternatively to rigorous optimization, this parameter can be set-up manually.

# IV. EVALUATION

## A. Experimental methodology

In order to emulate a blind industrial approach for the proposed algorithm, no hyper-parameter tuning step has been used. In both experiments, default settings were applied following the rule-of-thumb coined in [11], which are:

$n_f = 100$ (Time-frame length, see III-C)

$n_q = 8$ (Quantization, see III-B)

$\Delta = 20$ (Transition time-step, see (1))

$\eta = 0.95$ (Correlation threshold, see III-B)

$per_{b-} = 0.1$ (Lower bound percentile, see (5))

$per_{b+} = 99.9$ (Upper bound percentile, see (6))

$\epsilon = 1$ (Bounds deviation tolerance, see (10))

$n_v = 20$ (Config. ensembles cutoff cardinality, see III-B)

While the usual output of the algorithm is a detailed report of the stream using all three model characterization, it is

more convenient for the comparison's sake to generate only an aggregated score. Therefore, the final output is the maximum between the transition-related, domain-related and normalized configuration-related residuals across the sensors; with the reading-key that the score is proportional to the normality deviation.

In order to assess the Incremental Learning-increased performances, three metrics has been computed: the ROC-AUC (Receiving Operator Curve - Area Under Curve), the F1-score and the MTI (Merged Time-series Indicators [26], parameterized without anticipation). As both the F1-Score and the MTI need a binary prediction, they were computed over one hundred thresholds ranging from the 1st to the 99th percentiles of the aggregated score, and their highest (respective) values have been selected.

## B. Application to the Lorentz Attractor dataset

The Lorentz Attractor Blind Fault Detection Dataset [27] is a public synthetic TSAD dataset that contains data generated using the ODE governing the well-known Lorentz Attractor, which are

$$\dot{x}_1 = A(x_2 - x_1) \quad (18)$$

$$\dot{x}_2 = x_1(B - x_3) - x_2 \quad (19)$$

$$\dot{x}_3 = x_1x_2 - Cx_3 \quad (20)$$

Where the parameters A, B and C might be affected by unpredictable changes that one could raised as alarms. After an initial offline training on the first sixth of the data, the proposed model has been run on the test data (see Figure 2).

<figure><img src="image_4.png" /><figcaption>Fig. 2. Model initial run on the Lorentz Attractor dataset, with labelled novelty clusters.</figcaption></figure>

In this example, it is assumed in order to emulate an operator feedback scenario that cluster A novelties represent a new healthy context and should not raise any alarms. In order to accommodate for this operator feedback by updating the normality characterization as shown above, the model deployed its IL abilities on the short time-frame that is shown in Figure 3 which also show the new diagnosis of the post-IL model over the whole dataset.

Notice how the new model drastically reduces the alarms for Cluster A novelties while not significantly decreasing the prediction quality on the remaining truly faulty areas.

## C. Application to the SKAB dataset

The Skoltech Anomaly Benchmark (SKAB) [28] is a public TSAD dataset that contains raw data from a water
<figure><img src="image_5.png" /><figcaption>Fig. 3. After incrementally enhancing the model on the black square time-frame, the feedback-aware score is displayed on the Lorentz Attractor dataset.</figcaption></figure>

circulation system test bed, in which anomalies are injected in a controlled way. A preliminary analysis hints that three operative modes are available, and thus it was decided for this study to only focus on the third one (from timestamp "2020-03-09 10:14:33" onward). The train/test split is 30 % / 70 %, with a training restricted to the inliers points.

In the following scenario, an initial (offline trained) model has been run on the test data. As its initial output failed to raise an alarm around the first anomalous event (see Figure 4), it has been deemed necessary to run a transition diagnosis on this event in order to update the model normality space. After briefly skimming through the sensors transitions occurrence frequencies, it turned out that the *Volume Flow RateMS* sensor displayed a remarkable pattern for the transition (0, 0) (see Figure 5), and it was decided that it should be beneficial for the model to entirely remove this transition as a first Incremental Learning step.

<figure><img src="image_6.png" /><figcaption>Fig. 4. A comparison between the initial model and its version after being incrementally enhanced using the first SKAB outlier event. Only data around the first two SKAB anomalous events are displayed. O1 and O2 denote the two first labeled outliers in the test data.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 5. Occurrence frequencies of the *Volume Flow RateMS* transition (0, 0) over 100 consecutive points for the train set and around the first outlier of the test set. While this transition is not absent from the training part, it is overall uncommon. Thus, the crenel pattern of high occurrence frequencies displayed inside the undetected outlier area could be the anomaly manifestation. O1 denotes the first labeled outlier in the test data.</figcaption></figure>

After the first IL step the scenario picked up again, and the output started to show hints of normality drift (see Figure 6). After waiting an estimated long enough time to confirm this behavior, a short time-frame has been selected in order to realise a second IL step, this time enlarging the normality space to encompass the drift.

