Method of detecting anomalies in physical system and corresponding microcontroller and computer program product

Abstract

The disclosure relates to a method of detecting anomalies of a physical system and a corresponding microcontroller and computer program product. A computer-implemented method for generating a model for anomaly detection in a system includes obtaining a matrix of learning data corresponding to normal operation of the system, decomposing the matrix of learning data into singular values of the matrix of learning data, calculating a new basis, defining a maximum Mahalanobis distance threshold representing a limit of normal operation of the system, and generating a model for anomaly detection in the system. And defining an anomaly detection model from the new basis and from the maximum Mahalanobis distance threshold.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of French Patent Application No. 2306065, filed on June 14, 2023, which is hereby incorporated herein by reference. Technical Field

[0003] Anomaly detection (or "outlier detection") is a technique for identifying data that is significantly different from other data. These different data are often called "anomalies" or "outliers". Background Art

[0004] Anomaly detection is of interest in many applications. Some applications use microcontrollers that can be configured to implement anomaly detection.

[0005] Anomaly detection implemented by a microcontroller enables real-time monitoring using data acquired by at least one sensor in a physical system to detect abnormal behavior in this system. This technology can be used in various fields such as automotive, aerospace, energy, manufacturing, health monitoring and many others.

[0006] There are several anomaly detection techniques. Some methods are based on machine learning. These methods use machine learning algorithms to identify any data that does not correspond to the learned model.

[0007] In the context of anomaly detection, a microcontroller generally analyzes data collected by at least one sensor in the system using a model that represents the normal behavior of the system.

[0008] In particular, the model is used to compare current data collected by at least one sensor with data of normal behavior. If the current data differs too much from the expected data, then this may indicate an anomaly or malfunction in the system. In this case, an alarm may be triggered to warn the operator of the system.

[0009] The anomaly detection thus achieved enables warning of damage and failure of the system. This enables improving the reliability and safety of the system.

[0010] The model for detecting anomalies can be obtained using a machine learning algorithm. A computer server can be used to implement the machine learning algorithm for obtaining the model.

[0011] In particular, the machine learning algorithm is configured to use data representing the normal behavior of the system to generate a model for anomaly detection. Using such a machine learning algorithm has the advantage of avoiding feeding the machine learning algorithm with abnormal data to generate the model. This is because deliberately generating anomalies in the system to obtain abnormal data can be difficult and expensive.

[0012] Known models that can be generated by such machine learning algorithms generally have the disadvantage of comprising a large number of parameters involving relatively complex processing of the data by the microcontroller and occupying a large amount of memory space of the microcontroller.

[0013] Therefore, there is a need to propose a solution for obtaining a model for anomaly detection that is easily implemented by a microcontroller. Summary of the invention

[0014] According to one aspect, a computer-implemented method for generating a model for anomaly detection in a physical system is provided, the method comprising:

[0015] - obtain a matrix of learning data corresponding to the normal operation of the system,

[0016] - decompose the learning data matrix into singular values ​​in order to obtain an orthogonal input matrix, a diagonal matrix, and an orthogonal output matrix,

[0017] - determine the rank of the learning data matrix with energy above a threshold from the diagonal matrix,

[0018] - computing a new basis formed by the columns of the orthogonal input matrix selected according to the determined rank,

[0019] - Define the maximum Mahalanobis that represents the limit of normal operation of the system

[0020] Distance threshold,

[0021] - Define an anomaly detection model from the new basis and from the maximum Mahalanobis distance threshold.

[0022] This method uses decomposition into singular values ​​and a maximum Mahalanobis distance threshold to define an anomaly detection model. Decomposition into singular values ​​enables obtaining an anomaly detection model that is robust to noise and interference.

[0023] The decomposition into singular values ​​also enables the systematic acquisition of an invertible matrix of the projected learning data. It is therefore always possible to compute the Mahalanobis distance from this invertible matrix.

[0024] The model obtained can then be integrated in a microcontroller of a system in order to enable the detection of anomalies during the operation of this system.Such a model has the advantage of occupying a relatively small memory space.

