Chapters

32 Feature Engineering for ML

analytics-ml
modeling
feature
engineering

A vibration trace contains thousands of samples, but a maintenance model may need only energy, spread, peaks, and frequency content from a timed window. Feature engineering turns the waveform into measurements the model can use without erasing their physical meaning. The recipe must be reproducible at training and deployment.

32.1 Turn a Waveform Into a Versioned Record

Follow Figure 32.1 from raw samples through cleaning, windowing, feature calculation, selection, and the model-ready table. Each stage changes representation. Keep the sensor unit and feature window time at the start, then bind every output column to the exact operation that created it.

For four acceleration samples 1, 3, 5, and 7 m/s², the mean is ((1+3+5+7)/4=4\ \mathrm{m/s^2}). The range is (7-1=6\ \mathrm{m/s^2}). These two features describe centre and spread but not sample order: the sequence 7, 5, 3, 1 has the same mean and range. If order carries a fault signature, add a slope, autocorrelation, or frequency feature rather than assuming summary statistics preserve it.

Feature window design is part of the recipe. A 100 Hz sensor gives 200 samples in two seconds. With 50% overlap, a feature row starts every second. Split train and test data by machine or time before producing overlapping windows; otherwise neighbouring windows can leak nearly identical samples across the boundary.

Packet traces need different features. Counts by direction, inter-arrival summaries, sizes, and burst lengths may help infer an application without inspecting payloads. Yet a device identifier, destination unique to one lab, or capture-file name can become a shortcut. Remove such columns or test on unseen devices and networks.

Selection should use training evidence only. A feature can be dropped because it is constant, too often missing, redundant under a written rule, too expensive on the target, or harmful in validated comparisons. Do not browse test performance repeatedly while choosing columns; that turns the test set into training guidance.

Predict the recipe with fixtures. The four-sample feature window should yield mean 4 m/s² and range 6 m/s². Reorder it and expect those two values to stay equal, demonstrating their limit. Send a 199-sample feature window to the two-second 100 Hz contract and expect a visible rejection or named padding rule. Finally compare one training feature row with edge-generated output, including names, order, units, and tolerance.

32.2 Start With the Story

Picture a motor that begins to shake. Raw samples fill a file, but the repair team needs a clear sign of change. A useful model input keeps the part of the signal that helps that choice.

A feature is a measured clue made from raw data. Firmware is the software stored on the device that may collect or shape that data. Start with the field decision. Then name the source, unit, time window, and missing-data rule. Use the same recipe when the model learns and when it runs. A clue made after the result happened must not leak back into training. A clue that the field device cannot make is not ready for live use.

Ask these short questions:

  • What choice will the model support?
  • Which signal can help that choice?
  • What unit does it use?
  • How long is the time window?
  • Which clock sets its edge?
  • What happens when samples are missing?
  • Was the same recipe used in training?
  • Is the feature ready before the label?
  • Can the live system make it?
  • Who checks drift after release?

One feature rarely proves a cause. It can support a bounded choice when its recipe and limits are clear. Practitioner writes the full recipe and test record. Under the Hood covers leakage, drift, version ties, and feature contracts. Those details can change which clue is trusted. They must not turn a late or missing clue into valid live evidence.

Keep the recipe plain. One source enters. One time window closes. One rule makes the clue. One test checks the live path.

Picture an IoT team using the ideas in Feature Engineering for ML during a live operations review. A device has produced messy evidence, an analytic step is about to change an alert or control decision, and someone has to explain why the result should be trusted.

Read this page as that path from sensor evidence to accountable action. Start with what the system observes, keep the model or data treatment visible, and finish with the check that would convince an operator, maintainer, or auditor to act.

32.3 Inferring Applications from Packet Traces

When endpoints do not identify their application, an observer can infer a traffic class from packet traces. Deep packet inspection compares visible payload structures with known patterns; port analysis uses transport metadata; statistical and machine-learning approaches use features such as packet sizes, directions, inter-arrival times, burst shape, and flow duration. Clustering can explore unlabelled traces, while a supervised classifier can assign known classes when representative labels exist.

