Main Content

Deep Signal Anomaly Detector

Detect signal anomalies using deep learning network in Simulink

Since R2024a

expand all in page
  • Deep Signal Anomaly Detector icon

Libraries:
DSP System Toolbox / AI

Description

The Deep Signal Anomaly Detector block detects real-time signal anomalies in Simulink® using a trained long short-term memory (LSTM) autoencoder or a trained long short-term memory (LSTM) forecaster (since R2024b) deep learning network model.

You must first create and train a detector object in MATLAB® using the deepSignalAnomalyDetector function, and then configure the block to use this model in Simulink. To configure the block, specify the path to the detector model in the block dialog box. For more information on these steps, see User Workflow.

Note

This block additionally requires a Deep Learning Toolbox™ license.

Examples

expand all

This example uses:

Open Model

Use the Deep Signal Anomaly Detector block to detect anomalies in a sinusoidal signal. The block uses a detector that has been trained on a set of sinusoidal signals of constant frequency and amplitude. Use the time scope to plot the input, anomaly flag, and the window loss.

Open the detectAnomaliesSingleChannel.slx model. The input is a single-channel sinusoidal signal. The Deep Signal Anomaly Detector block reads the post-processing parameters from the detector MAT-file. As you can see in the Parameter values from MAT-file section in the block dialog box, the window length WL is 1 and the overlap length OL is 0. The hop size $WL - OL$ is 1. The threshold value is approximately 0.06.

Run the model. The first plot shows the delayed input signal. The delay value is equal to the number of samples the Deep Signal Anomaly Detector block outputs through the Delay port. To align the input with the anomaly flag and window loss, use a Delay block, set the Delay length parameter to Input, and provide the delay estimate as the delay input to the Delay block.

The second plot shows the anomalies in the signal. A value of 1 indicates the presence of an anomaly. The third plot shows the aggregate window loss.

When the window loss is greater than the threshold, the block flags the region as having an anomaly. In this case, since the window length is 1, the block detects point anomalies. The block turns on the anomaly flag for every sample where the window loss is greater than the threshold value. This makes the anomaly plot look very noisy.

Increasing Window Length

To make the anomaly plot look less noisy, increase the window length in the Deep Signal Anomaly Detector block to 40. To do that, set the Parameters for post-processing parameter to Specify on dialog. Set Window length to 40 and Overlap length to 39. Set the threshold to the default value obtained from the MAT-file.

Run the model. The anomaly plot looks much smoother. However, there are still some regions where the window loss value is low (around 0.1) and the block detects these regions as anomalies.

Increasing Threshold

To filter out anomalies that have a relatively lower window loss, increase the threshold value to 0.15. To be called an anomaly, the aggregate window loss must now be greater than 0.15. Increasing the threshold value removes the unintended anomaly detections and further smoothens the plot.

This example uses:

Open Model

Open the detectAnomaliesMultiChannel.slx model.

The input is a multichannel sinusoidal signal. If one of the channels has an anomaly, the Deep Signal Anomaly Detector block assumes the presence of the anomaly across all input channels and returns a scalar value at the Anomaly flag port. The block uses a window length WL of 40 and an overlap length OL of 39. The hop size $WL - OL$ is 1.

Run the model. The first plot shows the delayed input signal. The second plot shows the presence of an anomaly in the signal. The third plot shows the corresponding aggregate window loss.

Observe from the time scope that the presence of an anomaly is uniform across all channels and the block provides a single-channel output for the window loss and anomaly flag, corresponding to all the channels of the input.

The sample time of the input and output ports is the same. You can confirm this from the color of the signals in the model. The delay port always has a constant sample time.

Changing Hop Size

Change the hop size in the Deep Signal Anomaly Detector block and note the effect on the sample time of the output ports Anomaly flag and Window loss.

Decrease the overlap length to 30. The hop size is now 10. Run the model again. View the sample time of the two output ports in the timing legend. To view the timing legend, in the Debug tab of the Simulink model toolstrip, click Information Overlays > Timing Legend. The timing legend shows that the sample time of the output ports is 10 times the sample time of the input port. For every 10 input samples, the block produces 1 output sample. To change the sample time at the output port, adjust the hop size accordingly. For more information on sample time at the block ports, see Sample- and Frame-Based Concepts.