[0025] In an advantageous embodiment, defining a maximum Mahalanobis distance threshold comprises:

[0026] - Project the learning data onto the new basis,

[0027] - calculate the Mahalanobis distance for each learning data,

[0028] - Define the maximum Mahalanobis distance threshold from the calculated Mahalanobis distances.

[0029] Advantageously, the method further comprises calculating a covariance matrix and a precision matrix from the projected learning data and from the mean of the projected learning data, the calculation of the Mahalanobis distance is performed from the projected learning data, from the precision matrix and from the calculated mean, and the anomaly detection model defined therein further comprises the precision matrix and the mean.

[0030] In a variation, defining the maximum Mahalanobis distance threshold includes defining the maximum Mahalanobis distance threshold from a chi-square table.

[0031] In a variant, in an advantageous embodiment, the method further comprises transforming the new basis, the transformation being suitable for normalizing the projected learning data, and the anomaly detection model then comprises the new transformed basis and a maximum Mahalanobis distance threshold.

[0032] This transformation makes it possible to avoid storing the precision matrix in the anomaly detection model, since the precision matrix then corresponds to the identity matrix. Therefore, the anomaly detection model only includes the new transformed basis and the maximum Mahalanobis distance threshold.

[0033] According to another aspect, a computer-implemented method for anomaly detection in a physical system is provided, comprising:

[0034] - obtaining an anomaly detection model generated from learning data corresponding to normal operation of the system according to the generation method as described above,

[0035] - obtain data representative of the operation of the system,

[0036] - projecting data representing the operation of the system onto the basis of the anomaly detection model,

[0037] - calculate the Mahalanobis distance from the projected data,

[0038] - compare the calculated Mahalanobis distance with the maximum Mahalanobis distance threshold defined in the anomaly detection model,

[0039] - If the calculated Mahalanobis distance is greater than the maximum Mahalanobis distance threshold, then an anomaly is detected.

[0040] This approach has the advantage of being able to be implemented by a microcontroller, since the microcontroller implements only two operations, projecting the data representing the operation of the system onto the basis of the model, and calculating the Mahalanobis distance.

[0041] Advantageously, the calculation of the Mahalanobis distance is performed using the projected data, the precision matrix and the mean of the anomaly detection model.

[0042] According to another aspect, a computer program product is provided, comprising instructions, which, when executed by a computer, cause the computer to implement the method for generating an anomaly detection model as described above.

[0043] According to another aspect, a computer program product is provided, comprising instructions. When the program is executed by a computer, the instructions enable the computer to implement the anomaly detection method as described above.

[0044] According to another aspect, a microcontroller is provided, comprising:

[0045] - a non-transitory memory having recorded therein a computer program for detecting anomalies as described above,

[0046] - a processing unit, or processor, configured to execute this computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Other advantages and features of the present invention will become apparent upon review of the detailed description of non-limiting embodiments and from the accompanying drawings, in which:

[0048] Figure 1 A first embodiment of a method for generating an anomaly detection model is illustrated;

[0049] Figure 2 A second embodiment of a method for generating an anomaly detection model is illustrated;

[0050] Figure 3 A microcontroller configured to implement a method for detecting anomalies in a matrix of data is illustrated; and

[0051] Figure 4 A method used by a microcontroller to implement anomaly detection in a matrix of data is illustrated. DETAILED DESCRIPTION

[0052] Figure 1 A first embodiment of a method for generating an anomaly detection model is illustrated. The method for generating an anomaly detection model is implemented by a computer.

[0053] This approach is used to define models that determine the limits of the normal behavior of a physical system.

[0054] In particular, such a method can be implemented by a computer server. The server then comprises a non-transitory memory in which a computer program comprising instructions is stored, which, when implemented by the server, causes the server to implement the generation method.

[0055] The method comprises a step 10 of obtaining learning data. In this step 10, learning data are supplied to the server. Learning data are data representing the normal behavior of the physical system. These data may be acquired, for example, by at least one sensor of this system during normal operation of the system.