Each route has a different boundary. Payload inspection can be precise for recognisable cleartext protocols, but encryption and encapsulation remove visibility and inspection may be prohibited or disproportionate. Ports are cheap to read but are weak identities because applications share, change, or deliberately reuse them. Statistical models can operate without reading content, yet they can learn a device, site, firmware version, or capture setup instead of the application behavior the team intended.

Build the inference record like any other feature contract: name the observation point, flow key, direction convention, window, feature code, label source, encrypted-traffic handling, excluded payload fields, and retention policy. Split evaluation by device, site, or time when those boundaries could leak into both training and test data. Report per-class errors, unknown handling, drift, and the decision made from the prediction. A home gateway might classify video-like bursts to understand congestion, for example, but it should route uncertain or new traffic to an unknown class rather than silently applying a restrictive policy. Why it matters is operational: inference can support capacity planning and troubleshooting without endpoint cooperation, but a confident label is not consent to inspect content or proof that the application itself misbehaved.

32.4 Features Preserve Signal Meaning

Feature engineering turns raw IoT observations into model inputs that preserve the meaning needed for a decision. The useful feature is not simply a statistic or embedding. It is a repeatable measurement of the signal, context, label boundary, and time window that the model will see again in deployment.

For a vibration classifier, a feature may describe energy in a frequency band, peak behavior, or a change from normal baseline. For an occupancy model, a feature may combine motion events, door state, time of day, and recent absence. For a battery-risk model, a feature may tie voltage, temperature, current draw, firmware state, and communication retries to a service decision.

If you only need the intuition, this layer is enough: a feature is acceptable when its source, window, units, label timing, missing-data behavior, transformation code, and deployment availability are all reviewable.

Worked example: a temperature-alert model might turn one-second sensor samples into a 60-second window with mean, maximum, slope, missing-sample count, and last-calibration age. Those features are only trustworthy if the same window boundary, unit conversion, calibration state, and missing-data rule are used during training, validation, and deployment. If the edge device later reports every 10 seconds, the feature recipe has changed even when the feature names stay the same.

Signal

Name the physical or operational phenomenon the feature represents, including sensor source, units, sampling behavior, and expected noise.

Window

Define the time span, event boundary, aggregation rule, freshness, and whether the window is allowed to look before or after the prediction time.

Label

Connect the feature to the target label without leaking future outcomes, maintenance notes, post-event states, or operator decisions.

Deployment

Prove the same feature can be computed online or at the edge with the available latency, power, storage, privacy, and fallback behavior.

The feature-pipeline diagram in Figure 32.1 makes the deployable recipe visible before individual statistics are judged.

Feature engineering pipeline diagram showing raw sensor values moving through a window segment, statistic extraction, and normalization to a zero-to-one scaled feature vector
Figure 32.1: Feature engineering pipeline from raw sensor values through windowing, statistics, and normalization

Follow Figure 32.1 from raw sensor values into a defined window, through statistic extraction, and finally normalization. The window fixes sample membership and latency; statistics encode the chosen signal behavior; normalization uses training-derived parameters to place features on the expected scale. Every arrow must execute identically after deployment. This carries forward the chapter’s running narrative: a useful feature is not just predictive in a notebook—it is physically meaningful, leakage-controlled, affordable, versioned, and available with the same semantics at inference time.

What Makes a Feature Set Useful

A feature set is useful when the chosen dimensions make the groups easier to distinguish together than they would be alone. Color by itself may overlap, weight by itself may overlap, but color plus weight may separate the examples well enough for a simple model. Even a simple image question such as whether a fruit is more red or orange needs a recipe: maximum channel value, mean channel value, channel ratio, and histogram shape can support different decisions. A weak feature is not "wrong" because it is ugly. It is weak when it is irrelevant, unstable, too expensive to compute, unavailable at inference time, or unable to separate the decision groups it is supposed to support.

