Normal Behavior Model Research Articles

An Adaptive Condition Monitoring Method of Wind Turbines Based on Multivariate State Estimation Technique and Continual Learning

With the development of wind energy, the condition monitoring (CM) methods of wind turbines (WTs) based on supervisory control and data acquisition (SCADA) data have attracted much attention to detect potential faults. With the impact of complicated internal and external factors, the operation conditions of WTs are time-varying. Thus it is necessary to adaptively update CM models in long-term operation. An adaptive WT CM method based on multivariate state estimation technique (MSET) and continual learning (CL) is proposed, which is concise and suitable for practical application. MSET is used to build the non-parametric and high-accuracy normal behavior model. In the proposed CL strategy, new normal data will be temporarily stored in the data buffer to realize the adaptive update of the MSET model. And rules for missing and abnormal data are designed to stabilize update frequency and improve fault detection ability respectively. The proposed method is validated using a real-world SCADA data set with gearbox faults. The results show that the proposed method has higher estimation accuracy and lower false alarm rate than other methods, and the proposed CL strategy has popularization potential. Related hyperparameters are discussed, and when using less training data, the proposed method still has better performance.

Fault Detection of Wind Turbine Pitch Motors Based on Ensemble Learning Approach

Machine learning-based condition monitoring of wind turbines’ critical components is an active area of research, especially for pitch systems, which suffer from a high failure rate. In this work, we successfully predicted and detected the high-temperature fault of the electric pitch motor by analyzing SCADA data through the ensemble learning-based approach. For that, normal behavior models to predict pitch motor temperature were constructed respectively for three pitch motors by gradient boosting tree regression. Residual evolution before the reported high-temperature fault was studied by the sliding window approach. A Shewhart control chart was applied to detect the anomalies of temperature. The proposed approach successfully gave an early warning for the potential high-temperature fault of electric pitch motors around ten days prior to the SCADA system.

Intrusion Detection System Based on Pattern Recognition.

Artificial intelligence has been developed to be able to solve difficult problems that involve huge amounts of data and that require rapid decision-making in most branches of science and business. Machine learning is one of the most prominent areas of artificial intelligence, which has been used heavily in the last two decades in the field of network security, especially in Intrusion Detection Systems (IDS). Pattern recognition is a machine learning method applied in medical applications, image processing, and video processing. In this article, two layers' IDS is proposed. The first layer classifies the network connection according to the used service. Then, a minimum number of features that optimize the detection accuracy of malicious activities on that service are identified. Using those features, the second layer classifies each network connection as an attack or normal activity based on the pattern recognition method. In the training phase, two multivariate normal statistical models are created: the normal behavior model and the attack behavior model. In the testing and running phases, a maximum likelihood estimation function is used to classify a network connection into attack or normal activity using the two multivariate normal statistical models. The experimental results prove that the proposed IDS has superiority over related IDSs for network intrusion detection. Using only four features, it successfully achieves DR of 97.5%, 0.001 FAR, MCC 95.7%, and 99.8% overall accuracy.

Machine-Learning-Based Modeling of a Hydraulic Speed Governor for Anomaly Detection in Hydropower Plants

Hydroelectric power plants (HEPPs) are renewable energy power plants with the highest installed power in the world. The control systems are responsible for stopping the relevant unit safely in case of any malfunction while ensuring the desired operating point. Conventional control systems detect anomalies at certain limits or predefined threshold values by evaluating analog signals regardless of differences caused by operating conditions. In this study, using real data from a large hydro unit (>150 MW), a normal behavior model of a hydraulic governor’s oil circulation in an operational HEPP is created using several machine learning methods and historical data obtained from the HEPP’s SCADA system. Model outputs resulted in up to 96.45% success of prediction with less than 1% absolute deviation from actual measurements and an R2 score of 0.985 with the random forest regression method. This novel approach makes the model outputs far more appropriate to use as an active threshold value changing for different operating conditions, eliminating insufficiency of the constant threshold, resulting in the detection of anomalies in early stages and taking precautions accordingly. The study fills the gap in the literature on anomaly detection in hydraulic power units, which is a demanding task with state-of-the-art methods.

