Normal Behavior Model Research Articles

Anomaly detection of wind turbines based on stationarity analysis of SCADA data

This study presents a stationarity-based method, based on sliding window principle, for wind turbine monitoring and anomaly detection. Initially, the window is formed with a reference data set collected from a wind turbine under healthy condition. During the monitoring process, the data window is regularly updated with the latest samples recorded by the SCADA system. The Augmented Dickey-Fuller (ADF) test is exploited to compute the stationary statistical characteristics of the data within the window at each updating step. Any abrupt changes in the ADF t-statistics indicate the fault occurrence. The method can simultaneously monitor various parameters without using normal behaviour models. Its monitoring and fault detection mechanism relies on the consecutive accumulation of variations in stationarity of SCADA signals in the data window over time. Through the validation using two SCADA data sets, the method has proven its capability in monitoring wind turbines and detecting faults at the early stage.

Wind turbine gearbox condition monitoring using AI-enabled virtual indicators*

Abstract At present, the condition monitoring of wind turbine gearbox mostly involves selecting monitoring indicators in advance and establishing normal behavior models based on deep learning. However, single physical monitoring indicator cannot fully characterize the operating status of the wind turbine gearbox. To address the above issues, a wind turbine gearbox condition monitoring method using convolutional neural network (CNN)-long and short term memory network (LSTM)-autoencoder (AE) enabled virtual indicators is proposed in this paper. This method first establishes a cleaning principle to preprocess the data of supervisory control and data acquisition (SCADA) system and screen out effective SCADA data further. A CNN-LSTM-AE monitoring model was trained using SCADA data during normal operating process, various characteristic parameters of the gearbox are integrated to construct the AI-enabled virtual indicators, and meanwhile warning thresholds was determined based on the probability density distribution of virtual indicators to analyze the operating status of the gearbox. Finally, the proposed method was validated using real SCADA data from two wind turbines in a cooperated wind farm with my group. Compared with a single physical indicator, the virtual indicator enables to detect gearbox early faults 5 d in advance, indicating that the proposed method can effectively alert wind turbine gearbox failures.

APT Attack Detection Method Based on Traceability Graph

This article proposes an Advanced Persistent Threat (APT) attack detection method based on traceability graphs, aimed at addressing the complexity and concealment of APT attacks. This method describes system behavior by constructing a traceability graph, optimizing it to reduce redundant information, converting the traceability graph sequence into a feature vector sequence, and using an encoder decoder model to train the GRU (Gate Recurrent Unit) model to extract long-term features of the sequence. Finally, a normal behavior model is established through clustering to detect APT attacks.

Transfer learning applications for autoencoder-based anomaly detection in wind turbines

Anomaly detection in wind turbines typically involves using normal behaviour models to detect faults early. Normal behaviour models are often implemented through the use of neural networks, of which autoencoders are particularly popular in this field. However, training autoencoder models for each turbine is time-consuming and resource intensive. Thus, transfer learning becomes essential for wind turbines with limited data or applications with limited computational resources. This study examines how cross-turbine transfer learning can be applied to autoencoder-based anomaly detection. Here, autoencoders are combined with constant thresholds for the reconstruction error to determine if input data contains an anomaly. The models are initially trained on one year’s worth of data from one or more source wind turbines. They are then fine-tuned using small amounts of data from the target wind turbine. Three methods for fine-tuning are investigated: adjusting the entire autoencoder, only the decoder, or only the threshold of the model. The performance of the transfer learning models is compared to baseline models that were trained on one year’s worth of data from the target wind turbine. The results of the tests conducted in this study indicate that models trained on data of multiple wind turbines do not improve the anomaly detection capability compared to models trained on data of one source wind turbine. In addition, modifying the model’s threshold can lead to comparable or even superior performance compared to the baseline, whereas fine-tuning the decoder or autoencoder further enhances the models’ performance.

Fault Diagnosis for Wind Turbine Generators Using Normal Behavior Model Based on Multi-Task Learning

Fault Diagnosis for Wind Turbine Generators Using Normal Behavior Model Based on Multi-Task Learning

Multitarget Normal Behavior Model Based on Heterogeneous Stacked Regressions and Change-Point Detection for Wind Turbine Condition Monitoring

Multitarget Normal Behavior Model Based on Heterogeneous Stacked Regressions and Change-Point Detection for Wind Turbine Condition Monitoring

Application of ensemble learning approach on anomaly detection of a dual induced draft fan system

Intelligent monitoring of thermal power plants has been receiving growing interest. As one of the promising technologies in intelligent monitoring, machine learning-based fault detections for auxiliary equipment in the thermal power plant have been widely investigated. In this work, we constructed normal behavior models to predict the current of a dual-induced draft fan system by gradient-boosting tree regression. For anomaly detection, we evaluated the residual by calculating the mean value and meanwhile added a control boundary based on statistical analysis. As a result, we successfully identified the abnormal fan in the dual-induced draft fan system and assisted in the schedule of maintenance work.

