An abnormal data detection method and system based on hierarchical feature engineering
By employing a hierarchical feature engineering approach, the issues of universality and accuracy in existing detection schemes are addressed, enabling efficient and automated anomaly detection of panel data and improving detection accuracy and efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- FUDAN UNIVERSITY
- Filing Date
- 2026-03-05
- Publication Date
- 2026-05-29
AI Technical Summary
Existing technologies lack versatility and transferability, have limited detection accuracy, ignore the temporal continuity of panel data, and fail to provide feedback on correction information.
We employ a hierarchical feature engineering approach, which involves dataset preparation, basic feature construction, hierarchical feature vector construction, correction model generation and optimization, and utilizes unsupervised and supervised machine learning algorithms for anomaly detection.
It achieves cross-industry and cross-scenario versatility, improves detection accuracy and recall, and can continuously optimize the detection model to reduce false positive rate and improve processing efficiency.
Smart Images
Figure CN121786643B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data processing technology, and in particular to an abnormal data detection method and system based on hierarchical feature engineering. Background Technology
[0002] Data quality inspection and anomaly identification are crucial to ensuring the value of panel data. Low-quality panel data containing anomalies or conflicting records can directly negatively impact AI model parameter estimation, industrial production decisions, and enterprise risk assessment.
[0003] Existing specialized data inspection solutions lack versatility and portability. By solidifying domain-specific expertise into data inspection rules, their application scope is strictly limited. Inspection solutions developed for a particular industry are deeply tied to that industry's specific data patterns, making them unsuitable for direct application to other industries. Their low technology reusability makes them unsuitable as widely deployable, universal panel data quality control tools.
[0004] General outlier detection schemes have limited accuracy. They rely on the statistical distribution characteristics of the data, treating all numerical outliers as anomalies, failing to distinguish between reasonable data fluctuations and genuine data errors. Because their judgment criteria lack any business logic or contextual information, the accuracy and recall of the detection results are insufficient to meet the demands of high-standard data analysis.
[0005] Current technological approaches generally overlook the temporal continuity of panel data. The core characteristic of panel data is that it records the state of the same individual at multiple points in time. Current technological approaches either view data points in isolation or only analyze short-term series fluctuations, neither of which can verify the logical consistency of an individual's long-term development trajectory.
[0006] Correction information cannot be fed back into the recognition scheme. Existing technical solutions are mostly one-way processes, and correction information cannot be fed back to optimize the recognition scheme and achieve continuous iterative optimization of judgment capabilities.
[0007] For example, in prior art 1: CN109345408A, there is a method for identifying abnormal data in power systems based on long short-term memory networks, which focuses on identifying abnormal parameters such as grid load and voltage.
[0008] Existing technology 2: CN114428775A A method and system for online quality monitoring of real-time production data in oil fields, which establishes a monitoring model for indicators such as production pressure and temperature of oil wells.
[0009] Prior Art 3: CN109857817A A method for detecting outliers in electrical energy data, which uses statistical criteria to define the confidence interval of normal values and combines cluster analysis to identify data points that cannot be classified into any normal cluster as outliers.
[0010] Existing technology 4: CN110807014B A method and system for detecting anomalies in power data by integrating multiple algorithms. The method integrates multiple algorithms to comprehensively evaluate multiple outlier indicators such as the local density of data points and the distance to nearest neighbors, and makes a final judgment by cross-validation. Summary of the Invention
[0011] This invention addresses the problems of existing dedicated data detection schemes lacking versatility and transferability, and general outlier detection schemes having limited detection accuracy, ignoring the temporal continuity of panel data, and failing to provide feedback on correction information. It provides an outlier data detection method and system based on hierarchical feature engineering.
[0012] To solve the above-mentioned technical problems, the present invention provides the following technical solution:
[0013] An anomaly detection method based on hierarchical feature engineering for panel data includes: dataset preparation, which involves preparing the full dataset, training set, and validation set. Prepare the dataset to be detected;
[0014] Basic feature construction involves placing the training set onto the full dataset and using an anomaly processor to parse the historical time-series data of each entity in the training set, constructing basic features for each record. ;
[0015] Hierarchical feature vectors The initial model is constructed by inputting the basic features of the training set into an unsupervised machine learning algorithm. Initial model Output hierarchical feature vectors of the training set ;
[0016] Correction model The generation and optimization of the validation set With hierarchical feature vectors A calibration model is implemented using supervised machine learning algorithms. Generation and optimization;
[0017] Anomaly detection model The determination of the calibration model If convergence is achieved, then the correction model at this point... For abnormal data detection model ;
[0018] Anomaly detection, using anomaly data detection models The dataset to be tested is analyzed to detect abnormal records.
