Deep Signal Anomaly Detector

Detect signal anomalies using deep learning network in Simulink

Since R2024a

• 

Libraries:
DSP System Toolbox / AI

Description

The Deep Signal Anomaly Detector block detects real-time signal anomalies in Simulink^® using a trained long short-term memory (LSTM) autoencoder deep learning network model.

You must first create and train a detector object in MATLAB^® using the deepSignalAnomalyDetector function, and configure the block to use this model in Simulink. To configure the block, specify the path to the detector model in the block dialog box. For more information on these steps, see User Workflow.

Note

This block additionally requires a Deep Learning Toolbox™ license.

Examples

Detect Anomalies in Sinusoidal Signal

Use the Deep Signal Anomaly Detector block to detect anomalies in a sinusoidal signal. The block uses a detector that has been trained on a set of sinusoidal signals of constant frequency and amplitude. Use the time scope to plot the input, anomaly flag, and the window loss.

Open the detectAnomaliesSingleChannel.slx model. The input is a single-channel sinusoidal signal. The Deep Signal Anomaly Detector block reads the post-processing parameters from the detector MAT-file. As you can see in the Parameter values from MAT-file section in the block dialog box, the window length WL is 1 and the overlap length OL is 0. The hop size WL - OL is 1. The threshold value is approximately 0.06.

Run the model. The first plot shows the delayed input signal. The delay value is equal to the number of samples the Deep Signal Anomaly Detector block outputs through the Delay port. To align the input with the anomaly flag and window loss, use a Delay block, set the Delay length to Input, and provide the delay estimate as the delay input to the block.

The second plot shows the anomalies in the signal. A value of 1 indicates the presence of an anomaly. The third plot shows the aggregate window loss.

When the window loss is greater than the threshold, the block flags the region to have an anomaly. In this case, since the window length is 1, the block detects point anomalies. The block turns on the anomaly flag for every sample which has the window loss value greater than the threshold value. This makes the anomaly plot look very noisy.

Increasing Window Length

To make the anomaly plot look less noisy, increase the window length in the Deep Signal Anomaly Detector block to 40. To do that, set the Parameters for post-processing parameter to Specify on dialog. Set Window length to 40 and Overlap length to 39. Set the threshold to the default value obtained from the MAT-file.

Run the model. The anomaly plot looks much smoother. However, there are still some regions where the window loss value is low (around 0.1) and the block detects these regions as anomalies.

Increasing Threshold

To filter out anomalies which have a relatively lower window loss, increase the threshold value to 0.15. To be called an anomaly, the aggregate window loss should now be greater than 0.15. This removes the unintended anomaly detections and further smoothens the plot.

Detect Anomalies in Multichannel Sinusoidal Signal

Open the detectAnomaliesMultiChannel.slx model.

The input is a multichannel sinusoidal signal. If one of the channels has an anomaly, the Deep Signal Anomaly Detector block assumes the presence of the anomaly across all input channels and returns a scalar value at the Anomaly flag port. The block uses a window length WL of 40 and an overlap length OL of 39. The hop size WL - OL is 1.

Run the model. The first plot shows the delayed input signal. The second plot shows the presence of an anomaly in the signal. The third plot shows the corresponding aggregate window loss.

Observe from the time scope that the presence of anomaly is uniform across all channels and the block provides a single channel output for the window loss and anomaly flag, corresponding to all the channels of the input.

The sample time of the input and output ports is the same. You can confirm this from the color of the signals in the model. The delay port always has a constant sample time.

Changing Hop Size

Change the hop size in the Deep Signal Anomaly Detector block and note the effect on the sample time of the output ports, Anomaly flag and Window loss.

Decrease the overlap length to 30. The hop size is now 10. Run the model again. View the sample time of the two output ports in the timing legend. To view the timing legend, in the Debug tab of the Simulink model toolstrip, click Information Overlays > Timing Legend. The timing legend shows that the sample time of the output ports is 10 times the sample time of the input port. For every 10 input samples, the block produces 1 output sample. To change the sample time at the output port, adjust the hop size accordingly. For more information on sample time at the block ports, see Sample- and Frame-Based Concepts.

Extended Examples

Fault Detection and Localization in Three-Phase Power Transmission Using Deep Signal Anomaly Detector in Simulink

Detect faults in three-phase power transmission using the Deep Signal Anomaly Detector block.

Open Live Script

Detect Anomalies in ECG Data Using Wavelet Scattering and LSTM Autoencoder in Simulink

Use wavelet scattering and deep learning network to detect anomalies in ECG signals.

