Model learning algorithms for anomaly detection in CERN control systems

The CERN automation infrastructure consists of over 600 heterogeneous industrial control systems with around 45 million deployed sensors, actuators and control objects. Therefore, it is evident that the monitoring of such huge system represents a challenging and complex task. This paper describes three different mathematical approaches that have been designed and developed to detect anomalies in any of the CERN control systems. Specifically, one of these algorithms is purely based on expert knowledge; the other two mine the historical generated data to create a simple model of the system; this model is then used to detect faulty sensors measurements. The presented methods can be categorized as dynamic unsupervised anomaly detection; “dynamic” since the behaviour of the system and the evolution of its attributes are observed and changing in time. They are “unsupervised” because we are trying to predict faulty events without examples in the data history. So, the described strategies involve monitoring the evolution of sensors values over time in the historical data. Indeed, consistent deviations from the historical evolutions can be seen as warning signs of a possible future anomaly; these warning signs have been used to trigger a generic anomaly alarm for the specific incoherent sensors, requiring further checks by system experts and operators. The paper also presents some results, obtained by the application of this analysis to the CERN Cryogenics systems. Finally, the paper briefly describes the deployment of Spark and Hadoop platform into the CERN industrial environment to deal with huge datasets and to spread the computational load of the analysis across multiple hosts.