[0056] The learning data is grouped in a matrix X. The matrix X has a size of, for example, m×n.

[0057] The method then comprises a step 11 of implementing a decomposition into singular values. In this step 11, the server proceeds to decompose the matrix X into singular values. This step 11 enables the matrix X of the learning data to be factorized into three matrices U, Σ and V. In particular, the matrices U, Σ and V are defined such that the matrix X and the matrix product UΣV T Corresponding. Then the matrix U is an orthogonal matrix of size m×m. The matrix Σ is a diagonal matrix of size m×n, containing the singular values ​​of the matrix X (i.e., the matrix X T X or XX T The square root of the eigenvalue of ), and V is an orthogonal matrix of size n×n.

[0058] The matrix V contains K n The matrix of orthogonal basis vectors of is called the "input vector". Therefore, the matrix V is the orthogonal input matrix.

[0059] The matrix U contains K m The matrix of orthogonal basis vectors of is called the “output vector”. Therefore, the matrix U is an orthogonal output matrix.

[0060] This singular value decomposition makes it possible to reduce the dimensionality of the matrix X of the learning data while preserving the important characteristics of the matrix X. Thus, the decomposition into singular values ​​makes it possible to compress the matrix X and reduce its memory footprint while retaining only the vectors corresponding to the most important singular values.

[0061] The method then comprises a step 12 of calculating a new basis. In this step 12, the server calculates a new basis V' from the matrix Σ obtained by means of the decomposition into singular values.

[0062] In particular, the step 12 of calculating the new basis V' comprises determining the rank of the matrix of learning data having an energy corresponding to a predefined energy threshold. More particularly, the total energy of the matrix of learning data corresponds to the sum of the squares of the singular values ​​of this matrix, the singular values ​​being contained in the diagonal matrix Σ obtained by singular value decomposition. The rank determined in this step 12 corresponds to the rank of the matrix of learning data having an energy reaching a predefined energy threshold (i.e. the number of singular values ​​that enables this energy threshold to be reached). The energy threshold may correspond to a predefined percentage relative to the total energy of the matrix of learning data.

[0063] The step 12 of calculating a new basis consists in selecting the columns of the matrix V corresponding to the determined rank of the matrix of learning data. The columns of said matrix V then form a new basis V'. This new basis V' makes it possible to retain only the columns of the basis V corresponding to the most important singular values, ie those that contribute most to the total energy of the matrix.

[0064] The method then comprises a projection step 13. In this step 13, the server projects the learning data onto a new basis V'. The projection corresponds to a matrix product between the learning data and the new basis V'.

[0065] The server thus obtains a projected matrix. This projected matrix is ​​systematically invertible.

[0066] Then, the method comprises a transformation step 14. In this transformation step 14, the server uses an algorithm to normalize the data of the projected matrix. This step 14 enables the calculation of the transformed basis V". In particular, the transformed basis V" can be obtained according to the following expression:

[0067] where n represents the number of rows in the learning matrix, V' is the new basis, and S' is the truncated diagonal matrix of the singular value decomposition.

[0068] This step 14 makes it possible to obtain the central unit variance matrix from the projected matrix. The matrix obtained is centered around zero. This transformation makes it possible to obtain a precision matrix corresponding to the unit matrix.

[0069] Then, the method comprises a step 15 of calculating Mahalanobis distances. In this step 15, the server calculates the Mahalanobis distances for each learning data. Each Mahalanobis distance can be calculated because the covariance matrix corresponding to the projection is systematically invertible due to the singular value decomposition and only considering components with large singular values.

[0070] Specifically, the Mahalanobis distance is calculated using the following formula:

[0071]

[0072] where x is the vector corresponding to the projected data items, μ is the vector corresponding to the mean of the projected learning data, and ∑ -1 corresponds to the precision matrix (i.e., the inverse of the covariance matrix).

