Frequency domain signal clustering

Abstract

Systems, methods, and other embodiments associated with clustering of time series signals based on frequency domain analysis are described. In one embodiment, an example method includes accessing time series signals to be separated into clusters. The example method also includes determining a similarity of power spectral densities between the time series signals. The example method also includes extracting a cluster of similar time series signals from the time series signals based on similarities in the frequency domain. Also, the example method includes training a machine learning model based on the cluster to detect anomalies.

Description

Technical Field

[0001] This disclosure relates to machine learning. More specifically, this disclosure relates to systems, methods, apparatuses, and other embodiments configured to enable machines to adapt or evolve based on experience gained by the machine. Background Technology

[0002] Generally, clustering algorithms used to group time-series signals into relevant groups operate in the time domain. If the noise in the sensor signal rises to only 10-20% noise ratio, then time-domain signal clustering algorithms encounter very large clustering errors. Furthermore, for sensors with inherent noise levels of 50% or higher, time-domain clustering algorithms become completely ineffective. Summary of the Invention

[0003] In one embodiment, this document proposes a computer-implemented method. The computer-implemented method includes accessing time-series signals to be clustered. The computer-implemented method includes determining the similarity of power spectral density between the time-series signals. The computer-implemented method includes extracting clusters of similar time-series signals from the time-series signals based on the power spectral density similarity. Furthermore, the computer-implemented method includes training a machine learning model based on the clusters to detect anomalies.

[0004] In one embodiment, this document proposes one or more non-transitory computer-readable media. The one or more non-transitory computer-readable media store computer-executable instructions, which, when executed by at least one processor of a computer system, cause the computer system to perform the steps of a computer-implemented method. The computer-executable instructions cause the computer system to access a collection of time-series signals that are not differentiated relative to a cluster. The computer-executable instructions cause the computer system to determine the similarity between time-series signals in the frequency domain. The computer-executable instructions cause the computer system to select clusters of similar time-series signals from the time-series signals based on the similarity in the frequency domain. Furthermore, the computer-executable instructions cause the computer system to route the cluster to a destination discrete from the destinations of other clusters detected in the time-series signals.

[0005] In one embodiment, a computer system is proposed herein. The computer system includes at least one processor; at least one memory connected to the at least one processor; and one or more non-transitory computer-readable media including instructions stored thereon, the instructions causing the computing system to perform the steps of a computer-implemented method when executed by at least one processor. The instructions cause the computer system to access a training range of time-series signals including unidentified clusters. The instructions cause the computer system to determine a measure of correlation between the time-series signals based on analysis in the frequency domain. The instructions cause the computer system to transfer the time-series signals to the cluster based on the correlation measure. The instructions cause the computer system to train a machine learning model based on the training range of the cluster to detect anomalies. Furthermore, the instructions cause the computer system to transmit an electronic alert that an anomaly has occurred in the cluster in response to detecting an anomaly within the monitoring range of the cluster.

[0006] In one embodiment, a computer program product is proposed herein. The computer program product includes program instructions that, when executed by a processor, cause the processor to perform the steps of a computer-implemented method. The program instructions cause the processor to access a training range of time-series signals including unidentified clusters. The program instructions cause the processor to determine a measure of correlation between the time-series signals based on analysis in the frequency domain. The program instructions cause the processor to transfer the time-series signals to the cluster based on the correlation measure. The program instructions cause the processor to train a machine learning model based on the training range of the cluster to detect anomalies. Furthermore, the program instructions cause the processor to transmit an electronic alert that an anomaly has occurred in the cluster in response to detecting an anomaly within the monitoring range of the cluster. Attached Figure Description

[0007] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate various systems, methods, and other embodiments of this disclosure. It will be appreciated that the element boundaries shown in the figures (e.g., boxes, groups of boxes, or other shapes) represent one embodiment of a boundary. In some embodiments, one element may be implemented as multiple elements, or multiple elements may be implemented as one element. In some embodiments, an element shown as an inner component of another element may be implemented as an outer component, and vice versa. Furthermore, elements may not be drawn to scale.

[0008] Figure 1 An example of a frequency domain clustering system associated with the clustering of time series signals based on frequency domain analysis is illustrated.

[0009] Figure 2A An example of a frequency domain clustering method associated with the clustering of time series signals based on frequency domain analysis is illustrated.

[0010] Figure 2BThe illustration shows an example of determining the similarity of power spectral density between time series signals associated with clustering based on frequency domain analysis.

[0011] Figure 2C The illustration shows an example of extracting clusters of similar time series signals from time series signals based on the similarity of power spectral density associated with clustering based on frequency domain analysis.

[0012] Figure 3 An example of a frequency domain clustering method associated with the clustering of time series signals based on frequency domain analysis is illustrated.

[0013] Figure 4 The figure shows a graph of the periodogram of a selected signal from an example collection of signals.

[0014] Figure 5 The figure shows a graph of the cross power spectral density (CPSD) of a pair of example signals.

[0015] Figure 6 The figure shows a graph of the selected normalized CPSD for paired signals.

[0016] Figure 7 The figure shows a graph of the absolute value (also known as the absolute error) of the difference between the periodogram of the reference signal and the selected CPSD of the signal pair.

[0017] Figure 8 The figure shows a graph of the cumulative mean absolute error (CMAE) values ​​for each signal in an example collection of time series signals.

[0018] Figure 9 The diagram illustrates the CMAE values ​​of each signal in an example collection sorted in ascending order of CMAE.

[0019] Figure 10 The diagram illustrates an example average cumulative function (MCF) plot of CMAE values ​​in sorted order.

[0020] Figure 11 The figure illustrates the CMAE values ​​of the remaining signals in the collection after the first cluster is removed from the example collection of time series signals.

[0021] Figure 12 The diagram illustrates the CMAE values ​​for the sorting of the remaining signals.

[0022] Figure 13 The figure shows the MCF of the CMAE value of 1205 for the sorting of the remaining signals.

[0023] Figure 14The illustration shows an embodiment of a computing system configured with the disclosed example systems and / or methods. Detailed Implementation

[0024] This document describes systems, methods, and other embodiments for providing clustering of time-series signals based on frequency domain analysis. In one embodiment, a frequency-domain clustering system determines the similarity or dissimilarity of time-series signals in the frequency (or spectrum) domain and then clusters similar time-series signals into clusters. Previous clustering techniques operating in the time domain began to incorrectly place signals into clusters even when there was moderate noise in the signals. However, in one embodiment, the frequency-domain clustering system enables signals with very high noise ratios to be automatically and accurately placed into clusters.

[0025] In one embodiment, a frequency-domain clustering system determines the similarity—that is, how correlated—of time-series signals in the frequency domain. Using a measure of frequency-domain similarity, the system selects the most correlated signals to move into clusters. In one embodiment, a change-point detection test is used to identify cluster boundaries between signals in and out of the clusters. This process can be repeated to remove additional clusters from the time-series signals one at a time until the final time-series signals can no longer be distinguished as dissimilar to each other, resulting in a final cluster. A machine learning model specific to each individual cluster can then be trained to monitor for anomalous activity within that cluster and to generate alerts when anomalies occur in one or more signals within the cluster.

[0026] For example, a frequency-domain clustering system can be presented with a time-series database or other aggregates of time-series signals from chemical processing equipment that may exist in a refinery. A refinery can have over a million sensors, each producing time-series signals of readings. In practice, datasets consisting of such a large number of signals are unlabeled (or poorly labeled) in terms of which groups the signals belong to. Sensors employed in the chemical processing equipment of a refinery, such as thermocouples, resistance temperature detectors, piezoelectric vibration detectors, and various chemical sensors used to measure the concentration of gases or fluids, produce signals that include high levels of measurement noise relative to the measured signal. These high levels of noise on the signal prevent autonomous clustering using clustering techniques previously operated in the time domain. In one embodiment, despite the high level of measurement noise on the signal, the frequency-domain clustering system will automatically identify clusters of sensor signals associated with various components of the refinery. In this way, the frequency-domain clustering system improves the technology of sensor monitoring by providing autonomous signal clustering in these cases where moderate to severe signal noise would otherwise prevent such autonomous clustering.

[0027] Generally, time-series signals can be obtained from sensors (such as those listed above) in manufacturing or chemical processing systems (such as oil refineries); or from sensors in vehicles (such as aircraft). Sensors can be configured to measure physical variables of the part to be manufactured or chemicals processed in the manufacturing or chemical processing system. Alternatively, or additionally, sensors can be configured to measure environmental conditions in the system's environment, the condition of one or more devices in the manufacturing, chemical processing, or aircraft, and / or the performance of said one or more devices. Electronic alerts generated in response to the detection of an anomaly can be transmitted to alerting devices, such as screens, light sources, or sound sources, for example, to notify human operators of the manufacturing, chemical processing, or vehicle of the anomaly. Electronic alerts generated in response to the detection of an anomaly can be transmitted to systems configured to initiate automatic responses to the alerts, such as activating mechanical, pneumatic, hydraulic, or electromechanical controls of the manufacturing, chemical processing, or aircraft. In this way, errors and problems in such systems can be handled more quickly and effectively.

[0028] -definition-

[0029] As used herein, the terms "time series" and "time series signal" refer to a data structure in which a series of data points or readings (such as observed or sampled values) are indexed in chronological order. For convenience, a time series signal may be simply referred to as a "signal" herein. In one embodiment, the data points of a time series can be indexed using time points described by timestamps and / or observation numbers. A time series can be thought of as a "column" or sequence of data points from one of several sensors used to monitor an asset at multiple points in time. For example, a time series is a "column" or sequence of observations over time from one of N variables (such as a sensor from an aircraft or oil refinery).

[0030] As used herein, the term "vector" refers to a data structure comprising a set of data points or readings (such as observed or sampled values) from multiple time series at a specific point in time (such as a point in time described by a timestamp, observation number, or other index). Thus, a vector can be thought of as a "row" of data points sampled from all the sensors used to monitor an asset at a single point in time. A vector may also be referred to herein as an "observation." For example, a "vector" is a row of observations from all N variables (such as multiple (or all) sensors from an aircraft or refinery).

[0031] As used herein, the term "time series database" refers to a data structure that includes multiple time series sharing a common index, such as a series of time points, timestamps, time steps, or observation numbers. In one embodiment, a time series database is a form of aggregation of time series signals. From another perspective, the term "time series database" refers to a data structure that includes vectors or observations across multiple time series at a series of time points—that is, a time series of vectors. As an example, a time series can be thought of as a "column" of a time series database, while a vector can be thought of as a "row" of a time series database. Thus, a time series database is a type of collection of time series readings. For example, a database or aggregation of sensed amplitudes from aircraft sensors could be arranged or indexed in the order in which the amplitudes were recorded, thus constituting a time series database of sensed amplitudes.

[0032] As used herein, the term "residual" refers to the difference or error between a value (such as a measured value, an observed value, a sampled value, or a resampled value) and an estimate, reference, or prediction of what that value should be. In one embodiment, the residual can be an unsigned quantity of the difference, also known as "absolute error." For example, a residual can be the difference between an actually observed value and an ML prediction or ML estimate of what a machine learning (ML) model should expect that value. In one embodiment, a time series of residuals, or "residual time series," refers to a time series consisting of the residual values ​​between a time series of values ​​and a time series of what that value should expect.

[0033] As used herein, the term "cluster" refers to a subset of time-series signals that exhibits a relatively high degree of cross-correlation between signals within the subset and a relatively low degree of cross-correlation with signals outside the subset (or within other subsets). More generally, signals within a cluster behave over time more similarly to other signals within the cluster than to signals outside the cluster. Anomalous behavior of the clusters can then be monitored using ML models specifically configured for each cluster. In one embodiment, the clusters may be discrete, with no overlap or repetition of time-series signals from one cluster to another. When the term "cluster" is used as a verb herein, it refers to a highly cross-correlated subset of time-series signals that produces what is called a cluster.

[0034] For example, an aircraft may have an engine and a hydraulic pump. Time-series signals from multiple sensors on the engine can be clustered into a subset representing relevant engine behaviors (e.g., engine speed, vibration level, temperature, etc.), and time-series signals from multiple sensors on the hydraulic pump can be clustered into a subset representing relevant hydraulic pump behaviors. The engine signals are more cross-correlated with each other, and less cross-correlated with the hydraulic pump signals; conversely, the hydraulic pump signals are more cross-correlated with each other, and less cross-correlated with the engine signals.

[0035] It should be understood that no action or function described or claimed herein is performed by human thought. No action or function described or claimed herein can actually be performed by human thought. Any interpretation that the actions or functions described or claimed herein can be performed by human thought is inconsistent with and contrary to this disclosure.

[0036] —Example Frequency Domain Clustering System—

[0037] Figure 1 An embodiment of a frequency domain clustering system 100 associated with clustering of time-series signals based on frequency domain analysis is illustrated. The frequency domain clustering system 100 includes components for grouping time-series signals into clusters based on the similarity of the signals in the frequency domain. In one embodiment, the components of the frequency domain clustering system 100 include a signal collector 105, a similarity analyzer 110, a cluster extractor 115, and a model trainer 120.

