Analytics & ML · Study deck

Time-Series Anomalies: Machine Learning

A motor can sound healthy while its vibration pattern starts to shift.

Data Dora is your guide for this deck.

anomalytimeseries

After studying this chapter

Learning objectives

You will be able to:

Explain: deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.
Explain: Data may be missing, a normal seasonal pattern may be present, or the threshold may fit the wrong operating mode.
Explain: In Figure: An IoT anomaly detector is a review loop, the Data Stream contains readings and logs.
Explain: A: Threshold is the boundary between normal, warning, and critical results.: Actions state what happens next.

Major section

Start With the Decision

A motor can sound healthy while its vibration pattern starts to shift.

A learned model must flag that shift and still show why the score rose.
A learned model may find that weak pattern.
The first choice is still the field decision: warn, inspect, slow down, or do nothing.

Major section

ML-Based Anomaly Detection

deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.

Scores changes in timing, phase, and sequence shape.
ML anomaly models are sensitive to training data.

ML belongs where the anomaly type demands it: collective or high-dimensional patterns often need learned models, while point and contextual anomalies may still be better served by simpler statistical or time-series methods.

Major section

ML-Based Anomaly Detection (continued)

Anomaly detection helps a team decide which unusual readings need review.

It must also show why an alert can be trusted.
In Figure: An IoT anomaly detector is a review loop, the Data Stream contains readings and logs.
A: Threshold is the boundary between normal, warning, and critical results.: Actions state what happens next.

Major section

ML-Based Anomaly Detection (continued)

Several cases can look alike in raw data.

The process may have failed, or the sensor may be faulty.
Data may be missing, a normal seasonal pattern may be present, or the threshold may fit the wrong operating mode.
For example, a vibration sensor sends motion readings, event counts, and maintenance logs.

Deck summary

Key takeaways

A motor can sound healthy while its vibration pattern starts to shift.

deployment rule: edge or gateway can compute features and cheap scores. Cloud review can handle retraining, drift checks, and fleet comparison.
Anomaly detection helps a team decide which unusual readings need review.
Several cases can look alike in raw data.

Retrieval practice

Recall check 1 of 6

Data Dora says: answer from memory, then check your reasoning.

Q1When is an ML anomaly detector justified over a simple statistical threshold?

AWhen the dashboard needs a more advanced algorithm name, even if one stable sensor threshold explains the fault.

BWhen no baseline, threshold policy, review record, or sensor-health check is available for the alert.

CWhen abnormal evidence is a multi-feature pattern, learned representation, or sequence that a simple threshold cannot express.

DWhen sensor-health checks are inconvenient, so model scores should replace missing input evidence.

Show answer

Answer: C ML detectors should be chosen for evidence boundaries that simpler methods cannot represent.

Retrieval practice

Recall check 2 of 6

Data Dora says: answer from memory, then check your reasoning.

Q2A motor fault appears as a joint change in vibration, current, and heat while each value alone stays near normal. Which feature set best fits a multivariate anomaly detector?

AAligned vibration, current, heat, and operating-mode features from the same window.

BOnly a device identifier and its dashboard color.

COnly the largest single vibration reading, with no current or heat.

DA mix of readings from unrelated time windows and machines.

Show answer

Answer: A A shared window and mode let the detector learn a joint normal pattern across the measured signals.

Retrieval practice

Recall check 3 of 6

Data Dora says: answer from memory, then check your reasoning.

Q3Why should an ML anomaly alert store the feature vector, model version, score, threshold, and sensor-health state?

ABecause model family names alone reproduce alert evidence, even when features, version, and threshold are missing.

BBecause those fields make the alert reviewable, reproducible, and retestable when data or models drift.

CBecause sensor-health state is unrelated to process alerts, so bad probes cannot create false anomalies.

DBecause the raw anomaly score gives a stable measure of severity that can be compared directly across model updates.

Show answer

Answer: B ML anomaly alerts need the same evidence discipline as statistical alerts, plus model and feature provenance.

Retrieval practice

Recall check 4 of 6

Data Dora says: answer from memory, then check your reasoning.

Q4What evidence should an IoT anomaly alert preserve so it can be reviewed?

AOnly a final label plus chart screenshot, because the baseline, threshold, context, and sensor-health evidence can be reconstructed later.

BOnly the raw sensor value and model family, without the operating context, threshold version, or persistence rule that made it alert.

CThe normal baseline, anomaly score, threshold or model rule, context, persistence rule, and sensor-health state.

DOnly the most recent score, because anomaly detectors should not keep baseline windows, threshold versions, or sensor-health state.

Show answer

Answer: C Anomaly detection is a reviewable scoring pipeline, not just a final alert label.

Retrieval practice

Recall check 5 of 6

Data Dora says: answer from memory, then check your reasoning.

Q5Why should the worked z-score detector use a persistence or confirmation rule before raising an operational alert?

ABecause the earliest threshold crossing should trigger a response, and waiting for another reading would miss the useful intervention window.

BBecause a single high score may be noise, a sensor fault, or a transient sample rather than a sustained process anomaly.

CBecause repeated high readings establish a process trend, letting the detector accept the sensor's health status without further checks.

DBecause a second sensor may share the same fault, confirmation should rely on repeated readings from the original sensor instead.

Show answer

Answer: B Candidate scoring and operational alerting are separate design decisions.

Retrieval practice

Recall check 6 of 6

Data Dora says: answer from memory, then check your reasoning.

Q6Why is accuracy a weak headline metric for many IoT anomaly detectors?

ABecause normal samples dominate

BBecause it excludes false alarms.

CBecause faults dominate the dataset.

DBecause thresholds are unrelated to operator workload.

Show answer

Answer: A Imbalanced anomaly data requires metrics that reveal both misses and alert burden.

Print reference

Answers 1 of 2

Answer key.

C · ML detectors should be chosen for evidence boundaries that simpler methods cannot represent.
A · A shared window and mode let the detector learn a joint normal pattern across the measured signals.
B · ML anomaly alerts need the same evidence discipline as statistical alerts, plus model and feature provenance.
C · Anomaly detection is a reviewable scoring pipeline, not just a final alert label.
B · Candidate scoring and operational alerting are separate design decisions.

Print reference

Answers 2 of 2

Answer key.

A · Imbalanced anomaly data requires metrics that reveal both misses and alert burden.