System, device and method of detecting abnormal datapoints

A computing device for detecting at least one abnormal datapoint in operation data associated with an industrial environment, wherein the operation data comprises historical data and streaming data corresponding to operation of industrial assets in the industrial environment, the computing device comprising:

• a processing unit;
• and
• an anomaly module executable by the processing unit comprising computer-readable instructions when executed by the processing unit is configured to:
• apply one or more anomaly detection models to at least one subset of the operation data, wherein the anomaly detection models are trained based on a training dataset consisting of datapoints labeled as normal;
• classify subset-datapoints in the subset as one of normal datapoints and abnormal datapoints using the anomaly detection models;
• determine a confidence index in the classification of the subset-datapoints based on at least one of an engineering software input and operation of a comparable industrial environment;
• re-classify the subset-datapoints when a confidence threshold is not satisfied;
• update the training dataset with the confidence index and the re-classified datapoints;
• update the training dataset with the normal datapoints;
• retrain the anomaly detection models with the updated training dataset after expiration of a threshold time, wherein the threshold time is based on a number of updates to the training dataset;
• detect the at least one abnormal datapoint in the operation data using the anomaly detection models;
• remove the subset from the operation data;
• detect the at least one abnormal datapoint in remainder operation data without the subset using the retrained anomaly detection models;
• apply the retrained anomaly detection models to a new subset of the operation data and classifying new-datapoints in the new subset as one of the normal datapoints and the abnormal datapoints;
• and
• update the training dataset and retraining the retrained anomaly detection models.

A non-transitory computer readable medium, having machine-readable instructions stored therein for detecting at least one abnormal datapoint in operation data associated with an industrial environment, wherein the operation data comprises historical data and streaming data corresponding to operation of industrial assets in the industrial environment, wherein the machine-readable instructions when executed by a processor cause the processor to apply one or more anomaly detection models to at least one subset of the operation data, wherein the anomaly detection models are trained based on a training dataset consisting of datapoints labeled as normal;

• classify subset-datapoints in the subset as one of normal datapoints and abnormal datapoints using the anomaly detection models;
• determine a confidence index in the classification of the subset-datapoints based on at least one of an engineering software input and operation of a comparable industrial environment;
• re-classify the subset-datapoints when a confidence threshold is not satisfied;
• update the training dataset with the confidence index and the re-classified datapoints;
• update the training dataset with the normal datapoints;
• retrain the anomaly detection models with the updated training dataset after expiration of a threshold time, wherein the threshold time is based on a number of updates to the training dataset;
• detect the at least one abnormal datapoint in the operation data using the anomaly detection models;
• remove the subset from the operation data;
• detect the at least one abnormal datapoint in remainder operation data without the subset using the retrained anomaly detection models;
• apply the retrained anomaly detection models to a new subset of the operation data and classifying new-datapoints in the new subset as one of the normal datapoints and the abnormal datapoints;
• and
• update the training dataset and retraining the retrained anomaly detection models.