[0073] By applying step 14, the Mahalanobis distance is simplified to the Euclidean distance. It can be expressed as follows: where x is the vector corresponding to the projected and normalized data items, and μ is the vector corresponding to the mean of the projected and normalized learning data.

[0074] Then, the method comprises a step 16 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum Mahalanobis distance threshold. This maximum Mahalanobis distance threshold represents the limit of normal behavior of the system. For example, the maximum threshold is defined as a distance greater than the Mahalanobis distance associated with 98% of normal data projected onto the basis V' and normalized.

[0075] The anomaly detection model is then defined. This anomaly detection model includes the basis V', the precision matrix and the maximum Mahalanobis distance threshold. In a variant, the detection model only includes the basis V" and the maximum Mahalanobis distance threshold after the transformation using step 14, because the precision matrix is ​​then the identity matrix, which is known and therefore does not need to be stored.

[0076] Next, this anomaly detection model is integrated into the microcontroller of the system. In particular, the anomaly detection model is stored in the non-volatile memory of the microcontroller. This detection model has the advantage of occupying relatively little space in the memory of the microcontroller.

[0077] Figure 2 A second embodiment of a method for generating an anomaly detection model is illustrated.

[0078] This approach is used to define models that determine the limits of the normal behavior of a physical system.

[0079] In particular, the method can be implemented by a computer server. The server comprises a non-transitory memory in which a computer program comprising instructions is stored, which, when implemented by the server, causes the server to implement the generation method.

[0080] The method comprises a step 20 of obtaining learning data. In this step 20, learning data are supplied to the server. Learning data are data representing the normal behavior of the system. These data may be acquired, for example, by at least one sensor of this system during normal operation of the system.

[0081] The learning data is grouped in a matrix X. The matrix X has a size of, for example, m×n.

[0082] The method then includes implementing a step 21 of decomposing into singular values. In this step 21, the server proceeds to decompose the matrix X into singular values. This step 21 enables the learning data matrix X to be factorized into three matrices U, Σ and V. In particular, the matrices U, Σ and V are defined such that the matrix X and the matrix product UΣV T Corresponding. Then the matrix U is an orthogonal matrix of size m×m. The matrix Σ is a diagonal matrix of size m×n, containing the singular values ​​of the matrix X (i.e., the matrix X T X or XX T The square root of the eigenvalue of ), and V is an orthogonal matrix of size n×n.

[0083] The matrix V contains K n The matrix of orthogonal basis vectors of is called the "input vector". Therefore, the matrix V is the orthogonal input matrix.

[0084] The matrix U contains K m The matrix of orthogonal basis vectors of is called the “output vector”. Therefore, the matrix U is an orthogonal output matrix.

[0085] This singular value decomposition makes it possible to reduce the dimensionality of the matrix X of the learning data while preserving the important characteristics of the matrix X. Thus, the decomposition into singular values ​​makes it possible to compress the matrix X and reduce its memory footprint while retaining only the vectors corresponding to the most important singular values.

[0086] The method then comprises a step 22 of calculating a new basis V'. In this step 22, the server calculates a new basis V' from the matrix Σ obtained by means of a singular value decomposition.

[0087] In particular, the step 22 of calculating the new basis V' comprises determining the rank of the matrix of learning data having an energy corresponding to a predefined energy threshold.

[0088] The step 22 of calculating a new basis consists in selecting the columns of the matrix V corresponding to the rank of the determined matrix of learning data. The columns of the matrix V then form a new basis V'.

[0089] The method then comprises a transformation step 23. This step 23 enables the calculation of the transformed basis V". In particular, the transformed basis V" corresponds to the following expression:

[0090] where n represents the number of rows of the learning matrix, V' is the new basis, and S' is the truncated diagonal matrix of the singular value decomposition.

[0091] The method next comprises a step 24 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum Mahalanobis distance threshold. This maximum Mahalanobis distance threshold represents the limit of normal behavior of the system. In this embodiment, the maximum Mahalanobis distance threshold is defined from a chi-square table. This is because the Mahalanobis distance follows the chi-square law. Therefore, the maximum Mahalanobis distance threshold can be defined from such a table.