[0038] In one embodiment, signal collector 105 is configured to access, retrieve, or otherwise acquire time-series signal 125. Time-series signal 125 will be separated into clusters. Time-series signal 125 may be a collection of time-series signals sharing a common index. The clusters of time-series signal 125 are indistinguishable relative to each other. In other words, time-series signal 125 includes clusters that are not identified or labeled as clusters. In one embodiment, time-series signal 125 includes both the training range and the monitoring range of the index. The training range and the monitoring range may be discrete from each other, for example, the monitoring range follows the training range. In one embodiment, signal collector 105 is configured to access the training range of time-series signal 125. In one embodiment, time-series signal 125 describes the physical state of asset 127. In one embodiment, time-series signal 125 is generated by one or more sensors 128. In one embodiment, sensor 128 is configured to generate time-series signal 125 as a description of the physical state of asset 127 over time.

[0039] In one embodiment, the similarity analyzer 110 is configured to determine the similarity 130 of the power spectral density between time-series signals 125. More generally, the similarity analyzer 110 is configured to determine the similarity 130 between time-series signals 125 in the frequency domain. For example, the similarity analyzer 110 is configured to determine a measure of the correlation between time-series signals 125 (its quantized similarity 130) based on analysis in the frequency domain.

[0040] In one embodiment, the similarity analyzer 110 includes components configured to perform a comparison (or other similarity analysis) of time-series signals 125 in the frequency domain. The similarity analyzer 110 includes a reference selector 135, a CPSD generator 140, a CPSD normalizer 145, and a CMAE generator 150. In one embodiment, the reference selector 135 is configured to select one of the time-series signals 125 as a reference signal. In one embodiment, the CPSD generator 140 is configured to generate a cross-power spectral density (CPSD) between the reference signal and other signals in the time-series signal 125. In one embodiment, the CPSD normalizer 145 is configured to normalize the CPSD (generated by the CPSD generator 140) to a periodogram of the reference signal (selected by the reference selector 135). In one embodiment, the CMAE generator 150 is configured to generate a cumulative mean absolute error (CMAE) of the normalized CPSD relative to the reference signal. In one embodiment, the similarity 130 (a measure of correlation) of the power spectral density of the time series signals is the cumulative average absolute error of the cross-power spectral density generated by the CMAE generator. In this way, the similarity analyzer 110 is configured to determine the degree of similarity between the time series signals by performing a comparison of the time series signals in the frequency domain.

[0041] In one embodiment, cluster extractor 115 is configured to extract clusters 155 of similar time-series signals from time-series signal 125 based on power spectral density similarity 130. More generally, cluster extractor 115 is configured to extract clusters 155 of similar time-series signals from time-series signal 125 based on frequency domain similarity 130. For example, cluster extractor 115 is configured to transfer time-series signals into clusters 155 based on a correlation metric. The correlation metric quantifies the similarity 130.

[0042] In one embodiment, cluster extractor 115 includes components for selecting signals belonging to a cluster based on signal similarity 130 in the frequency domain. In one embodiment, cluster extractor 115 includes signal sorter 160, change point detector 165, and signal clusterer 170. In one embodiment, signal sorter 160 is configured to sort time series signals 125 based on the similarity 130 of the time series signals with other time series signals in the frequency domain (e.g., power spectral density). In one embodiment, change point detector 165 is configured to detect change points in the similarity 130 of time series signals 125. In one embodiment, change points in the similarity 130 of time series signals 125 are detected by applying the Mann-Kendall test to the average cumulative function of the similarity 130 of the time series signals 125 in sorted order (i.e., the cumulative sum of the cumulative average absolute errors used as a measure of correlation). In one embodiment, signal clusterer 170 is configured to select individual signals in time series signals 125 up to change points and include change points into cluster 155. In another embodiment, the signal clusterer 170 is configured to select individual signals in the time series signals 125 up to, but excluding, the change points into cluster 155. In this way, the cluster extractor 115 is configured to create cluster 155 by selecting those time series signals 125 below jumps in dissimilarity (such as discontinuities in metrics of correlation) to include in cluster 155 of time series signals.

[0043] In one embodiment, model trainer 120 is configured to train machine learning model 175 on a cluster to detect anomalies. In another embodiment, model trainer 120 is configured to train machine learning model 175 on a training scope of the cluster to detect anomalies within the monitoring scope of the cluster. In one embodiment, machine learning model 175 is a multivariate state estimation technique model. In one embodiment, model trainer 120 is configured to assign time series data from cluster 155 as input to machine learning model 175 (such as input to a multivariate state estimation technique model). Furthermore, model trainer 120 is configured not to assign time series data excluded from cluster 155 as input to machine learning model 175.

[0044] In one embodiment, the frequency domain clustering system 100 includes additional components. In one embodiment, the frequency domain clustering system includes an anomaly detector and an alert generator. In one embodiment, the anomaly detector is configured to detect anomalies in cluster 155 using a trained machine learning model 175. In one embodiment, the alert generator is configured to generate electronic alerts that have detected anomalies in clusters of time-series signals.

[0045] In one embodiment, the frequency domain clustering system 100 can be configured to extract multiple clusters from a time series signal. In one embodiment, the frequency domain clustering system 100 is configured to repeatedly use a similarity analyzer 110 to determine similarities in the frequency domain and a cluster extractor 115 to extract clusters of similar time series signals until no further changes are detected at a given confidence level. Furthermore, the frequency domain clustering system 100 can be configured to add any remaining unextracted time series signals to the last cluster once no further changes are detected.

[0046] Further details regarding the frequency domain clustering system 100 are presented herein. In one embodiment, the operation of the frequency domain clustering system 100 will be referenced to Figure 2 and Figure 3 The example frequency domain clustering methods 200 and 300 shown are described. Additional details regarding the operation of the frequency domain clustering system 100 are provided during the steps of frequency domain clustering methods 200 and 300. Figure 4-13 The example data is presented in the context of visualization.

[0047] —Example Frequency Domain Clustering Method—

[0048] Figure 2A The illustration depicts an embodiment of a frequency domain clustering method 200 associated with clustering of time-series signals based on frequency domain analysis. Initially, a collection of time-series signals to be separated into clusters is accessed. The similarity between the time-series signals in the frequency domain (e.g., power spectral density similarity) is determined. These similarities are measures of correlation between pairs of signals (such as the cross-power spectral density between a reference signal of a cluster and another signal in the collection). Clusters of similar time-series signals are then extracted or removed from the collection of time-series signals. The cluster is identified based on the similarity of the signals in the frequency domain—that is, the signals belonging to that cluster. A cluster-specific machine learning model is then trained based on the clusters to detect anomalies within the clusters. For example, the model is trained using the (observed) training range of the clusters, and the trained model will monitor the monitored range of the clusters. In one embodiment, this process can be repeated to extract multiple or all clusters from the collection of time-series signals.

[0049] In one embodiment, frequency domain clustering method 200 is initiated at “Start” block 205 in response to one or more of the following determined by the frequency domain clustering system: (i) the frequency domain clustering system has received or has begun receiving a set of time-series signals; (ii) an instruction has been received to perform frequency domain clustering method 200 on the set of time-series signals / readings; (iii) a user or administrator of the frequency domain clustering system has initiated frequency domain clustering method 200; (iv) it is currently scheduled to run frequency domain clustering method 200; or (v) frequency domain clustering method 200 should begin in response to the occurrence of some other condition. In one embodiment, a computer system configured by computer-executable instructions to perform the functions of frequency domain clustering system 100 performs frequency domain clustering method 200. After initiation at “Start” block 205, frequency domain clustering method 200 continues to processing block 210.

[0050] —Example Method— Accessing Time Series Signals—

[0051] At box 210, the frequency domain clustering method 200 accesses the time-series signals to be separated into clusters. For example, the frequency domain clustering method 200 may access a collection of time-series signals that are not distinguished relative to clusters. Or, for example, the frequency domain clustering method may access a training range that includes time-series signals that have not been identified into clusters. More simply, the frequency domain clustering method 200 acquires a collection of time-series signals so that relevant signals can subsequently be searched within that collection to remove them from the collection and into individual clusters. In short, in one embodiment, the frequency domain clustering method 200 inputs ungrouped signals for subsequent grouping into clusters.

[0052] In one embodiment, the aggregation of time-series signals is a time-series database. The time-series signals may be generated or otherwise associated with sensors configured to translate physical phenomena occurring within or around an asset into measurements. Measurements may be sampled to generate time-series signals. For example, time-series signals may include time-series signals from various components of an aircraft, such as individual engines, hydraulic systems, fuel pumps, and other aircraft systems. Sensors (or intermediate systems) transmit the time-series signals to a frequency-domain clustering system 100.

[0053] Time series signals can be mixed together in a collection of time series signals without considering the correlation between the activities of the signals. Therefore, the signals are undifferentiated and include unidentified groups of signals exhibiting shared or matching activity patterns. Time series signals may not be labeled relative to groups of related activities within the time series signal. For example, a collection of time series signals generated by an oil refinery may simply be numbered with signal numbers 1–1,000,000 (or similar non-informative identifiers) without indicating which signals are related to each other. In other words, clusters of related signals may be hidden or scattered throughout the collection of time series signals. Accordingly, the collection of time series signals will be separated into its constituent clusters.

[0054] In one embodiment, only the training range (of observations or vectors) is accessed and used to identify clusters. For example, an initial number of observations or vectors are retrieved from a collection of time-series signals. In one embodiment, the training range is long enough to accommodate multiple cycles of cyclically related activities in the collection of time-series signals.

[0055] In one embodiment, accessing a time-series signal includes retrieving the time-series signal from a memory or storage device. In one embodiment, the frequency domain clustering method accepts user input indicating a collection of time-series signals to be accessed. The frequency domain clustering method 200 establishes a connection to a data source that includes the collection of time-series signals. The frequency domain clustering method 200 then formulates and executes a query on the data source to retrieve the time-series signal (such as a query retrieving a training range of the time-series signal). This query is configured to cause the data source to return the time-series signal. Alternatively, the frequency domain clustering method 200 formulates and executes a query on the data source such that the time series is available for creation, reading, updating, and / or deletion operations.

[0056] Furthermore, in one embodiment, accessing the time-series signal may include receiving live, real-time signals from sensors of the monitored asset. In one embodiment, a frequency-domain clustering method 200 establishes a connection to an observation stream of the time-series signal. Individual observations arriving from this stream are placed into a buffer upon arrival to create a batch of observations. The batches of observations can be processed according to the method steps described herein. Generally, real-time processing of the time-series signal is performed during the monitoring phase after the time-series signal has been separated into clusters.

[0057] Therefore, in one embodiment, by accepting input of a collection of specified time-series signals and then generating and executing one or more commands (such as queries) to make the collection of time-series signals available for creation, reading, updating, and deletion operations, frequency domain clustering method 200 accesses the time-series signals to be separated into clusters. The collection of time-series signals can be placed in memory or a storage device for subsequent processing. At the end of processing block 210, the collection of time-series signals, including the identified clusters, is ready for frequency domain clustering analysis. In one embodiment, the functionality of processing block 210 is performed by the signal collector 105 of frequency domain clustering system 100.

[0058] —Example Method— Determining Similarity in the Frequency Domain—

[0059] At box 215, frequency domain clustering method 200 determines the similarity of power spectral density between time-series signals. More generally, frequency domain clustering method 200 determines the similarity between time-series signals in the frequency domain. Alternatively, frequency domain clustering method 200 determines a measure of correlation (also referred to herein as "similarity") between time-series signals based on analysis in the frequency domain. In other words, frequency domain clustering method 200 finds out how similar the signals are in the frequency domain. The degree of similarity (i.e., correlation) of activity in the signals can then be used to determine whether a signal belongs to a cluster with a reference signal.

[0060] Figure 2B The illustration depicts an embodiment of determining the similarity of power spectral density between time series signals associated with clustering of time series signals based on frequency domain analysis. In one embodiment, determining the similarity of time series signals in the frequency domain at block 215 includes the step of generating a measure of correlation or similarity between the clustered signals and a reference signal. In one embodiment, the measure of correlation or similarity for a given signal is the cumulative mean absolute error (CMAE) of the cross-power spectral density (CPSD) between the reference signal and the given signal. In one embodiment, at block 220, one of the time series signals is selected as the reference signal. Then, at block 225, the cross-power spectral density between the reference signal and the other time series signals is generated. At block 230, the cross-power spectral density is normalized to a periodogram of the reference signal. At block 235, the cumulative mean absolute error of the cross-power spectral density is generated. The cumulative mean absolute error of the cross-power spectral density is then used as a measure of correlation or similarity (power spectral density similarity) in the frequency domain.

[0061] In one embodiment, the reference signal is arbitrarily selected from the remaining time-series signals in the pool of signals (i.e., those not yet added to the cluster). The reference signal serves as a reference or baseline signal from which the frequency domain clustering method 200 can measure the similarity to other signals. In other words, the similarity of signals in the pool is measured from the reference signal to provide a consistent measure of correlation. The frequency domain clustering method 200 will use the reference signal as the basis for new clusters, as discussed below at box 240. At box 220, the frequency domain clustering method 200 selects one of the available signals as the reference signal. For example, the reference signal can be randomly selected from those signals in the pool that have not yet been added to the cluster. Alternatively, for example, the reference signal could be the next available signal in the pool of signals that has not yet been assigned to a cluster (e.g., the signal with the lowest signal index).

