Available online at www.sciencedirect.

com

ScienceDirect
Anomaly Detection
IFAC PapersOnLine 55-10 Method of Aircraft System
(2022) 1582–1587
using Multivariate Time Series Clusteringofand
Anomaly Detection Method Aircraft System Techniques
Classification
using Multivariate
AnomalyTime Series Clustering and Classification Techniques
Anomaly Detection
Detection MethodMethod of of Aircraft
Aircraft System
System
using
using Multivariate
Multivariate Time
Time Series
Series Clustering
Clustering and and Classification
Classification Techniques
Techniques
Mohamed Ben Slimene & Mohamed-Salah Ouali *
Mohamed Ben
Mohamed Ben Slimene
Slimene & & Mohamed-Salah
Mohamed-Salah Ouali Ouali * *
Polytechnique Montreal, Montreal (QC), Canada, H3C3A7
(Phone: 514 4304711 Mohamed
Polytechnique
#5929; e-mail:
Polytechnique Ben Slimene
Montreal, & Mohamed-Salah
Montreal (QC), Canada,
Mohamed.ben-slimene@polymtl.ca,
Montreal, Montreal (QC), Canada, Ouali
H3C3A7
H3C3A7 *msouali@polymtl.ca).
Mohamed Ben Slimene & Mohamed-Salah Ouali *
(Phone: 514
(Phone: 514 4304711
*Member
4304711 #5929;
of #5929;
CIRRELT e-mail:
e-mail: Mohamed.ben-slimene@polymtl.ca,
(https://www.cirrelt.ca) and IVADO (https://ivado.ca)
Mohamed.ben-slimene@polymtl.ca, msouali@polymtl.ca).
msouali@polymtl.ca).
Polytechnique Montreal, Montreal (QC), Canada, H3C3A7
*MemberPolytechnique
*Member of CIRRELT
of CIRRELT (https://www.cirrelt.ca)
(https://www.cirrelt.ca)
Montreal, Montreal (QC), andCanada,
and IVADO H3C3A7
IVADO (https://ivado.ca)
(https://ivado.ca)
(Phone: 514 4304711 #5929; e-mail: Mohamed.ben-slimene@polymtl.ca, msouali@polymtl.ca).
(Phone: 514 4304711 #5929; e-mail: Mohamed.ben-slimene@polymtl.ca, msouali@polymtl.ca).
*Member of CIRRELT (https://www.cirrelt.ca) and IVADO (https://ivado.ca)
Abstract: *Member of CIRRELT (https://www.cirrelt.ca) and IVADO (https://ivado.ca)
Abstract:
Abstract:
The paper presents an anomaly detection method that identifies and explains anomalies in an aircraft system
Abstract:
Abstract:
The
The paper
based presents
presents an
on explainable
paper anomaly
anomaly detection
an multivariate time series
detection method
method that
that identifies
clustering and
and explains
techniques.
identifies The method
explains anomalies
considers
anomalies in
in an
anthe aircraft system
cyclicity
aircraft system of
based
each
based on
on explainable
variable within the
explainable multivariate
multivariate time
flight phases
time series
and
series clustering
selects thosetechniques.
clustering behind theThe
techniques. method
anomalies.
The method considers
It combines
considers the
the thecyclicity
Density-
cyclicity of
of
The paper presents an anomaly detection method that identifies and explains anomalies in an aircraft system
each
The
Based
each variable
paper
Spatial
variable within
presents an the
Clustering
within the flight
anomaly
of phases
detection
Applications
flight phases and
and selects
method
with thatthose
Noise
selects behind
identifies
(DBSCAN)
those behind andthe and
the anomalies.