[0092] Then define an anomaly detection model. This anomaly detection model includes a basis V', a precision matrix and a maximum Mahalanobis distance threshold. In a variant, the detection model only includes the basis V" and the maximum Mahalanobis distance threshold after the transformation using step 14, because then the precision matrix is ​​the identity matrix, which is known and therefore does not need to be stored.

[0093] This anomaly detection model is finally integrated in the microcontroller of the system, and in particular, the anomaly detection model is stored in a non-volatile memory of the microcontroller. This detection model has the advantage of occupying relatively little space in the memory of the microcontroller.

[0094] Figure 3 The figure shows a microcontroller MCU configured to implement an abnormality detection method in a matrix of data. Figure 4 Describe this approach.

[0095] The microcontroller MCU comprises a processor UT and a non-transitory memory MEM. The non-transitory memory MEM comprises a computer program PRG comprising instructions which, when implemented by the processor UT of the microcontroller, cause the processor UT of the microcontroller to implement an anomaly detection method.

[0096] The computer program PRG includes a model MDL defined by the model generation method described above. In particular, the model MDL includes a new transformed basis V" and a maximum Mahalanobis distance threshold MTS of the anomaly detection model. In a variant example, the model MDL may include a new basis V', a precision matrix and a maximum Mahalanobis distance threshold.

[0097] The microcontroller can be integrated in a system that needs to be monitored for operational anomalies. The microcontroller can be configured to receive data acquired by the system's sensors. These acquired data then represent the operation of the system.

[0098] Figure 4 A method used by a microcontroller to implement anomaly detection in a matrix of data representing operation of a system is illustrated.

[0099] The method comprises a step 30 of obtaining a matrix of data to be analyzed. In this step 30, the microcontroller obtains a vector of data to be analyzed. These data to be analyzed can be obtained from sensors of the system.

[0100] Then, the method comprises a projection step 31. In this step 31, the data to be analyzed are projected onto a transformed basis V" of an anomaly detection model stored in a non-transitory memory of the microcontroller. The projection corresponds to a matrix product between the data to be analyzed and the transformed basis V".

[0101] This projection of the data to be analyzed makes it possible to obtain a vector of projected data.

[0102] The method then comprises a step 32 of calculating the Mahalanobis distance. In this step 32, the microcontroller calculates the Mahalanobis distance from the projected and normalized data.

[0103] The method then comprises a step 33 of determining the presence of anomalies in the matrix of data. In this step 34, the microcontroller compares the value of the calculated Mahalanobis distance with a maximum threshold value stored in a non-transitory memory of the microcontroller.

[0104] If the value of the calculated Mahalanobis distance is below the maximum threshold, the microcontroller considers that the vector of data represents normal behavior of the system ( Figure 3 Status NRML).

[0105] If the value of the calculated Mahalanobis distance is above a maximum threshold, the microcontroller considers that the vector of data represents an anomaly in the behavior of the system ( Figure 3 OTLR state in). In this case, the microcontroller can generate an alarm signal to notify the user of the system of the malfunction of the system. This detection method is useful when access to abnormal data is limited or costly. One example is rotating machine fault prediction. That is, most industrial processes do not have abnormal data for their rotating machines. Therefore, they can adopt the embodiment abnormal presence detection using acceleration data to detect various types of rotating machine faults, such as bearing faults, misalignment and imbalance. In response to detecting a fault, an operator alarm signal can be generated, or the operation of the machine can be directly modified (e.g., slowed down) or stopped by the controller. Another example is detecting abnormal behavior in a sensor network, where the embodiment abnormal presence detection can be used to detect the occurrence of abnormal events such as forest fires or air pollution, and generate corresponding alarm signals.