[0062] The cross-power spectral density (CPSD) between two signals is a measure of how the power of one signal correlates with the power of another signal on the frequency spectrum. Peaks in the CPSD of two signals indicate the period (or frequency) of the activity correlation between the two signals. At box 225, frequency-domain clustering method 200 generates the cross-power spectral density between the reference signal and other time-series signals. To generate the CPSD, frequency-domain clustering method 200 applies an FFT to the reference signal and other time-series signals in the aggregation of the time-series signals to transform the signals from the time domain to the frequency domain. The power spectral density function generated by the FFT of the reference signal may also be referred to herein as the periodogram of the reference signal.

[0063] Then, the frequency domain clustering method 200 performs cross-power calculations on pairs of FFT-transformed signals. The cross-power calculation multiplies the complex conjugate of the FFT of one signal in the pair by the FFT of the other signal in the pair to produce the CPSD function for that pair of signals. These pairwise cross-power calculations are performed on pairs of the reference signal and other signals in the pool. Therefore, for the remaining N signals in the pool, where the reference signal is signal 1, cross-power calculations are performed on the following signal pairs that have been transformed to the frequency domain: (reference signal, signal 2), (reference signal, signal 3), ..., (reference signal, signal N). Thus, in one embodiment, this generates a CPSD function for each signal in the pool that shows how the signal is related to the reference signal. The CPSD of the reference signal with a given signal may be referred to as the CPSD of the given signal.

[0064] Generally, the CPSD of signals other than the reference signal will have a different magnitude than that of the periodogram of the reference signal. Therefore, at box 230, the frequency domain clustering method 200 normalizes the CPSD to the periodogram of the reference signal. Normalization adjusts the CPSD of the signal to match the magnitude of the periodogram of the reference signal. In this way, the bivariate CPSD density function of other signals is scaled relative to the univariate FFT density function of the reference signal. CPSD normalization is performed to ensure that the CPSD of signals similar to the reference signal always has a small residual to the periodogram of the reference signal, while the CPSD of signals dissimilar to the reference signal always has a large residual to the periodogram of the reference signal. This normalization method results in poor normalization of signals dissimilar to the reference signal, and this will exaggerate the residuals of dissimilar signals, further increasing the cumulative mean absolute error of dissimilar signals at box 235.

[0065] In one embodiment, frequency domain clustering method 200 performs normalization of the CPSD to the periodogram of the reference signal using a linear regression process. For example, for each frequency increment (or point within the spectrum), frequency domain clustering method 200 determines the logarithm of the periodogram of the reference signal at that frequency increment and the logarithm of the CPSD at that frequency increment. Frequency domain clustering method 200 then performs linear regression between the logarithm of the periodogram for the reference signal and the logarithm of the CPSD to find a scaling factor that minimizes the difference between the logarithm of the periodogram for the reference signal and the logarithm of the CPSD. The CPSD is then multiplied by the scaling factor to normalize the CPSD to the periodogram of the reference signal. In one embodiment, this normalization is performed on the CPSD of each signal remaining in the pool other than the reference signal.

[0066] Then, the frequency domain clustering method 200 finds the cumulative mean absolute error (CMAE) of the CPSD with reference to the periodogram of the reference signal. At box 225, the frequency domain clustering method 200 generates the cumulative mean absolute error of the normalized cross-power spectral density relative to the periodogram of the reference signal. In one embodiment, at each frequency increment, the frequency domain clustering method 200 finds the residual (or absolute error) between the normalized CPSD and the periodogram of the reference signal. The residual or absolute error between the normalized CPSD and the periodogram of the reference signal at the frequency increment is the absolute value of the difference between the normalized CPSD and the periodogram at that frequency increment. The frequency domain clustering method 200 then finds the cumulative sum of the residuals over all frequency increments to produce the CMAE of the signal. The CMAE of the signal can then be used as a measure of the similarity or correlation of the signal. In this way, the measure of correlation or similarity between time series signals is based on the cumulative mean absolute error of the cross-power spectral density between one of the selected time series signals as a reference and other time series signals.

[0067] Therefore, in one embodiment, the frequency domain clustering method 200 determines the similarity between time-series signals in the frequency domain by: (i) selecting a reference signal, (ii) converting the aggregated signals into a periodogram in the frequency domain, (iii) generating a CPSD (Continuous Frequency Detection Score) with respect to the reference signal for each other signal, (iv) normalizing the CPSD of the other signals to the periodogram of the reference signal, (v) determining the residual between the periodogram of the reference signal and the normalized CPSD of each other signal, and (vi) for each other signal, combining the residuals to produce a CMAE (Conversion Scale Effect) value used as a measure of the correlation or similarity between that signal and the reference signal. At the end of processing block 215, a measure of similarity or correlation with the reference signal in the frequency domain has been generated for the remaining signals in the aggregated signal. The measure of similarity between a signal and the reference signal can be used to determine whether the signal can subsequently be used (as discussed below) or to determine whether the signal should be included in the cluster along with the reference signal (as discussed below). In one embodiment, the functionality of processing block 215 is performed by the similarity analyzer 110 of the frequency domain clustering system 100. Specifically, in one embodiment, the function of block 220 is performed by reference selector 135, the function of block 225 is performed by CPSD generator 140, the function of block 230 is performed by CPSD normalizer 145, and the function of processing block 235 is performed by CMAE generator 150.

[0068] —Example Methods— Clustering for Extracting Time Series Signals—

[0069] Refer again Figure 2A At box 240, frequency domain clustering method 200 extracts clusters of similar time-series signals from the time-series signal based on the similarity of power spectral density. Alternatively, more generally, frequency domain clustering method 200 selects clusters of similar time-series signals from the time-series signal based on similarity in the frequency domain. For example, frequency domain clustering method 200 shifts the time-series signal into clusters based on a measure of correlation or similarity between the signal and a reference signal. In one embodiment, frequency domain clustering method 200 collects signals that are most similar to the reference signal in the frequency domain and shifts them into clusters along with the reference signal. In this way, frequency domain clustering method 200 filters out signals that are not similar enough to the reference signal to be included in the cluster along with the reference signal.

[0070] In one embodiment, frequency domain clustering method 200 includes a reference signal in a new cluster. Frequency domain clustering method 200 determines whether to include other signals from the aggregated signals along with the reference signal in the new cluster. Frequency domain clustering method 200 makes this determination based on the similarity between the signals and the reference signal in the frequency domain. Specifically, frequency domain clustering method 200 makes this determination based on CMAE (Common Cosmetic Effects of Signals).

[0071] Figure 2C The illustration depicts one embodiment of extracting clusters of similar time-series signals from time-series signals based on the similarity of power spectral density associated with clustering based on frequency domain analysis. In one embodiment, the process of extracting clusters of similar time-series signals from time-series signals based on frequency domain similarity (e.g., power spectral density similarity), as shown in block 240, includes the step of selecting those time-series signals below the jump in dissimilarity as the cluster of time-series signals. In one embodiment, at block 245, the time-series signals are sorted based on the similarity of the power spectral density of the time-series signals with other time-series signals. At block 250, for the time-series signals, change points in the similarity are detected. At block 255, time-series signals below the change point (e.g., up to and including the change point, up to but not including the change point) are selected into the cluster.

[0072] In one embodiment, the signals in the pool are sorted based on a measure of correlation or similarity (in the frequency domain) between each signal and a reference signal. At block 245, the frequency domain clustering method 200 sorts the time-series signals based on the similarity of the power spectral density of the time-series signal to other time-series signals. For example, the signals are arranged in ascending order of CMAE. In this order, each subsequent signal is equal to or less similar to the reference signal than the preceding signal. Therefore, the signals will start with the reference signal, whose CMAE is 0 because it is perfectly similar to itself. The signals will then become increasingly different from the reference signal. The sorting can be performed using any of a variety of sorting algorithms, such as quicksort, mergesort, heapsort, blocksort, bucketsort, etc., or combinations thereof.

[0073] In one embodiment, when there is more than one cluster in the collection of signals, there will be a change point in the CMAE measure of correlation or similarity between signals belonging to the same cluster as the reference signal and signals not belonging to the same cluster as the reference signal. Therefore, at block 250, for a new time-series signal, frequency domain clustering method 200 detects change points in the similarity (CMAE). A change point indicates a jump or discontinuity in the CMAE of the signal outside the change point. (For example, such a jump occurs in...) Figure 9 The signals between 10 and 11 and Figure 12 (Signals 20 and 21 are visible in the sequence). The reference signal is the lower boundary (inclusive) of the cluster of signals within the sequenced signal pool. The change point is the upper boundary (inclusive) of the cluster of signals within the sequenced signal pool. Signals outside the change point in the sequenced pool (i.e., signals whose CPSD is higher than the CPSD of the signal at the change point) are excluded from the cluster of signals.

[0074] In one embodiment, to detect change points, frequency domain clustering method 200 (i) determines the mean cumulative function (MCF) of CMAEs, and (ii) applies the Mann-Kendall test (or other change point detection test) to the MCF to identify which signal the change point occurs at. The MCF is defined as the cumulative sum of CMAEs in sorted order. Frequency domain clustering method 200 generates the MCF from the sorted CMAEs. For example, frequency domain clustering method 200 generates the MCF value at a signal by determining and summing the CMAEs up to and including the preceding signals. In one embodiment, for all (sorted) CMAEs belonging to the same cluster as the reference signal, the resulting MCF will have a very straight, non-decreasing slope, but for signals not in the cluster, it will exhibit a varying slope.

[0075] In one embodiment, the frequency domain clustering method 200 uses the Mann-Kendall (MK) test to detect change points based on the MCF (Mean Cross-Sectional Flow). The MK test detects when a trend deviating from the initial slope of the MCF appears, based on the analysis of data points in the MCF. The data points in the MCF are the MCF values ​​of the signals in sorted order. In one embodiment, the MK test is used on an increasing number of MCFs until a trend is detected with sufficient confidence. For example, the MK test is performed on the MCF values ​​of the first two signals in sorted order (number of data points n=2), then on the MCF values ​​of the first three signals in sorted order (n=3), then on the MCF values ​​of the first four signals in sorted order (n=4), and so on, until a confidence factor indicating the presence of a trend satisfies a threshold condition. In one embodiment, the data point where a trend is detected by a confidence factor that satisfies the threshold condition is selected as a change point. Further details about the Mann-Kendall test and the associated confidence factor are described elsewhere in this document, for example under the heading “Mann-Kendall Analysis”.

[0076] In one embodiment, the threshold condition is pre-specified, for example, through user input or the configuration of a frequency domain clustering system. In one embodiment, the confidence factor indicates the probability p of incorrectly detecting a trend (which indicates a change point) when no trend exists at a given data point n. This can be referred to as the false alarm probability. In this case, the threshold condition can be set to specify that the probability of detecting a change point where there is no change point should be 5% or less (p ≤ 0.05). To increase the confidence in detecting a change point, the threshold can be set even more stringently, for example, specifying that the probability of detecting a change point where there is no change point should be 1% or less (p ≤ 0.01). The inverse of the probability of detecting a change point where there is no change point (1–p) is the probability that the trend (change point) detected at a given data point n is a true change point. The threshold condition can also be set based on this (1–p) confidence that a change point actually exists at a given data point n, for example, by requiring that the probability of the detected change point being true should be 95% or higher (1–p ≥ 0.95), or 99% or higher (1–p ≥ 0.99). In one embodiment, a threshold condition specifying a false alarm probability (the chance of finding a change point where there is no change point) of 10% or lower (p≤0.1) may be satisfactory for change point detection.

[0077] Once a change point is detected based on the MCF, at box 255, the frequency domain clustering method 200 selects the time-series signal below the change point to enter the cluster. In one embodiment, the selected time-series signal below the change point is the time-series signal up to but not including the change point. In another embodiment, the time-series signal at the change point can be included in the cluster, and the selected time-series signal below the change point is the time-series signal up to and including the change point. Which of these cases is used is determined based on which of the two signals on either side of the MCF slope change is designated as the change point. If the last signal before the MCF slope change is designated as the change point, then the signal up to and including the change point is included in the cluster. And, if the first signal after the MCF slope change is designated as the change point, then the signal up to but not including the change point is included in the cluster. In either case, signals outside the discontinuity of the CMAE value indicated by the change point in the MCF are excluded from the cluster, and signals before the discontinuity are added to the cluster.