<figure><img src="image_8.png" /><figcaption>Fig. 6. A comparison between the post 1st IL model and its version after being a second time incrementally enhanced using a short time-frames presenting normality drifts. Only the first half of the SKAB test data is displayed.</figcaption></figure>

Finally, it has been decided to stop there the IL steps, as the two corrections seemed to be robust enough through time (see Figure 7). As seen on the Table I, each IL step enhances the proposed model.

<table><caption>TABLE I</caption><thead><tr><td>Model Iteration</td><td>ROC-AUC</td><td>F1-Score</td><td>MTI</td></tr></thead><tbody><tr><td>Initial</td><td>0.71</td><td>0.60</td><td>0.61</td></tr><tr><td>1st IL step</td><td>0.93</td><td>0.90</td><td>0.81</td></tr><tr><td>2nd IL step</td><td>0.95</td><td>0.92</td><td>0.84</td></tr></tbody></table>

Performance comparison between the three model iterations using TSAD metrics. The ROC-AUC evaluates the trade-off between True Positive Rate and False Positive Rate while the F1-Score focuses on Precision and Recall.

Finally, the MTI [26] is a time-aware metric that takes in account the quantity, the duration and the earliness of the alarms, along with the Recall.

## V. CONCLUSION

This contribution underlines the necessity of operator feedback in industrial monitoring and exposing the restrictions of current solutions in this domain, but also in term of explainability and physic system specificities exploitation, the foundations of the ideal algorithm are presented.

The proposed algorithm is an extension of an existing model-free, dynamic laws-inspired Time-Series Anomaly Detection algorithm toward the notion of Incremental Learning. Thanks to the multiple intuitive and dyadic systems related characterizations of normality, this model presents a high level of explainability while remaining relatively straightforward for the proposed Online Learning steps.

Across two examples the algorithm's Incremental Learning abilities are highlighted and shown to be in tune with the common industrial practice of operator feedback.
<figure><img src="image_9.png" /><figcaption>Fig. 7. Final comparison between the initial (top) model and its two incrementally enhanced iterations (bottom). First IL iteration has been trained on the undetected outlier and the second on the normality drift time-frame. All SKAB test data are displayed.</figcaption></figure>

Undergoing work aims at evaluating the proposed algorithm across an extensive benchmarks while comparing its performances against other state-of-the-art ones. Furthermore, the development of an operator fault diagnosis tool should emphasise its high explainability ability in industrial use-cases.

## REFERENCES

[1] K. Schwab, *The Fourth Industrial Revolution*, 2017.

[2] F. Raheem and N. Iqbal, "Artificial intelligence and machine learning for the industrial internet of things (iiot)," *Industrial Internet of Things*, pp. 1–20, 2 2022.

[3] H. Meghnoudj, B. Robu, and M. Alamir, "Sparse dynamical features generation, application to parkinson's disease diagnosis," *Eng. Appl. Artif. Intell.*, vol. 126, no. PB, feb 2024. [Online]. Available: https://doi.org/10.1016/j.engappai.2023.106882

[4] M. Pota, G. D. Pietro, and M. Esposito, "Real-time anomaly detection on time series of industrial furnaces: A comparison of autoencoder architectures," *Engineering Applications of Artificial Intelligence*, vol. 124, 9 2023.

[5] A. Mattioni, L. J. da Silva Moreira, H. Roustan, G. Besançon, and M. Fiacchini, "A step towards implementation of state observers in industrial aluminium smelters," *12th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes*, 2024.

[6] S. Schmidl, P. Wenig, and T. Papenbrock, "Anomaly detection in time series: A comprehensive evaluation," vol. 15. VLDB Endowment, 2022, pp. 1779–1797.

[7] A. Lavin and S. Ahmad, "Evaluating real-time anomaly detection algorithms-the numenta anomaly benchmark," 2015.

[8] L. Melgar-García, D. Gutiérrez-Avilés, C. Rubio-Escudero, and A. Troncoso, "Identifying novelties and anomalies for incremental learning in streaming time series forecasting," *Engineering Applications of Artificial Intelligence*, vol. 123, p. 106326, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0952197623005109

[9] J. Gama, P. Medas, G. Castillo, and P. Rodrigues, "Learning with drift detection," in *Advances in Artificial Intelligence – SBIA 2004*, A. L. C. Bazzan and S. Labidi, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2004, pp. 286–295.