Since R2024b

This example uses:

Open Model

This example trains the LSTM forecaster network model and imports the model into a Deep Signal Anomaly Detector block. The Deep Signal Anomaly Detector block assumes that for multichannel inputs, the presence of anomaly is uniform across channels. To detect anomalies in multichannel signals where the presence of anomaly in each channel is uncorrelated, you can use a separate block for each channel of input. This example uses two such blocks to detect anomalies in the two channels of the input sinusoidal signal.

Train Model

Load the train and test data file sineWaveData.mat. The train data contains 40 single-channel sinusoidal signals of different frequencies with no noise. The test data contains two-channel sinusoidal signal with noise or anomaly. The presence of an anomaly is independent on both channels.

Train the deep signal anomaly detector model using the 'lstmforecaster' method. Export the saved detector model and parameters to the LSTMForecasterModel MAT file. This MAT file is provided with the example.

You can use this code to train the detector model using the train data.

load sineWaveData.mat
plot(dataTest);
anomalyDetector =  deepSignalAnomalyDetector(1,'lstmforecaster',WindowLength=10);
opts = trainingOptions("adam",MaxEpochs=300);
trainDetector(anomalyDetector,dataTrain,opts)
saveModel(anomalyDetector,'LSTMForecasterModel');

Open and Run Model

Open the detectIndependentAnomalies Simulink model. The two Deep Signal Anomaly Detector blocks in the model import the LSTMForecasterModel MAT file. The blocks also import post-processing parameters such as the window length, overlap length, threshold, and window loss aggregation from the MAT file. The input to the model is the test data which contains independent anomalies on both its channels.

Run the detectIndependentAnomalies Simulink model. The two Deep Signal Anomaly Detector blocks detect anomalies in the two input channels separately and return a scalar value at the Anomaly flag port. The first plot shows the two channels of the sinusoidal signal with the anomalies. The second plot shows the output of the Anomaly flag port. As you can see, the LSTM forecaster model accurately detects the presence of an anomaly on both the channels.

Extended Examples

Fault Detection and Localization in Three-Phase Power Transmission Using Deep Signal Anomaly Detector in Simulink

Fault Detection and Localization in Three-Phase Power Transmission Using Deep Signal Anomaly Detector in Simulink

Detect faults in three-phase power transmission using the Deep Signal Anomaly Detector block.

Detect Anomalies in ECG Data Using Wavelet Scattering and LSTM Autoencoder in Simulink

Detect Anomalies in ECG Data Using Wavelet Scattering and LSTM Autoencoder in Simulink

Use wavelet scattering and deep learning network to detect anomalies in ECG signals.

New
Real-Time Noise Detection on Raspberry Pi Using Deep Signal Anomaly Detector

Real-Time Noise Detection on Raspberry Pi Using Deep Signal Anomaly Detector

Detect the presence of noise on a Raspberry Pi device.

Ports

Input

expand all

Specify the input signal through this port as a vector or a matrix.

When the input has multiple channels, the block assumes that the presence of an anomaly is uniform across all input channels and generates a single-channel output for anomaly detection.

This port is unnamed until you enable the Threshold port.

Data Types: single | double

Specify the detection threshold value as a nonnegative scalar. The block uses this value as the threshold for the window loss to detect anomalies.

Dependencies

To enable this port, set:

  • Parameters for post-processing to Specify on dialog.

  • Threshold source to Input port.

Data Types: single | double

Output

expand all

Anomaly flag, returned as a logical scalar:

  • 1 –– Anomaly is present in the input data.

  • 0 –– No anomaly is present in the input data.

When the input has multiple channels, the block assumes that the presence of an anomaly is uniform across all input channels, and generates a single-channel output for the anomaly detection.

The sample time at this port equals Ts × HS, where Ts is the sample time (or the sample period) at the input port, and HS is the hop size between adjacent windows. Hop size equals WL − OL, where WL is the window length and OL is the overlap length. For more information on block samples times, see Sample- and Frame-Based Concepts.

Data Types: Boolean

Aggregate window loss, returned as a scalar. The block computes this value using the Window length, Overlap length, and Window loss aggregation parameters.

The block uses the aggregate window loss to detect the anomalies. For more information, see Algorithms.

The sample time at this port equals Ts × HS, where Ts is the sample time (or the sample period) at the input port and HS is the hop size between adjacent windows. Hop size equals WL − OL, where WL is the window length and OL is the overlap length. For more information on block samples times, see Sample- and Frame-Based Concepts.

