Abstract: A method of behavior monitoring includes determining, by one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset. The method also includes determining a risk score based on the output data and determining feature importance data based on the output data. The method further includes determining whether to generate an alert based on the risk score and the feature importance data.

Abstract: A method includes providing behavior model input data to a behavior model to generate behavior model output data and generating an initial state prediction based on the behavior model output data. The method also includes, based on the initial state prediction indicating a particular state, generating state prediction statistics based on the initial state prediction and historical state predictions indicating the particular state. The method further includes providing classifier input data to a classifier model to generate a classification output indicating whether the initial state prediction is reliable. The classifier input data generated based on the state prediction statistics.

Abstract: A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device includes receiving feature data including time series data for multiple sensor devices associated with the device and receiving an alert indicator for the alert. The method includes processing a portion of the feature data that is within a temporal window associated with the alert indicator to generate feature importance data for the alert. The feature importance data includes values indicating relative importance of each of the sensor devices to the alert. The method also includes identifying one or more historical alerts that are most similar, based on the feature importance data and stored feature importance data, to the alert.

Abstract: A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device includes receiving feature data including time series data for multiple sensor devices associated with the device and receiving an alert indicator for the alert. The method includes processing a portion of the feature data that is within a temporal window associated with the alert indicator to generate feature importance data for the alert. The feature importance data includes values indicating relative importance of each of the sensor devices to the alert. The method also includes identifying one or more historical alerts that are most similar, based on the feature importance data and stored feature importance data, to the alert.

Abstract: A method of identifying successive alerts associated with a detected deviation from an operational state of a device includes receiving feature data corresponding to an alert indication and including time series data for multiple sensor devices associated with the device. The method includes determining, based on a first portion of the feature data, first feature importance data of a first alert associated with the first portion of the feature data and determining a first alert threshold corresponding to the first alert. The method includes determining, based on a second portion of the feature data that is subsequent to the first portion, a metric corresponding to second feature importance data of the second portion. The method includes comparing the metric to the first alert threshold to determine whether the second portion corresponds to the first alert or to a second alert that is distinct from the first alert.

Abstract: In some aspects, a method includes obtaining feature importance data associated with an alert and indicating relative importance of each of multiple sensor devices and of one or more simulated features. The method includes identifying a group of the sensor devices that have greater relative importance than a highest relative importance of any of the one or more simulated features. In some aspects, a method includes obtaining a reference list of alerts that are similar to a reference alert and a list of alerts predicted to be similar to the reference alert and ranked by predicted similarity to the reference alert. The method includes determining a score indicating similarity of the list to the reference list. A contribution of each alert in the list to the score is determined based on whether that alert appears in the reference list and the rank of that alert in the list.

Abstract: A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device includes receiving feature data including time series data for multiple sensor devices associated with the device and receiving an alert indicator for the alert. The method includes processing a portion of the feature data that is within a temporal window associated with the alert indicator to generate feature importance data for the alert. The feature importance data includes values indicating relative importance of each of the sensor devices to the alert. The method also includes identifying one or more historical alerts that are most similar, based on the feature importance data and stored feature importance data, to the alert.

Abstract: A method includes performing a first clustering operation to group members of a first data set into a first group of clusters and associating each cluster of the first group of clusters with a corresponding label of a first group of labels. The method includes performing a second clustering operation to group members of a combined data set into a second group of clusters. The combined data set includes a second data set and at least a portion of the first data set. The method includes associating one or more clusters of the second group of clusters with a corresponding label of the first group of labels and generating training data based on a second group of labels and the combined data set. The method includes training a machine learning classifier based on the training data to provide labels to a third data set.

Abstract: A method includes performing a first clustering operation to group members of a first data set into a first group of clusters and associating each cluster of the first group of clusters with a corresponding label of a first group of labels. The method includes performing a second clustering operation to group members of a combined data set into a second group of clusters. The combined data set includes a second data set and at least a portion of the first data set. The method includes associating one or more clusters of the second group of clusters with a corresponding label of the first group of labels and generating training data based on a second group of labels and the combined data set. The method includes training a machine learning classifier based on the training data to provide labels to a third data set.

Abstract: During training mode, first input data is provided to a first neural network to generate first output data indicating that the first input data is classified in a first cluster. The first input data includes at least one of a continuous feature or a categorical feature. Second input data is generated and provided to at least one second neural network to generate second output data. The at least one second neural network corresponds to a variational autoencoder. An aggregate loss corresponding to the second output data is determined, including at least one of evaluating a first loss function for the continuous feature or evaluating a second loss function for the categorical feature. Based on the aggregate loss, at least one parameter of at least one neural network is adjusted. During use mode, the neural networks are used to determine cluster identifications and anomaly likelihoods for received data samples.

Abstract: During training mode, first input data is provided to a first neural network to generate first output data indicating that the first input data is classified in a first cluster. The first input data includes at least one of a continuous feature or a categorical feature. Second input data is generated and provided to at least one second neural network to generate second output data. The at least one second neural network corresponds to a variational autoencoder. An aggregate loss corresponding to the second output data is determined, including at least one of evaluating a first loss function for the continuous feature or evaluating a second loss function for the categorical feature. Based on the aggregate loss, at least one parameter of at least one neural network is adjusted. During use mode, the neural networks are used to determine cluster identifications and anomaly likelihoods for received data samples.