How it's built — Anomaly Detection

구축 방법 — Anomaly Detection · v1.0 · 2026-10-26

합성 센서 신호에 통계 탐지기와 학습 탐지기를 적용하고, 넣어 둔 이상(정답)과 대조하는 규칙 시뮬레이션 + 브라우저 학습
탭 4개: Signals & Features / Statistical Methods / Learning-based Methods / Evaluation
환경 효과 빼기: 기준 구간(0–3일)에서 strain = a + b·기온 + c·교통 지수, f₁ = a + b·기온을 최소제곱으로 맞추고 잔차 사용
통계: z-score(과거 창 / 기준 구간 고정), EWMA(λ, 한계 = L·σ√(λ/(2−λ))), 양쪽 CUSUM(k, h). 경보 뒤 초기화 없음(정한 방식)
Isolation Forest: 특징 5개(strain·f₁ 잔차, 기온, 1시간 strain 표준편차, 직전 대비 변화, 기준 구간으로 표준화), 나무 25–200, 표본 256, 시드 3
오토인코더: 1시간 창 × 특징 3개(18개) → tanh 은닉 2–12 → 18, MSE, Adam lr 0.01, 묶음 32, 1,500단계, 시드 5. 점수 = 복원 오차, 문턱 = 학습 구간 점수의 백분위
진동수 특징: 50 Hz 가속도 60초, Hann 창 FFT 봉우리 + 포물선 보간(1–6 Hz). 그림은 512점 Welch 평균
평가: 점 단위 정밀도·재현율·F1, 순위 기반 ROC AUC, 사건 단위(사건 안에 경보가 한 번이라도 있으면 잡음), 탐지 지연, 오경보 묶음 수, 비용 = 오경보 비용 × 오경보 + 놓친 비용 × 놓친 사건
학습: 브라우저에서 바로(사전 학습 없음) · 직접 쓴 JavaScript(anomaly-core.js), 외부 라이브러리 없음
LLM 없음

합성 · 자체 생성 · 시드 7 · 10분 간격 21일(3,024점) · 기온(하루 사인 + 느린 날씨 무작위 걸음 + 잡음), strain = 120 + 8·(기온−15) + 6·교통 + 잡음 2, f₁ = 3.2·(1 − 0.002·(기온−15)) + 잡음 0.006 (모두 정한 값)
넣은 이상 5개(정한 값): 급변 +60 µε(4.30–4.33일), 센서 멈춤(6.0–6.5일), drift 0→+28 µε(9–11일), f₁ ×0.97(14–16.5일), 잡음 ×6(18–19일) · 이상 점 869개
실제 측정 데이터 아님. 숫자 모양은 교량 감시 문헌(Z24 등)의 경향을 흉내 낸 것
사용자 입력 저장 없음

측정 조건: 평가 3–21일, 시드 7, 화면 기본 설정 · 실행 20261025T163653Z
ROC AUC(무작위 0.5): z 원신호 0.742 · z 잔차 0.949 · EWMA 잔차 0.948 · CUSUM 잔차 0.558 · Isolation Forest 0.930 · 오토인코더 0.963
사건(5개) / 오경보 묶음: z 원신호 1/0 · z 잔차 5/10 · EWMA 5/12 · CUSUM 5/5 · Isolation Forest 5/13 · 오토인코더 5/18
학습 구간에 이상 3개가 섞이면(0–11일) 오토인코더 점 단위 재현율 96% → 41%
AUC·정밀도·재현율을 scikit-learn 1.9.1로 다시 계산해 소수 셋째 자리까지 같음
EWMA·CUSUM 정의, AUC(쌍 비교), 사건 평가는 손계산 예와 일치(tests/anomaly/core-test.mjs)
학습·평가 분리: 학습 모델은 학습 구간만으로 학습, 평가는 3–21일

Farrar, C.R., Worden, K. (2012). Structural Health Monitoring: A Machine Learning Perspective. Wiley.
Peeters, B., De Roeck, G. (2001). One-year monitoring of the Z24-Bridge: environmental effects versus damage events. Earthquake Engineering & Structural Dynamics 30(2).
Page, E.S. (1954). Continuous inspection schemes. Biometrika 41(1/2).
Roberts, S.W. (1959). Control chart tests based on geometric moving averages. Technometrics 1(3).
Liu, F.T., Ting, K.M., Zhou, Z.-H. (2008). Isolation Forest. IEEE ICDM.
Hinton, G.E., Salakhutdinov, R.R. (2006). Reducing the dimensionality of data with neural networks. Science 313(5786).
Lavin, A., Ahmad, S. (2015). Evaluating real-time anomaly detection algorithms — the Numenta Anomaly Benchmark. IEEE ICMLA.
Tatbul, N. et al. (2018). Precision and recall for time series. NeurIPS.