Hospital Intelligent Power Operation and Maintenance Information Evaluation with the Long and Short Memory Neural Network.

The invention describes a deep learning-based technique for monitoring power grid information operation and maintenance. Based on the time series data information in the power grid information operation and maintenance monitoring system, this method obtains the cleaned time series data through appropriate data preprocessing technology. This also uses the long-term and short-term memory neural network to realize the prediction function of the time series data to be detected. The reason behind is to construct the normal behavior model of the time series. Additionally, the control chart based on an exponentially weighted moving average is employed to determine whether the time series to be discovered contains any anomalous and abnormal phenomena. In the area of power grid information operation and maintenance monitoring, the method of invention is designed to counter anomaly. This phenomenon is universal in nature and has significant scientific importance for guiding treatment after the anomaly is discovered. Additionally, it guards against serious faults that the abnormality might bring about.

Research on Normal Behavior Models for Status Monitoring and Fault Early Warning of Pitch Motors

Nowadays, pitch motors play an important role in many manufacturing plants. To ensure the other components run normally, it is urgent to automatically monitor the running state of pitch motors and early warning faults to avoid huge losses at a later period. Based on the normal behavior modeling technique, this paper studies the status monitoring of the pitch motors. Based on the fact that the state of the motor varies with time, we propose to train an echo state network with the SCADA data to predict the temperature of the pitch motor. Subsequently, the EWMA (exponentially weighted moving average) technique is used to set the alarm limit lines of each parameter. By employing some real data collected in a wind farm in China to conduct experiments, the results show that in comparison with several other methods, the proposed method can more effectively identify and early warn the faults of the pitch motor.

A Comparative Analysis on the Variability of Temperature Thresholds through Time for Wind Turbine Generators Using Normal Behaviour Modelling

Data-driven normal behaviour models have gained traction over the last few years as a convenient way of modelling turbine operational health to detect anomalies. By leveraging high-dimensional operational relationships, temperature thresholds can be automatically calculated based on each individual turbine unique operating envelope, in theory minimising false alarms and providing more reliable diagnostics. The aim of this work is to provide further insight into practical uses and limitations of implementing normal behaviour temperature models in practice, to inform practitioners, as well as assist in improving wind turbine generator fault detection systems. Results suggest that, on average, as little as two months of data are adequate to produce stable temperature alarm thresholds, with the worst case example requiring approximately 200–290 days of data depending on the component and desired convergence criteria.

A two-stage anomaly decomposition scheme based on multi-variable correlation extraction for wind turbine fault detection and identification

Effective condition monitoring is critical to improve the reliability and reduce unplanned downtime of wind turbines (WTs). Supervisory control and data acquisition (SCADA) data with the advantages of easy access and low cost, has been widely used in wind turbine condition monitoring (WTCM). While the existing literature based on SCADA data for WTCM provides whether the condition is normal or abnormal, few have attempted to identify the underlying causes of the anomaly. In this paper, a two-stage anomaly decomposition scheme based on the multi-variable correlation extraction is proposed for WT fault detection and anomaly causes identification. Firstly, a normal behavior model (NBM) based on the multi-variable correlation extraction (Co-NBM) is proposed for WT fault detection using only SCADA data. A network based on the multi-head self-attention mechanism is designed to extract correlation among the variables. It can effectively provide early warning and reduce false alarms rate by exploring the multi-variable correlations. Furthermore, a two-stage anomaly decomposition scheme based on the Hotelling’s T2 method is proposed for WT fault identification. It is capable of effectively identifying the fault locations and anomaly causes based on the defined two-stage abnormal factors. Compared with auto-encoder (AE) and LSTM-attention methods, the proposed method could achieve better performance in fault detection and reduce the false alarm rate. Moreover, the proposed method could also provide the underlying cause of the anomaly, which is useful for the decision making of WT maintenance.

