A Data Analytic Engine Towards Self-Management
of Cyber-Physical Systems
Min Ding, Haifeng Chen, Abhishek Sharma, Kenji Yoshihira, and Guofei Jiang NEC Laboratories America, Inc.
Princeton, NJ 08540, USA
Email: {minding, haifeng, absharma, kenji, gfj}@nec-labs.com
Abstract—With the increasing complexity of cyber-physical systems, it is essential to enhance their self-management capabili-ties (e.g., self-protection, self-optimization). This paper presents a data-oriented approach to achieving that goal, given that a large amount of measurements can be collected in current systems. We investigate typical data characteristics in physical systems, and identify that the collected data from those systems exhibit a wide range of diversities. Following those observations, a new analytic engine is proposed and developed to extract knowledge from measurement data streams in physical systems. The engine treats each attribute in measurements as a time series and contains an ensemble of models, each attempting to discover a specific data property accordingly, such as periodicity, pairwise dependency and so on. Therefore time series are profiled based on their properties captured by engine models. The extracted data profiles can be further used to facilitate several management tasks of system status monitoring and online anomaly detection. Our experimental results in a real power plant have demonstrated that our analytic engine can correctly profile heterogeneous time series in the system, and successfully detect a number of abnormal situations in the system operation including some system inspection events as well as component faults.
I. Introduction
Cyber-physical systems (CPS) are receiving a lot of at-tentions recently with examples including automobile and intelligent transportation systems, medical devices and health care systems, smart grids and so on. Those systems are equipped with a large network of sensors distributed across different components, which leads to a tremendous amount of measurement data available to system operators. Since those measurements are collected continuously along the time, they can be regarded as time series. Given a huge amount of time series data, it is important to build effective models to profile them, so that we can better understand the underlying dynamics that drive the system operation and hence facilitate many system management tasks.
However, with the dramatic increase of the number of time series that can be collected in the system, we are now facing a much wider variety of behaviors in those data. Based on the data regularities and varieties in several physical systems we have studied, including a power plant system, an automobile system and a glass manufacture plant, we observe that the collected time series are dramatically different in terms of their shape, trend, seasonal variation and periodicity. Some series exhibit deterministic periodic behaviors, whereas others show irregular curves in their evolutions. With the increasing degree
of heterogeneity in the collected big data from cyber-physical systems, we need a general tool that can profile a wide variety of time series behaviors.
To this end, this paper presents an analytic engine to deal with heterogeneous behaviors in big time series data. Consid-ering that it is almost impossible to come up with a method that can cover all aspects of time series, our engine includes an ensemble of analysis models, each of which explores a specific property from the data. We will introduce a variety of models implemented in the engine such as the cumulative sum (CUSUM) model [1], the periodic model, the AutoRegresive model with eXternal input (ARX) [2] and so on. The properties considered in those models cover different compositions of attributes, including those from a single attribute, every pair of attributes, a group of attributes and the whole data set. As the output, the engine provides a profile for each attribute in the monitoring data. The profile describes the expected behavior of time series according to the learned properties.
The time series profiles learned from our engine can be leveraged to benefit many system management tasks such as the anomaly detection, capacity planning and so on. In this paper, we focus on the detection of anomalies in the system. That is, given the online measurements of each time series from system operations, we evaluate the newly observed data with respect to the discrepancy against its own profile. If there are significant deviations, alerts are issued to notify operators for checking the system operation. We will show that our engine can successfully detect a number of true anomalies in a power plant with few false alarms.
In the following sections, we first list some typical data properties observed in cyber-physical systems. Based on that, Section III presents an overview of our analytic engine, includ-ing the design of each analysis model and their integrations. Section IV then gives a more detailed description of some models implemented in the engine. Some experimental results of system anomaly by using our engine in a power plant system are described in Section V.
II. DataCharacteristics inPhysicalSystems
Since we use the data oriented approach for achieving the autonomic system management of cyber-physical systems, it is important to understand the statistical property of those data, which can lead us to develop correct analytic models. Based on our studies in a power plant system, an automobile system
and a glass manufacture plant, we list the following common data characteristics in physical systems.
1. Degree of physical constraints: Due to the underlying physical laws in signal generation, there exist many constraints for the values of collected data. For example, the temperature of certain component is controlled at a specific degree during system operation. As a result, a lot of collected measurements are restrict to vary within a narrow range or even become a constant.
