# An Unsupervised Anomaly Detection Based on Self-Organizing Map for the Oil and Gas Sector
## 4 Results and Discussions
### The Algorithm Evaluation  
In the second phase of the research work, level 1 and level 2 anomalous readings are analysed on the output map. As performed previously, the level 1 and level 2 outlier test data were first unified and then standardized with the mean and variance of the input dataset. Figure 15 represents all readings of levels 1 and 2 projected onto the output map. The green circles in Figure 15a represent the level 1 and 2 anomaly readings generated by the VM3 shut-off valve. The new input data are arranged in four distinct clusters. The first two clusters are projected close to the border of the green area and the edge of the orange-coloured steady state. The readings of the first two levels of VM3 are similar to those of these two clusters. The last two clusters represent the readings of level 2. They are placed within the area of the reservoir anomaly since the system in both situations has the same incoming water flow rate. The red area on the map represents the cluster in which the source network distributes the anomalous readings of the system caused by the occlusion of the pipe connecting the ejector outlet to the inlet of the holding tank. Level 1 and level 2 anomaly test data from the VM5 valve are shown using red circles. These new input data, recording lower occlusions than level 3, are distributed to the sides of the red area. The first readings of anomaly 5 level 1 deviate from the red area board and are located at the board of the air anomaly macro area (Figure 15b). The purple circles represent the data from the level 1 and level 2 anomalous tests of the VM6 shut-off valve. Again, the new data are projected into the edge of the corresponding anomalous area since, once more, the occlusions are less severe than those of level 3 (Figure 15c). The brown circles depict the first two degrees of occlusion generated by the VM7 shut-off valve on the output map. The data recorded from these two tests show a reduced obstruction of the air intake duct. The system is ready and immediately returns to the steady-state condition; this is why level 1 and 2 readings are projected between the brown and orange areas of the steady-state data (Figure 15d). The network separates the data from levels 1 and 2 of anomaly 8 into four major clusters, each symbolized by a pink cross. Due to their reduced intensity, all level 1 measurements are projected near the regime data zone. Level 2 measures, on the other hand, are situated close to the edge of the anomaly 8 level 3 region and have a bigger valve opening (Figure 15e). Figure 14: Airflow sensor readings and samples in the box [6; 10]. The color legend can be consulted in Table 4.  
Figure 15: _Cont._  
By providing the algorithm with data from levels 1 and 2 of anomaly 9, all readings are projected into three clusters marked with a grey line. In addition, because the occlusions are smaller than those in level 3, the data are also projected near to the regime zone, notably in the transient zone. (Figure 15f). The VM10 manual shut-off valve simulates the loss of water from the tank. The yellow area of the map at the bottom right contains the level 3 VM10 readings. The map shows the network level 1 and 2 readings as separate clusters of yellow rhombi positioned throughout the network. Even slightly opening VM10 makes the system unstable and prevents it from finding a new equilibrium point. While level 1 readings, due to their lower intensity, are projected to be close to the regime zone, level 2 readings are projected to be close to the yellow area (Figure 15g). Moreover, the confusion matrix is used to verify the effectiveness of the algorithm. Figure 16 represents the confusion matrix, and Table 6 compiles the findings after sending the network level 1 and 2 anomaly values as input. Figure 16: Levels 1 and 2 confusion matrix. Figure 15: Output map for level 1 and level 2 anomalies samples.