Data Types: single

Estimate of the delay between the input and output signals in samples, returned as a scalar. To align the input data with the anomaly flag and window loss, apply this delay estimate to the input before further processing. For an example, see Detect Anomalies in Sinusoidal Signal.

The output at this port is always a scalar and the sample time of this port is always constant.

Dependencies

To enable this port, select the Enable delay port check box in the block dialog box.

Data Types: single

Parameters

expand all

To edit block parameters interactively, use the Property Inspector. From the Simulink Toolstrip, on the Simulation tab, in the Prepare gallery, select Property Inspector.

Specify the path to the MAT-file that you generated using the saveModel function. This MAT-file contains the trained LSTM autoencoder or LSTM forecaster deep learning network model and parameters used for post-processing such as the window length, overlap length, detection threshold, and window loss aggregation.

Specify the source for the post-processing parameters as one of these:

  • Read from MAT-file –– The block uses the default parameters read from the MAT-file.

  • Specify on dialog –– Specify the parameters in the block dialog box.

The goal of post-processing is to detect the signal anomalies and determine the window loss that is a measure of how well the block reconstructs the data.

Specify the window length WL the block uses in post-processing as a positive integer. By default, the block uses a window length of one sample and an overlap length of zero samples between adjoining windows. This setting detects point anomalies. Increase the window length to aggregate the window loss over a larger range of the signal.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Specify the overlap length OL between adjoining windows as a nonnegative integer. The block obtains one detection per input sample when OL is WL − 1, that is, a hop size of 1 sample. Hop size is the difference between the window length and overlap length, WL − OL. If you want to downsample the output by a factor of the hop size HS, set OL to WL − HS.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Specify the source of detection threshold as one of these:

  • Dialog –– Specify the threshold value in the block dialog box using the Threshold parameter.

  • Input port –– Specify the threshold value through the Threshold input port.

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

Specify the detection threshold value as a nonnegative scalar. The block computes the loss for each window based on the statistic method you specify in the Window loss aggregation parameter. To set the anomaly flag, the block compares the aggregate window loss to the threshold value you specify in this parameter. If the window loss is greater than the threshold value, the block sets the anomaly flag to 1 and sets it to 0 otherwise. A lower threshold value results in the block classifying more samples as anomalies. Adjust the threshold value based on the window loss observed in anomalous and non-anomalous regions.

Tunable: Yes

Dependencies

To enable this parameter, set:

  • Parameters for post-processing to Specify on dialog.

  • Threshold source to Dialog.

Specify the statistic method the block uses to aggregate the sample loss in each window segment as one of these:

  • Mean

  • Max

  • Min

  • Median

Dependencies

To enable this parameter, set Parameters for post-processing to Specify on dialog.

This parameter is read-only.

Display the post-processing parameter values the block reads from the MAT-File. The display parameters are:

  • Window length

  • Overlap length

  • Threshold

  • Window loss aggregation

Use these values as a baseline if you want to adjust the post-processing parameters by setting Parameters for post-processing to Specify on dialog.

Dependencies

To enable this parameter, set Parameters for post-processing to Read from MAT-file.

Select this check box to enable the Delay output port. The block outputs the estimated delay in samples between the input and the reconstructed signals through this port.

Block Characteristics

Data Types

double | single

Direct Feedthrough

no

Multidimensional Signals

no

Variable-Size Signals

no

Zero-Crossing Detection

no

More About

expand all

Algorithms

expand all

The Deep Signal Anomaly Detector block first buffers the input into frames and then tries to reconstruct the buffered signal using the trained network. The block processes the difference between the input and the reconstructed frames to obtain the window loss and anomaly flags. The block can also output an estimate of the delay (in samples) the input signal goes through as the trained network reconstructs this signal. For the LSTM Forecaster model, the block omits the buffering of the input signal, thereby reducing the delay added to the input signal. (since R2024b)

Input signal feeding into a buffer block. Buffered signal goes into trained network. Difference block computes the difference between the input and the reconstructed signal. This signal now goes into post processing block which detects the signal anomalies and window loss. Third branch estimates the delay incurred by the input signal.

Extended Capabilities

Version History

Introduced in R2024a

expand all

See Also

Functions

Objects