explains
a modified
anomalies. It
anomalies
It combines
Dynamic in an Time
combines the
aircraft
the Density-
system
Warping
Density-
based on explainable multivariate time series clustering techniques. The method considers the cyclicity of
Based
based on
(DTW)
Based Spatial
distance
Spatial Clustering
explainablealgorithms
Clustering oftoApplications
multivariatedetecttime abnormal with
series Noise
clustering
behavioral(DBSCAN)
techniques. and
andThe
profiles within aa modified
method
the Dynamic
considers
collected flight the Time
phases Warping
cyclicity
without of
each variable within the of Applications
flight phases and with Noisethose
selects (DBSCAN)
behind the modified
anomalies. ItDynamic
combines Time
the Warping
Density-
(DTW)
each
any prior
(DTW)Spatial distance
variableknowledge
distance algorithms
within the
algorithmson theto
flightdetect
phases
system’s abnormal
and
behavior. behavioral
selects those
The profiles
behind
proposed within
the
method the
anomalies. collected
explains It flight
combines
those phases
abnormal the without
Density-
profiles
Based Clustering of to detect abnormal
Applications with behavioral
Noise (DBSCAN) profiles within the collected
and a modified flight phases
Dynamic Time Warpingwithout
any
any prior
Based
comparedprior knowledge
Spatial Clustering
to normal
knowledge on
on ofthe
profiles
thetosystem’s
Applications
using a new
system’s behavior.
with Noise
importance
behavior. The proposed
The(DBSCAN) method
score. Profiles
proposed and aare explains
modified
detected those
usingabnormal
Dynamic theTime Time profiles
Warping
Series
(DTW) distance algorithms detect abnormal behavioral profilesmethodwithin the explains
collected those flightabnormal profiles
phases without
compared
(DTW)
Forest
compared (TSF) to
distance
to normal
and
normal theprofiles
algorithms to using
detect
silhouette
profiles using aaabnormal
criterion.new
new importance
Thebehavioral
method
importance score. Profiles
profiles
is trained
score. Profileswithinandare
arethe detected
collected
tested
detected using using
flight
using the
a samplephases
the Time
Time from Series
without
the
Series
any prior knowledge on the system’s behavior. The proposed method explains those abnormal profiles
Forest
any
Bombardier’s
Forest (TSF)
prior
(TSF) and
knowledge
Aircraft
and the
the onsilhouette
the system’s
Health criterion.
Monitoring
silhouette criterion. The
behavior.
System.
The method
The is
proposedtrained
It distinguishes
method is trainedmethodtheand
and tested
explains
normal
tested using
and those
using aa abnormal
abnormal sample
sample from
behaviors the
profiles
from by
the
compared to normal profiles using a new importance score. Profiles are detected using the Time Series
Bombardier’s
compared
achieving
Bombardier’s Aircraft
atoclustering
normal
Aircraft Health
profiles
silhouette
Health Monitoring
using
score
Monitoring a new System.
importance
of 0.95 It distinguishes
and detects
System. It score. Profiles
unknown
distinguishes the normal
are
profiles
the normal detected
withand
and a abnormal
using theof
precision
abnormal behaviors
Time
89%.Series
behaviors by
by
Forest (TSF) and the silhouette criterion. The method is trained and tested using a sample from the
achieving
Forest
achieving
Keywords: (TSF)
Copyright © 2022a
a clustering
and
clustering
Aircraft the silhouette
silhouette
silhouette
Health
The Authors. score
criterion.
score
Monitoring
This is of
of
an 0.95
0.95
System, The
open and
and detects
method
detects
Anomaly
access unknown
is trained
unknown
detection,
article under the profiles
and
profiles tested
Clustering,
CC with
with
BY-NC-ND a
using
a precision
a
precision
machine licensesample of
of
learning. 89%.
from
89%. the
Bombardier’s Aircraft Health Monitoring System. It distinguishes the normal and abnormal behaviors by
Bombardier’s Aircraft Health Monitoring System. It distinguishes the normal and abnormal behaviors by
Keywords:
Keywords:
achieving aAircraft
(https://creativecommons.org
Aircraft
clustering Health
Health Monitoring
Monitoring
silhouette score of System,
/licenses/by-nc-nd/4.0/)
System,
0.95 and Anomaly
detectsdetection,
Anomaly unknown Clustering,
detection, profiles withmachine
Clustering, machine
a precision learning.
learning.
of 89%.
achieving a clustering silhouette score of 0.95 and detects unknown profiles with a precision of 89%.
Keywords: Aircraft Health Monitoring System, Anomaly detection, Clustering, machine learning.
Keywords: Aircraft Health Monitoring System, Anomaly detection,
abnormal Clustering,
patterns withinmachine
a multivariate learning. time series data (i.e.,
1. INTRODUCTION abnormal patterns within a multivariate time
element). Deep learning
abnormal patterns within a multivariate time architectures whereserieswidely
series data (i.e.,
data used.
(i.e.,
1.