2. Auto-correlation: A number of time series in physical data exhibit strong auto-correlations, i.e., the measurement at timet is highly correlated with its previous samples at t−1, t−2,···, due to the smooth nature of many physical processes. For example, if we heat up a component to a target degree of temperature, the measured temperature value will gradually increase rather than randomly jump across different values.
3. Periodicity: Some time series from physical systems demonstrate strong periodic patterns due to the regular be-havior of physical processes, but the length of period varies with different attributes.
4. Pairwise relationships: Many time series can find their correlated partners in the collected data. Those dependencies can be both linear or nonlinear. In addition, some time series are correlated with each other with long time delays because some requests have to be processed slowly such as heating up a component.
5. Value and structure changes: Operators in physical sys-tem not only are interested in whether resource utilizations reach the system capacity, but also care about the frequency of changes in signal values. For instance, if a vibration component is supposed to operate at 100 vibrations per hour, an alert need to be issued if the observed change frequency deviates from the expected value.
6. Seasonal patterns and trends: In physical systems, some time series may contain slight long term degradations in the collected signals due to the aging of its related sensors. While such long term trend is weak, sometime we may need to separate them from the raw time series to get accurate modeling results. On the other hand, we may also need to give a prediction of the aging speed of sensors based on the degradation trend in time series.
7. Abrupt regime changes: It is possible that the system immediately switches to another process after completing the previous one. Since the two physical processes are different, the collected measurements undergo abrupt regime changes. In the absence of domain knowledge, we need to identify the switching point in collected data and build different models for each stage.
Given those typical features of time series data, it is hard to have a general method to model all those characteristics. Instead, we develop the following engine which includes a set of analytic models to cover different aspects of time series behaviors.
III. Time seriesAnalyticEngine
In this section, we first give an overview of all the models in the engine, followed by the design policy and parameters for each model. After that, we describe the process of integrating those models for anomaly detection in the system.
A. An Ensemble of Models
There can exist many properties in physical data that cover different aspects of system evolutions. For example, observed signal time series can show constant, periodic, autoregressive, or other behaviors. There are also various types of dependen-cies across different groups of attributes. In terms of such data variety, we classify data properties into four categories, as from layer 1 to layer 4 described in Fig. 1. Each layer represents a specific data dependency relationship, ranging from the single attribute analysis, pairwise relationship analysis, group wise analysis to full attribute analysis.
Fig. 1 :Four categories of data properties.
Thesingle attribute analysisbuilds a number of models to describe properties from individual time series, such as the periodic model for signals with periodicity, the cumulative sum (CUSUM) model for time series with nearly constant means, the autoregressive (AR) model to measure linear signal dynamics, and so on. At layer 2, we performpairwise analysis to model correlations between every pair of system attributes. Note that the measurement of each attribute is a time series, and the correlation of two time series may involve multiple time points. That is, the value of one attribute may affect not only the immediate value of the other attribute but also values with some time delays. The AutoRegresive model with eXternal input (ARX) [2] is leveraged in our engine because it can learn the delay-aware correlation between every pair of time series. We also propose a new search mechanism to quickly identify attribute pairs that exhibit high correlations.
We further extend to group-wise analysis for relationship among multiple time series at layer 3. A delay-aware multivari-ate regression model is developed in the engine to cluster time series and capture correlations in each cluster. The top layer in Fig. 1 relates to the all-attributes analysis, which attempts to analyze the behavior and dependencies for all attributes in the systems. Following the group-wise analysis in layer 3, the all-attributes analysis considers inter-cluster correlations of attributes to obtain a global picture of data distribution.