Direct Measurements

Use physical quantities directly when the units and calibration are trustworthy: weight, temperature, pressure, vibration energy, battery voltage, or signal strength.

Encoded Objects

Represent objects as numbers only when the encoding preserves the useful difference. A color may become an RGB tuple; an image may become an ordered grid of pixel values.

Windowed Signals

Represent audio, motion, or other time-varying signals as fixed windows, sampled sequences, frequency features, or summary values such as mean, slope, variance, peaks, zero crossings, event counts, and energy.

Distribution Summaries

Histograms, skewness, and kurtosis can preserve distribution shape, but bin choices and window boundaries matter: too few bins hide detail, while too many bins become sparse and sensitive to noise.

Real sensor preprocessing is application-dependent. Filtering, denoising, normalization, clipping, and windowing should be chosen because they preserve the decision signal, not because they are standard notebook steps. For a gesture classifier on a Particle-class device, the pipeline might collect IMU motion on the device, compute compact window features locally, train or configure the model from a phone workflow, display the predicted character on the phone, and keep raw logs for Python plots so the team can see whether four in-air gestures are actually separable.

32.5 Practitioner: Write a Feature Recipe

A feature recipe is the contract between training and inference. It states exactly how a feature is computed, what assumptions it uses, how missing and out-of-range values are handled, and what evidence proves it still means the same thing when deployed.

Recipe Field
What to Record
Failure Mode
Retest Trigger
Source and units
Sensor stream, channel, unit, calibration state, coordinate frame, sample rate, and timestamp source.
A model treats values from different devices, firmware, units, or placements as if they were comparable.
Sensor, firmware, calibration, placement, gateway, time source, or unit conversion changes.
Window and transform
Window length, stride, event boundary, aggregation, filter, normalization, clipping, and order of operations.
Training and inference use different window boundaries or transformation order.
Sampling rate, latency budget, feature code, normalization baseline, or streaming architecture changes.
Label boundary
Prediction time, label source, delay, human review state, exclusion rule, and unavailable future information.
Features include future labels, maintenance actions, post-alarm states, or manual corrections.
Label process, operator workflow, data retention, audit rule, or target definition changes.
Quality behavior
Missingness, stale data, outliers, duplicate events, imputation, confidence flags, and degraded-mode fallback.
Cleaning hides data gaps or creates features that look valid when the source is weak.
Missing-rate pattern, device population, environment, privacy policy, field failures, or drift monitor changes.

Keep feature selection reviewable. Removing redundant features can make a model cheaper and easier to monitor, but the retained features should still explain the operational claim. If a selected feature is a proxy for user identity, protected status, site ID, maintenance shift, or a post-decision workflow, the review should check whether it is meaningful, fair, legal, and available at inference.

Common selection methods ask different questions. A variance threshold keeps features that actually spread out across examples, so a nearly constant column does not pretend to add evidence. Univariate tests score one feature at a time against the label and can reveal a single strong separator, but they can miss combinations that only work together. Principal component analysis (PCA) transforms the feature space toward directions with high variation and can reduce dimensionality, but the projected components still need scaling, provenance, and deployment-time reproducibility.

Frequency-Domain Comparison as a Feature Contract

When two sensors observe the same motion through different mechanisms, compare more than their raw traces. Welch power spectral density estimation divides a window into overlapping segments, windows each segment, estimates a periodogram, and averages the results. The averaging makes the estimate less erratic than one periodogram, at the cost of frequency resolution and added latency. The feature contract must record sample rate, synchronization, segment length, overlap, window function, detrending, filtering, normalization, and the frequency band used for the decision; otherwise two curves can differ because the pipelines differ rather than because the sensors disagree.

For example, an event camera and a balance board may both observe postural sway while measuring different physical quantities. Agreement of band power, dominant-frequency region, or spectral shape within a predeclared sway band supports the claim that both preserve relevant dynamics. It does not prove that their amplitudes are interchangeable or that either is clinically valid. Check coherence only when synchronization and signal definitions support it, preserve participant and stance context, and investigate spectral disagreement as possible timing, geometry, calibration, filtering, noise-floor, or measurand evidence. This turns a PSD plot into a reproducible validation feature rather than a visual similarity claim.