1. INTRODUCTION
INTRODUCTION
Aircraft operation can be improved by analyzing the detailed LSTM element).
element). Deep
Recurrent
Deep learning
Neural
learning architectures
Network
architectures (RNN) where
where waswidely
trained
widely used.
used.by
abnormal patterns within a multivariate time series data (i.e.,
Aircraft
flight
Aircraftdataoperation
recorded
operation can
can be
1.during
be improved
INTRODUCTION
daily flights
improved by
by analyzing
(Dani etthe
analyzing the 2015). LSTM
al.,detailed
detailed abnormal
(Nanduri
LSTM Recurrent
patterns
and
Recurrent Sherry, Neural
within
2016)
Neural a Network
to predict (RNN)
multivariate
Network
element). Deep learning architectures where widely used.
time was
a multivariate
(RNN) seriestrained
was parameter
trained by
data (i.e.,
by
1. INTRODUCTION
flight
Signals
flight data
data recorded
generated
recorded byduring
sensors
during daily
daily flights
installed
flights (Dani
on some
(Dani et
et al.,
al., 2015).
aircraft
2015). (Nanduri
element).
time series
(Nanduri and
andDeep
forSherry,
learning
normal
Sherry, 2016)
2016) to
operation
to predict
architectures
predict data.aa multivariate
where widely
Abnormal
multivariate parameter
eventsused.
parameter are
Aircraft operation can be improved by analyzing the detailed LSTM time
Recurrent Neural Network (RNN) was trained by
Signals
Aircraft
components
Signalsdata
flight
generated
operation
allow can
generated
recorded by
by fill
to besensors
in an installed
improved
sensors
during
Aircraft
dailyinstalled
on
on some
by analyzing
Health
flights (Dani somethe aircraft LSTM
detailed
Monitoring
et al., aircraft time series
detected
2015). (Nanduri
Recurrent
series when
andfor
for normal
theNeural
normal
Sherry,
operation
predictionNetwork
operation
2016) to predict
data.
error
data.(RNN) Abnormal
reaches
Abnormal
a multivariate
events
wasa trained
predefined
events
parameter
are
by
are
components
flight
System data
components (AHMS) allow
recorded
allow to fill
during
database
to fill in
that
in an
daily
an Aircraft
can flights
register
Aircraft Health
(Danimany
Health etMonitoring
al.,
indicators
Monitoring detected
2015). (Nanduri
threshold.
detected when
and
Deep
when the
Sherry,
learning
the prediction
2016) to predict
models
prediction error
error reaches
needa amultivariate
consistent
reaches aa predefined
parameter
amount
predefined of
Signals generated by sensors installed on some aircraft threshold. time series for normal operation data. Abnormal events are
System
Signals (AHMS)
generated
and operation
System (AHMS) cycles database
by
oversensors
database that
time.
that can
Most
can register
installed
commonly,
register onmany
many data takes time
the indicators
some aircraft
indicators data series
to
threshold. train Deep
Deep learning
forannormal
Artificial
learning models
Neuralneed
operation
models data.
Network
need aa Abnormal
consistent
consistent amount
(ANN)events for time
amount of
are
of
components allow to fill in an Aircraft Health Monitoring data detected when the prediction error reaches a predefined
and
the operation
components
and form of allow
operation cycles
a time
cycles toover
filltime.
series
over time. Most
in that
an
Most commonly,
Aircraft
representsHealth
commonly, a the
the data takes
Monitoring
sequence
data takes seriesto
detected
of threshold.
data to trainwhen
reconstruction,
train an
an Artificial
the prediction
Artificial Neural
prediction,
Neural orNetwork
error reaches (ANN)
classification.
Network (ANN) for
a predefined time
Knowing
for time
System (AHMS) database that can register many indicators series reconstruction, Deep learning models need a consistent amount of
the
Systemform of
form(AHMS)
continuous aa time
values takenseries
database thatcanrepresents
that
at successive register
equally many aa sequence
spaced points of
indicators in datathreshold.
that
seriesflights Deep learning
with anomalies prediction,
models
in theirneed or classification.
data a rare
is consistent
and is not Knowing
amount
always of
the operation
and of time
cycles series
over time.thatMostrepresents
commonly, sequence
the data takes of toreconstruction,
train an Artificial prediction,
Neural orNetwork classification.
