Introducing a new diagnostic technique for your SAS Event Stream Processing Projects!
1) Overview of using the Mahalanobis-Taguchi System for anomaly detection
The Mahalanobis-Taguchi System (MTS) is a new forecasting procedure available in SAS Visual Forecasting and in SAS Event Stream Processing. It is a multivariate statistical method used for pattern recognition and diagnosis applicable in countless use cases and industries. This is a link to an overview of the MTS system.
The first part of this technique establishes a baseline ‘reference space’ using interval variable data representing any system while it is in a healthy state. The reference space is based on the Mahalanobis Distance (MD): the distance between a point and a distribution that takes into account the correlations of the data set. If new data that is scored using this technique falls outside the MD threshold, the system is flagged as no longer being in a healthy state.
The second part of this technique implements the Taguchi methods. These methods include a quality loss function that quantifies the cost of deviation from the target performance and a signal-to-noise ratio.
The MTS has three phases that occur in this order:
- a training phase that constructs a reference space by using MD from normal data (healthy state), and then calculates MD for each sample in the reference data set to establish a baseline
- an evaluation phase that calculates MD for new data points and compares them to the reference space to classify new data as normal or abnormal
- an optimization phase that uses Taguchi methods to optimize the system parameters and compute a measure of importance called “gain” for each variable.
In my previous post, I described how to use Proc MTS and Proc MTSSCORE to analyze a system of 24 sensors monitoring a turbofan jet engine.
In this post, you create a new SAS Event Stream Processing (ESP) project to score new data from jet engines in real-time. The objective is to monitor and identify any changes that might be a leading indicator of failure in an engine. The changes are identified by comparing the MD from current data to the MD threshold established under normal operating conditions for the 24 sensor readings over time. If the model reveals a current MD value that is above the selected threshold of 3, the event is flagged as an abnormal condition.
2) Implementing MTS scoring in SAS Event Stream Processing
SAS Event Stream Processing projects use connected source and derived windows. In our example a source window ingests the sensor data and passes it onto a calculate window for processing.
Anyone unfamiliar with ESP can take our SAS Event Stream Processing Essentials e-learning class to quickly get up to speed.
There are many analytic techniques already included with SAS Event Stream Processing as shown here.
There are occasions, however, when it is useful to supplement these with an advanced analytic model such as MTS that is trained on historic data-at-rest. This model is used to score streaming data in real-time.
The MTS system is available as a plug-in for the SAS Event Stream Processing Calculate window and can be used for real-time streaming event anomaly detection.
This is the Proc MTS code from the previous post. The savestate statement created a binary form of the model scorecode for model deployment.
PROC MTS data=CASUSER.CENSORtrain;
input x1-x24 ;
by engine;
id datetime;
output out=casuser.out
mean=casuser.mean
cov=casuser.cov
stat=casuser.stat
scoreinfo=casuser.scoreinfo;
savestate rstore=casuser.model;
run;
Now, we'll outline the steps to upload the MTS model into ESP and configure and test it for real-time scoring.
The Proc ASTORE code to download the model file as mts.astore to a file on your local system is shown below. Next, you can upload it into ESP.
proc astore;
DOWNLOAD RSTORE=casuser.model STORE/home/Peter@sas.com/mts.astore";
run;
It is important to place this file in a location that ESP can access. You use the up-arrow icon to upload it into your ESP Project Package.
3) Project Packages in ESP
I am a big fan of Project Packages, and I’m confident that you will be too. A project package contains a standard set of folders that contain the files that the project references. This makes testing new projects convenient. Project packages are self-contained and can also be shared very easily.
You can upload files and data into the test_files folder and reference them in your project window’s properties. In the following screen capture notice 1) the upload arrow, 2) the uploaded mts.astore file and censorscore.csv file, and 3) the Mahalanobis Taguchi System algorithm specified in the Calculate window properties. You click the upload arrow to copy your mts.astore file to the test_files folder for accessibility in the project. See this post for additional information on Project Packages.
In ESP Studio, you add a source window, including all 24 input variables and flag both the engine identifier and datetime cycle variables as key variables in the output schema. (not shown)
You then connect a Calculate window to the Source window and select the new MTS (Mahalanobis Taguchi System) algorithm. Under Parameters in the screen below, point modelReference to the mts.astore file that you uploaded to the test_files folder in the project package. Remember this astore file works just like proc MTSSCORE from the previous post, but in a real-time streaming application.
The ESP Calculate window includes support for processing the astore format of the model and executing the Taguchi MTS scoring technique. The screen capture also shows the field names entered in the calculate window’s Output Map.
In the Output Schema of the Calculate window, you have to specify type: Array(dbl) for the gainList so the computed gain value for each variable would be available in other windows and in your project's test results.
Running a test of this ESP model with the model’s Calculate window selected, you can review the Mahalanobis distance and normalized distance, whether the observation is an outlier or not and the computed gain value for each of the 24 input variables in the gainList array.
The outlier column contains a 1 for any scored event having a MD value greater than the MD threshold value established during model training.
The values in the array under the gainList column are the result of applying the Taguchi system in the scoring process that was run using Proc MTSSCORE in my previous post. The order of the gain values match up with the order of the input variables listed in the source window.
For an event that has outlier flagged as 1, the largest value from the gainList array is the variable contributing most to the outlier condition. The second largest value of the gainList array is the second most important variable contributing to the condition.
In an upcoming post, I will consider ways to further process the gainList array and view results.
This post highlights the collaboration between SAS R&D Developers in the Forecasting and ESP groups as they successfully implemented this new analytical technique for use in several solutions. You have multiple choices of algorithms available when it comes to detecting anomalies in data, and now you can add the MTS system to your list of techniques to try for your next project.
Just to make sure it sticks, one more time… repeat after me: ‘Ma-Ha-la-no-bis'.
Thanks for reading!
Find more articles from SAS Global Enablement and Learning here.
