Sensor anomaly detection is often sold as a model problem. In practice, it is a systems problem. The model must understand normal variation, handle missing data, adjust to operating regimes, and produce alerts that humans can act on.
A good anomaly detector does not simply find unusual points. It finds unusual points that matter.
Types of Sensor Anomalies
| Type | Description | Example |
|---|---|---|
| Point anomaly | one observation is unusual | sudden pressure spike |
| Contextual anomaly | value is unusual for the current condition | high temperature during low load |
| Collective anomaly | sequence pattern is unusual | slow vibration increase over days |
| Sensor fault | measurement is wrong | stuck value or calibration drift |
| Process anomaly | system behavior is genuinely abnormal | bearing degradation |
Distinguishing sensor faults from process anomalies is critical. The operational response is different.
Start With Strong Baselines
Before applying deep learning, build baselines:
- rolling median and robust z-scores;
- seasonal decomposition residuals;
- control charts;
- simple forecasting residuals;
- rule-based domain limits.
These baselines are interpretable and often catch data pipeline issues. They also provide a benchmark for more complex methods.
Model Approaches
Common approaches include:
- forecasting residuals: predict the next value and flag large errors;
- reconstruction models: train autoencoders to reconstruct normal behavior;
- density models: estimate whether a point lies in a low-probability region;
- change-point detection: detect regime shifts rather than isolated spikes;
- multivariate monitoring: track relationships between sensors.
Multivariate methods are often necessary because many failures appear as changed relationships, not extreme single-sensor values.
Thresholds and Alert Fatigue
Thresholds should be chosen against operational capacity and risk. A detector that produces too many alerts becomes ignored.
Practical threshold design:
- define severity bands rather than one binary flag;
- suppress duplicate alerts within the same incident;
- require persistence for noisy signals;
- include domain limits that bypass statistical uncertainty;
- review false positives with operators.
Alert quality is a product metric. It should be measured.
Monitoring the Detector
The detector itself needs monitoring:
- alert volume by asset and site;
- percentage of alerts investigated;
- time from alert to action;
- confirmed incident rate;
- sensor missingness and stuck values;
- drift in baseline operating regimes.
If the detector changes behavior after a maintenance procedure, software update, or sensor replacement, retraining may not be the first response. The correct response may be recalibration or metadata repair.
Conclusion
Sensor anomaly detection succeeds when data science is connected to operations. The model should be evaluated not only by detection metrics, but by whether it improves inspection, maintenance, safety, or reliability decisions.
The best systems combine simple baselines, robust thresholds, domain constraints, and clear response workflows. Complexity is useful only when it reduces missed incidents or unnecessary alarms in the real environment.
References
- Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3).
- Basseville, M., & Nikiforov, I. V. (1993). Detection of Abrupt Changes: Theory and Application. Prentice Hall.
- Montgomery, D. C. (2019). Introduction to Statistical Quality Control (8th ed.). Wiley.
- Hundman, K., et al. (2018). Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding. KDD.
