Sensor attribution for anomaly detection

A method of detecting and correcting anomalies, comprising:

• generating historical binary codes from a plurality of historical time series segments, the plurality of historical time series segments each being made up of measurements from respective sensors;
• generating a latest binary code from a latest time series segment;
• determining that the latest time series segment represents anomalous behavior, based on a comparison of the latest binary code to the historical binary codes, including:
• grouping the historical time series segments in buckets according to prefixes of the historical binary codes;
• and
• determining exemplars of the buckets for only those buckets which have an above-threshold percentage of the plurality of historical time series segments, wherein the comparison of the latest binary code to the historical binary codes includes comparing the latest binary code to binary codes of the exemplars;
• ranking the sensors, based on a comparison of measured values of the sensors in the latest time series segment to respective time series data of the plurality of historical time series, comparing the latest time series segment to each of the exemplars, to generate a sensor ranking;
• and
• performing a corrective action responsive to the detected anomaly, prioritized according to the sensor ranking.

A system for detecting and correcting anomalies, comprising:

• a hardware processor;
• and
• a memory that stores computer program code, which, when executed by the hardware processor, causes the hardware processor to:
• generate historical binary codes from a plurality of historical time series segments, the plurality of historical time series segments each being made up of measurements from respective sensors;
• generate a latest binary code from a latest time series segment;
• determine that the latest time series segment represents anomalous behavior, based on a comparison of the latest binary code to the historical binary codes, including:
• a grouping of the historical time series segments in buckets;
• and
• a determination of exemplars of the buckets as time series segments that are nearest to a centroid of the historical time series grouped into a respective bucket, wherein the comparison of the latest binary code to the historical binary codes includes a comparison of the latest binary code to binary codes of the exemplars;
• rank the sensors, based on a comparison of time series data of the sensors in the latest time series segment to respective time series data of the plurality of historical time series, to generate a sensor ranking;
• and
• perform a corrective action responsive to the detected anomaly, prioritized according to the sensor ranking.