B. Model Design
For a given time seriesxt, we learn a set ofmodel param-etersθ. Based onθ, the estimated ˆxtcan be calculated. While models have different representations, they all come with a common metric, thefitness score F, that reflects the goodness of fit for a given time series. In general, the fitness of each model is defined as F=1− N t=1|xt−xtˆ|2 N t=1|xt−x¯|2 , (1)
where ˆxtis the estimated value ofxtfromθ, ¯xis the mean ofxt,
N
t=1|xt−xtˆ|2is the sum of estimation errors and
N
t=1|xt−x¯|2
relates to the variance of xt. If a model fits xt perfectly, we will get zero estimation errors and the highest fitness F= 1, whereas large estimation errors of (1) lead to low fitness values. In modeling pre-filtering, the fitness score is used to remove irrelevant time series against each model. That is, we define a threshold and prune out time series whose fitness values are below that threshold. If xt has a high fitness, we further profile that time series based on the learned properties. In addition toFandθ, another element is also included inxt’s profile: the maximum errorΔ obtained when fitting xt to the model based onθ. The model parameters are used to generate the prediction of future observations during online monitoring. We use the maximum error Δ as the threshold to check the deviation of the predicted value from the real observation. C. Anomaly Detection and Model Integration
Our analytic engine contains a number of models, each pro-filing a group of time series that follow a specific data property. If those models can cover all types of the measurement data, each time series can find a model that contains the profile of its behaviors. In the online monitoring process, as shown in Fig. 2, new time series measurements will be dispatched to the corresponding models. The model checks the values of associated time series based on their profiles and reports status to the model integrator. The model integrator then combines reports from all the models and generates a global report of the system status.
Every model contains an aforementioned profile of{θ,F,Δ} for each covered time series. During the monitoring process, it can predict the value of new observations at every time t based on xt’s profile and its past observations att−1, t−2, ···. We calculate the absolute difference between ˆxt and real observationxt as theresidual
rt=|xt−xtˆ|. (2)
Ifrtis larger than the thresholdΔinxt’s profile, it may indicate that the newly observed value deviates from the model. If extensive and consecutive (e.g.,>3) violations are observed, the model regards that the deviation is caused by some faults in the system rather than the noise, and sends a status report to the model integrator. The status report is an information tuple (time, model ID, attribute ID, fitness) which contains the time stamp of the last violation, IDs of the model and time series,
Fig. 2 :Integrating outputs from multiple models in the online moni-toring.
and the fitness score of that time series with respect to the model.
At each timet, the model integrator receives status reports from all the models, each relating to an alert from mea-surement data. Therefore we use the summation of fitness values from the received status reports to describe the system status, denoted as the “anomaly score” of the system. The anomaly score is actually the sum of alerts at timetwith each alert weighted by its associated fitness value. A high anomaly score often means that the system significantly deviates from its normal situations. Once the anomaly score exceeds a predefined threshold, the model integrator generates an alarm so that system operators need to be involved to check the operation. The operator can further pinpoint the root cause of the problem based on the model IDs and attribute IDs from status reports.
IV. AnalyticModels in theEngine
While there are a number of different models in the engine, this section presents five typical ones which usually capture the majority of physical system data. The first three belong to the single attribute analysis while the other two models are related to the pairwise analysis and group-wise analysis. While we only introduce those models in the paper due to the limit of space, there are several others in the analytic engine. In addition, we are continuously adding new models into the engine to cover more data properties in the system.
A. Cumulative Sum (CUSUM) model
CUSUM [1] is a widely used sequential analysis technique in process control, to model signals with almost constant values and small deviations. It defines two countersC+ and C− for each time series xt, which accumulate the deviation ofxt above the mean, i.e.,xt+μand below the mean xt−μ, respectively. The values stored in countersC+0 andC−0 can be regarded as two time series
C+t =max[0,xt−(μ+K)+C+t−1];
C−t =max[0,(μ−K)−xt+C−t−1], (3)
whereK represents the tolerance range ofxt’s normal behav-ior. In the engine it is determined as half of xt’s standard deviation.We define the deviation error sequence as
If the maximum of deviation errors is smaller than the thresh-old Δ, i.e., max{rt}<Δ, the model includesxt and keeps its profile. After some pilot data evaluations, we determine the thresholdΔas two times the standard deviation of xt. B. Auto-regressive (AR) model
The AR model is a general technique in time series analysis to capture the auto-regressive behavior series,
xt= n
i=1
ϕixt−i+c+εt (5) whereϕ1,...,ϕn are the parameters of the model, cis a con-stant value andεtis the white noise. Given the measurements ofxtin training, we use the least square regression to estimate model parametersθ=[ϕ1,...,ϕn,c], and compute the estimated value ˆxt.
C. Periodic model
This model focuses on signals that exhibit periodicity be-haviors. It contains two parts: periodicity detection and time series profiling. The main feature of periodic time series xt is that it contains dominant frequencies in its evolution. Thus we use fast Fourier transform (FFT) [3] to compute the power spectrum Xn of xt, where n=1,···,N. A time series is a periodic signal if the majority of the power is occupied by a small number of dominant frequency components. To infer xt’s period lengthT, the auto-correlation function (ACF) [3] of xt is used for superior accuracy than FFT. Once we get the period length T, the harmonic model [3] is employed to describe the shape of period
xt= J j=1 ajsin(jωt)+bjcos(jωt) +c (6)
which is represented as the composition of a set of harmonic waves with frequenciesω, 2ω,···,Nω. Given the measure-ments of xt as the training data, we use the least squares re-gression to estimate model parametersθ=[a1,b1,···,aJ,bJ,c].