[0078] In one embodiment, the selected signal is transferred to a newly defined cluster. In another embodiment, a signal added to a cluster is removed from the collection of signals so that signals in the cluster are not considered for inclusion in other clusters in subsequent iterations of the clustering process. In one embodiment, a time-series signal added to a cluster is removed from the collection of time-series signals by setting a flag or label associated with the signal in the cluster that indicates the signal's presence in the cluster. In another embodiment, a time-series signal added to a cluster is removed from the collection by reorganizing or redefining the collection of signals to exclude signals in the cluster and include remaining signals not added to the cluster. For example, when the collection of time-series signals is a time-series database, the collection can be split into two time-series databases, one for clusters and one for remaining signals. Therefore, signals included in the cluster are clustered separately from the remaining signals in the collection. Remaining signals not included in the cluster along with the reference signal can be analyzed to determine if further clusters exist.

[0079] Therefore, in one embodiment, the frequency domain clustering method 200 extracts clusters of similar time-series signals based on similarity in the frequency domain by: (1) sorting the time-series signals in ascending order of the CMAEs associated with the signals; (2) generating the MCF of the CMAEs; (3) detecting change points in the CMAEs by analyzing the MCF over an increasingly larger range using the Mann-Kendall test until a confidence threshold condition is met, thereby indicating that the signal index at the top of the range is a change point; and (4) transferring the time-series signals up to and including the change points into the cluster. At the end of processing block 240, a cluster of similar or related signals has been extracted from the collection of signals. The cluster of signals can be used to train an ML model that is specific to the cluster and therefore specific to the components of the monitored assets that exhibit the correlated behavior of the clustered signals. In one embodiment, the functionality of processing block 240 is performed by the cluster extractor 115 of the frequency domain clustering system 100. Specifically, in one embodiment, the function of block 245 is performed by signal sorter 160, the function of block 250 is performed by change point detector 165, and the function of processing block 255 is performed by signal clusterer 170.

[0080] —Example Methods— Cluster Usage—

[0081] Refer again Figure 2AAt box 260, frequency domain clustering method 200 trains a machine learning model based on clusters to detect anomalies. More specifically, frequency domain clustering method 200 trains the machine learning model based on the training range of the clusters to detect anomalies. Then, in response to detecting an anomaly within the monitoring range of a cluster, frequency domain clustering method 200 transmits an electronic alert that the anomaly has occurred in that cluster. Because multiple clusters in the aggregation of time-series signals are presented to discrete machine learning models (or other analyses) specific to each of the multiple clusters, frequency domain clustering method 200 routes clusters to destinations discrete from the destinations of other clusters detected in the time-series signal. In short, frequency domain clustering method 200 associates a cluster with a dedicated machine learning model specifically configured for that cluster. In one embodiment, signals outside the cluster are excluded from the training and monitoring of the machine learning model.

[0082] In one embodiment, a machine learning model is assigned time-series signals from a cluster as multivariate inputs to the model. The machine learning model resolves the training range of the cluster's time-series signals during an automated training operation. The automated training operation adjusts the configuration so that the ML model produces estimates consistent with the time-series signals in the cluster. Training configures the machine learning model to produce estimates of what each signal in the cluster should be based on the actual values ​​of other signals in the cluster. The trained ML model is then stored for subsequent monitoring of the monitoring range of signals in the cluster. For example, the configuration of the trained ML model can be written into a data structure that can be used to configure instances of the trained ML model. Differences or residuals between estimates can be fed to a detection model such as the Sequential Probability Ratio Test (SPRT) to detect when deviations from expected signal values ​​are anomalous. The trained ML model is then stored for subsequent monitoring of anomalies in ensemble-averaged signals (such as other averaged signals). In this way, trained machine learning models specifically designed for the cluster can be automatically generated. Additional details on training machine learning models to detect anomalies are provided below under the heading "Overview of Multivariate ML Anomaly Detection".

[0083] Therefore, the machine learning model is trained to detect incorrect, inappropriate, or otherwise anomalous operation of an asset based on clusters. The training scope of the cluster provides an initial reference state for the asset and / or the physical phenomena associated with the asset. In one embodiment, the training scope of the cluster is specified as representing a nominal, expected, or otherwise normal operating state of the asset. Anomalous operation can indicate that the asset is entering or has entered a degraded operating state different from the initial reference state. In other words, an anomaly indicates physical degradation or initial failure of the asset. Note that a cluster can represent a specific component or area of ​​the asset that is associated with the behavior of signals within the cluster; in this case, an anomaly indicates physical degradation or initial failure in that specific component or area of ​​the asset.

[0084] In one embodiment, once the machine learning model is trained, it can be used to monitor clusters of signals for anomalous deviations from expected values. Therefore, in one embodiment, after training the machine learning model, frequency domain clustering method 200 monitors the cluster and, in response to detecting anomalies, generates electronic alerts. In one embodiment, during a monitoring phase where frequency domain clustering method 200 monitors the cluster to look for anomalies, it detects anomalies using the trained machine learning model. In response to the detection of anomalies, frequency domain clustering method 200 generates electronic alerts indicating that anomalies have been detected in the cluster of time-series signals. Electronic alerts may indicate that an asset, or more specifically a particular component of an asset associated with the cluster, is undergoing degradation or initial failure. Additional details regarding the signal monitoring performed by the machine learning model are described elsewhere herein, for example under the heading “Overview of Multivariate ML Anomaly Detection.”

[0085] The trained ML model is specific to a cluster. The ML model is trained only on the cluster's signals. Other time-series signals are filtered out when the cluster is created before training the ML model. In one embodiment, this results in an ML model trained on a cluster generated as described herein exhibiting improved prognostic accuracy. In one embodiment, an ML model trained on a cluster created as described herein generates fewer false alarm probabilities (FAP) and fewer missed alarm probabilities (MAP) than an ML model trained on the entire collection of time-series signals. Moreover, in one embodiment, multiple ML models trained on multiple associated clusters extracted from the collection of time-series signals as described herein exhibit similarly improved prognostic accuracy than an ML model trained on the entire collection of time-series signals. Additionally, multiple ML models trained on multiple associated clusters extracted from the collection of time-series signals as described herein require fewer computational operations for training and monitoring than an ML model trained on and monitored on the entire collection of time-series signals. This is because the computational load of a multivariate ML model increases quadratically with the number of input signals. Therefore, in one embodiment, the frequency domain clustering technique described herein (1) improves ML accuracy and (2) significantly reduces the computational load of ML training and monitoring. These are significant improvements to ML prognostic monitoring techniques for assets.

[0086] At the end of box 260, a trained machine learning model specifically configured for the cluster has been configured. In one embodiment, a trained machine learning model specifically configured for other clusters in the signal pool can also be generated. In one embodiment, the ML model is provided with multivariate inputs that are relevant to the activity, regardless of high levels of measurement noise. Thus, in one embodiment, the resulting ML anomaly detection model is highly accurate because it excludes signals that are irrelevant to the modeling of the relevant activity (and the underlying components of the assets) created by the ML model.

[0087] In one embodiment, the frequency domain clustering method 200 repeats the function of boxes 215–260 to extract multiple clusters from a collection of time-series signals and train multiple ML models associated with these clusters. For example, the steps of determining similarity in the frequency domain (e.g., power spectral density similarity) and extracting clusters of similar time-series signals are repeated until no further change points are detected at a given confidence level. In one embodiment, once no further change points are detected, the frequency domain clustering method 200 puts the remaining unextracted time-series signals into the last cluster. The additional ML models are then configured to accept the signals from the additional clusters as their multivariate inputs and trained to produce estimates consistent with the clusters. Further details about this repeating loop are described below, for example, in reference to Figure 3 .

[0088] —Further Implementations of the Example Frequency Domain Clustering Method—

[0089] In one embodiment, determining the similarity of power spectral density between time series signals (as discussed above at block 215) further includes performing a comparison of the time series signals in the frequency domain. In one embodiment, determining the similarity of power spectral density between time series signals includes a comparison step, as described below. Frequency domain clustering method 200 selects one of the time series signals as a reference signal. Frequency domain clustering method 200 then generates a cross-power spectral density between the reference signal and the other time series signals. Frequency domain clustering method 200 then normalizes the cross-power spectral density to a periodogram of the reference signal. From these normalized CPSDs, frequency domain clustering method 200 generates a cumulative mean absolute error (CME) of the cross-power spectral density. The similarity of the power spectral density is the resulting CME of the cross-power spectral density. In other words, the measure of correlation (similarity) between time series signals is based on the CME of the cross-power spectral density between the time series signal and one of the time series signals selected as a reference.

[0090] In one embodiment, extracting clusters of similar time-series signals from time-series signals based on power spectral density similarity (as discussed above at block 240) further includes selecting those time-series signals below the jumps in dissimilarity as clusters of time-series signals. In one embodiment, extracting clusters of similar time-series signals from time-series signals based on power spectral density similarity includes the step of detecting jumps in dissimilarity, as described below. Frequency domain clustering method 200 sorts the time-series signals based on the similarity of the power spectral density of the time-series signals with other time-series signals. Frequency domain clustering method 200 then detects changes in similarity for the time-series signals. In one embodiment, changes in similarity of time-series signals are detected by applying the Mann-Kendall test to the average cumulative function of similarity in the order of sorting of the time-series signals. Frequency domain clustering method 200 then selects time-series signals up to the changes and includes the changes in the clusters.

[0091] In one embodiment, to facilitate the identification of signals to be extracted into the cluster, the signals are sorted in ascending order. Therefore, in one embodiment of the frequency domain clustering method 200, transferring time-series signals into the cluster based on a correlation metric (as discussed above at box 240) also includes sorting the time-series signals in ascending order of their correlation (similarity) metric. The frequency domain clustering method 200 then transfers time-series signals with discontinuous correlation metrics (lower than the correlation metrics of the sorted time-series signals) into the cluster.

[0092] Therefore, in one embodiment, when extracting clusters of similar time-series signals from time-series signals based on the similarity of power spectral density, the frequency domain clustering method 200 applies the Mann-Kendall test to detect change points in the time-series signals. The time-series signals are sorted in order of similarity to facilitate change point detection. Furthermore, the frequency domain clustering method 200 selects those time-series signals below the change points as clusters of time-series signals.

[0093] In one embodiment, multiple clusters are extracted from the time series signal. In one embodiment, the frequency domain clustering method 200 repeats the steps of (1) determining similarity in the frequency domain (e.g., power spectral density similarity) and (2) extracting clusters of similar time series signals until no further change points are detected at a given confidence level. Once no further change points are detected, the frequency domain clustering method 200 then puts the remaining unextracted time series signals into the last cluster.

[0094] In one embodiment, the machine learning model (discussed above in processing box 260) is a multivariate anomaly detection model (such as a multivariate state estimation technique (MSET) model). Therefore, the frequency domain clustering method 200 further assigns time series within the clusters as input to the MSET model. Furthermore, the frequency domain clustering method 200 does not assign time series excluded from the clusters as input to the MSET model. The model is thus trained and correlated on and with specific clusters of the time series signals.

[0095] The preceding example illustrates how training a dedicated ML model for a specific cluster of signals routes a cluster to a destination discrete from the destinations of other clusters. In one embodiment, routing a cluster to a destination discrete from the destinations of other clusters includes cluster-specific ML model training, monitoring, and alerting, as described below. In one embodiment, a frequency domain clustering method 200 trains a machine learning model to detect anomalies in the cluster, wherein the machine learning model is cluster-specific. The frequency domain clustering method 200 then monitors the cluster using the trained machine learning model during a monitoring phase to detect anomalies. In response to detecting an anomaly, the frequency domain clustering method 200 generates an electronic alert indicating that the anomaly has occurred in the cluster.

[0096] In one embodiment, the frequency domain clustering system 100 also includes an asset configured to be monitored by one or more sensors, and the one or more sensors. The one or more sensors are configured to generate time-series signals as a description of the physical state of the asset over time. Thus, in one embodiment, the frequency domain clustering method 200 identifies one or more clusters based on a training range of the time-series signals, and then monitors the one or more clusters over a monitoring range of the time-series signals. In one embodiment, the training range of the clusters describes a first physical state of the asset. In another embodiment, the monitoring range of the clusters describes a second physical state of the asset. And, in one embodiment, anomalies within the monitoring range of the clusters indicate that the asset is undergoing degradation.

[0097] Therefore, in one embodiment, one or more clusters are used to perform anomaly detection during the monitoring phase. In one embodiment, frequency domain clustering method 200 detects anomalies using a trained machine learning model. In response to the detection, frequency domain clustering method 200 generates electronic alerts indicating that the anomaly has been detected in the clusters of the time-series signal.

[0098] Advantageously, in one embodiment, the frequency domain clustering method 200 successfully distinguishes clusters of signals when the noise level is high enough to prevent cluster differentiation using time series techniques. For example, in one embodiment, the frequency domain clustering method 200 distinguishes clusters of signals when the noise on one or more time series signals exceeds 50%. Alternatively, in one embodiment, the frequency domain clustering method 200 distinguishes clusters of signals when the noise standard deviation on one or more time series signals exceeds 5.

[0099] —Discussion and Additional Examples—

[0100] In one embodiment, the frequency-domain clustering system and method described herein demonstrate a novel signal clustering approach operating in the frequency domain. Specifically, the frequency-domain clustering system and method described herein are based on correlation analysis between signals in the frequency domain (rather than analysis in the time domain). The frequency-domain clustering system and method are robust to signal noise. In experimental validation, an example embodiment of the frequency-domain clustering system correctly clusters signals even at noise ratios reaching 10-fold. This has been confirmed using basic factual knowledge about which clusters the signals belong to. This is unprecedented robustness in correctly clustering signals even under extremely high noise ratios.