Wind Turbine Gearbox Condition Monitoring Using Hybrid Attentions and Spatio-Temporal BiConvLSTM Network

Gearbox fault deterioration can significantly impact the safety, reliability, and efficiency of wind turbines, resulting in substantial economic losses for wind farms. However, current condition monitoring methods face challenges in effectively mining the hidden spatio-temporal features within SCADA data and establishing reasonable weight allocations for model input variables. To tackle these issues, we proposed a novel condition monitoring method for wind turbine gearboxes called HBCE, which integrated a feature-time hybrid attention mechanism (HA), the bidirectional convolutional long short-term memory networks (BiConvLSTM), and an improved exponentially weighted moving-average (iEWMA). Specifically, utilizing historical health SCADA data acquired through the modified Thompson tau data-cleaning algorithm, a normal behavior model (HA-BiConvLSTM) of gearbox was constructed to effectively extract the spatio-temporal features and learn normal behavior patterns. An iEWMA-based outlier detection approach was employed to set dynamic adaptive thresholds, and real-time monitor the prediction residuals of HA-BiConvLSTM to identify the early faults of gearbox. The proposed HBCE method was validated through actual gearbox faults and compared with conventional spatio-temporal models (i.e., CNN-LSTM and CNN&LSTM). The results illustrated that the constructed HA-BiConvLSTM model achieved superior prediction precision in terms of RMSE, MAE, MAPE, and R2, and the proposed method HBCE can effectively and reliably identify early anomalies of a wind turbine gearbox in advance.

Privacy-Preserving Fleet-Wide Learning of Wind Turbine Conditions with Federated Learning

A wealth of data is constantly being collected by manufacturers from their wind turbine fleets. And yet, a lack of data access and sharing impedes exploiting the full potential of the data. Our study presents a privacy-preserving machine learning approach for fleet-wide learning of condition information without sharing any data locally stored on the wind turbines. We show that through federated fleet-wide learning, turbines with little or no representative training data can benefit from accuracy gains from improved normal behavior models. Customizing the global federated model to individual turbines yields the highest fault detection accuracy in cases where the monitored target variable is distributed heterogeneously across the fleet. We demonstrate this for bearing temperatures, a target variable whose normal behavior can vary widely depending on the turbine. We show that no member of the fleet is affected by a degradation in model accuracy by participating in the collaborative learning procedure, resulting in superior performance of the federated learning strategy in our case studies. Distributed learning increases the normal behavior model training times by about a factor of ten due to increased communication overhead and slower model convergence.

Behavior-Based Anomaly Detection in Log Data of Physical Access Control Systems

Behavior-based anomaly detection (AD) approaches for enterprise-IT security are not easily applicable to other domains, such as embedded devices and IoT nodes in cyber-physical systems. AD approaches are usually highly optimized for specific purposes, tightly bound to domain-specific technologies and rely on a specific syntax of investigated data. Data from cyber-physical systems is however highly diverse, often poorly documented and not easily ingested for automated analysis. AECID provides an anomaly detection approach, that monitors unstructured textual event data (i.e., log data), and implements self-learning for autonomous operation. A parser generator establishes a model of normal system behavior on top of observed events, which then can be leveraged to detect anomalies as deviations from that baseline. The unsupervised anomaly detection approaches of AECID apply machine learning techniques to perform sequence analysis, correlation analysis and statistical tests of events represented in log data. This paper discusses AECID's applicability in a building security system use case. A proof of concept demonstrates the effective detection of anomalies in log data of a building access control system stemming from card misuse, including stolen access cards and cloned cards.

Wind Turbine Condition Monitoring Using the SSA-Optimized Self-Attention BiLSTM Network and Changepoint Detection Algorithm

Condition-monitoring and anomaly-detection methods used for the assessment of wind turbines are key to reducing operation and maintenance (O&M) cost and improving their reliability. In this study, based on the sparrow search algorithm (SSA), bidirectional long short-term memory networks with a self-attention mechanism (SABiLSTM), and a binary segmentation changepoint detection algorithm (BinSegCPD), a condition-monitoring method (SSA-SABiLSTM-BinSegCPD, SSD) used for wind turbines is proposed. Specifically, the self-attention mechanism, which can mine the nonlinear dynamic characteristics and spatial–temporal features inherent in the SCADA time series, was introduced into a two-layer BiLSTM network to establish a normal-behavior model for wind turbine key components. Then, as a result of the advantages of searching precision and convergence rate methods, the sparrow search algorithm was employed to optimize the constructed SABiLSTM model. Moreover, the BinSegCPD algorithm was applied to the predicted residual sequence to achieve the automatic identification of deterioration conditions for wind turbines. Case studies conducted on multiple wind turbines located in south China showed that the established SSA-SABiLSTM model was superior to other contrast models, achieving a better prediction precision in terms of RMSE, MAE, MAPE, and R2. The MAE, RMSE, and MAPE of SSA-SABiLSTM were 0.2543 °C, 0.3412 °C, and 0.0069, which were 47.23%, 42.19%, and 53.38% lower than those of SABiLSTM, respectively. The R2 of SABiLSTM was 0.9731, which was 4.6% higher than that of SABiLSTM. The proposed SSD method can detect deterioration conditions 47–120 h in advance and trigger fault alarm signals approximately 36 h ahead of the actual failure time.