[0106] Of course, the present invention is capable of various variations and modifications that would be apparent to a person skilled in the art. For example, instead of implementing a transformation that normalizes the projection of the learning data onto a basis, a method for generating an anomaly detection model may include calculating a covariance matrix, a precision matrix (i.e., the inverse of the covariance matrix), and a mean from the projection of the learning data onto a new basis V'. This precision matrix and the calculated mean are then used to obtain the Mahalanobis distance calculated in this generation method. The generated detection model then also includes this precision matrix and the calculated mean. In this case, the anomaly detection method includes calculating the Mahalanobis distance using this precision matrix and the stored mean.

[0107] However, projecting the data onto the transformed basis makes it possible not to calculate the precision matrix, since the precision matrix in this case corresponds to the identity matrix. This transformation also makes it possible to avoid storing the precision matrix in the microcontroller.

Claims

1. A computer-implemented method for generating an anomaly detection model in a physical system, the method comprising: obtaining a learning data matrix including learning data and corresponding to normal operation of the physical system; Decomposing the learning data matrix into singular values ​​of the learning data matrix, thereby generating an orthogonal input matrix, a diagonal matrix, and an orthogonal output matrix; determining the rank of the learning data matrix having an energy above a threshold from the diagonal matrix; computing a new basis having columns of an orthogonal input matrix selected according to the determined rank; generating a maximum Mahalanobis distance threshold representing a limit of normal operation of the physical system; as well as Generate an anomaly detection model from the new basis and from the maximum Mahalanobis distance threshold.

2. The method of claim 1, wherein generating a maximum Mahalanobis distance threshold comprises: Project the learning data onto the new basis; Calculate a separate Mahalanobis distance for each learning data; as well as A maximum Mahalanobis distance threshold is generated from the individual Mahalanobis distances calculated.

3. The method according to claim 2 also includes calculating a covariance matrix and a precision matrix from the projected learning data and from the mean of the projected learning data, calculating a separate Mahalanobis distance includes calculating a separate Mahalanobis distance from the projected learning data, from the precision matrix and from the mean, and the generated anomaly detection model also includes the precision matrix and the mean. 4 . The method of claim 1 , wherein generating a maximum Mahalanobis distance threshold comprises generating the maximum Mahalanobis distance threshold from a chi-square table.

5. The method according to claim 2 further includes transforming the new basis to standardize the projected learning data, and the anomaly detection model includes the transformed new basis and a maximum Mahalanobis distance threshold.

6. The method according to claim 1, further comprising: obtaining operational data representing actual operation of the physical system; Projecting operational data representing actual operations of the physical system onto a new basis for the anomaly detection model; Calculate the projected Mahalanobis distance from the projected operational data; Compare the calculated projection's Mahalanobis distance with the generated maximum Mahalanobis distance threshold; as well as An anomaly is detected in response to the calculated Mahalanobis distance of the projections being greater than a maximum Mahalanobis distance threshold.

7. The method of claim 6, wherein calculating the projected Mahalanobis distance is performed using the projected operational data, the precision matrix, and the mean of the anomaly detection model.

8. A non-transitory computer readable medium storing computer instructions for generating an anomaly detection model in a physical system, the computer instructions, when executed by a processor, causing the processor to perform the following steps: obtaining a learning data matrix including learning data and corresponding to normal operation of the physical system; Decomposing the learning data matrix into singular values ​​of the learning data matrix, thereby generating an orthogonal input matrix, a diagonal matrix, and an orthogonal output matrix; determining the rank of the learning data matrix having an energy above a threshold from the diagonal matrix; computing a new basis having columns of an orthogonal input matrix selected according to the determined rank; generating a maximum Mahalanobis distance threshold representing a limit of normal operation of the physical system; as well as Generate an anomaly detection model from the new basis and from the maximum Mahalanobis distance threshold.

9. The non-transitory computer readable medium of claim 8, wherein the computer instructions that cause the processor to generate a maximum Mahalanobis distance threshold value include further computer instructions that cause the processor to perform the following steps: Project the learning data onto the new basis; Calculate a separate Mahalanobis distance for each learning data; and A maximum Mahalanobis distance threshold is generated from the individual Mahalanobis distances calculated.