(ANN) Knowing
for time
continuous
and
time operation
(fixed
continuous values
cycles taken
frequency)
values over at
takenseries successive
time. Most
(Brockwell
at successive equally
commonly,
and spaced
Davis,
equally spaced the points
data
2009).takes
points ofin
A that
data flights
to
available, train
that flights
in series with
which an anomalies
Artificial
leads
with anomalies to in
search their
Neural for
in their data data is
Network
abnormal rare and
(ANN)
events
is rare and is notis not
or always
for time
hidden
always
the form of a time that represents a sequence reconstruction, prediction, or classification. Knowing
time
the (fixed
form
multivariate
time (fixed frequency)
of time
a time series
frequency) (Brockwell
series
data that
includes
(Brockwell and
represents Davis,
different
and a sequence
Davis, 2009).
patterns
2009). A
of
that
A available,
patterns
available, which
series reconstruction,
among
which leads
normal
leads to
to search
prediction,
ones
search with for
for orabnormal
high accuracy.
abnormal events
classification.
eventsTo ormeet
or hidden
Knowing this
hidden
that flights
continuous values taken at successive equally spaced points in patterns among normal ones with high accuracy. To meet with anomalies in their data is rare and is not always
multivariate
continuous
reflect time
values
different
multivariate time series
taken
phenomena
series atdata
data includes
successive
occurring
includes different
equally
during
differentaspaced patterns
flight points that
session.
patterns that that flights
in challenge,
patterns among with
(Xiong anomalies
normal et al.,ones in2018)
their data
with usedisaccuracy.
high rare transfer
the and is To not this
always
learning
meet this
time (fixed frequency) (Brockwell and Davis, 2009). A challenge, available, which leads to search for abnormal events or hidden
reflect
time
reflect different
(fixed
different phenomena
frequency)
phenomena occurring
(Brockwell
occurring during aa flight
and Davis,
during flight session.
2009).
session. A available,
method
challenge, (Xiong
towhichtrain leads
(Xiong a et
etRNN al.,
to
al., 2018)
search
in
2018) forused
order abnormal
used the
to predict
the transfer
events
the or
transfer learning
hidden
vibration
learning
multivariate time series
Detecting anomalies datathe
within includes different
multivariate timepatterns patterns among normal ones with high accuracy. To meet this
that method
series data
multivariate time series data includes different patterns that patterns
method among
acceleration to train
during
to (Xiong
train aa RNN
normal the ones inwith
aircraft’sorder high to
landing predict
phase.the
to accuracy. ToThe vibration
meetLSTMthis
reflect
Detecting
allows
Detecting different
anomalies
alerting phenomena
experts
anomalies within
when
within occurring
the
the during
multivariate
symptoms of
multivariate a atime flight
potential
time session.
series data
incident
series data challenge, etRNN al., in 2018)order used predict
the transferthe vibration
learning
reflect different phenomena occurring during a flight session. acceleration
challenge,
autoencoder
acceleration during
(Xiong
(AE) isthe
during etthe aircraft’s
al., 2018)
oneaircraft’s
of the most landing
used
landing the phase.
efficienttransfer
phase. The LSTM
learning
unsupervised
The LSTM
allows
begin
allows toalerting
appear.experts
alerting Commonly
experts when symptoms
whenapplied
symptoms of
of aa potential
methods in the aeronautic
potential incident
incident method to train a RNN in order to predict the vibration
Detecting anomalies within the multivariate time series data autoencoder
method
learning
autoencoder
acceleration
to (AE)
(AE)ais
train
techniques
during isRNNone
used of
in the
oneaircraft’s
the of order
time
the most
most to efficient
series
landing
predict
anomaly
efficient unsupervised
the vibration
detection.
phase.unsupervised
The LSTM
begin
industry
begin to
Detecting
to appear.
anomaliesCommonly
use an Commonly
appear. within
expertise-based applied
the
applied methods
multivariate
approach
methods in
time
called
in the
the aeronautic
series
exceedancedata
aeronautic learning
acceleration
(Yan et techniques
al., during
2021) used
the
learn in
from time
aircraft’s an series
landing
AE on anomaly
phase.
nominal Thedetection.