Wind turbine gearbox fault prognosis using high-frequency SCADA data

Condition-based maintenance using routinely collected Supervisory Control and Data Acquisition (SCADA) data is a promising strategy to reduce downtime and costs associated with wind farm operations and maintenance. New approaches are continuously being developed to improve the condition monitoring for wind turbines. Development of normal behaviour models is a popular approach in studies using SCADA data. This paper first presents a data-driven framework to apply normal behaviour models using an artificial neural network approach for wind turbine gearbox prognostics. A one-class support vector machine classifier, combining different error parameters, is used to analyse the normal behaviour model error to develop a robust threshold to distinguish anomalous wind turbine operation. A detailed sensitivity study is then conducted to evaluate the potential of using high-frequency SCADA data for wind turbine gearbox prognostics. The results based on operational data from one wind turbine show that, compared to the conventionally used 10-min averaged SCADA data, the use of high-frequency data is valuable as it leads to improved prognostic predictions. High-frequency data provides more insights into the dynamics of the condition of the wind turbine components and can aid in earlier detection of faults.

The detection of generator bearing failures on wind turbines using machine learning based anomaly detection

In this research an early warning methodological framework is developed that is able to detect premature failures due to excessive wear. The methodology follows the data-driven Normal Behavior Model (NBM) principle, in which one or more data-driven models are used to model the normal behavior of the wind turbine. Anomalous behaviour of the turbine is identified by analyzing the deviation between the observed and predicted normal behaviour. The framework consists of two pipelines, a statistics and machine learning based pipeline. The former is based on techniques like ARIMA, OLS and CUSUM. The latter makes use of techniques like Random Forest, Gradient Boosting, … Each pipeline has its strengths and weaknesses, but by combining them in an intelligent way, a more capable detector is developed. The methodology is validated on 10-minute SCADA data from a real operational wind farm. The validation case focuses on generator (front/rear) bearing failures. The goal is to predict these failures well in advance (ideally at least a month) using the developed framework, which should allow for timely adjustments to the maintenance plan. The results show that the methodology is able to accomplish this reliably.

Abnormal vibration detection of wind turbine based on temporal convolution network and multivariate coefficient of variation

A working wind turbine generates a large amount of multivariate time-series data, which contain abundant operation state information and can predict impending anomalies. The anomaly detection of the wind turbine nacelle that houses all of the generating components in a turbine have been challenging due to its inherent complexities, systematic oscillations and noise. To address these problems, this paper proposes an unsupervised time-series anomaly detection approach, which combines deep learning with multi-parameter relative variability detection. A normal behavior model (NBM) of nacelle vibration is firstly built upon training normal historical data of the supervisory control and data acquisition (SCADA) system in the high-resolution domain. To better capture the temporal characteristics and frequency information of vibration signals, the vibration spectrum vector is integrated with the multivariate time-series data as inputs and the spectrum-embedded temporal convolutional network (SETCN) is then used to extract latent features. The anomalies are detected through a multi-variate coefficient of variation (MCV) based anomaly assessment index (AAI) of relative variability among vibration residuals and environment parameters of the nacelle. The approach considers the time-series characteristics of input data and preserves the spatio-temporal correlation between variables. Validations using data collected from real-world wind farms demonstrate the effectiveness of the proposed approach.

Unusual Insider Behavior Detection Framework on Enterprise Resource Planning Systems Using Adversarial Recurrent Autoencoder

Detecting unusual behaviors of insiders on enterprise resource planning (ERP) systems is one of the essential parts to reduce the risks of threatening and abusing enterprise resources by insiders. Many approaches to detect the behaviors based on rule-based systems and stochastic processes are currently limited to empirical monitoring using manually established algorithms or probabilistic boundaries. Those approaches need prior knowledge such as user permission guideline and process data characteristics. Unfortunately, obtaining prior knowledge is hard in practice, and these are not appropriate to detect atypical unusual behavior which can not be clearly defined using heuristic rules. Therefore, in this article, we propose a novel framework for unusual insider behavior detection (UIBD) for ERP systems. The proposed framework initially derives a discriminative model for normal behavior samples, and UIBD is conducted by computing an error using the model. Since the model is compiled using normal samples only, the error of unusual samples would be larger than normal ones. To derive a robust normal behavior model, we present adversarial recurrent autoencoder (ARAE). To demonstrate the efficiency of the proposed framework based on ARAE, we conduct experiments using a dataset composed of insider behaviors defined by sequences of security audit logs of ERP systems operating in real-world enterprises. The experimental results show that the proposed framework with ARAE can successfully detect unusual insider behaviors and outperform other methods to detect unusual insider behavior or threatening.