[0101] The number of sensors in assets continues to grow exponentially. This increase in the number of sensors used for monitoring places further demands on improved clustering algorithms. When using ML algorithms to monitor sensor signals, it is beneficial to employ efficient clustering algorithms upstream of the core ML anomaly detection algorithm. Decomposing the database of signals into multiple (N) clusters and monitoring those clusters in parallel using individual ML models is computationally more efficient than attempting to monitor the entire database of signals with a single ML model. This is because the computational cost for ML analysis increases quadratically with the number of signals. Therefore, the overall computational cost is significantly reduced when signals can be intelligently clustered into correlated groups with good intra-signal correlation within each cluster. Moreover, monitoring clusters of correlated signals using separate ML models dedicated to the corresponding clusters of correlated signals yields more accurate and earlier anomaly detection.

[0102] Time-domain signal clustering algorithms can be satisfactory for identifying clusters when the measurement noise on the signal is moderate (e.g., 5% or less). However, if there is any noise on the signal exceeding moderate levels, time-domain signal clustering algorithms quickly become inaccurate. For example, when the noise on the sensor signal rises to 10-20%, time-domain signal clustering algorithms are prone to incorrectly clustering the signal. Furthermore, time-domain signal clustering becomes completely ineffective when the sensor produces an inherent noise level of 50% or more (i.e., a noise ratio of 1.5 or higher).

[0103] In one embodiment, a reference signal (as discussed above in processing block 220) is selected, and its similarity to other signals is evaluated by bivariate frequency-domain cross-power spectral density (CPSD) analysis applied to the other signals. In one embodiment, when a reference signal is selected, linear regression is applied to normalize the CPSD relative to a univariate periodogram of the reference signal. In other words, in one embodiment, the frequency-domain clustering technique uses linear regression to normalize the paired CPSDs using a univariate periodogram of each reference signal. This normalization ensures that (i) signals in the full set that are actually similar to the reference signal will have small residuals, and (ii) dissimilar signals will be poorly normalized, causing the residuals of dissimilar signals to be exaggerated and further increasing the cumulative mean absolute error (CMAE) used to distinguish clusters in subsequent analysis. CMAE is a measure of the correlation between the reference signal and other signals. Therefore, CMAE describes the similarity between a signal and a reference signal.

[0104] In one embodiment, after determining the residuals and CMAEs, similarity measurements of the CMAEs are analyzed to detect clusters. In one embodiment, the cluster detection analysis employs the mean cumulative function (MCF) to determine the CMAEs sorted in ascending order. For the (sorted) CMAEs of signals within the same cluster, the MCF has a very straight, non-decreasing slope. However, for the (sorted) CMAEs of signals not in the cluster, the MCF exhibits a change in slope. This change in slope reveals jumps or discontinuities in the CMAEs representing the similarity of a signal to a reference signal. Change point detection is then performed using the Mann-Kendall test to identify cluster boundaries of groups of signals similar to the reference signal. Cluster boundaries establish the locations where signals belonging to a cluster are separated from other signals. The MCF curves are very linear and noise-free, even when the original, unprocessed data signal is contaminated with a very high noise ratio. This is demonstrated in the extensive reduction-to-practice experiment summarized below.

[0105] In one embodiment, the frequency domain clustering system and method described herein improves the accuracy of ML monitoring of clustered signals. Specifically, it utilizes ML monitoring of clustered signals. In one embodiment, the frequency domain clustering system and method described herein exhibits a lower false alarm rate and a lower missed alarm rate for ML prognostic anomaly detection. In one embodiment, the frequency domain clustering system and method described herein achieves improved accuracy, improved ability to monitor noisy signals, and reduced computational costs for monitoring without requiring hardware upgrades anywhere in the data center or monitored asset. Therefore, the frequency domain clustering system and method described herein are immediately backward compatible with existing data center and sensor systems.

[0106] —Additional example frequency domain clustering methods—

[0107] Figure 3 An embodiment of a frequency domain clustering method 300 associated with clustering time-series signals based on frequency domain analysis is illustrated. The frequency domain clustering method 300 begins at “Start” box 305, for example, in response to conditions similar to those described above for method 200. At box 310, the frequency domain clustering method 300 receives ungrouped signals as input. In one embodiment, the ungrouped signals are a collection of time-series signals, such as a time-series database that has not been clustered. Given a collection of ungrouped signals, the following steps (a loop through boxes 315–345) are iteratively repeated to group the signals into clusters.

[0108] At box 315, the frequency domain clustering method 300 selects one signal as a reference signal from all ungrouped signals. In one embodiment, the signal with the lowest remaining number in the pool is selected; in other words, the first signal among the ungrouped signals is chosen as the reference signal. In another embodiment, the reference signal is randomly selected from the remaining signals in the pool.

[0109] At box 320, frequency domain clustering method 300 determines or calculates the cross-power spectral density (CPSD) between the selected reference signal and all other ungrouped signals. Furthermore, frequency domain clustering method 300 calculates the periodogram of the reference signal. The periodogram of the reference signal is the CPSD of the reference signal itself. In this way, for all signals in the cluster, a measure of correlation or similarity with an arbitrarily selected reference signal is found.

[0110] At box 325, the frequency domain clustering method 300 normalizes the CPSD of the signal relative to the periodogram of the reference signal. In one embodiment, normalization is performed using linear regression. For example, the frequency domain clustering method 300 normalizes the CPSD with scaling and shift factors to make it have the smallest possible mean square error (MSE) relative to the periodogram of the reference signal. The normalization step is employed to harmonize the magnitudes of different signals. Without normalization, measured signals with different units (such as temperature, voltage, revolutions per minute (RPM), etc.) would have large mean absolute errors simply because the original signals have different magnitudes.

[0111] At box 330, frequency domain clustering method 300 determines or calculates the cumulative average absolute error (CMAE) between the periodogram of the reference signal and all normalized CPSDs generated by boxes 320 and 325.

[0112] At box 335, the frequency domain clustering method 300 sorts the CMAEs in ascending order. Then, the frequency domain clustering method 300 calculates the mean cumulative function (MCF) of the sorted CMAEs. As mentioned above, the MCF is the cumulative sum of the CMAEs in the sorted order.

[0113] At box 340, frequency domain clustering method 300 checks for changes in the slope of the MCF. In one embodiment, the check is performed using the Mann-Kendall (MK) algorithm. In this embodiment, the Mann-Kendall algorithm is used for change point detection to achieve sensitive and accurate change point detection. Alternatively, other tests can be used for change point detection, including other trend detection algorithms (such as linear regression and Spearman's rho), and change point detection tests (such as the Pettitt test, von Neumann ratio test, cumulative sum test, Bayesian change point analysis, and standard normal uniformity test). Change point detection is specified to satisfy a pre-provided threshold confidence factor. The confidence factor can specify a high level of confidence, for example, above 0.95, such as 0.99. Change points detected with a high level of confidence are clearly changes. Change points detected with a low level of confidence may be less obvious and may cause unnecessarily fragmented clusters.

[0114] Box 340 represents the basic condition for the iterative step of grouping signals into clusters. When a change point can be detected in the slope of the MCF with sufficient confidence (e.g., a confidence factor of at least 0.99), at least one cluster remains in the signal pool, and the frequency domain clustering method 300 proceeds to box 345 and iterates further within the loop. When a change point cannot be detected in the slope of the MCF with sufficient confidence (e.g., a confidence factor less than 0.99), no further clusters are to be extracted from the signal pool, and the frequency domain clustering method 300 proceeds to box 350 and terminates the loop.

[0115] In box 345, the frequency domain clustering method 300 marks the signals before and at the detected change point as belonging to the same cluster as the reference signal. The frequency domain clustering method 300 then extracts or removes signals, including the reference signal, up to the change point from the remaining ungrouped signals and places them into clusters. For example, signals are placed into clusters by marking them as belonging to a cluster. Signals in this cluster can be provided as input for cluster-specific multivariate ML analyses.

[0116] The frequency domain clustering method 300 iteratively repeats the steps described above for boxes 315–345 until (at box 340) no change point is detected with a confidence factor of 0.99. Thereafter, at box 350, when no further change points can be found, the signals that are still ungrouped are defined (i.e., placed into) the last cluster. Signals in the last cluster that exhibit a small cross-correlation with the reference signal (indicated by a CMAE value exceeding a threshold) can be used individually for univariate analysis. Signals in the last cluster that exhibit a substantial cross-correlation with the reference signal (indicated by a CMAE value within a threshold) can be provided as input for a last-cluster-specific multivariate ML analysis.

[0117] —Experimental verification and explanation of the example processing—

[0118] Conventional time-domain clustering algorithms perform poorly when the measured signal is contaminated by measurement noise. This is especially true when the noise becomes large enough that it actually exceeds the dynamics (amplitude variations) in the measured signal. Time-domain clustering algorithms begin to misidentify at a noise ratio of standard deviation (STD) = 1—that is, placing incorrect signals into incorrect clusters. Moreover, time-domain clustering algorithms become completely ineffective at a noise ratio of STD = 5. At noise ratios of STD = 5 or higher, the cluster assignments of time-domain clustering algorithms are no more accurate than random cluster assignments.

[0119] In one embodiment, the frequency-domain clustering technique described herein overcomes the challenges posed by noisy signals. As demonstrated by the experimental results described below, even at a noise ratio of STD = 10, the frequency-domain clustering described herein robustly classifies signals into perfectly correct clusters. Successful clustering under such high noise conditions is unattainable using time-domain clustering algorithms.

[0120] To illustrate an example of frequency-domain clustering methods and demonstrate their effectiveness, an example aggregation of time-series signals is applied. The aggregation of time-series signals is synthesized or otherwise generated to include a set of three signal clusters exhibiting activity that is correlated within each cluster but uncorrelated between clusters. Because the signals are constructed to have these three clusters, there is the fundamental knowledge that the signals in the three clusters do indeed have cross-correlation between signals in each cluster and lack cross-correlation with any signals in the other two clusters.

[0121] Initially, in signal synthesis processing, basis functions (without random noise) are generated. The basis functions are dynamic because their amplitudes change over time. Within the basis functions, the intra-group correlation (due to amplitude variation) is very high, but the inter-group correlation is low. Three sets of signals are defined, each containing 10 signals. The period of the sinusoidal basis for each set is:

[0122] Group 1: 199, 383, and 547 observations;

[0123] Group 2: 163, 337, and 409 observations; and

[0124] Group 3: 139, 271 and 467 observations.

[0125] Group 1 contains signals with indices 1–10, Group 2 contains signals with indices 11–20, and Group 3 contains signals with indices 21–30. Therefore, the example collection of time series signals comprises thirty time series signals that, at the level of basic facts, belong to three clusters or related groups.

[0126] For generality, the period of the dynamic component in each signal is defined based on the number of observations. For example, a period of 199 means that there is a repeating amplitude variation pattern for every 199 observations. This is because in practical industrial applications, the sampling rate of a signal can range from milliseconds (or less) to minutes (or more). By defining the period based on the number of observations, the result can be immediately converted to a time-based period for any industrial application using a simple scalar transformation to time units. In this example, the time series signal is 4096 observations long. 4096 observations is long enough to include multiple repetitions of even the longest period (547 observations) in the basis function.

[0127] To simulate the real-world challenges posed by measurement noise superimposed on signals, an example collection of time-series signals was generated by applying Gaussian noise to the basis functions. The noise obscures or otherwise masks the intra- and inter-cluster correlations of the signals. During the experiments, the noise ratio was systematically increased across all three clusters of the signal to provide test signals with varying noise levels. For example, the tests were performed by superimposing measurement noise with a standard deviation (STD) of 1 on all signals, followed by successive increases in the noise to STD levels of 2, 5, and 10.

[0128] The following section summarizes the results of the frequency-domain clustering method at very high noise levels (STD = 10) to demonstrate how robust it is to noise. Similar success was achieved at lower noise levels. At each noise level, the frequency-domain clustering method correctly separated the signals in the example collection into clusters.

[0129] Figure 4The figure shows a graph 400 of the periodograms of selected signals from an example collection of signals. The noise on these signals has a standard deviation of 10. The periodograms 405 of signal 1 and 410 of signal 5 from the example collection are shown plotted on the period axis 415 and the amplitude axis 420. Note that the underlying components, or basis functions, with periods of 199, 383, and 547 are slightly visible in the periodograms with peaks around these periods. However, the basis functions are also slightly obscured by measurement noise superimposed on the underlying signals.

[0130] The effects of measurement noise are eliminated by calculating the cross power spectral density (CPSD) between the signals. The CPSD is then calculated (e.g., as discussed above in reference boxes 225 and 320). Figure 5 The figure shows the CPSD 505 plot 500 for signals 1 and 5. CPSD 505 is plotted on the period axis 510 and the amplitude axis 515. As can be observed, CPSD most clearly emphasizes the three frequency components. In CPSD 505, clear peaks 520 are visible at the component periods of 199, 383, and 547. Other frequency components due to noise are suppressed in CPSD 505. Plot 500 demonstrates that CPSD performs better in identifying signal characteristics compared to noisy time series (not shown) and periodograms (such as periodograms 405 and 410).