LSTM
time-series
allows alerting experts when symptoms of a potential incident autoencoder learning techniques (AE) is used one of in the
timemost series anomaly
efficient detection.
unsupervised
industry
allows
detection
industry use
alerting
(Lee
use an
an etexpertise-based
experts
al., when
2020).symptoms
expertise-based approach
These of acalled
methods
approach called areexceedance
potential incident
based
exceedance on (Yansamples et
autoencoder al., 2021)
(AE)
corresponding learn
is oneto from
of
the thean
healthy AE
most on nominal
efficient
behavior of time-series
unsupervised
an aircraft’s
begin to appear. Commonly applied methods in the aeronautic learning (Yan et al., 2021) learn
techniques usedfrom in timean AE on nominal
series anomalytime-series
detection.
detection
predefined
detection (Lee
begin to appear. expert
(Lee et al.,
Commonly 2020).
rules These
applied
which methods
methods
detect in the
abnormal are based
aeronautic
system on
industry use an etexpertise-based
al., 2020). These methods
approach called areexceedance
based on samples
hydrauliccorresponding
learning
samples
(Yan et
techniques
system to build
corresponding
al., 2021)
used
learn
to the
tofromin healthy
time series
a reconstruction
the healthy
an AE
behavior
behavior
on
anomalyof
of an
model.
nominal an aircraft’s
detection.
Abnormal
aircraft’s
time-series
predefined
industry use
behaviors
predefined expert
during
expert rules
an expertise-based
different
rules which
flight
which detect
approach
phases.
detect abnormal
called
Hence,
abnormal anomalies system
exceedance
systemare (Yanhydraulic
landing et system
al.,
events 2021) areto build
learn a
from
detected reconstruction
an
when AE theon model.
nominal
reconstruction Abnormal
time-series
error
hydraulic system
detection (Lee et al., 2020). These methods are based on samples corresponding to the healthy behavior of an aircraft’s to build a reconstruction model. Abnormal
behaviors
detection
detected
behaviorswhen during
during etdifferent
(Leeobservations
al., 2020).
different flight phases.
These
exceed Hence,limits
methods
predefined anomalies
are based are
or satisfyon samples
predefined expert rules flight
whichphases. detectHence,
abnormal anomalies systemare landing
exceeds
landing events
acorresponding are
fixed threshold.
events are detected
detected when
to the healthy
when
hydraulic system to build a reconstruction model. Abnormal
the
the reconstruction
behavior error
of an aircraft’s
reconstruction error
detected
predefined
some
detected when
conditions.
when observations
expert These
observations exceed
rules methods
which
exceed predefined
detect limitsphysically
abnormal
are simple,
predefined or satisfy
orsystem
behaviors during different flight phases. Hence,limits anomalies satisfy
are exceeds
hydraulic
exceeds aa fixed
systemthreshold.
fixed to build a reconstruction model. Abnormal
threshold.
some
some conditions.
behaviors
interpretable during
conditions. These
anddifferent
represent
These methods
flight the
methods phases.are simple,
areHence,
most trusted
simple, physically
anomalies
approach. are landing
Supervised eventslearning are techniques
detected when were used the reconstruction
to build an anomaly error
detected when observations exceed predefined limitsphysically landing
or satisfy Supervised
exceeds a
events
fixed
learning
are detected when
threshold.
techniques were
the reconstruction
used to build an
error
anomaly
interpretable
detected
However, when
interpretable and
the performance
and represent
observations
represent of the
exceed
these
the most
predefined
methods
most trusted
depends
trusted approach.
limitsapproach.
orstrongly
satisfy exceeds
detection
Supervised a flowchart
learning
fixed based on prediction
techniques
threshold. were used error.
to (Boulfani
build an et al.,
anomaly
some conditions. These methods are simple, physically detection flowchart based on prediction error. (Boulfani et al.,
However,
some
on the rule’s the performance
conditions.
thedesign These
(Nanduri of these
methods
and methods
are 2016).