Overview of normal behavior modeling approaches for SCADA-based wind turbine condition monitoring demonstrated on data from operational wind farms

Abstract. Condition monitoring and failure prediction for wind turbines currently comprise a hot research topic. This follows from the fact that investments in the wind energy sector have increased dramatically due to the transition to renewable energy production. This paper reviews and implements several techniques from state-of-the-art research on condition monitoring for wind turbines using SCADA data and the normal behavior modeling framework. The first part of the paper consists of an in-depth overview of the current state of the art. In the second part, several techniques from the overview are implemented and compared using data (SCADA and failure data) from five operational wind farms. To this end, six demonstration experiments are designed. The first five experiments test different techniques for the modeling of normal behavior. The sixth experiment compares several techniques that can be used for identifying anomalous patterns in the prediction error. The selection of the tested techniques is driven by requirements from industrial partners, e.g., a limited number of training data and low training and maintenance costs of the models. The paper concludes with several directions for future work.

An Early Fault Detection Method for Wind Turbine Main Bearings Based on Self-Attention GRU Network and Binary Segmentation Changepoint Detection Algorithm

The condition monitoring and potential anomaly detection of wind turbines have gained significant attention because of the benefits of reducing the operating and maintenance costs and enhancing the reliability of wind turbines. However, the complex and dynamic operation states of wind turbines still pose tremendous challenges for reliable and timely fault detection. To address such challenges, in this study, a condition monitoring approach was designed to detect early faults of wind turbines. Specifically, based on a GRU network with a self-attention mechanism, a SAGRU normal behavior model for wind turbines was constructed, which can learn temporal features and mine complicated nonlinear correlations within different status parameters. Additionally, based on the residual sequence obtained using a well-trained SAGRU, a binary segmentation changepoint detection algorithm (BinSegCPD) was introduced to automatically identify deterioration conditions in a wind turbine. A case study of a main bearing fault collected from a 50 MW windfarm in southern China was employed to evaluate the proposed method, which validated its effectiveness and superiority. The results showed that the introduction of a self-attention mechanism significantly enhanced the model performance, and the adoption of a changepoint detection algorithm improved detection accuracy. Compared to the actual fault time, the proposed approach could automatically identify the deterioration conditions of main bearings 72.47 h in advance.

Condition-Based Maintenance of Gensets in District Heating Using Unsupervised Normal Behavior Models Applied on SCADA Data

Increasing interest in natural gas-fired gensets is motivated by District Heating (DH) network applications, especially in urban areas. Even if they represent customary solutions, when used in DH, duty regimes are driven by network thermal energy demands resulting in discontinuous operation, which affects their remaining useful life. As such, the attention on effective condition-based maintenance has gained momentum. In this paper, a novel unsupervised anomaly detection framework is proposed for gensets in DH networks based on Supervisory Control And Data Acquisition (SCADA) data. The framework relies on multivariate Machine-Learning (ML) regression models trained with a Leave-One-Out Cross-Validation method. Model residuals generated during the testing phase are then post-processed with a sliding threshold approach based on a rolling average. This methodology is tested against nine major failures that occurred on the gas genset installed in the Aosta DH plant in Italy. The results show that the proposed framework successfully detects anomalies and anticipates SCADA alarms related to unscheduled downtime.

Detection of abnormal situations in the operation of communication channels

Currently, many countries have high expectations for the digitalization of economies, meaning various elements of automation. One of the most effective tools in achieving a new level of digitalization can be the Internet of Things (IoT). The development of IoT provokes the fourth industrial revolution (Industry 4.0), which will be marked by the transition to fully automated digital production, the use of cyber-physical systems and cloud computing. Processes will be controlled by "smart" devices online. An example of such smart devices is modern telecommunications equipment, the operation of which accumulates large amounts of data - telemetry of various kinds. This "big data" can be used to predict possible future failures and other faults (abnormal situations) in the equipment itself. This article is devoted to the issue of creating models of normal behavior of various characteristics of communication channels, which is central in creating predictive diagnostics systems. Examples of such models are given.