Effects of Wind Conditions on Wind Turbine Temperature Monitoring and Solution Based on Wind Condition Clustering and IGA-ELM.

To reduce maintenance costs of wind turbines (WTs), WT health monitoring has attracted wide attention, and different methods have been proposed. However, most existing WT temperature monitoring methods ignore the fact that various wind conditions can directly affect internal temperature of WT, such as main bearing temperature. This paper analyzes the effects of wind conditions on WT temperature monitoring. To reduce these effects, this paper also proposes a novel WT temperature monitoring solution. Compared with existing solutions, the proposed solution has two advantages: (1) wind condition clustering (WCC) is applied and then a normal turbine behavior model is built for each wind condition; (2) extreme learning machine (ELM) is optimized by an improved genetic algorithm (IGA) to avoid local minimum due to the irregularity of wind condition change and the randomness of initial coefficients. Cases of real SCADA data validate the effectiveness and advantages of the proposed solution.

Using Transfer Learning to Build Physics-Informed Machine Learning Models for Improved Wind Farm Monitoring

This paper introduces a novel, transfer-learning-based approach to include physics into data-driven normal behavior monitoring models which are used for detecting turbine anomalies. For this purpose, a normal behavior model is pretrained on a large simulation database and is recalibrated on the available SCADA data via transfer learning. For two methods, a feed-forward artificial neural network (ANN) and an autoencoder, it is investigated under which conditions it can be helpful to include simulations into SCADA-based monitoring systems. The results show that when only one month of SCADA data is available, both the prediction accuracy as well as the prediction robustness of an ANN are significantly improved by adding physics constraints from a pretrained model. As the autoencoder reconstructs the power from itself, it is already able to accurately model the normal behavior power. Therefore, including simulations into the model does not improve its prediction performance and robustness significantly. The validation of the physics-informed ANN on one month of raw SCADA data shows that it is able to successfully detect a recorded blade angle anomaly with an improved precision due to fewer false positives compared to its purely SCADA data-based counterpart.

On Residual-based Diagnosis of Physical Systems

In this article we describe a novel diagnosis methodology for physical systems such as industrial production systems. The article consists of two parts: Part one analyzes the differences between using sensor values and using residual values for fault diagnosis. Residual values denote the health of a component by comparing sensor values to a predefined model of normal behaviour. We further analyse how faults propagate through components of a physical system and argue for the use of residual values for diagnosing physical systems. In part two we extend the theory of established consistency-based diagnosis algorithms to use residual values. We also illustrate how users of the presented diagnosis methodology are free to substitute the residual generating equations and the diagnosis algorithm to suit their specific needs.For diagnosis, we present the algorithm HySD, based on Satisfiability Modulo Linear Arithmetic. We present an implementation of HySD using threshold values and a symbolic diagnosis approach. However, the approach is also suitable to integrate modern machine learning methods for anomaly detection and combine them with a multitude of diagnosis approaches.Through experiments on the process-industry benchmark Tennessee Eastman Process and another benchmark consisting of multiple tank systems we show the feasibility of our approach. Overall we show how our novel diagnosis approach offers a practical methodology that allows industry to advance from current state of the art anomaly detection to automated fault diagnosis.

A Normal Behavior Model Based on Power Curve and Stacked Regressions for Condition Monitoring of Wind Turbines

Wind turbines are complex systems composed of multiple components. In order to assess the overall condition of a given wind turbine, one may need to employ multiple models; such a solution, however, is deemed to be unwieldy and expensive to implement, especially for large-scale wind farms. This paper proposes a novel heterogeneous stacked regressor (HET-SR) algorithm, which learns from optimal power curve data attained through a delicate signal processing scheme involving density-based spatial clustering of applications with noise (DBSCAN). The proposed method is thus a normal behavior model (NBM) capable of accurately assessing the health status of an entire wind turbine through an overall health indicator such as the power curve. We compare this method with state-of-the-art methods and perform an extensive experimental work based on real operational data from the supervisory control and data acquisition (SCADA) system. The findings of this research work provide evidence on the effectiveness and superiority of the proposed method in terms of high accuracy in fault detection.

