Analytics & ML · Study deck

Time-Series Anomalies: Machine Learning

A motor can sound healthy while its vibration pattern starts to shift.

Data Dora is your guide for this deck.

anomalytimeseries

After studying this chapter

Learning objectives

You will be able to:

Select features for isolation-forest and autoencoder detectors.
Connect a model score to a reviewable alert threshold.
Explain: A motor can sound healthy while its vibration pattern starts to shift.
Explain: deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.

Major section

Start With the Decision

A motor can sound healthy while its vibration pattern starts to shift.

A learned model must flag that shift and still show why the score rose.
A learned model may find that weak pattern.
The first choice is still the field decision: warn, inspect, slow down, or do nothing.

Major section

ML-Based Anomaly Detection

deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.

Scores changes in timing, phase, and sequence shape.
ML anomaly models are sensitive to training data.

ML belongs where the anomaly type demands it: collective or high-dimensional patterns often need learned models, while point and contextual anomalies may still be better served by simpler statistical or time-series methods.

Major section

ML-Based Anomaly Detection (continued)

Anomaly detection helps a team decide which unusual readings need review.

It must also show why an alert can be trusted.
In Figure: An IoT anomaly detector is a review loop, the Data Stream contains readings and logs.
A: Threshold is the boundary between normal, warning, and critical results: Actions state what happens next.

An IoT anomaly detector is a review loop: stream data becomes features, features feed a scoring model, thresholds route actions, and operator feedback tunes the next baseline.

Major section

ML-Based Anomaly Detection (continued)

Several cases can look alike in raw data.

The process may have failed, or the sensor may be faulty.
Data may be missing, a normal seasonal pattern may be present, or the threshold may fit the wrong operating mode.
For example, a vibration sensor sends motion readings, event counts, and maintenance logs.

Deck summary

Key takeaways

A motor can sound healthy while its vibration pattern starts to shift.

deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.
Anomaly detection helps a team decide which unusual readings need review.
Several cases can look alike in raw data.

Retrieval practice

Recall check 1 of 6

Data Dora says: answer from memory, then check your reasoning.

Q1When is an ML anomaly detector justified over a simple statistical threshold?

AWhen abnormal evidence is a multi-feature pattern, learned representation, or sequence that a simple threshold cannot express.

BWhen the dashboard needs a more advanced algorithm name, even if one stable sensor threshold explains the fault.

CWhen no baseline, threshold policy, review record, or sensor-health check is available for the alert.

DWhen sensor-health checks are inconvenient, so model scores should replace missing input evidence.

Show answer

Answer: A ML detectors should be chosen for evidence boundaries that simpler methods cannot represent.

Retrieval practice

Recall check 2 of 6

Data Dora says: answer from memory, then check your reasoning.

Q2A motor fault appears as a joint change in vibration, current, and heat while each value alone stays near normal. Which feature set best fits a multivariate anomaly detector?

AA device identifier and dashboard colour without the fault's sensor values.

BThe single largest vibration value with no matching current or heat data.

CReadings from unrelated windows and machines treated as one motor fault.

DAligned vibration, current, heat and mode features from one window.

Show answer

Answer: D A shared window and mode let the detector learn a joint normal pattern across the measured signals.

Retrieval practice

Recall check 3 of 6

Data Dora says: answer from memory, then check your reasoning.

Q3Why should an ML anomaly alert store the feature vector, model version, score, threshold, and sensor-health state?

ABecause model family names alone reproduce alert evidence, even when features, version, and threshold are missing.

BBecause sensor-health state is unrelated to process alerts, so bad probes cannot create false anomalies.

CBecause the raw anomaly score gives a stable measure of severity that can be compared directly across model updates.

DBecause those fields make the alert reviewable, reproducible, and retestable when data or models drift.

Show answer

Answer: D ML anomaly alerts need the same evidence discipline as statistical alerts, plus model and feature provenance.

Retrieval practice

Recall check 4 of 6

Data Dora says: answer from memory, then check your reasoning.

Q4What evidence should an IoT anomaly alert preserve so it can be reviewed?

AOnly a final label plus chart screenshot, because the baseline, threshold, context, and sensor-health evidence can be reconstructed later.

BOnly the raw sensor value and model family, without the operating context, threshold version, or persistence rule that made it alert.

COnly the most recent score, because anomaly detectors should not keep baseline windows, threshold versions, or sensor-health state.

DThe normal baseline, anomaly score, threshold or model rule, context, persistence rule, and sensor-health state.

Show answer

Answer: D Anomaly detection is a reviewable scoring pipeline, not just a final alert label.

Retrieval practice

Recall check 5 of 6

Data Dora says: answer from memory, then check your reasoning.

Q5Why should the worked z-score detector use a persistence or confirmation rule before raising an operational alert?

ABecause the earliest threshold crossing should trigger a response, and waiting for another reading would miss the useful intervention window.

BBecause repeated high readings establish a process trend, letting the detector accept the sensor's health status without further checks.

CBecause a second sensor may share the same fault, confirmation should rely on repeated readings from the original sensor instead.

DBecause a single high score may be noise, a sensor fault, or a transient sample rather than a sustained process anomaly.

Show answer

Answer: D Candidate scoring and operational alerting are separate design decisions.

Retrieval practice

Recall check 6 of 6

Data Dora says: answer from memory, then check your reasoning.

Q6Why is accuracy a weak headline metric for many IoT anomaly detectors?

ABecause accuracy excludes false alarms, making operator workload invisible by definition.

BBecause fault samples dominate, making normal behaviour too rare to measure.

CBecause normal samples dominate, making high accuracy easy without finding rare faults.

DBecause alert thresholds are unrelated to the workload caused by false alarms.

Show answer

Answer: C Imbalanced anomaly data requires metrics that reveal both misses and alert burden.

Print reference

Answers 1 of 2

Answer key.

A · ML detectors should be chosen for evidence boundaries that simpler methods cannot represent.
D · A shared window and mode let the detector learn a joint normal pattern across the measured signals.
D · ML anomaly alerts need the same evidence discipline as statistical alerts, plus model and feature provenance.
D · Anomaly detection is a reviewable scoring pipeline, not just a final alert label.
D · Candidate scoring and operational alerting are separate design decisions.

Print reference

Answers 2 of 2

Answer key.

C · Imbalanced anomaly data requires metrics that reveal both misses and alert burden.