[0019] As a preferred option, the calibration model The generation and optimization include:
[0020] Step 1: Extracting false positive records and retrieving the first validation set. The first verification set Place it on the full dataset and use an exception handler to build the validation set. The basic features are input into the initial model. To obtain the initial model For the validation set Based on the analysis results, the initial model is extracted. For the validation set All misjudgment records in the analysis results ;
[0021] Step 2, Model Calibration The generation of misjudgment records Compared with the initial model A supervised machine learning algorithm based on hierarchical features generated from the training set is used to generate a calibration model. ;
[0022] Step 3, Model Calibration The evaluation, the validation set that has never been used Randomly select the verification set , verification set Place it on the full dataset, invoke the exception handler, and construct the validation set. Basic features Using the current calibration model For the validation set Basic features The analysis yields the current correction model. Regarding the validation set All misjudgment records in the analysis results The model was calibrated based on multiple performance indicators. Conduct an assessment;
[0023] Step 4, calibrate the model Optimization, extraction of calibration model For the validation set All misjudgment records in the analysis results Record the misjudgment Compared with the initial model Based on the hierarchical feature input of the training set, a supervised machine learning algorithm is used to obtain the optimized correction model. .
[0024] As a preferred option, anomaly detection model The determination of the repeated correction model Evaluation and correction model Optimization based on the input validation set For the calibration model Optimize until the model is corrected. If multiple performance metrics converge, then the current calibration model... For abnormal data detection model .
[0025] Preferred performance metrics include accuracy, precision, recall, and F1 score.
[0026] As preferred methods, supervised machine learning algorithms include random forest, gradient boosting decision tree classification, and neural network classification.
[0027] As a preferred option, hierarchical feature vectors The construction includes:
[0028] basic feature vectors The construction of the record r for the i-th entity involved in the training set. i By querying the entity's historical data in the full dataset, an anomaly detector is used to build r. i basic feature vector ;
[0029] Hierarchical feature vectors The construction of the basic feature vector Input an unsupervised machine learning algorithm to obtain an initial model. Initial model For the basic feature vector Perform anomaly analysis to obtain anomaly score sets. Abnormal scoring set Constructing hierarchical feature vectors .
[0030] As preferred options, unsupervised learning algorithms include the Isolation Forest algorithm, the Single-Class Support Vector Machine algorithm, or the Autoencoder algorithm.
[0031] As a preferred option, the full dataset is a dataset containing records of all entities for all years; the training set is a high-quality dataset selected from the full dataset using a training set generation tool; the validation set is a dataset selected from the full dataset using a validation set generation tool and a specific number of records are copied. The quantitative indicators of the copied records are subjected to random numerical perturbations between 0.1 and 10 times. If the original record is labeled as true, the label is 1; if the perturbed record is labeled as false, the label is 0.
[0032] To address the aforementioned technical problems, this invention also provides an anomaly data detection system based on hierarchical feature engineering, which is used to implement an anomaly data detection method based on hierarchical feature engineering.
[0033] This invention, by adopting the above technical solutions, has significant technical effects:
[0034] This invention enables its technical framework to be universally applicable across industries and scenarios by constructing continuous basic features rather than relying on business rules specific to a particular field.
[0035] This invention optimizes the model through subsequent supervised machine learning algorithms, enabling the model to learn and correct errors in detection, thereby improving the accuracy and recall of detection results. It utilizes deeper temporal logic information, resulting in high recognition accuracy while avoiding the inability to transfer and reuse information.
[0036] This invention quantifies whether a data point conforms to the historical development trajectory of its respective entity by calculating correlation indicators between the recorded data and its own historical data; it effectively identifies those values that are not extreme, thus reducing the false judgment rate.