DpGuard: A Lightweight Attack Detection Method for an Industrial Bus Network

In industrial control systems (ICSs), the PROFIBUS-DP (decentralized peripherals) protocol is widely used for communication between devices. Because PROFIBUS-DP is an unencrypted and insecure bus protocol, attackers can connect to the PROFIBUS-DP system and arbitrarily manipulate I/O process values, which may interrupt the normal operation of industrial equipment, or have more serious consequences. However, due to the complex structures of bus networks and the large number of attack areas, the existing scheme does not monitor all the messages in the industrial head office network and cannot effectively detect semantic attacks. To solve this problem, we propose a novel attack detection system DpGuard. DpGuard automatically builds a finite-state machine model of normal ICS behavior through a large number of historical ICS traffic data. The model includes state events, state transitions, state transition probability, and other normal behavior information. In addition, DpGuard records the execution status of the context data package, uses the real-time captured data package as the input of the model, and judges whether the state event and state transition probability conform to the constraints of the finite-state machine model, so as to identify the legitimate normal behavior of the ICS. Our proposal was evaluated using two Siemens PLCs (programmable logic controllers) deployed on the PROFIBUS-DP system. The experimental results demonstrated that the scheme could accurately detect fault injection and semantic attacks. Compared with other detection models, our scheme presented an improved detection performance, with a detection accuracy of 99.80%.

False alarm reduction in drilling process monitoring using virtual sample generation and qualitative trend analysis

Process monitoring is essential for ensuring the safety of geological drilling processes, but most existing monitoring systems suffer from false alarms. This study is motivated by the fact that many false alarms are generated from dynamic changes in signals under normal conditions. A new process monitoring method is proposed by analyzing the relationship between the input and output signals of a drilling normal behavior model, enabling a fault detection decision by checking their qualitative trends at the change point. The main novelties of this study are: (i) a data-driven normal behavior model describing the fault-free operating condition is proposed to output expected healthy virtual samples; (ii) a new alarm generation strategy is designed for reducing false alarms in drilling processes based on change point detection and qualitative trend analysis. Industrial case studies demonstrate the effectiveness and practicability of the method.

Vibration Fault Detection in Wind Turbines Based on Normal Behaviour Models without Feature Engineering

Most wind turbines are remotely monitored 24/7 to allow for early detection of operation problems and developing damage. We present a new fault detection approach for vibration-monitored drivetrains that does not require any feature engineering. Our method relies on a simple model architecture to enable a straightforward implementation in practice. We propose to apply convolutional autoencoders for identifying and extracting the most relevant features from a broad continuous range of the spectrum in an automated manner, saving time and effort. We focus on the range of [0, 1000] Hz for demonstration purposes. A spectral model of the normal vibration response is learnt for the monitored component from past measurements. We demonstrate that the trained model can successfully distinguish damaged from healthy components and detect a damaged generator bearing and damaged gearbox parts from their vibration responses. Using measurements from commercial wind turbines and a test rig, we show that vibration-based fault detection in wind turbine drivetrains can be performed without the usual upfront definition of spectral features. Another advantage of the presented method is that a broad continuous range of the spectrum can be monitored instead of the usual focus on monitoring individual frequencies and harmonics. Future research should investigate the proposed method on more comprehensive datasets and fault types.

Real-World Application of Early Detection of Sudden Changes in Driver’s Physical Condition Using Machine Learning and Interpretation Method

In order to decrease fatal traffic accidents, early detection of sudden changes in driver’s physical condition is desired. In this paper, we reported an example of modeling process of "driver’s normal behavior model," which is a part of driver state sensing technology we are developing. By combining machine learning and domain knowledge, we have achieved the model for normal steering operation that had both high prediction accuracy and high interpretability/explainability under real-world conditions.

Wind Turbine Spindle Operating State Recognition and Early Warning Driven by SCADA Data

An operating condition recognition approach of wind turbine spindle is proposed based on supervisory control and data acquisition (SCADA) normal data drive. Firstly, the SCADA raw data of wind turbine under full working conditions are cleaned and feature extracted. Then the spindle speed is employed as the output parameter, and the single and combined normal behavior model of the wind turbine spindle is constructed sequentially with the pre-processed data, with the evaluation indexes selected as the optimal model. Finally, calculating the spindle operation status index according to the sliding window principle, ascertaining the threshold value for identifying the abnormal spindle operation status by the hypothesis of small probability event, analyzing the 2.5 MW wind turbine SCADA data from a domestic wind field as a sample, The results show that the fault warning time of the early warning model is 5.7 h ahead of the actual fault occurrence time, as well as the identification and early warning of abnormal wind turbine spindle operation without abnormal data or a priori knowledge of related faults.