Open Live Script

Limitations

• This block only supports the LSTM auto encoder detector model. To generate this model, you must set ModelType to "lstmautoencoder" while creating the signal anomaly detector using the deepSignalAnomalyDetector function.

Ports

Input

Input — Input signal

vector | matrix

Specify the input signal through this port as a vector or a matrix.

When the input has multiple channels, the block assumes that the presence of an anomaly is uniform across all input channels, and generates a single-channel output for the anomaly detection.

This port is unnamed until you enable the Threshold port.

Data Types: single | double

Threshold — Detection threshold value

nonnegative scalar

Specify the detection threshold value as a nonnegative scalar. The block uses this value as the threshold for the window loss to detect anomalies.

Dependencies

To enable this port, set:

• Parameters for post-processing to Specify on dialog.

• Threshold source to Input port.

Data Types: single | double

Output

Anomaly flag — Anomaly flag

logical scalar

Anomaly flag, returned as a logical scalar:

• 1 –– Anomaly is present in the input data.

• 0 –– No anomaly is present in the input data.

When the input has multiple channels, the block assumes that the presence of an anomaly is uniform across all input channels, and generates a single channel output for the anomaly detection.

The sample time at this port equals Ts × HS, where Ts is the sample time (or the sample period) at the input port, and HS is the hop size between adjacent windows. Hop size equals WL − OL, where WL is the window length and OL is the overlap length. For more information on block samples times, see Sample- and Frame-Based Concepts.

Data Types: Boolean

Window loss — Aggregate window loss

scalar

Aggregate window loss, returned as a scalar. The block computes this value using the Window length, Overlap length, and Window loss aggregation parameters.

The block uses the aggregate window loss to detect the anomalies. For more information, see Algorithms.

The sample time at this port equals Ts × HS, where Ts is the sample time (or the sample period) at the input port and HS is the hop size between adjacent windows. Hop size equals WL − OL, where WL is the window length and OL is the overlap length. For more information on block samples times, see Sample- and Frame-Based Concepts.

Data Types: single

Delay — Estimate delay

scalar

Estimate of the delay between the input and output signals in samples, returned as a scalar. To align the input data with the anomaly flag and window loss, apply this delay estimate to the input before further processing. For an example, see Detect Anomalies in Sinusoidal Signal.

The output at this port is always a scalar and the sample time of this port is always constant.

Dependencies

To enable this port, select the Enable delay port check box in the block dialog box.

Data Types: single

Parameters

To edit block parameters interactively, use the Property Inspector. From the Simulink Toolstrip, on the Simulation tab, in the Prepare gallery, select Property Inspector.

Detector MAT-file path — Path to detector MAT-file

untitled.mat (default) | MAT-file name

Specify the path to the MAT-file that you generate using the saveModel function. This MAT-file contains the trained LSTM autoencoder deep learning network model and parameters used for post-processing such as the window length, overlap length, detection threshold, and window loss aggregation.

Parameters for post-processing — Source for post-processing parameters

Read from MAT-file (default) | Specify on dialog

Specify the source for post-processing parameters as one of these:

• Read from MAT-file –– The block uses the default parameters read from the MAT-file.

• Specify on dialog –– Specify the parameters in the block dialog box.

The goal of post-processing is to detect the signal anomalies and determine the window loss which is a measure of how well the block reconstructs the data.

Window length — Window length

1 (default) | positive integer

Specify the window length WL the block uses in post-processing as a positive integer. By default, the block uses a window length of one sample and an overlap length of zero samples between adjoining windows. This setting detects point anomalies. Increase the window length to aggregate the window loss over a larger range of the signal.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Overlap length — Overlap length between adjoining windows

0 (default) | nonnegative integer

Specify the overlap length OL between adjoining windows as a nonnegative integer. The block obtains one detection per input sample when OL is WL − 1, that is, a hop size of 1 sample. Hop size is the difference between the window length and overlap length, WL − OL. If you want to downsample the output by a factor of the hop size HS, set OL to WL − HS.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Threshold source — Source of detection threshold value

Dialog (default) | Input port

Specify the source of detection threshold as one of these:

• Dialog –– Specify the threshold value in the block dialog box using the Threshold parameter.

• Input port –– Specify the threshold value through the Threshold input port.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Threshold — Detection threshold value

0.01 (default) | nonnegative scalar

Specify the detection threshold value as a nonnegative scalar. The block computes the loss for each window based on the statistic method you specify in the Window loss aggregation parameter. To set the anomaly flag, the block compares the aggregate window loss to the threshold value you specify in this parameter. If the window loss is greater than the threshold value, the block sets the anomaly flag to 1, else to 0. A lower value of threshold results in more samples being classified as anomalies. Adjust the threshold value based on the values of window loss observed in anomalous and non-anomalous regions.