[0037] This invention constructs a feedback loop through a technical framework combining unsupervised machine learning-based model generation and supervised machine learning-based model optimization. The system can use the set of false positive records detected as a learning set, and by feeding this learning set into a supervised learning algorithm, it can perform targeted optimization of the overall detection framework. The detection model possesses the ability to continuously optimize; as its application deepens and validation data accumulates, its detection performance will continuously improve.
[0038] This invention transforms the data cleaning process, which originally required extensive expert knowledge and manual intervention, into a highly automated workflow. Users no longer need to write complex rules for each different dataset. At the same time, the model's optimization mechanism can reduce repetitive manual review work, significantly improve the efficiency of processing large-scale panel data, and reduce labor costs. Attached Figure Description
[0039] Figure 1 This is a flowchart illustrating the implementation of the present invention.
[0040] Figure 2 This is a flowchart illustrating the generation process of the correction model of this invention.
[0041] Figure 3 This is a flowchart illustrating the optimization process of the correction model of this invention.
[0042] Figure 4-1 This is a distribution chart of data anomaly scores.
[0043] Figure 4-2 To correct the model performance graph.
[0044] Figure 4-3 Benford's theorem test chart for key financial fields in the full dataset of the "China Industrial Enterprises Database (1998-2013)" before cleaning.
[0045] Figure 4-4 Benford's theorem test chart for key financial fields in the full dataset of the cleaned "China Industrial Enterprises Database (1998-2013)". Detailed Implementation
[0046] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.
[0047] Example 1
[0048] An anomaly detection method based on hierarchical feature engineering. Figure 1 In panel data, the methods include: dataset preparation, including the preparation of the full dataset, training set, and validation set. Prepare the dataset to be detected;
[0049] Basic feature construction involves placing the training set onto the full dataset and using an anomaly processor to parse the historical time-series data of each entity in the training set, constructing basic features for each record. ;
[0050] Hierarchical feature vectors The initial model is constructed by inputting the basic features of the training set into an unsupervised machine learning algorithm. Initial model Output hierarchical feature vectors of the training set ;
[0051] Correction model The generation and optimization of the validation set With hierarchical feature vectors A calibration model is implemented using supervised machine learning algorithms. Generation and optimization;
[0052] Anomaly detection model The determination of the calibration model If convergence is achieved, then the correction model at this point... For abnormal data detection model ;
[0053] Anomaly detection, using anomaly data detection models The dataset to be tested is analyzed to detect abnormal records.
[0054] Figure 2 In the middle, the calibration model The generation uses the initial model. For the validation set Perform analysis and extract the initial model. In the validation set Misjudgment records generated above Record the misjudgment With the initial model The generated hierarchical features of the training set are input into a supervised machine learning algorithm to obtain a corrected model. .
[0055] Figure 3 In the middle, the calibration model Optimization using the current calibration model sequentially on the validation set The analysis extracts the set of misjudgments generated by the current calibration model on the current validation set. , misjudgment record set The hierarchical features generated from the initial model are then input into a supervised machine learning algorithm to calibrate the model. Optimization and correction model Once convergence is achieved, the calibration model at this point will be... Determined as an anomaly data detection model .
[0056] Correction model The generation and optimization include:
[0057] Step 1: Extracting false positive records and retrieving the first validation set. The first verification set Place it on the full dataset and use an exception handler to build the validation set. The basic features are input into the initial model. To obtain the initial model For the validation set Based on the analysis results, the initial model is extracted. For the validation set All misjudgment records in the analysis results ;
[0058] Step 2, Model Calibration The generation of misjudgment records Compared with the initial model A supervised machine learning algorithm based on hierarchical features generated from the training set is used to generate a calibration model. ;
[0059] Step 3, calibrate the model The evaluation, the validation set that has never been used Randomly select the verification set , verification set Place it on the full dataset, invoke the exception handler, and construct the validation set. basic features Using the current calibration model For the validation set basic features The analysis yields the current correction model. Regarding the validation set All misjudgment records in the analysis results The model was calibrated based on multiple performance indicators. Conduct an assessment;
[0060] Step 4, calibrate the model Optimization, extraction of calibration model For the validation set All misjudgment records in the analysis results Record the misjudgment Compared with the initial model Based on the hierarchical feature input of the training set, a supervised machine learning algorithm is used to obtain the optimized correction model. .
