Anomaly Detection

What this topic covers

Statistical and machine-learning approaches for identifying unusual asset behaviour.

Core ideas

Anomaly models compare current behaviour with expected patterns.

An anomaly is not automatically a fault; load, season, product or operating mode can explain unusual data.

Models require validation, monitoring and human review because process behaviour changes over time.

Program tradeoffs

Data must retain asset identity, timestamp, units and operating context to support reliable trend analysis.

What good evidence looks like

Anomalies and model predictions are decision support, not automatic proof of failure.

Lifecycle perspective

OT security should protect monitoring availability and integrity without interfering with safe operation.