# A Correlation-Change Based Feature Selection Method for IoT Equipment Anomaly Detection
## 4 Methodology
### Data Representation of Correlation Changes  
In Algorithm 1, for a set of correlated features we would select all the features because of only one feature's anomaly. Obviously, this is an inefficient data representation. To our mind, the selected features should be uncorrelated with each other, i.e., we need a low rank approximation to select the most informative features for each feature cluster when feature correlation changes happen. Fortunately, this has been widely discussed, and we conduct feature selection following the MCFS method [9]. The MCFS method analyses the feature correlation based on the recent feature sequence, and generates the important score for each feature. Based on feature importance, we select the dominant features with the largest scores. Based on the above idea, we refine our feature selection algorithm as shown in Algorithm 4. For each feature set, we first conducted curve alignment (lines 6-11) to generate the time lags of all features. Then we applied the MCFS method to the feature sequence within the sliding window (line 12), and generated the dominant feature set as the selected features. It is noted that we do not conduct curve alignment for each pair of correlated features since we assume the features in the same feature set are highly correlated, and the time lags of feature pairs are consistent with each other. Herein, we just need a baseline for comparison. Without any correlation change, we can make a random selection. However, when there are correlation changes, we need to avoid the abnormal features since the time lag achieved by the SGEM method does not make sense. To that end, we selected the most dominant feature of the results of the MCFS method, because we believe that most of the features turn out to be normal, including the selected dominant feature, which is a safe choice for the baseline feature (line 13). After calculating the MCFS scores of each feature, we rank the feature importance according to the calculated MCFS scores from high to low, and select k features with the highest MCFS scores (line 15). For Algorithm 4, we setup the parameter \(\Delta\) as 0.2. Because we consider a pair of features not so correlated when their correlation coefficient is smaller than 0.8, if the correlation coefficient decreases more than 0.2, it has to be smaller than 0.8. ```
Input: feature sequence \(x_{1},\ x_{2},\ldots,x_{t},\ldots\);  correlated feature set \(C_{1},C_{2},\ldots,C_{k}\); \(\Delta\); #predefined correlation changes threshold \(\underline{\text{{Disize}}}\); #the set of data segment size for correlated features \(k\); #the quantity of features to be selected Output: selected feature sequence \(y_{1},y_{2},\ldots,y_{t},\ldots\);
1 For each correlated feature set \(C_{i}\)
2 make a random selection for \(\underline{\text{{base}}}[C_{i}]\);
3 End for
4 For each arriving feature \(x_{t}\)
5 For each correlated feature set \(C_{i}\)
6\(\underline{\text{{timelags}}}=()\);
7 For each pair of features \(a^{(\underline{\text{{base}}})},a^{(j)}\) in \(C_{i}\)
8\(\underline{\text{{seg}}}=\text{{Disize}}\left(a^{(\underline{\text{{base}}})},a^{(j)}\right)\);
9\(\left(\underline{\text{{timelag}}},\underline{\text{{cor}}}\right)\gets SGEM \left(a^{(\underline{\text{{base}}})},a^{(j)},\underline{\text{{seg}}}\right)\);
10\(\text{Add}\left(a^{(1)},a^{(j)},\underline{\text{{timelag}}}\right)\) to \(\underline{\text{{timelags}}}\);
11\(\Delta T=\underline{\text{{seg}}}\) if \((\Delta T<\underline{\text{{seg}}})\);
12 End for
13\(y_{t}^{i}=MCFS(C_{i},\underline{\text{{timelags}}},t,\Delta T)\);
14\(\underline{\text{{base}}}\)\([C_{i}]=y_{t}^{i}[0]\);
15 End for
16 Select \(k\) features from all \(y_{t}^{i}\) with the top \(k\) MCFS scores
17 End for
```  
**Algorithm 4** Feature selection based on feature importance. Figure 3 shows the revised workflow of our method. We first investigated the structure of the correlated sensors and the appropriate sliding window size used for correlation monitoring; then we utilized such a priori knowledge for online curve alignment.