[0131] The CPSD is then normalized using linear regression (e.g., as discussed in reference boxes 230 and 325 above). Normalization places the CPSD on the same scale as the periodogram of the reference signal to enable comparison. Figure 6 The diagram illustrates a graph 600 of the selected normalized CPSDs of paired signals. The CPSD 605 of signal 1 with itself, the CPSD 610 of signal 1 with signal 9, and the CPSD 615 of signal 1 with signal 17 are plotted on the period axis 620 and the amplitude axis 625. In one embodiment, the CPSD 605 of signal 1 with itself is used as a periodogram of a reference signal (i.e., in one embodiment, the periodogram of the reference signal is the CPSD of the reference signal with itself). The CPSD 610 of signal 1 with signal 9 and the CPSD 615 of signal 1 with signal 17 are both normalized to the scale of the CPSD 605 of signal 1 with itself.

[0132] Graph 600 shows the magnitudes of CPSD 605 for signal 1 and itself, CPSD 610 for signal 1 and signal 9, and CPSD 615 for signal 1 and signal 17. Note that, in the basic facts, signal 1 and signal 9 belong to the same group or cluster, while signal 1 and signal 17 belong to different groups or clusters. Although not immediately visible in graph 600, the difference between CPSD 610 for signal 1 and signal 9 and CPSD 605 for signal 1 and itself is smaller than the difference between CPSD 615 for signal 1 and signal 17 and CPSD 605 for signal 1 and itself.

[0133] The difference lies in Figure 7 It becomes more visible in the middle. Figure 7 The graph 700 illustrates the absolute value (also known as absolute error) of the difference between the periodogram 605 of the reference signal (signal 1 and its own CPSD 605) and the selected CPSD of the signal pair. Graph 700 shows the absolute error 705 between the CPSD 610 of signal 1 and signal 9 and the periodogram 605 of the reference signal. Furthermore, graph 700 shows the absolute error 710 between the CPSD 615 of signal 1 and signal 17 and the periodogram 605 of the reference signal. Absolute errors 705 and 710 are plotted on the period axis 715 and the amplitude axis 720. The absolute error 710 between signals belonging to different clusters is generally greater than the absolute error 705 between signals belonging to the same cluster.

[0134] Then the cumulative mean absolute error (CMAE) is calculated for the signal (e.g., as described in reference boxes 235 and 330 above). Figure 8 Figure 800 illustrates the CMAE values ​​805 for each signal in the example set. The CMAE values ​​805 are plotted on the signal index axis 810 and the CMAE value axis 815. As indicated in Figure 800, using signal 1 820 as the reference signal, the cumulative mean absolute error (CMAE) of the signals with indices 2 to 10 is less than that of signal 1 and all other signals above 10. Therefore, these nine signals (indices 2 to 10) will be clustered into the same group as signal 1 using a frequency domain clustering method, and the signals with indices 1–10 will be removed from the example set of signals available for clustering.

[0135] In one embodiment, the clustering process is enabled to be performed autonomously by the following steps: sorting by CMAE (e.g., as described in boxes 245 and 335), generating the mean cumulative function (MCF) of the sorted CMAEs (e.g., as described in boxes 250 and 335), and detecting change points in the MCF (e.g., as described in boxes 250 and 340).

[0136] In one embodiment, the signals are sorted in ascending order of CMAE values. In other words, CMAE is sorted in ascending order, for example as discussed in blocks 245 and 335. Figure 9 Figure 900 illustrates the CMAE values ​​905 of the various signals in the example collection. The CMAE values ​​905 (and, in one embodiment, the associated signals) are sorted in ascending order of CMAE. The values ​​sorted in ascending order of CMAE are reordered such that the CMAE increases with each subsequent signal. The CMAE values ​​are plotted on the sorted signal index axis 910 and the CMAE value axis 915. The signal indices in the sorted signal index axis 910 are reordered in ascending order of CMAE such that the reference signal with index 1 in Figure 800 has index 1 in Figure 900, the signal with index 10 in Figure 800 has index 2 in Figure 900, the signal with index 2 in Figure 800 has index 3 in Figure 900, the signal with index 6 in Figure 800 has index 4 in Figure 900, the signal with index 3 in Figure 800 has index 5 in Figure 900, and so on. The association between the original signal indices and the reordered signal indices is maintained in a data structure. For example, the order in which signals are sorted can be represented by index positions in an array or other vector data structure, while the original signal index is a label applied to the signals so that they can appear in any order in the vector data structure.

[0137] In one embodiment, the average cumulative function (MCF) of the sorted CMAEs is calculated (e.g., as described in boxes 250 and 335). Specifically, the MCF is generated by the cumulative summation of the sorted CMAEs. Figure 10 Figure 1000 illustrates the MCF 1005 of the sorted CMAE value 905. MCF 1005 is plotted on the sorted signal index axis 1010 and the MCF value axis 1015. Similar to the signal index axis 910 above, the signal index axis 1010 represents the sorted order of the signals (ascending order of CMAE values), rather than the original signal index labels of the example collection.

[0138] In one embodiment, a change point detection algorithm analyzes the MCF to detect change points (e.g., as discussed in reference boxes 250 and 340) that represent jumps or discontinuities in the ordered CMAEs. In one embodiment, the change point detection algorithm is the Mann-Kendall algorithm. For MCF 1005, the change point 1020 of the slope of MCF 1005 is represented by the circled point. Enlarged view 1025 shows that the change point detection algorithm even detects subtle changes in the slope of MCF 1005 at change point 1020. Below change point 1020, the slope of MCF 1005 is shallower, while outside change point 1020, the slope of MCF 1005 is steeper. When the noise level is low, the changes in the MCF slope are less subtle and more noticeable. Change point 1020 appears at the signal corresponding to the 10th smallest CMAE. Frequency domain clustering methods determine that signals with CMAEs up to and including the change point belong to a cluster. The 10 smallest CMAEs correspond to the original signal index numbers 1, 10, 2, 6, 3, 5, 8, 9, 7, and 4, respectively. As we know from the basic facts, these signals all belong to cluster 1. Therefore, despite the very high noise level, the frequency domain clustering method still correctly defines the clusters.

[0139] In one embodiment, signals identified as part of a cluster are extracted from the sample collection and added to the cluster, for example as described in blocks 240, 255, and 345. Thus, the 10 signals (assigned to cluster 1) are removed from the sample collection of signals.

[0140] Any further clustering will be formed from signals that have not yet been extracted from the example collection. Therefore, in one embodiment, the frequency domain clustering method is repeated using the remaining 20 signals and a new reference signal selected from the 20 remaining signals. In one embodiment, the first remaining signal, signal 11, is selected as the reference signal. The CMAE between the new reference signal (signal 11) and the remaining signals (including signal 11 itself) is determined. Figure 11 Figure 1100 illustrates the CMAE value 1105 of the remaining signal. The CMAE value 1105 of the remaining signal is plotted on the signal index axis 1110 and the CMAE value axis 1115. The CMAE value 1105 of the remaining signal is generated based on the new reference signal. Here, for the remaining 20 signals, using signal 11 as the reference signal, the CMAE of the signals with indices 12 to 20 is significantly smaller than that of the signals with indices 21–30. Therefore, these nine signals with indices 12 to 20 will be autonomously clustered into the same group as signal 11 through this iteration of the frequency domain clustering method.

[0141] The remaining signal CMAE values ​​1105 are sorted in ascending order, as discussed above in boxes 245 and 335. Figure 12Figure 1200 illustrates the sorted CMAE values ​​1205. The sorted CMAE values ​​1205 are ordered in ascending order of CMAE between the CPSD of the signal and the CPSD of the reference signal. The sorted CMAE values ​​1205 are plotted on the sorted signal index 1210 and the CMAE value index 1215. The sorted signal index axis 1210 represents the order of the signals when sorted by ascending CMAE values. After the signal at index 20, there is a clear jump in the CMAE. This will be detected by frequency domain clustering methods using changepoint analysis of the MCF for the sorted CMAE values ​​1205 of the remaining signals.

[0142] The frequency domain clustering method generates an MCF with a sorted CMAE value of 1205 for the remaining signals. Figure 13 Figure 1300 illustrates the MCF 1305 for the sorted CMAE value 1205 of the remaining signals. MCF 1305 is plotted on the sorted signal index axis 1310 and the MCF value axis 1315. The sorted signal index axis 1310 represents the order of the signals when sorted by ascending CMAE values. A frequency domain clustering method performs a change point detection algorithm to detect change point 1320. Change point 1320 is found at signal index 20. This change point corresponds to a jump in the CMAEs after signal index 20 shown in Figure 1200 for the sorted CMAE values ​​of the remaining signals. The change point at signal index 20 corresponds to the 10th smallest CMAE among the remaining signals. These 10 smallest CMAEs correspond to the original signal index numbers 11, 13, 19, 15, 18, 12, 14, 16, 17, and 20, respectively. As is known from basic facts, these signals are all in cluster 2. Despite the high noise levels in the signal, the frequency domain clustering method once again identified the cluster perfectly correctly. This second cluster was extracted from the example collection of time-series signals, leaving signals 21-30.

[0143] Further iterations of the frequency domain clustering method result in no change points being detected for the remaining signals 21-30. Therefore, the remaining signals 21-30 are extracted into a final cluster, such as that described in reference box 350. As is known from the basic facts, signals 21-30 are all in cluster 3 of the example collection. In this way, the frequency domain clustering method has precisely identified all clusters of cross-correlated activity in the example collection. Therefore, even if the noise level on the signals (noise STD = 10) is high enough to make time-domain clustering impossible, the frequency domain clustering method is successful and completely accurate.

[0144] In one embodiment, this improvement in the clustering effectiveness and accuracy of the frequency domain clustering technique shown and described herein is thus validated by accurately detecting known, fundamental clusters of signals even in the presence of very high noise ratios (such as noise STD = 10). While demonstrated using an example set of relatively small signals, in one embodiment, the frequency domain clustering technique shown and described herein is scalable: it is equally effective and accurate when applied to large datasets containing hundreds of thousands of signals. Different noise ratios, signal sets of different sizes, and different numbers of clusters have been tested. In one embodiment, for each case, the frequency domain clustering technique shown and described herein demonstrates unprecedented accuracy for clustering, even in the presence of very high uncertainty about the signal. For example, as shown above, even with a noise ratio of 10x, the frequency domain clustering technique achieves exact 100% clustering correctness. No other clustering method achieves this level of robustness to noise levels.

[0145] —Mann-Kendall Analysis—

[0146] In the MK test, data points are evaluated sequentially. Each data point is compared to all subsequent data points to determine if the trend changed at that data point. At each data point, the value of the MK statistic is determined. As shown in Equation 1, in one embodiment, the MK statistic S for n data points is given by the following formula:

[0147] Equation 1

[0148] in:

[0149]

[0150] The initial value of the MK statistic S is 0, indicating no trend. When the data comes from an earlier period... The data points are greater than those from later periods. When data points are from later periods, the MK statistic S decreases by 1. The data points are larger than those from earlier periods. When the data points are equal, the MK statistic S increases by 1. A positive MK statistic S indicates an increasing trend, while a negative MK statistic S indicates a decreasing trend.

[0151] In one embodiment, a change point in the sorted signal is detected at a data point (signal index position in the sorted signal) where the confidence factor for the existence of a trend meets a threshold. To determine the confidence factor for data points in the MCF, frequency domain clustering method 200 initially determines the variance of the MK statistic S. The variance of the MK statistic S... As given by Equation 2.

[0152] Equation 2

[0153] Where n is the number of data points (here, the number of signals remaining in the pool), k is the number of tied groups, and This represents the number of data points in the k-th tie group. (A "tie group" is a set of data points in the MCF that have the same value, or in other words, they are "tied" in terms of magnitude, with neither value being greater than or less than the other.) Frequency domain clustering method 200 aggregates the values ​​of the variables in Equation 2 and performs Equation 2 to generate the variance of the MK statistic. .

[0154] Once the variance of the MK statistic is determined... The frequency domain clustering method 200 then generates a Z-statistic, which indicates how far the underlying trend differs from the expected situation when there is no trend. In one embodiment, the Z-statistic is given by Equation 3:

[0155] Equation 3

[0156] Frequency domain clustering method 200 accesses the value of MK statistic S and the variance of MK statistic Then execute Equation 3 to generate the Z statistic.