Power Curve-Based Fault Detection Method for Wind Turbines

A normal behavior model based on a boosted stacked regressor, trained in a k-fold crossvalidation with optimal power curve data, is proposed for wind turbine fault detection. In order to obtain the optimal power curve data, a signal processing scheme based on density-based spatial clustering of applications with noise, along with a robust estimation algorithm are employed, from which an upper-lower bound envelop is established. The experimental results based on real wind turbine data from supervisory control and data acquisition system indicate the effectiveness and impact of the proposed method in practical applications

Methods for Host-based Intrusion Detection with Deep Learning

Host-based Intrusion Detection Systems (HIDS) automatically detect events that indicate compromise by adversarial applications. HIDS are generally formulated as analyses of sequences of system events such as bash commands or system calls. Anomaly-based approaches to HIDS leverage models of normal (a.k.a. baseline) system behavior to detect and report abnormal events and have the advantage of being able to detect novel attacks. In this article, we develop a new method for anomaly-based HIDS using deep learning predictions of sequence-to-sequence behavior in system calls. Our proposed method, called the ALAD algorithm, aggregates predictions at the application level to detect anomalies. We investigate the use of several deep learning architectures, including WaveNet and several recurrent networks. We show that ALAD empowered with deep learning significantly outperforms previous approaches. We train and evaluate our models using an existing dataset, ADFA-LD, and a new dataset of our own construction, PLAID. As deep learning models are black box in nature, we use an alternate approach, allotaxonographs, to characterize and understand differences in baseline vs. attack sequences in HIDS datasets such as PLAID.

Image-Based Insider Threat Detection via Geometric Transformation

Insider threat detection has been a challenging task over decades; existing approaches generally employ the traditional generative unsupervised learning methods to produce normal user behavior model and detect significant deviations as anomalies. However, such approaches are insufficient in precision and computational complexity. In this paper, we propose a novel insider threat detection method, Image-based Insider Threat Detector via Geometric Transformation (IGT), which converts the unsupervised anomaly detection into supervised image classification task, and therefore the performance can be boosted via computer vision techniques. To illustrate, our IGT uses a novel image-based feature representation of user behavior by transforming audit logs into grayscale images. By applying multiple geometric transformations on these behavior grayscale images, IGT constructs a self-labelled dataset and then trains a behavior classifier to detect anomaly in a self-supervised manner. The motivation behind our proposed method is that images converted from normal behavior data may contain unique latent features which remain unchanged after geometric transformation, while malicious ones cannot. Experimental results on CERT dataset show that IGT outperforms the classical autoencoder-based unsupervised insider threat detection approaches, and improves the instance and user based Area under the Receiver Operating Characteristic Curve (AUROC) by 4% and 2%, respectively.

Wind turbine blade icing detection with multi-model collaborative monitoring method

Blade ice accretion endangers the safety of wind turbines located at high altitudes with a humid climate, particularly during winter. Timely detection of ice accretion facilitates appropriate regulation of the wind turbine, including shut down, to ensure safety. This paper provides a detailed analysis of the impact of ice accretion on wind turbine performance and relevant operational parameters. Rotor speed, output power and ambient temperature are selected as variables that can facilitate the detection of blade ice accretion. The XGBoost method is used to accurately construct normal behavior models for output power and rotor speed respectively, and the model errors (Mean Absolute Percentage Error, MAPE) can be as low as 0.53%. A Sequential Probability Ratio Test (SPRT) is introduced to analyze the model prediction residuals and thus identify any abnormal changes to output power and rotor speed. If significant changes are detected when the ambient temperature is below zero, an ice accretion alarm is triggered. Using real blade ice accretion data, a case study demonstrates that the proposed blade ice detection method can give blace icing alarm 5 h in advance and offers sufficient time to gurantte the safety of wind turbine.