Feature recipe template Feature name: stable, versioned, and tied to one meaning. Decision target: what the model output supports. Source streams: sensor, unit, time source, calibration, device class, and context. Window rule: length, stride, event boundary, freshness, and prediction-time cutoff. Transform rule: filtering, aggregation, scaling, clipping, encoding, and missing-data behavior. Validation evidence: holdout split, leakage check, drift monitor, edge or cloud cost, and failure behavior. Retest trigger: any change in sensor, firmware, label process, sampling, code, deployment path, population, environment, or decision use.

32.6 Leakage, Drift, Feature Contracts

Feature engineering often fails because a model learns a shortcut that will not hold after deployment. The shortcut may be explicit leakage, such as a post-event field inside the feature table. It may also be a quiet proxy, such as a device ID that stands in for a site, a timestamp that stands in for maintenance schedule, or a missing-value pattern that stands in for a broken collection process.

A practical leakage test asks whether the value would exist, with the same precision and delay, at the moment the model must act. If the answer depends on a future repair ticket, a later human label, a batch backfill, or a post-alarm state, the feature contract is invalid for real-time inference.

Temporal Leakage

The feature uses values, labels, repairs, alarms, or operator actions that happen after the prediction time.

Population Leakage

The split lets the same device, user, room, asset, or site appear in both training and validation when deployment needs generalization.

Processing Drift

The deployed code changes sampling, normalization, clipping, imputation, encoding, or missing-data labels compared with training.

Meaning Drift

The same feature name remains in the table after sensors, firmware, labels, usage, environment, or operating policy changes its meaning.

The strongest defense is a feature contract: a versioned recipe, an availability check at prediction time, a leakage audit, a held-out validation split that matches deployment, and monitors for input range, missingness, drift, and feature calculation failures. Feature stores can help when they preserve this contract, but they do not remove the need to review feature meaning.

Under the hood, feature selection should also be treated as a reliability decision. Dropping a feature can reduce cost, but it may remove the only signal that catches a rare failure mode. Adding a feature can improve a metric, but it may increase latency, power, privacy risk, or false confidence. The accepted feature set should state what it optimizes and what it no longer claims to detect.

32.7 Summary

  • Feature engineering turns raw IoT data into model inputs that preserve signal meaning for a specific decision.
  • Useful feature sets separate the decision groups with reproducible dimensions, whether those dimensions come from direct measurements, encoded images, fixed signal windows, summary statistics, or distribution summaries.
  • Every feature needs a recipe: source, unit, timestamp, window, transform, label boundary, missing-data behavior, and deployment availability.
  • Leakage checks must verify that the feature is available at prediction time and does not encode future labels, post-event actions, or inappropriate proxies.
  • Validation should hold out the boundary that deployment must generalize across, such as future time, new devices, new sites, or new users.
  • Feature selection is an operations decision as well as a modeling decision because retained and dropped features change cost, latency, privacy, monitoring, and failure coverage.
  • Retest feature recipes after sensor, firmware, label process, sampling, transform code, deployment path, population, environment, or decision-use changes.
Key Takeaway

Feature engineering is trustworthy when training and deployment share the same feature meaning: source, window, transform, label boundary, quality behavior, leakage controls, and retest triggers all stay reviewable.

32.8 See Also

Machine Learning Fundamentals

Review the basic supervised-learning terms that feature recipes support.

IoT Machine Learning Pipeline

Place features inside the full path from decision target to deployed model, monitoring, and retraining evidence.

Validation and Outlier Detection

Connect feature quality to schema checks, outlier handling, provenance, drift, and exception review.

Edge ML and TinyML Deployment

Check whether feature computation fits edge latency, memory, power, update, telemetry, and fallback constraints.