Tunable: Yes

Dependencies

To enable this parameter, set:

• Parameters for post-processing to Specify on dialog.

• Threshold source to Dialog.

Window loss aggregation — Statistic method to aggregate window loss

Mean (default) | Max | Min | Median

Specify the statistic method the block uses to aggregate the sample loss with in each window segment as one of these:

• Mean

• Max

• Min

• Median

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Parameter values from MAT-file — Display post-processing parameter values from MAT-file

text box

This parameter is read-only.

Display the post-processing parameter values the block reads from the MAT-File. The display parameters are:

• Window length

• Overlap length

• Threshold

• Window loss aggregation

Use these values as a baseline if you would like to adjust the post processing parameters by setting Parameters for post-processing to Specify on dialog.

Dependencies

To enable this parameter, set Parameters for post-processing to Read from MAT-file.

Enable delay port — Output estimated delay

off (default) | on

Select this check box to enable the Delay output port. The block outputs the estimated delay in samples between the input and the reconstructed signals through this port.

Block Characteristics

Data Types	double | single
Direct Feedthrough	no
Multidimensional Signals	no
Variable-Size Signals	no
Zero-Crossing Detection	no

More About

User Workflow

Here are the steps to train the detector model in MATLAB and configure the block to use this model in Simulink:

1. Use the deepSignalAnomalyDetector function with ModelType set to "lstmautoencoder" to create the anomaly detector object, deepSignalAnomalyDetectorLSTM.

   detector = deepSignalAnomalyDetector(1,"lstmautoencoder")

2. Train the detector using the trainDetector function by providing data which contains no anomalies.

   trainDetector(detector,Data)

3. Export the trained model and detector parameters to a MAT-file using the saveModel function. The generated MAT-file contains the trained deep learning model and parameters used for post-processing such as window length, overlap length, detection threshold, and window loss aggregation.

   saveModel(detector,"filename.mat")

4. Load the detector model and parameters into the Deep Signal Anomaly Detector block by specifying the path of the generated MAT-file in the Detector MAT-file path parameter

5. You can specify the parameters for post-processing in the block dialog box to override the default detector parameters the block reads from the MAT-file. The goal of the post-processing is to detect signal anomalies and determine the window loss which is a measure of how well the block reconstructs the data. For more details, see Algorithms.

For an example that shows this workflow in detail, see Detect Anomalies in ECG Data Using Wavelet Scattering and LSTM Autoencoder in Simulink.

Algorithms

The Deep Signal Anomaly Detector block first buffers the input into frames and tries to reconstruct the buffered signal using the trained network. The block processes the difference between the input and the reconstructed frames to obtain the window loss and anomaly flags. The block can also output the estimate of the delay (in samples) the input signal goes through as the trained network reconstructs this signal.

Trained Network

Train the deep signal anomaly detector network in MATLAB using the steps described in User Workflow.

Load the detector MAT-file into the Deep Signal Anomaly Detector block through the Detector MAT-file path parameter. The block uses this network in Simulink.

Pass the input signal with anomalies to the trained network. The trained networks reconstructs this signal. The block algorithm computes the difference between the input signal and the reconstructed signal. The block uses this difference for post processing.

Post-processing

In post-processing, the block detects signal anomalies and determines the window loss which is a measure of how well the block reconstructs the data.

Here are the steps the block implements:

1. Computing the point loss by computing the absolute square of the difference between input and reconstructed signal.

2. When the input is a multiple channel signal, the block combines the losses across all channels by computing the mean of the losses from all channels.

3. Computing the aggregate window loss using the Window length, Overlap length, and Window loss aggregation parameters. You can specify the window length and overlap length in the block dialog box, or the block inherits these values from the detector parameters in the MAT-file.

4. To set the anomaly flag, the block compares the window loss to the threshold value you specify in the Threshold parameter. If the window loss is greater than the threshold value, the block sets the anomaly flag to 1, else to 0. A lower value of threshold results in more samples being classified as anomalies. Adjust the threshold value based on the values of window loss observed in anomalous and non-anomalous regions.

Extended Capabilities

C/C++ Code Generation

Generate C and C++ code using Simulink® Coder™.

This block supports library-free code generation and does not support the rapid accelerator mode (Simulink).

Version History

Introduced in R2024a