[10] I. Souiden, M. N. Omri, and Z. Brahmi, "A survey of outlier detection in high dimensional data streams," *Computer Science Review*, vol. 44, p. 100463, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1574013722000107

[11] M. Alamir and R. Dion, "Model-free unsupervised anomaly detection framework in multivariate time-series of industrial dynamical systems," 2024. [Online]. Available: https://arxiv.org/abs/2405.08349

[12] M. M. Moya, M. W. Koch, and L. D. Hostetler, "One-class classifier networks for target recognition applications," 1 1993. [Online]. Available: https://www.osti.gov/biblio/6755553

[13] S. Han, X. Hu, H. Huang, M. Jiang, and Y. Zhao, "Adbench: Anomaly detection benchmark," 2022.

[14] K. Shaukat, T. Alam, S. Luo, S. Shabbir, I. Hameed, J. Li, S. Abbas, U. Javed, and A. K., "A review of time-series anomaly detection techniques: A step to future perspectives," *Advances in Intelligent Systems and Computing*, vol. 1363 AISC, p. 865 – 877, 2021.

[15] V. Chandola, A. Benerjee, and V. Kumar, "Anomaly detection: A survey," *ACM Computing Surveys*, vol. 41, pp. 1–58, 2009.

[16] J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, "Do deep neural networks contribute to multivariate time series anomaly detection?" *Pattern Recognition*, vol. 132, p. 108945, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S00313202322004253

[17] A. Siffer, P. Fouque, A. Termier, and C. Largouet, "Anomaly detection in streams with extreme value theory," 2017.

[18] A. Pandya, O. Odunsi, C. Liu, A. Cuzzocrea, and J. Wang, "Adaptive and efficient streaming time series forecasting with lambda architecture and spark," in *2020 IEEE International Conference on Big Data (Big Data)*, 2020, pp. 5182–5190.

[19] X. Zhou, C. Chang, J. Wu, and K. Liu, "Information-value-based feature selection algorithm for anomaly detection over data streams," in *Technical Gazette / Tehnički Vjesnik*, vol. 21, 2014, p. 223.

[20] G. Al-Falouji, C. Gruhl, T. Neumann, and S. Tomforde, "A heuristic for an online applicability of anomaly detection techniques," in *2022 IEEE International Conference on Autonomic Computing and Self-Organizing Systems Companion (ACSOS-C)*, 2022, pp. 107–112.

[21] F. T. Liu, K. M. Ting, and Z.-H. Zhou, "Isolation forest," 2008, pp. 413–422.

[22] H. Bao and Y. Wang, "A c-svm based anomaly detection method for multi-dimensional sequence over data stream," in *2016 IEEE 22nd International Conference on Parallel and Distributed Systems (ICPADS)*, 2016, pp. 948–955.

[23] W. Yu, W. Cheng, C. C. Aggarwal, K. Zhang, H. Chen, and W. Wang, "Netwalk: A flexible deep embedding approach for anomaly detection in dynamic networks," in *Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining*, ser. KDD '18. New York, NY, USA: Association for Computing Machinery, 2018, p. 2672–2681. [Online]. Available: https://doi.org/10.1145/3219819.3220024

[24] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, "Robust anomaly detection for multivariate time series through stochastic recurrent neural network," in *Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining*, ser. KDD '19. New York, NY, USA: Association for Computing Machinery, 2019, p. 2828–2837. [Online]. Available: https://doi.org/10.1145/3292500.3330672

[25] A. Bifet and R. Kirkby, "Data stream mining a practical approach," 2009. [Online]. Available: https://apisemanticscholar.org/CorpusID:116780483

[26] R. Dion, M. Alamir, and T. Le Magueresse, "Anticipation, earliness, alarm cardinality: A new metric for industrial time-series anomaly detection," in *SAFEPROCESS 2024 - 12th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes*. Ferrara, Italy: IFAC, Jun. 2024. [Online]. Available: https://hal.science/hal-04577634

[27] M. Alamir, "mazenalamir/lorentz-tractor-blind-fault-detection-dataset: dataset for benchmarking blind anomalies detectors," Jun. 2023. [Online]. Available: https://doi.org/10.5281/zenodo.8012462

[28] I. D. Katser and V. O. Kozitsin, "Skoltech anomaly benchmark (skab)," https://www.kaggle.com/dsv/1693952, 2020.