[0157] Once the Z-statistic is generated, its value can be used to determine the probability that a trend was falsely detected at signal index position n. In one embodiment, the frequency domain clustering method 200 can look up the probability (p value) of finding a change point at position n where there is no change point, such as a table of standard normal distribution probabilities indexed by the Z-statistic. Alternatively, the frequency domain clustering method 200 can calculate the value of p for a given Z-statistic using the probability distribution function of the standard normal distribution in Equation 4:

[0158] Equation 4

[0159] —An Overview of Multivariate ML Anomaly Detection—

[0160] Generally, multivariate ML modeling techniques used for anomaly detection predict or estimate what each signal should or is expected to be based on a database or aggregation of time-series signals. The predicted signal can be referred to as an "estimate." Multivariate ML anomaly detection models are used to predict or estimate individual variables based on values ​​provided for other variables. For example, for signal 1 in a database of N signals, a multivariate ML anomaly detection model would use signals 2 through N to calculate an estimate of signal 1.

[0161] In one embodiment, the ML anomaly detection model can be a nonlinear nonparametric (NLNP) regression algorithm for multivariate anomaly detection. Such NLNP regression algorithms include autoassociative kernel regression (AAKR) and similarity-based modeling (SBM), such as multivariate state estimation techniques (MSET) (including Oracle's proprietary multivariate state estimation technique (MSET2)). In one embodiment, the ML anomaly detection model can be another form of algorithm for multivariate anomaly detection, such as a neural network (NN), support vector machine (SVM), or linear regression (LR). In one embodiment, the prognostic performance of the aforementioned multivariate anomaly detection algorithms can be improved by applying the systems and methods described herein for frequency domain clustering.

[0162] The ML anomaly detection model is trained to produce estimates of what the values ​​of variables should be based on training with time-series readings (such as time-series vectors or time-series signals) representing normal or correct operation of the monitored asset. The training process involves iteratively optimizing the configuration of the ML model until it consistently predicts the expected value of the training portion of an individual signal, which matches (within acceptable tolerances) the actual value of that individual signal's training portion. To train the ML anomaly detection model, time-series readings are used to adjust the model. The configuration of the correlation patterns between variables in the ML anomaly detection model is automatically adjusted based on the values ​​of the time-series readings so that the ML anomaly detection model produces accurate estimates for each variable based on inputs from other variables. The accuracy of the estimates sufficient to determine that the ML anomaly detection model has been adequately trained can be determined by minimizing the residuals below a pre-configured training threshold. Residuals are the differences between actual values ​​(such as measured, observed, sampled, or resampled values) and estimates, references, or predictions of what that value should be. At the end of training, the ML anomaly detection model has learned the correlation patterns between variables.

[0163] After training, the ML anomaly detection model can be used to monitor time series readings. Subtracting the actual measured value of each signal from the corresponding estimate gives the residual, or difference, between the signal value and the estimate. When an anomaly is present in the signal, the measured signal value deviates from the estimated signal value. This causes the residual to increase, thus triggering an anomaly alarm. Therefore, the residual is used to detect such anomalies when one or more of the residuals indicate this deviation (e.g., due to becoming persistently excessive).

[0164] For example, the presence of anomalies can be detected by performing a sequential probability ratio test (SPRT) analysis on the residuals, as discussed in detail above. In one embodiment, SPRT calculates the cumulative sum of the log-likelihood ratios of each successive residual between the actual value of the signal and the estimated value of the signal, and compares this cumulative sum with a threshold value indicating anomaly deviation. When the threshold is exceeded, an anomaly is detected, and an alert indicating the anomaly can be generated.

[0165] —Electronic Alert—

[0166] In one embodiment, an electronic alert is generated by composing and transmitting a computer-readable message. The computer-readable message may include content describing the anomaly that triggered the alert, such as the time the anomaly was detected, an indication of the signal value causing the anomaly, and an identifier of the cluster (and / or the underlying asset, a component of the asset, or another source of the signal within the cluster) to which the anomaly occurred and to which the alert applies. In one embodiment, an electronic alert may be generated and transmitted in response to the detection of an anomalous signal value. The electronic alert may be composing and then transmitting for subsequent display on a display or other actions.

[0167] In one embodiment, an electronic alert is a message configured to be transmitted over a network (such as a wired network, cellular phone network, Wi-Fi network, or other communication infrastructure). The electronic alert may be configured to be read by a computing device. The electronic alert may be configured to trigger a request (such as a REST request) for the initiation of an automation function in response to the detection of an anomaly in the cluster. In one embodiment, the automation function is configured to adjust the physical state or activity of an asset or component of an asset associated with the cluster, such as by triggering a maintenance response to the asset or component of the asset or reducing power supply to the asset or component of the asset (e.g., slowing down or shutting down). In one embodiment, the content of the electronic alert can be retrieved via a REST API that has received the electronic alert and presented in a user interface (such as a graphical user interface (GUI)). The GUI may present messages, notifications, or other indications that the operating status of a specific machine, asset component, or other signal source has entered (or left) an abnormal operating state.

[0168] In one embodiment, the automatic clustering method thus proposes a technical solution that aggregates unlabeled, noisy time-series signals into clusters of related activities associated with specific activities or components of an asset and notifies the user when an anomaly indicating asset degradation or initial failure occurs, even when the noise level on the signal is too high.

[0169] —Cloud or Enterprise Implementation Examples—

[0170] In one embodiment, the system (such as frequency domain clustering system 100) is a computing / data processing system comprising a collection of computing applications or distributed computing applications accessible and usable by other client computing devices communicating with the system via a network. In one embodiment, frequency domain clustering system 100 is a component configured to aggregate, provide, and perform operations on time series data as a time series data service. The application and computing system may be configured to operate with or be implemented as a cloud-based network computing system, Infrastructure as a Service (IAAS), Platform as a Service (PAAS), or Software as a Service (SaaS) architecture, or other types of networked computing solutions. In one embodiment, the system provides one or more of the functions disclosed herein, along with a graphical user interface for accessing and operating those functions. In one embodiment, frequency domain clustering system 100 is a centralized server-side application that provides at least the functions disclosed herein and is accessible to a number of users via computing devices / terminals communicating with a computer that communicates with frequency domain clustering system 100 (which acts as one or more servers) via a computer network. In one embodiment, the frequency domain clustering system 100 may be implemented by a server or other computing device configured with hardware and software to implement the functions and features described herein.

[0171] In one embodiment, the components of the frequency domain clustering system 100 may be implemented as a collection of one or more software modules executed by one or more computing devices specifically configured for such execution. In one embodiment, the components of the frequency domain clustering system 100 are implemented on one or more hardware computing devices or hosts interconnected via a data network. For example, the components of the frequency domain clustering system 100 may be executed by network-connected computing devices of one or more computer hardware forms, such as a central processing unit (CPU) or general-purpose, dense input / output (I / O), graphics processing unit (GPU), and high-performance computing (HPC) forms.

[0172] In one embodiment, components of the frequency domain clustering system 100 communicate with each other via electronic messages or signals. These electronic messages or signals can be configured to call functions or procedures that access the characteristics or data of a component, such as, for example, application programming interface (API) calls. In one embodiment, these electronic messages or signals are sent between hosts in a format compatible with Transmission Control Protocol / Internet Protocol (TCP / IP) or other computer networking protocols. Components of the frequency domain clustering system 100 can (i) generate or compose electronic messages or signals to issue commands or requests to another component, (ii) transmit messages or signals to other components of the frequency domain clustering system 100, (iii) parse the content of received electronic messages or signals to identify commands or requests that the component can execute, and (iv) automatically execute or perform the commands or requests in response to the identification of the commands or requests. Electronic messages or signals may include queries against a database. Queries can be written and executed using a query language compatible with the database and executed in a runtime environment compatible with the query language.

[0173] In one embodiment, the remote computing system can access information or applications provided by the frequency domain clustering system 100, for example, through a web interface server. In one embodiment, the remote computing system can send requests to and receive responses from the frequency domain clustering system 100. In one example, information or applications can be accessed using a web browser on a personal computer or mobile device. In one example, communication exchanged with the frequency domain clustering system 100 can take the form of Remote Representation State Transfer (REST) ​​requests, such as using JavaScript Object Notation (JSON) as the data exchange format, or sending Simple Object Access Protocol (SOAP) requests to or from an XML server. REST or SOAP requests can include API calls to components of the frequency domain clustering system 100.

[0174] —Software Module Examples—

[0175] Generally, software instructions are designed to be executed by one or more appropriately programmed processors accessing memory. Software instructions can include, for example, computer-executable code and source code that can be compiled into computer-executable code. These software instructions can also include instructions written in interpreted programming languages ​​such as scripting languages.

[0176] In complex systems, such instructions can be arranged into program modules, each performing a specific task, process, function, or operation. The operation of the entire set of modules can be controlled or coordinated by an operating system (OS) or other form of organizational platform.

[0177] In one embodiment, one or more of the components described herein are configured as modules stored in a non-transitory computer-readable medium. The modules are configured with stored software instructions that, when executed by accessing memory or a storage device via at least a processor, cause a computing device to perform one or more corresponding functions as described herein.

[0178] In one embodiment, the frequency domain clustering system and method described herein can be implemented using a computer program product comprising a computer program / instruction that, when executed by a processor, causes the processor to perform any of the methods described herein.

[0179] —Computing Device Examples—

[0180] Figure 14 An example computing system 1400 is illustrated, which is a dedicated computing device configured and / or programmed to have one or more of the example systems and methods described herein and / or equivalents. The example computing device may be a computer 1405 including at least one hardware processor 1410, a memory 1415, and an input / output port 1420 operably connected via a bus 1425. In one example, the computer 1405 may include frequency domain clustering logic 1430 configured to facilitate clustering of time-series signals based on analysis in the frequency domain, similar to the referenced... Figure 1 –3 shows and describes the frequency domain clustering system, method, and logic.

[0181] In various examples, logic 1430 may be implemented in hardware, one or more non-transitory computer-readable media 1437 storing instructions, firmware, and / or a combination thereof. Although logic 1430 is shown as a hardware component attached to bus 1425, it should be appreciated that in other embodiments, logic 1430 may be implemented in processor 1410, stored in memory 1415, or stored in disk 1435.

[0182] In one embodiment, logic 1430 or computer is a component (i.e., structure: hardware, non-transitory computer-readable medium, firmware) for performing the described actions. In some embodiments, the computing device may be a server operating in a cloud computing system, a server configured in a Software as a Service (SaaS) architecture, a smartphone, a laptop computer, a tablet computing device, etc.

[0183] The component can be implemented, for example, as an ASIC programmed to facilitate clustering of time-series signals based on analysis in the frequency domain. The component can also be implemented as stored computer-executable instructions, which are presented as data 1440 to computer 1405, temporarily stored in memory 1415, and then executed by processor 1410.

[0184] Logic 1430 may also provide components (e.g., hardware, nontransitory computer-readable medium storing executable instructions, firmware) for performing one or more publicly disclosed functions and / or combinations of functions.

[0185] In a typical example configuration describing computer 1405, processor 1410 can be various processors, including dual-microprocessor and other multiprocessor architectures. Memory 1415 can include volatile memory and / or non-volatile memory. Non-volatile memory can include, for example, ROM, PROM, etc. Volatile memory can include, for example, RAM, SRAM, DRAM, etc.

[0186] Storage disk 1435 can be operatively connected to computer 1405 via, for example, an input / output (I / O) interface (e.g., card, device) 1445 and input / output port 1420 controlled by at least one input / output (I / O) controller 1447. Disk 1435 can be, for example, a disk drive, solid-state drive, floppy disk drive, tape drive, Zip drive, flash memory card, memory stick, etc. Furthermore, disk 1435 can be a CD-ROM drive, CD-R drive, CD-RW drive, DVD ROM, etc. Memory 1415 can store, for example, processing 1450 and / or data 1440. Disk 1435 and / or memory 1415 can store an operating system that controls and allocates resources of computer 1405.

[0187] Computer 1405 can interact with, control, and / or be controlled by input / output (I / O) devices via input / output (I / O) controller 1447, I / O interface 1445, and input / output port 1420. Input / output devices may include, for example, one or more displays 1470, printers 1472 (such as inkjet printers, laser printers, or 3D printers), audio output devices 1474 (such as speakers or headphones), text input devices 1480 (such as keyboards), cursor control devices 1482 for pointing and selecting input (such as mice, trackballs, touchscreens, joysticks, pointing sticks, electronic styluses, electronic writing tablets), audio input devices 1484 (such as microphones or external audio players), video input devices 1486 (such as cameras and still cameras, or external video players), image scanners 1488, video cards (not shown), disks 1406, network devices 1455, one or more alert devices (not shown) configured to generate alerts in response to detected anomalies, one or more electronically activated mechanical, pneumatic, hydraulic, or electromechanical control devices (not shown), etc. Input / output ports 1410 may include, for example, serial ports, parallel ports, and USB ports.

[0188] Computer 1405 can operate in a network environment and therefore can be connected to network device 1455 via I / O interface 1445 and / or I / O port 1420. Through network device 1455, computer 1405 can interact with network(s) 1460(s). Through the network, computer 1405 can logically connect to remote computer 1465. Networks with which computer 1405 can interact include, but are not limited to, LANs, WANs, and other networks.