Rule-based simulation of sensor signals plus in-browser learning: statistical and learned detectors are applied and scored against the planted anomalies (ground truth)
4 tabs: Signals & Features / Statistical Methods / Learning-based Methods / Evaluation
Environmental removal: on the reference period (days 0–3), strain = a + b·temperature + c·traffic index and f₁ = a + b·temperature are fitted by least squares; residuals are used
Statistical: z-score (past window / fixed reference), EWMA (λ, limit = L·σ√(λ/(2−λ))), two-sided CUSUM (k, h). No reset after an alarm (chosen design)
Isolation Forest: 5 features (strain and f₁ residuals, temperature, 1-hour strain sd, step change; standardized on the reference period), 25–200 trees, sample 256, seed 3
Autoencoder: 1-hour window × 3 features (18 inputs) → tanh hidden 2–12 → 18, MSE, Adam lr 0.01, batch 32, 1,500 steps, seed 5. Score = reconstruction error, threshold = percentile of training scores
Frequency feature: 60 s of 50 Hz acceleration, Hann-window FFT peak with parabolic interpolation (1–6 Hz). The plot uses a 512-point Welch average
Evaluation: point-wise precision, recall, F1, rank-based ROC AUC, event-wise (an event is caught if any alarm falls inside it), detection delay, false-alarm episodes, cost = cost per false alarm × false alarms + cost per miss × missed events
Training: in the browser (no pretraining) · hand-written JavaScript (anomaly-core.js), no external libraries
No LLM

Synthetic · self-generated · seed 7 · 10-minute steps for 21 days (3,024 points) · temperature (daily sine + slow weather random walk + noise), strain = 120 + 8·(T−15) + 6·traffic + noise 2, f₁ = 3.2·(1 − 0.002·(T−15)) + noise 0.006 (all chosen values)
Five planted anomalies (chosen values): spike +60 µε (days 4.30–4.33), stuck sensor (6.0–6.5), drift 0→+28 µε (9–11), f₁ ×0.97 (14–16.5), noise ×6 (18–19) · 869 anomalous points
Not measured data. The shapes imitate trends reported in bridge monitoring (e.g. Z24)
User input stored: none

Conditions: scored on days 3–21, seed 7, default settings · run 20261025T163653Z
ROC AUC (random 0.5): z raw 0.742 · z residual 0.949 · EWMA residual 0.948 · CUSUM residual 0.558 · Isolation Forest 0.930 · autoencoder 0.963
Events caught (of 5) / false-alarm episodes: z raw 1/0 · z residual 5/10 · EWMA 5/12 · CUSUM 5/5 · Isolation Forest 5/13 · autoencoder 5/18
With 3 anomalies inside the training period (days 0–11), autoencoder point-wise recall drops from 96% to 41%
AUC, precision and recall recomputed with scikit-learn 1.9.1 agree to three decimals
EWMA and CUSUM definitions, pairwise AUC and event scoring match hand-worked examples (tests/anomaly/core-test.mjs)
Training and evaluation separated: learned models see only the training period; scores are reported on days 3–21

3 channels, 10-minute steps, 21 days, 5 anomaly types. Other real-world anomalies (other sensor faults, seasonal change, progressive damage) are not covered

Farrar, C.R., Worden, K. (2012). Structural Health Monitoring: A Machine Learning Perspective. Wiley.
Peeters, B., De Roeck, G. (2001). One-year monitoring of the Z24-Bridge: environmental effects versus damage events. Earthquake Engineering & Structural Dynamics 30(2).
Page, E.S. (1954). Continuous inspection schemes. Biometrika 41(1/2).
Roberts, S.W. (1959). Control chart tests based on geometric moving averages. Technometrics 1(3).
Liu, F.T., Ting, K.M., Zhou, Z.-H. (2008). Isolation Forest. IEEE ICDM.
Hinton, G.E., Salakhutdinov, R.R. (2006). Reducing the dimensionality of data with neural networks. Science 313(5786).
Lavin, A., Ahmad, S. (2015). Evaluating real-time anomaly detection algorithms — the Numenta Anomaly Benchmark. IEEE ICMLA.
Tatbul, N. et al. (2018). Precision and recall for time series. NeurIPS.