MVAD: MVAD: MultiVariate Anomaly Detection
In lanl-ansi/MVAD: MultiVariate Anomaly Detection

Description Details preprocess_data functions train_model function get_residual functions get_anomaly_score functions MVAD S3 object type Author(s)

A package for computing Mahalanobis and conditional probability scores of VAR(k) residuals in streaming real-time data to be used in multivariate anomaly detection.

The MVAD package provides four main important functions: preprocess_data, train_model, get_residual, and get_anomaly_score. This library was born from anomaly detection done in the power grid at Los Alamos National Laboratory. Results from this approach and methods for parameter selection can be found in a paper Real-time Anomaly Detection and Classification in Streaming PMU Data.

The preprocess_data functions are used to format data to a unit- independent representation. Inverse functions are present to express model predicted values in original units.

The train_model function is used to fit a VAR(p) model on the training data using the parameters and data supplied to the anomaly_detection data structure

The get residual function uses the trained model to calculate residuals of the testing data supplied.

The anomaly score functions calculate the conditional probability of each variables' residual sepraretly and the overall multivariate residual distrance from the learned models error term.

This package revolves around a simple S3 object type. The MVAD object contains the parameters of the anomaly detection, the preprocessing steps, the detection model, the residuals, and the scores. It is a simple way to release this package, while maintaining little tech debt. The following is a complete MVAD object, i.e., after calling the previous 4 functions.

dt.ad: params: num_vars (Integer) tau (Integer) data_resolution (Integer) num_lag_terms (Integer) raw_training_data (data.table) raw_testing_data (data.table) coarse_data (data.table) linearized_data: linearized_data (data.table) detrend_parameter_m (Float) detrend_parameter_b (Float) normalized_data: standardized_data (data.table) standardized_stds (list) model (VAR model*) detrended_eval_data (data.table) predict_x_expected (data.table) predict_x_observed (data.table) covariance_matrices (data.table) residuals (data.table) scores (data.table) The MVAD object is updatedand appended from the relevant functions.

* VAR model

Christopher Hannon

lanl-ansi/MVAD documentation built on July 24, 2020, 3:45 a.m.