[0189] In one embodiment, computer 1405 can be connected to sensor 1490 via I / O port 1420 or network 1460 to receive information about the physical state of a monitored machine, equipment, system, facility, or other device (collectively, “asset” 1492) and its components. In one embodiment, sensor 1490 is configured to monitor physical phenomena occurring in or around asset 1492. Asset 1492 generally includes any type of machine or facility with components performing measurable activities. In one embodiment, sensor 1490 may be operatively connected to or attached to asset 1492, or otherwise configured to detect and monitor physical phenomena occurring in or around asset 1492. Sensor 1490 can generate a time-series signal of readings acquired from asset 1492. Therefore, asset 1492 can be considered a source of signal (signal source). Sensor 1490 can be a network-connected sensor for monitoring any type of physical phenomenon. Asset 1492 with a network-connected sensor can be referred to as an Internet of Things (IoT) connected device. The network connection between sensor 1490 and network 1460 can be wired or wireless.

[0190] In one embodiment, sensor 1490 may include (but is not limited to): a temperature sensor (such as a thermocouple or a resistance temperature detector), a vibration sensor (such as a piezoelectric sensor), an accelerometer, a voltage sensor, a current sensor, a pressure sensor, a rotational speed sensor, a flow meter sensor, a speedometer or other speed sensor, an airspeed sensor or anemometer, a microphone, an electromagnetic radiation sensor, a proximity sensor, a gyroscope, an inclinometer, a Global Positioning System (GPS) sensor, a fuel gauge, a torque sensor, a bending sensor, a nuclear radiation detector, or a variety of other sensors or transducers for generating electrical signals representing sensed physical phenomena (e.g., physical phenomena occurring inside or around an asset). As discussed above, sensor 1490 may belong to a manufacturing system or a chemical processing system, such as an oil refinery. Sensor 1490 may be configured to measure physical variables of a part to be manufactured or chemicals processed in a manufacturing or chemical processing system. Alternatively, or additionally, sensor 1490 may be configured to measure environmental conditions in the environment of a manufacturing system, chemical processing system, or aircraft, the condition of the apparatus in the manufacturing system, chemical processing system, or aircraft, and / or the performance of the apparatus.

[0191] In one embodiment, computer 1405 is configured with logic, such as software modules, to collect readings from sensor 1490 and store them as observations in a time-series data structure, such as a time-series database. In one embodiment, computer 1405 polls sensor 1490 to retrieve sensor telemetry readings. In one embodiment, sensor telemetry readings may be a time series of vectors having the sensed values ​​of each sensor 1490. In one embodiment, computer 1405 passively receives sensor telemetry readings actively transmitted by sensor 1490. In one embodiment, computer 1405 receives one or more collections, sets, or databases of sensor telemetry readings previously collected from sensor 1490 (e.g., from storage device 1435 or from remote computer 1465).

[0192] —Definitions and Other Embodiments—

[0193] In another embodiment, the described methods and / or their equivalents may be implemented using computer-executable instructions. Thus, in one embodiment, a non-transient computer-readable / storage medium is configured to have stored computer-executable instructions of an algorithm / executable application that, when executed by one or more machines (and / or associated components), cause the one or more machines (and / or associated components) to perform the methods. Example machines include, but are not limited to, processors, computers, servers operating in cloud computing systems, servers embedded in Software as a Service (SaaS) architectures, smartphones, and the like. In one embodiment, the computing device is implemented using one or more executable algorithms configured to perform any of the disclosed methods.

[0194] In one or more embodiments, the disclosed methods or their equivalents are performed by any of: computer hardware configured to perform the methods; or, computer instructions embodied in a module stored in a non-transient computer-readable medium, wherein the instructions are configured to execute an algorithm that is configured to perform the methods when executed by at least one processor of a computing device.

[0195] While the methods illustrated in the figures are shown and described as a series of boxes representing the algorithm for the purpose of simplification, it should be understood that these methods are not restricted by the order of the boxes. Some boxes may appear in a different order than those shown and described, and / or appear simultaneously with other boxes. Moreover, example methods can be implemented using fewer boxes than are shown in all the figures. Boxes can be combined or divided into multiple actions / components. Furthermore, additional and / or alternative methods may employ additional actions not illustrated in the boxes.

[0196] The following includes definitions of the selected terms used herein. Definitions include various examples and / or forms of components that fall within the scope of the term and can be used to implement it. Examples are not intended to be restrictive. Both singular and plural forms of the terms may be included within the definitions.

[0197] References to "an embodiment," "an embodiment," "an example," "an example," etc., indicate that one or more embodiments or examples as described may include a particular feature, structure, characteristic, property, element, or limitation, but not every embodiment or example must include that particular feature, structure, characteristic, property, element, or limitation. Furthermore, repeated use of the phrase "in one embodiment" does not necessarily refer to the same embodiment, but may refer to the same embodiment.

[0198] As used herein, a “data structure” is an organization of data stored in memory, storage devices, or other computerized systems within a computing system. A data structure can be any of, for example, a data field, a data file, a data array, a data record, a database, a data table, a graph, a tree, a linked list, etc. A data structure can be formed from and contain many other data structures (e.g., a database includes many data records). Other examples of data structures are also possible according to other embodiments.

[0199] As used herein, "computer-readable medium" or "computer storage medium" means a non-transient medium that stores instructions and / or data configured to perform one or more of the disclosed functions when executed. In some embodiments, data may be used as instructions. Computer-readable media may take the form of, but is not limited to, non-volatile and volatile media. Non-volatile media may include, for example, optical discs, magnetic disks, etc. Volatile media may include, for example, semiconductor memory, dynamic memory, etc. Common forms of computer-readable media may include, but are not limited to, floppy disks, flexible disks, hard disks, magnetic tapes, other magnetic media, application-specific integrated circuits (ASICs), programmable logic devices, compact discs (CDs), other optical media, random access memory (RAM), read-only memory (ROM), memory chips or cards, memory sticks, solid-state storage devices (SSDs), flash drives, and other media in which computers, processors, or other electronic devices can operate. If each type of media is selected for implementation in one embodiment, it may include stored instructions of an algorithm configured to perform one or more of the disclosed and / or claimed functions.

[0200] As used herein, “logic” means a component implemented using computer or electrical hardware, a non-transient medium having instructions for executable application or program modules stored therein, and / or a combination thereof, to perform any function or action disclosed herein, and / or to cause a function or action from another logic, method, and / or system to be performed as disclosed herein. Equivalent logic may include firmware, a microprocessor programmed with an algorithm, discrete logic (e.g., an ASIC), at least one circuit, analog circuit, digital circuit, programmable logic device, memory device containing instructions for an algorithm, etc., any of which may be configured to perform one or more of the disclosed functions. In one embodiment, logic may include one or more gates, combinations of gates, or other circuit components configured to perform one or more of the disclosed functions. In the case of describing multiple logics, it is possible to combine multiple logics into one logic. Similarly, in the case of describing a single logic, it is possible to distribute that single logic among multiple logics. In one embodiment, one or more of these logics are corresponding structures associated with performing the disclosed and / or claimed functions. The choice of which type of logic to implement may be based on desired system conditions or specifications. For example, hardware implementation of the function would be chosen if higher speed is considered. If lower cost is a consideration, then stored instructions / executable applications will be chosen to implement the functionality.

[0201] An "operable connection," or a connection through which entities are "operably connected," is a connection capable of sending and / or receiving signals, physical communication, and / or logical communication. An operable connection may include physical interfaces, electrical interfaces, and / or data interfaces. An operable connection may include various combinations of interfaces and / or connections sufficient to allow operable control. For example, two entities may be operably connected to transmit signals to each other directly or through one or more intermediate entities (e.g., processors, operating systems, logic, non-transient computer-readable media). Logical and / or physical communication channels can be used to create an operable connection.

[0202] As used herein, “user” includes, but is not limited to, one or more persons, computers or other devices, or a combination of these.

[0203] While the disclosed embodiments have been illustrated and described in considerable detail, they are not intended to limit the scope of the appended claims or in any way restrict them to such detail. It is certainly impossible to describe every contemplated combination of components or methods in order to describe all aspects of the subject matter. Therefore, this disclosure is not limited to the specific details or illustrative examples shown and described. Consequently, this disclosure is intended to cover changes, modifications, and variations that fall within the scope of the appended claims.

[0204] As to the extent to which the term “comprising” is used in the specific embodiments or claims, it is intended to be inclusive in a manner similar to that interpreted when the term “comprising” is used as a transitional word in the claims.

[0205] As far as the term "or" is used in the specific embodiments or claims (e.g., A or B), it is intended to mean "A or B or both". When the applicant intends to indicate "only A or B but not both", then the phrase "only A or B but not both" will be used. Therefore, the use of the term "or" herein is inclusive rather than exclusive.

Claims

1. A computer-implemented method, the computer-implemented method comprising: Access to time-series signals that need to be separated into clusters; Determine the similarity of power spectral density between the time series signals; Based on the similarity of the power spectral density, clusters of similar time series signals are extracted from the time series signals; and Machine learning models are trained based on the cluster to detect anomalies.

2. The computer-implemented method of claim 1, wherein determining the similarity of power spectral density between the time series signals further comprises performing a comparison of the time series signals in the frequency domain.

3. The computer-implemented method according to claim 1 or claim 2, wherein extracting clusters of similar time series signals from the time series signals based on the similarity of the power spectral density further comprises selecting those time series signals in the time series signals that are below the jump in dissimilarity as the cluster of time series signals.

4. The computer-implemented method according to any one of the preceding claims, wherein determining the similarity of power spectral density between the time series signals further comprises: One of the time series signals is selected as the reference signal; Generate the cross-power spectral density between the reference signal and other time-series signals; The cross-power spectral density is normalized to the periodogram of the reference signal; and Generate a normalized cross-power spectral density with respect to the periodogram of the reference signal, wherein the similarity of the power spectral densities is the cumulative average absolute error of the cross-power spectral density.

5. The computer-implemented method according to any one of the preceding claims, wherein extracting clusters of similar time-series signals from the time-series signals based on the similarity of the power spectral density further comprises: Time series signals are sorted based on the similarity of their power spectral density to that of other time series signals. Detecting changes in the similarity of the time series signals; and Select the time series signal below the specified change point to enter the cluster.

6. The computer-implemented method of claim 5, wherein the turning points in the similarity of the time series signals are detected by applying the Mann-Kendall test to an average cumulative function of the similarity of the time series signals in sorted order.

7. The computer-implemented method of claim 5 or claim 6, wherein the steps of determining the similarity of power spectral density and extracting clusters of similar time series signals are repeated until no further change points are detected at a given confidence level, the method further comprising adding the remaining unextracted time series signals into the last cluster once no further change points are detected.

8. The computer-implemented method according to any one of the preceding claims, further comprising: Detect anomalies using trained machine learning models; as well as An electronic alert is generated in the cluster of the time-series signal in which the anomaly is detected.

9. The computer-implemented method according to any one of the preceding claims, wherein the noise on one or more time series signals in the time series signals exceeds 50%.

10. The computer-implemented method according to any one of the preceding claims, wherein the machine learning model is a multivariate state estimation technique model, the method further comprising assigning time series signals in the cluster as inputs to the multivariate state estimation technique model, and not assigning time series signals excluded from the cluster as inputs to the multivariate state estimation technique model.

11. One or more non-transitory computer-readable media, said one or more non-transitory computer-readable media comprising computer-executable instructions stored thereon, said computer-executable instructions, when executed by at least a processor of a computer system, cause the computer system to: Access the collection of time-series signals that are not differentiated relative to the cluster; Determine the similarity between the time series signals in the frequency domain; Clusters of similar time series signals are selected from the time series signals based on the similarity in the frequency domain; as well as The cluster is routed to a destination that is discrete from the destinations of other clusters detected in the time series signal.

12. The non-transitory computer-readable medium of claim 11, wherein the instructions for determining the similarity of power spectral density between the time-series signals further cause the computer system to perform the comparison of the time-series signals in the frequency domain.

13. The non-transitory computer-readable medium of claim 11 or claim 12, wherein the instruction to extract clusters of similar time-series signals from the time-series signals based on similarity in the frequency domain further causes the computer system to: The Mann-Kendall test is applied to detect changing points in the time series signal, wherein the time series signal is ordered by similarity; and Those time series signals below the change point are selected as the cluster of time series signals.

14. The non-transitory computer-readable medium according to any one of claims 11 to 13, wherein the instructions further cause the computer system to: Repeatedly determine similarities in the frequency domain and extract clusters of similar time-series signals until no further change points are detected at a given confidence level; and Once no further changes are detected, the remaining unextracted time series signals are put into the last cluster.

15. A computer system, the computer system comprising: At least one processor; At least one memory connected to the at least one processor; One or more non-transitory computer-readable media, the one or more non-transitory computer-readable media including instructions stored thereon, the instructions causing the computing system, when executed by at least said at least one processor: Access to the training range includes time-series signals from unidentified clusters; A measure of the correlation between the time series signals is determined based on analysis in the frequency domain; The time series signal is transferred to the cluster based on the correlation metric. A machine learning model is trained based on the training range of the cluster to detect anomalies; as well as In response to the detection of an anomaly within the monitoring range of the cluster, an electronic alert is transmitted indicating that the anomaly has occurred in the cluster.

Images