D. Pairwise time series model
The pairwise time series model focuses on the dependencies between every pair of time seriesxt andyt. In the engine we use the AR model with eXternal input (ARX) [2] to describe the relationship
yt+a1yt−1+...+anyt−n
=b0xt−k+...+bmxt−k−m+t, (7) because ARX can capture dependencies of both current and previous values of two time series. [n,m,k] represents maxi-mum lags of both time series involved in (7).
Given measurements of xt and yt in training, we use the least squares method to estimate the ARX coefficients [a1,...,an,b0,...,bm]. The Akaike information criterion [4] is
used to describe the model complexity and find the best order [n,m,k] of ARX. As all the parameters of ARX are represented asθ=[n,m,k,a1,...,an,b0,...,bm]. Based onθ, we can obtain
the estimation error rt=yt−ytˆ from the training data. The model fitness F can be computed using equation (1). The model selects pairs of time series with large fitness, i.e.F>0.7 in our experiments.
E. Multivariate time series model
In addition to the correlation between pairs of time series, we also model the correlation among a group of time series. That is, the values of time series yt may depend on multiple other series x(1)t ,x(2)t ,··· not just one. Multi-variate regression is adopted to describe the relationship below
yt=w0+w1x(1)t +w2x(2)t +...+wgx
(g)
t . (8)
Note that we usually do not know the subset of time series x(1)t ,···,x(tg) that are involved in the equation (8). Without domain knowledge, all other attributes except yt can be the candidates. In the model, we first put all the possible variables in the right part of equation (8) and then regularize the model coefficientsw=[w0,w1,···,wg] to select relevant coefficients.
The coefficients are estimated by minimizing the following objective function
yt−
j
wjx(tj)+γw1 (9)
While the first part of (9) is the likelihood function represent-ing the estimation error, the second part adds the L1 norm
regularization on the coefficientsw. It has been shown in [2] that the solution obtained from (9) is sparse, i.e., only a limit number of coefficients have nonzero values. Those nonzero coefficients correspond to relevant attributes with respect to yt. The parameterγrepresents the degree of sparseness in the optimization, which is set to 1 in our experiments. We use the least angle regression (LARS) [5] to identify the optimal solution from (9). As an output, only a small number of time series x(1)t ,···,x
(g)
t are associated with the dependency model withyt.
V. Results fromPowerPlantSystems
We have evaluated and validated our multi-layer time series analytic engine on several physical systems, including a power plant system, an automobile system, and a glass manufacture plant. In this section, we only report the experimental results on the power plant data set, due to limited space.
There are around 3065 physical sensors deployed in the power plant we studied, which collect a variety of mea-surements such as temperature, pressure and so on. Each sensor collects measurements every 30 seconds and all the recorded data are continuously sent to the back-end server where our analytic engine is running. Our experiments uses the data collected in seven consecutive days, from 10/07/11 to 10/13/11. According to the system trouble ticket, there are two abnormal events in the measurements, which occurred during day 5 (10/11/11) and day 7 (10/13/11). One of the abnormal events corresponds to some inspection operations made by system operators, whereas the other was caused by an actual anomaly in system operation. We randomly select a
74% ~ 0.1% ~ 1% 11% 2% 12% CUSUM model AR model Periodic model ARX model Multivariate model Others
Fig. 3 :Metric coverage of our analytics engine
normal day as the training set to learn the models. Then we test measurements from the other 6 days to check the behaviors of new monitoring data and the corresponding system status, against models learned.
A. Results for data modeling
Figure 3 illustrates the summary of outputs from different models. We find that there are around 74% mostly-constant or real-constant metrics. This conforms that a large number of signals have weak dynamics during normal operations in physical system. Our engine detects signals via CUSUM, AR and periodic models. Furthermore, we notice that more than 10% metrics are discovered as pairwise ARX models. Figure 4 shows one such example detected with the fitness score of 0.8542. There are some signals captured by our multivariate model as well.
