13. Anomaly Detection

The learnings in this chapter will help you determine if something is anomalous. Anomalous in this context effectively means out of range. It could be about a defect in a component or a fraudulent exchange. For example, if a person usually types with a certain speed, and suddenly the system sees a different speed, it is anomalous behavior, giving an indication of possible impersonation. Or, for a component, certain measured parameters being outside the range compared to the range exhibited by normal components could indicate a defective component. This information can be used for quality checks, either during manufacturing, shipment, acceptance stages, or also during preventive maintenance. The concept of anomaly detection depends on being able to observe certain parameters and then being able to form an opinion about some dependent behavior, which is difficult to directly observe at this time. For example, predict the expected remaining life of an aircraft engine based on noise (something that can be observed now). Similarly, use measured value of typing speed to predict if the person (not visible) at the other end is impersonating. Anomaly detection is used very extensively in monitoring computer equipment in large data centers. All the computers in a data center are monitored for many parameters. If a specific computer seems to exhibit a behavior that is very different from other computers, this computer could be defective and may need to be taken out of the network. For example, if it’s getting too few jobs compared to other computers, maybe, it’s working slowly. Or, if it’s getting too many jobs compared to others, maybe, it’s not working properly and terminating jobs immediately that come to it and, thus, be ready to take on additional jobs.