10. The non-transitory computer readable medium of claim 9 storing further computer instructions causing a processor to perform the following steps: A covariance matrix and a precision matrix are calculated from the projected learning data and from the mean of the projected learning data, calculating a separate Mahalanobis distance includes calculating a separate Mahalanobis distance from the projected learning data, from the precision matrix, and from the mean, and the generated anomaly detection model also includes the precision matrix and the mean.

11. The non-transitory computer readable medium of claim 8, wherein the computer instructions that cause the processor to generate a maximum Mahalanobis distance threshold value include further computer instructions that cause the processor to perform the following steps: Generates the maximum Mahalanobis distance threshold from the chi-square table.

12. The non-transitory computer readable medium of claim 9 storing further computer instructions that cause a processor to perform the following steps: The new basis is transformed to normalize the projected learning data, and the anomaly detection model includes the transformed new basis and a maximum Mahalanobis distance threshold.

13. The non-transitory computer readable medium of claim 8 storing further computer instructions that cause a processor to perform the following steps: obtaining operational data representing actual operation of the physical system; Projecting operational data representing actual operations of the physical system onto a new basis for the anomaly detection model; Calculate the projected Mahalanobis distance from the projected operational data; Compare the calculated projection's Mahalanobis distance with the generated maximum Mahalanobis distance threshold; as well as An anomaly is detected in response to the calculated Mahalanobis distance of the projections being greater than a maximum Mahalanobis distance threshold.

14. A microcontroller configured to generate an anomaly detection model in a physical system, the microcontroller comprising: non-volatile memory, including instructions; and A processor in communication with the non-transitory memory, wherein the processor executes instructions to: obtaining a learning data matrix including learning data and corresponding to normal operation of the physical system; Decomposing the learning data matrix into singular values ​​of the learning data matrix, thereby generating an orthogonal input matrix, a diagonal matrix, and an orthogonal output matrix; determining the rank of the learning data matrix having an energy above a threshold from the diagonal matrix; computing a new basis having columns of an orthogonal input matrix selected according to the determined rank; generating a maximum Mahalanobis distance threshold representing a limit of normal operation of the physical system; as well as Generate an anomaly detection model from the new basis and from the maximum Mahalanobis distance threshold.

15. The microcontroller of claim 14, wherein the processor executing instructions to generate a maximum Mahalanobis distance threshold comprises the processor executing instructions to: Project the learning data onto the new basis; Calculate a separate Mahalanobis distance for each learning data; and A maximum Mahalanobis distance threshold is generated from the individual Mahalanobis distances calculated.

16. The microcontroller of claim 15, further comprising a processor executing instructions to: A covariance matrix and a precision matrix are calculated from the projected learning data and from the mean of the projected learning data, calculating a separate Mahalanobis distance includes calculating a separate Mahalanobis distance from the projected learning data, from the precision matrix, and from the mean, and the generated anomaly detection model also includes the precision matrix and the mean.

17. The microcontroller of claim 14, wherein the processor executing instructions to generate a maximum Mahalanobis distance threshold comprises the processor executing instructions to generate a maximum Mahalanobis distance threshold from a chi-square table.

18. The microcontroller according to claim 15, further comprising a processor executing instructions to transform the new basis to standardize the projected learning data, the anomaly detection model comprising the transformed new basis and a maximum Mahalanobis distance threshold.

19. The microcontroller of claim 14, further comprising a processor executing instructions to: obtaining operational data representing actual operation of the physical system; Projecting operational data representing actual operations of the physical system onto a new basis for the anomaly detection model; Calculate the projected Mahalanobis distance from the projected operational data; Compare the calculated projection's Mahalanobis distance with the generated maximum Mahalanobis distance threshold; as well as An anomaly is detected in response to the calculated Mahalanobis distance of the projections being greater than a maximum Mahalanobis distance threshold.

20. The microcontroller of claim 19, wherein the processor executing instructions to calculate the projected Mahalanobis distance comprises the processor executing instructions to use the projected operational data, the precision matrix, and the mean of the anomaly detection model.

Images