# A Correlation-Change Based Feature Selection Method for IoT Equipment Anomaly Detection
## 4 Methodology
### Feature Clustering Based Curve Alignment  
One may argue the idea of feature clustering since the correlations of features transitivity is not strictly followed, i.e., features A and B are correlated; features A and C are correlated; but features B and C may not be correlated. In this case, there is no suitable partition for the clustering.  
We admit the feature clustering may get a confusing result when the features transitivity is not strictly followed. However, according to our observation, in industrial environments, sensors are always duplicated when they are deployed. For example, to monitor the temperature of a bearing, there are always multiple sensors deployed from different angles on the same bearing. As a result, in normal cases, such sensors always get the similar data. As a result, in this paper, we assume that the feature correlation transitivity is strictly followed.  
To conduct sensor clustering, we needed to define the similarity of a pair of features. Since we wanted to cluster the features that are highly correlated together, for each pair of features, we selected a set of historical data segments, and studied the feature correlations based on such data segments. If the two features are correlated on most of the data segments, we took the two features as correlated features, and combined them into the same cluster.  
To capture time-lagged correlations among sensors, we conducted curve alignment when we studied the correlations of a pair of features, and made use of the SGEM (Smooth Generalized Expectation Maximization) [14] method to realize the curve alignment.  
Formally, our method works as shown in Algorithm 2. We applied a hierarchical clustering based algorithm on the original feature space to cluster them into groups. Initially, we set each feature as a cluster. And we iteratively combine the clusters when they are correlated for most of the data segments according to the SGEM method's output. Here, SGEM(\(D_{k},i,j\)) randomly selects a feature from cluster \(i\) and cluster \(j\), and conducts SGEM method on data segment \(D_{k}\) to generate the correlation coefficient and corresponding time lag. When no clusters could be further combined, we stopped our algorithm.  
In Algorithm 2, we wanted to focus on the strong correlated features, therein we setup \(\varepsilon\) as 0.8 so that we only considered a pair of features to be correlated when their correlation coefficient is no smaller than 0.8. For the parameter _ratio_, since we simply want to combine highly correlated features, we setup _ratio_ as 1.  
```
Input: feature space \(a^{(1)},a^{(2)},\ldots,a^{(d)}\);  Offline Data segments \(D_{1},\ D_{2},\ldots,D_{m}\); \(c\); #predefined correlation threshold ratio; #predefined ratio to correlated features Output: feature clusters \(C_{1},C_{2},\ldots\);
1 Initialize all feature as a single cluster;
2 While (1)
3 For each cluster \(C_{i}\) and \(C_{j}(i\
eq j)\)
4 For each data segment \(D_{k}\)
5 \((timelag,cor)\gets SGEM(D_{k},i,j)\)
6 If \((cor>\varepsilon)\)\(count\)++;
7
8 End if
9 End for
10 If \((count/|C_{i}|\Big{|}C_{j}\Big{|}\geq ratio)\)
11 Combine clusters \(C_{i}\) and \(C_{j}\);
12 End if
13 End for
14 If (no clusters are combined in this iteration)
15 Break;
16 End if
17 End while
```  
**Algorithm 2** Curve alignment based feature clustering algorithm.