12:00AM 6:00AM 12:00PM 6:00PM 12:00AM 0.946 0.948 0.95 0.952 0.954 0.956 0.958 0.96
12:00AM 6:00AM 12:00PM 6:00PM 12:00AM 0.962 0.964 0.966 0.968 0.97 0.972 0.974 0.976 (a) (b)
Fig. 4 :Pairwise analysis example from power plant. (a) and (b) are detected as ARX invariant pair.
B. Results for system monitoring
One important application of our analytic engine is the auto-matic system monitoring. Figure 5 shows the overall anomaly views for the system monitoring during the two testing days. Firstly, the anomaly score is quite low and under the tolerant range during normal situation, e.g, during 8 : 00am∼11 : 59pm on day 5. Secondly, it is clearly demonstrated that our ana-lytic engine successfully detected two abnormal events, i.e., inspection operation on day 5, and anomaly event on day 7. As shown in Figure 5 (b), the system starts to behave abnormally at 4am and the anomaly score keeps increasing and reaches at the highest value around 11 : 30am. By referring to the incident record of the power plant, this anomaly event was noticed at time 11 : 42am by the system operators. Our engine automatically detected it almost 8 hours earlier. For inspection event detection, Figure 5 (a) shows that the anomaly score suddenly jumps to high values at 3 : 20am and keeps stable high values until 7 : 30am. The change for inspection is abrupt due to sudden turn-on or turn-off operations on
TABLE I :Statistics of affected signal numbers in two anomaly events inspection operation anomaly incident models # of affected signals # of affected signals
CUSUM model 19 34
AR model 0 0
periodic model 1 3
ARX model 22 32
multivariate model 0 0
target sensors/components. On the other hand, the anomaly event affects the related sensors gradually drifting out of the estimation range, thus causing incremental anomaly score changes. Table I lists the statistics of affected signal numbers from different models in both inspection operation event and anomaly incident. Due to space limit, two model examples are illustrated in the following.
(a) (b)
Fig. 5 :Anomaly scores on two different days: (a) Day 5 with inspection operation; (b) Day 7 with anomaly event.
12:00 AM 6:00 AM 12:00 PM 6:00 PM 12:00 AM 50.2 50.4 50.6 50.8 51 51.2 51.4 51.6 51.8 52 12:00 AM0 6:00 AM 12:00 PM 6:00 PM 12:00 AM 0.2 0.4 0.6 0.8 1 1.2 1.4 C+ t C− t H (a) (b) 12:00 AM 3:00AM 6:00 AM 50 50.2 50.4 50.6 50.8 51 51.2 51.4 51.6 12:00 AM0 3:00AM 6:00 AM 2 4 6 8 10 12 14 C+ t C− t H (c) (d)
Fig. 6 :Event detection example with CUSUM model. (a) is a time series from training stage. (b) is the CUSUM model learned from (a). (c) is the same metrics for testing. (d) is CUSUM prediction output for (c).
1) Event detection with CUSUM model: Figure 6 gives an example of event detection using CUSUM model where Figure 6 (a) is the time series from training data at day 1 and Figure 6 (b) is the corresponding CUSUM model trained at that stage. Figure 6 (c) shows the same metric measured at another day (day 5) for testing. Here we only plot the data from t=12am to t=6am for a detailed view. Figure 6 (d) is the CUSUM detection results for the corresponding time
12:00AM 6:00AM 12:00PM 6:00PM 12:00AM 1.005 1.0051 1.0052 1.0053 1.0054 1.0055 1.0056 1.0057 xt ˆ xt
12:00AM0 6:00AM 12:00PM 6:00PM 12:00AM 0.5 1 1.5 2 2.5x 10 −5 rt Δ (a) (b)
Fig. 7 :Anomaly detection with ARX model example. (a) xt and estimatedxˆtfrom testing. (b) residual rtfor testing.
period. As illustrated in figure 6 (c), it is hard to tell the signal difference only from the limited samples in the local window. Nevertheless, as shown in figure 6 (d), CUSUM effectively detects such small changes at the early time t=3 : 20am without needs for waiting for more samples. It is confirmed that there is an inspection event happening at that time. The high sensitivity property of CUSUM on early event detection by flagging underlying latent data shifting trends is highly desirable for mission-critical physical monitoring systems, such as power plants.