[0061] Anomaly detection model Once the determination is made, repeat step 3 to calibrate the model. Evaluation and Step 4 Correction Model Optimization based on the input validation set For the calibration model Optimize until the model is corrected. If multiple performance metrics converge, then the current calibration model... For abnormal data detection model .
[0062] Supervised machine learning algorithms include random forest algorithms, gradient boosting decision tree classification algorithms, and neural network classification algorithms.
[0063] Hierarchical feature vectors The construction includes:
[0064] basic feature vectors The construction of the record r for the i-th entity involved in the training set. i By querying the entity's historical data in the full dataset, an anomaly detector is used to build r. i basic feature vector ;
[0065] Hierarchical feature vectors The construction of the basic feature vector Input an unsupervised machine learning algorithm to obtain an initial model. Initial model For the basic feature vector Perform anomaly analysis to obtain anomaly score sets. Abnormal scoring set Constructing hierarchical feature vectors .
[0066] Unsupervised learning algorithms include the Isolation Forest algorithm, the Single-Class Support Vector Machine algorithm, or the Autoencoder algorithm.
[0067] The full dataset includes records of all entities for all years; the training set is a high-quality dataset selected from the full dataset using a training set generation tool; the validation set is a set of records selected from the full dataset using a validation set generation tool, which copies a specific number of records, and randomly perturbs the quantitative indicators of the copied records by a factor of 0.1 to 10. The original records are labeled as true with a label of 1, and the perturbed records are labeled as false with a label of 0, thus forming the validation set.
[0068] Example 2
[0069] In this embodiment, the full dataset is the "China Industrial Enterprise Database (1998-2013)". The original "China Industrial Enterprise Database" files for all years from 1998 to 2013 are merged to form a full dataset containing the historical records of all large-scale Chinese enterprises from 1998 to 2013. The full dataset is loaded into the system through the data loading module of the human-computer interaction interface, serving as a contextual reference library for subsequent feature engineering. Using a training set generation tool, enterprise entity records with continuous operation for many years and complete key financial indicators are selected from the full dataset. Records for certain years from some enterprise entities are randomly selected to form a high-confidence training set of approximately 15,000 records. Using a validation set generation tool, 1000 enterprise entity records with continuous operation for many years and complete key financial indicators are selected from the full dataset. Each enterprise record is copied, and 12 randomly selected key financial indicators (such as "zczj" total assets and "yylr" operating profit) of the copied records are subjected to random numerical perturbations between 0.1 and 10 times. The original records are labeled as true (label 1), and the perturbed records are labeled as false (label 0), forming a validation set containing 2000 rows. This process is repeated n times to generate n independent validation sets for iterative optimization of the model. Year-conflict records from the "China Industrial Enterprises Database (1998-2013)" are collected; that is, records with two or more identical enterprise names or legal entity codes but different financial information fields within the same year are used to generate the dataset to be tested.
[0070] Construction of basic features for the high-confidence training set. For each enterprise entity record in the training set, such as the record of enterprise A in year xxxx, it is loaded into the system through the data loading module of the human-computer interaction interface. The hierarchical feature engineering module places each enterprise entity record in the training set into a full dataset containing the historical records of all large-scale enterprises in China from 1998 to 2013, and queries all historical records of enterprise A in it. The hierarchical feature module calls the exception handler to query the existence information of enterprise A, and calculates the rate of change g (number of employees) based on the records of adjacent years of enterprise A in year xxxx. cyrs The rate of change of zczj (total assets) g zczj The fluctuation values of 12 financial fields are used. The entity's continuity information and the fluctuation values of these 12 financial fields constitute the basic characteristics of Company A's records over xxxx years. The anomaly processor performs this task for each entity record in the training set, achieving high-confidence training set basic characteristics. The construction;
[0071] Initial model Training and hierarchical feature construction. The unsupervised machine learning algorithm Isolation Forest in the hierarchical feature module applies basic features from the training set. The analysis assumes that the number of trees in an isolated forest is 100, resulting in an initial model based on the training set. Initial model Directly output the hierarchical feature vectors of the training set Simultaneously, the output data detection results yield a calibration recommendation value of -0.0013, which represents the hierarchical feature vector of a certain item. If the value is below -0.0013, then the initial model... This entry was identified as outlier, and the distribution chart of outlier scores is shown below. Figure 4-1 .
