Interpretable, Multidimensional, Multimodal Anomaly Detection with Negative Sampling for Detection of Device Failure

Complex devices are connected daily and eagerly generate vast streams of\nmultidimensional state measurements. These devices often operate in distinct\nmodes based on external conditions (day/night, occupied/vacant, etc.), and to\nprevent complete or partial system outage, we would like to recognize as early\nas possible when these devices begin to operate outside the normal modes.\nUnfortunately, it is often impractical or impossible to predict failures using\nrules or supervised machine learning, because failure modes are too complex,\ndevices are too new to adequately characterize in a specific environment, or\nenvironmental change puts the device into an unpredictable condition. We\npropose an unsupervised anomaly detection method that creates a negative sample\nfrom the positive, observed sample, and trains a classifier to distinguish\nbetween positive and negative samples. Using the Contraction Principle, we\nexplain why such a classifier ought to establish suitable decision boundaries\nbetween normal and anomalous regions, and show how Integrated Gradients can\nattribute the anomaly to specific variables within the anomalous state vector.\nWe have demonstrated that negative sampling with random forest or neural\nnetwork classifiers yield significantly higher AUC scores than Isolation\nForest, One Class SVM, and Deep SVDD, against (a) a synthetic dataset with\ndimensionality ranging between 2 and 128, with 1, 2, and 3 modes, and with and\nwithout noise dimensions; (b) four standard benchmark datasets; and (c) a\nmultidimensional, multimodal dataset from real climate control devices.\nFinally, we describe how negative sampling with neural network classifiers have\nbeen successfully deployed at large scale to predict failures in real time in\nover 15,000 climate-control and power meter devices in 145 Google office\nbuildings.\n