Alert similarity and label transfer

A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device, the method comprising:

• obtaining feature data including time series data for multiple sensor devices associated with the device;
• processing a portion of the feature data that is within a temporal window associated with the alert to generate feature importance data for the alert, the feature importance data including values indicating relative importance of each of the sensor devices to generation of the alert;
• ranking the sensor devices according to the relative importance of each of the sensor devices to generation of the alert;
• determining, for each of multiple historical alerts, a similarity value for that historical alert indicating how closely a list of highest-ranked sensor devices for that historical alert matches a list of highest-ranked sensor devices for the alert;
• and
• identifying one or more of the historical alerts that are most similar to the alert based on the determined similarity values.

A system to identify a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device, the system comprising:

• a memory including stored feature importance data for historical alerts;
• and
• one or more processors coupled to the memory, the one or more processors configured to:
• obtain feature data including time series data for multiple sensor devices associated with the device;
• obtain an alert indicator for the alert;
• process a portion of the feature data that is within a temporal window associated with the alert to generate feature importance data for the alert, the feature importance data including values indicating relative importance of each of the sensor devices to the alert;
• and
• identify one or more of the historical alerts that are most similar, based on the feature importance data and the stored feature importance data, to the alert.