[0072] Correction model The generation of the first validation set is achieved through the data loading module of the human-computer interaction interface. Placed on the full dataset, the hierarchical feature module calls the exception handler to construct the validation set. basic features Using the initial model Analysis of the validation set basic features To obtain the initial model Regarding the validation set The analysis results will be compared with the detection results. By comparing the actual labels in the model, an initial model is obtained. Regarding the validation set Misjudgment record The supervised machine learning algorithm Random Forest in the model optimization module records misclassifications. With the initial model Hierarchical features of the generated training set The analysis was performed with the default number of trees in the random forest set to 100, resulting in a calibrated model. .
[0073] Correction model Unused validation sets are loaded via the data loading module in the human-computer interaction interface. Select the validation set accordingly , verification set Placed on the full dataset, the hierarchical feature module calls the exception handler to construct the validation set. basic features Using the current calibration model For the validation set basic features The analysis yields the current correction model. Regarding the validation set The analysis results will be compared with the detection results. By comparing the actual labels in the model, the current correction model is obtained. Regarding the validation set Misjudgment record The supervised machine learning algorithm Random Forest in the model optimization module processes misclassified records. With the initial model Hierarchical features of the generated training set The analysis was performed with the default number of trees in the random forest set to 100, resulting in the optimized calibration model. The performance evaluation module evaluates the current calibration model. Based on validation set The analysis results are used to evaluate the current correction model. Performance 303, if the current calibration model Compared to the previous calibration model If the performance does not converge or convergence cannot be determined, this step is repeated continuously. If the precalibrated model... If the performance converges, then the correction model at this point will be... Determined as the final anomaly detection model .
[0074] Use in sequence The samples were optimized, and the calibration model was adjusted. Performance was evaluated. After four consecutive rounds, the model was calibrated. The loop terminates when accuracy, precision, recall, and F1 score no longer show significant improvement. (Based on the validation set) The detection results show that the current calibration model's performance is as follows: Figure 4-2 As shown in Table 1, the model performance evaluation results are as follows: accuracy is 96.94%, precision is 97.08%, recall is 96.79%, and F1 score is 0.9694. The current corrected model is determined as the final anomaly detection model. .
[0075] Table 1 Model performance evaluation results
[0076]
[0077] Anomaly detection. The data loading module through the human-computer interface places the dataset to be detected into the full dataset. The hierarchical feature module calls the anomaly handler to construct the basic features of the dataset to be detected. Using the final anomaly detection model Basic features of the dataset to be detected The analysis yielded the final anomaly detection model. Based on the analysis results of the dataset to be tested, the system can identify and detect abnormal records in the dataset.
[0078] To ensure the reliability of the panel data detection results of this invention, this study removed the detected abnormal data records from the full dataset of the "China Industrial Enterprise Database (1998-2013)" and constructed a cleaned full dataset of the "China Industrial Enterprise Database (1998-2013)". Benford's Law test was then performed on the full dataset of the "China Industrial Enterprise Database (1998-2013)" before and after cleaning.
[0079] Benford's Law states that in many naturally generated datasets, the probability of a number starting with "1" is approximately 30.1%, the probability of starting with "2" is approximately 17.6%, and the probability gradually decreases as the number increases, with the probability of starting with "9" being only 4.6%. This law is often used to detect anomalies in data. Figure 4-3 The results of the Benford theorem test for 16 key financial fields in the full dataset of the "China Industrial Enterprises Database (1998-2013)" before cleaning are shown. The distribution of the first digit of the original data (blue bar chart) deviates from the Benford theoretical value (red line): the frequency of the digit "1" is significantly lower, while the frequency of the middle digits (such as "2" to "5") is generally higher, indicating that there may be problems such as reporting habits, statistical methods or processing errors in the data. Figure 4-4 The results of the Benford theorem test on the full dataset of the "China Industrial Enterprises Database (1998-2013)" after being tested and cleaned by this invention are shown. The blue bars in the figure are closer to the Benford theorem curve, which confirms the reliability of the test results of the panel data in this invention.
[0080] Example 3
[0081] Based on the above embodiments, this embodiment is an anomaly detection system based on hierarchical feature engineering, which is implemented by an anomaly detection method based on hierarchical feature engineering.