2) Anomaly detection with ARX model: Our ARX model also detects the anomaly events from the real power plant data. Similarly, we use day 1 data for training and discover a set of correlated metrics pairs related to 313 metrics. We test our model on day 7 data which contains the real anomaly incident. Some of the correlation relationship start to break around time 6am. That is, the residuals rt are larger than the learned threshold Δ. Figure 7 is the exemplary plot for one broken metrics pair where (a) shows the real observation xt and estimated ˆxt from the training data and (b) plots the corresponding residualsrt=|xtˆ−xt|. Although it is difficult to judge the difference between ˆxt and xt directly, its residual values start exceeding the threshold band and keep drifting along one side. Note that the overall anomaly score after integrating alerts from ARX model and other models, i.e., CUSUM model and periodic model, triggers an alarm even earlier (4amas shown in Figure 5 (a)).
VI. RelatedWork
There are previous work in analyzing measurement data from physical systems to improve the self-manageability. We classify those methods into two categories: the domain specific and domain independent techniques. The domain specific techniques rely on system experts to define the patterns or rule based properties from the data. For instance, [6] proposes a rule-based approach based on the combination of complex events and reactive rules to describe and control CPS. Domain specific techniques require system experts to be extensively involved in the knowledge extraction. In addition, with the increasing scale and complexity of systems, the rules and policies obtained from domain knowledge are usually not com-plete or sufficiently comprehensive. The domain independent solutions attempt to extract knowledge from data using general data analytic tools rather than system experts. [7] presented a similarity based approach by comparing present data with
historical records to identify signal anomaly or drifting. [8] proposed a Support Vector Machine (SVM) based supervised learning method to classify anomaly from labeled training data. However, current methods have certain shortcomings. The similarity based method may not scale well for massive amount to attributes because it has to keep historical records for each attribute and computing similarity comparison is slow. The SVM based method requires the label of data as normal or abnormal in advance, which may not be available in practice. Compared with current methods, our approach is efficient because the learned properties of each time series are rep-resented in a parametric way, i.e., using equations and pa-rameters, which is faster to compute than similarity based approaches. We do not have to store and label historical data for each time series. In addition, we design a common input and output interface for each model in the analytic engine. As a result, new models can be easily added to further improve the engine performance.
VII. Conclusions
This paper has proposed a novel data analytic engine for cyber-physical system self-management. Based on the strong regularity and high diversity data characteristics observed in physical systems, our engine has profiled the system monitor-ing data with an ensemble of models, each discovering and handling a specific data property. The extracted data profiles have been utilized to facilitate several management tasks such as system status monitoring and online anomaly detection. The experimental results in a real power plant have demonstrated the good performance of our analytic engine, in terms oflarge modeling coverage(up to 88% system metrics) anddetecting system inspection and anomaly eventsuccessfully and reliably. Our engine can identify the anomaly status hours earlier than the original management approach.
References
[1] H. R. L. Alwan, “Time-series modeling for statistical process control,” in Journal of Business&Economic Statistics, vol. 6, 1988.
[2] G. Jiang, H. Chen, and K. Yoshihira, “Efficient and scalable algorithms for inferring likely invariants in distributed systems,” IEEE Trans. on Knowl. and Data Eng., vol. 19, Nov. 2007.
[3] P. Bloomfield,Fourier Analysis of Time Series: An Introduction. New York, NY: John Wiley and Sons, 2nd ed., 2000.
[4] J. D. Leeuw, “Information theory and an extension of the maximum likelihood principle by hirotogu akaike,” in2nd International Symposium on Information Theory, 1973.
[5] B. Efron, T. Hastie, I. Johnstone, and R. Tibshirani, “Least angle regression,” inAnnals of Statistics, vol. 32 (2), p. 407 ˝U499, 2004. [6] R. Klein, J. Xie, and A. Usov, “Complex events and actions to control
cyber-physical systems,” in Proceedings of the 5th ACM international conference on Distributed event-based system, DEBS ’11, pp. 29–38, 2011.
[7] S. Wegerich, “Similarity based modeling of time synchronous averaged vibration signals for machinery health monitoring,” inAerospace Con-ference, 2004. Proceedings. 2004 IEEE, vol. 6, pp. 3654 – 3662 Vol.6, march 2004.
[8] N. Zavaljevskl and K. C. Gross, “Sensor fault detection in nuclear power plants using multivariate state estimation technique and support vector machines,” in Proceeding of the 3rd International Conference of the Yugoslav Nuclear Society, Oct 2000.