Claims
1. An anomaly detection method based on hierarchical feature engineering, used in panel data, characterized in that, The methods include: Dataset preparation includes preparing the full dataset, training set, validation set, and dataset to be tested. Basic feature construction involves placing the training set onto the full dataset and using an anomaly processor to parse the historical time-series data of each entity in the training set to construct basic features for each record. The construction of hierarchical feature vectors involves inputting the basic features of the training set into an unsupervised machine learning algorithm to obtain an initial model, which then outputs hierarchical feature vectors of the training set. The generation and optimization of the calibration model are achieved by combining the validation set and hierarchical feature vectors through a supervised machine learning algorithm. The determination of the anomaly detection model: when the calibration model reaches convergence, the calibration model at this point is the anomaly detection model. Anomaly detection uses an anomaly data detection model to analyze the dataset to be detected and detect anomalies.
2. The anomaly detection method based on hierarchical feature engineering according to claim 1, characterized in that, The generation and optimization of the calibration model includes: Step 1, Extraction of False Positive Records: Take out the first validation set, place the first validation set in the full dataset, use the anomaly processor to construct the basic features of the first validation set, input the basic features into the initial model, obtain the analysis results of the initial model on the first validation set, and extract all false positive records in the analysis results of the initial model on the first validation set. Step 2, Generating the calibration model: Input all misjudged records from the first validation set analysis results and the hierarchical features generated by the initial model based on the training set into a supervised machine learning algorithm to generate the calibration model; Step 3, Evaluation of the calibration model: Randomly select a validation set from the unused validation set, place the random validation set into the full dataset, call the exception handler, construct the basic features of the random validation set, use the current calibration model to analyze the basic features of the random validation set, obtain all misjudged records in the analysis results of the current calibration model on the random validation set, and evaluate the calibration model based on multiple performance indicators. Step 4: Optimize the calibration model. Extract all misclassified records from the calibration model's analysis results on the arbitrary validation set. Input all misclassified records from the arbitrary validation set analysis results and the hierarchical features generated by the initial model based on the training set into the supervised machine learning algorithm to obtain the optimized calibration model.
3. The anomaly detection method based on hierarchical feature engineering according to claim 1, characterized in that, The process involves determining the anomaly detection model, evaluating and optimizing the repeated correction model, and then optimizing the correction model based on an arbitrary validation set of the input until multiple performance indicators of the correction model converge. If the current correction model is then the anomaly detection model, it is considered an anomaly detection model.
4. The anomaly detection method based on hierarchical feature engineering according to claim 3, characterized in that, Performance metrics include accuracy, precision, recall, and F1 score.
5. The abnormal data detection method based on hierarchical feature engineering according to claim 1, characterized in that, Supervised machine learning algorithms include random forest algorithms, gradient boosting decision tree classification algorithms, and neural network classification algorithms.
6. The anomaly detection method based on hierarchical feature engineering according to claim 1, characterized in that, Construction of hierarchical feature vectors include: The construction of the basic feature vector is based on the i-th record r of all entities involved in the training set. i By querying the historical data of entities in the full dataset, a basic feature vector is constructed using an anomaly detector. The construction of hierarchical feature vectors involves inputting basic feature vectors into an unsupervised machine learning algorithm to obtain an initial model. The initial model performs anomaly analysis on the basic feature vectors to obtain anomaly score sets, which constitute hierarchical feature vectors.
7. The anomaly data detection method based on hierarchical feature engineering according to claim 6, characterized in that, Unsupervised learning algorithms include the Isolation Forest algorithm, the Single-Class Support Vector Machine algorithm, or the Autoencoder algorithm.
8. The anomaly detection method based on hierarchical feature engineering according to claim 1, characterized in that, The full dataset is a dataset containing records of all entities for all years; the training set is a high-quality dataset selected from the full dataset using a training set generation tool. The validation set is generated by using a validation set generation tool to select and copy a specific number of records from the full dataset. The quantitative indicators of the copied records are randomly perturbed by a factor of 0.1 to 10. The original records are labeled as true and the label is 1, while the perturbed records are labeled as false and the label is 0.
9. An anomaly data detection system based on hierarchical feature engineering, characterized in that, This method is used to implement the hierarchical feature engineering-based anomaly detection method as described in any one of claims 1-8.