Sherry, depends
simple, strongly
physically
According 2020)
to Supervised
detection benchmarked
flowchart several machine error. learning methods to
However,
interpretable performance
and represent of these
the methods depends
most trusted strongly
approach. learning based on prediction
techniques were used to build (Boulfani et al.,
an anomaly
on the
(Dani rule’s
interpretable
et
on the rule’sal., design
and
2015), (Nanduri
represent
exceedance and
the Sherry,
most
detection 2016).
trusted
allows According
approach.
experts to 2020)
Supervised
predict benchmarked
oil
2020) benchmarked learning
temperature several
techniques
of an
several machine
were
aircraft used learning
electrical
machine error. to build
learning methods
an
generator. anomaly
methods Theyto
to
However, thedesign (Nanduri
performance of and
theseSherry,
methods 2016).
depends According
strongly to detection
predict oil
flowchart based
temperature of
on prediction
an
(Boulfani et al.,
(Dani
However,
only
(Dani et al.,
analyze
et al., 2015),
theandperformance
2015), exceedance
prevent of these
faults
exceedance thatdetection
already allows
methods
detection depends
occurred.
allows experts
strongly
experts to
to detection
compared
predict oil flowchart
the accuracy
temperature basedof onaircraft
of
an aprediction electrical
multi-layer
aircraft error.
electrical generator.
(Boulfanineural
perceptron
generator. They
et al.,
They
on the rule’s design (Nanduri and Sherry, 2016). According to compared 2020) benchmarked several machine learning methods to
only
on theanalyze and
rule’s design prevent
(Nanduri faults andthat already
Sherry, occurred.
2016). According to network, 2020) benchmarked
compared the
the accuracy
ridge regression
accuracy of aaand
several multi-layer
machine random perceptron
learning
forest methods
usingneuralto
the
only
(Dani analyze
Recently,et al., and
2015),
supervised
prevent faults
exceedance
and
that already
detection
unsupervised
occurred.
allows
Machine experts
Learning predict
to network, oil temperature of of multi-layer
an aircraft electrical perceptron
generator.neuralThey
(Dani et al., 2015), exceedance detection allows experts to predict prediction
network, oil ridge of theregression
temperature
ridge mean
regression of ansquareand
aircraft
and random
electrical
error
random forest
(MSE).
forest using
generator.
The
using the
They
most
the
only
(ML) analyze
Recently,
methods
Recently, and areprevent
supervised
supervised usedand tofaults
and detect that
unsupervised
and
unsupervised already
discoveroccurred.
Machine
Machine known Learning compared the accuracy of a multi-layer perceptron neural
or new promising
Learning
only analyze and prevent faults that already occurred. prediction
compared
prediction ridge of
the
method the
of accuracy inmean
theregressionterms
mean ofsquare
square error
aof multi-layer
anomaly (MSE).
perceptron
error detection
(MSE). The most
neural
efficiency
(ML)
(ML) methods
methods are
are used
usedand to
to detect
detect and
and discover
discover known
known or
or new network,
new promising and random forest The usingmost the
Recently, supervised unsupervised Machine Learning network, ridge
promising method
method in
regression
in terms
terms of
andanomaly
of randomdetection
anomaly forest using
detection efficiency
efficiencythe
prediction
Recently, supervised and unsupervised Machine Learning prediction of the mean square error (MSE). The most of the mean square error (MSE). The most
(ML) methods are used to detect and discover known or new promising method in license terms of anomaly detection efficiency
(ML) methods
2405-8963 Copyright are ©used2022toThe detect and This
Authors. discover
is an open known or new
access promising
article under method in terms. of anomaly detection efficiency
the CC BY-NC-ND
Peer review under responsibility of International Federation of Automatic Control.
10.1016/j.ifacol.2022.09.616
 Mohamed Ben Slimene et al. / IFAC PapersOnLine 55-10 (2022) 1582–1587
was the ANN. (Gorinevsky et al., 2012) proposed a technique
called Distributed Fleet Monitoring (DFM) which consists of
building tree-level regression models using Partial Least
Squares (PLS). These regression models describe time inside
the flight, flight-to-flight trend and aircraft-to-aircraft
variability during different flight phases including climb,
cruise, level turns, and descent.
Employing supervised learning techniques for anomaly
detection is not always possible because the data must be
labeled to perform regression or classification. Hence, the
history of abnormal elements is very limited because it is
dangerous and expensive to perform test flights under extreme
abnormal conditions (Yan et al., 2021).
Unsupervised techniques can be used in extracting patterns
through unlabeled time series datasets to learn the normal
behavior and detect abnormal or unknown observations which
are inconsistent when compared with most of the data.
Clustering analysis was deployed in anomaly detection. It
consists of classifying a large amount of data without any prior
knowledge about classes (Aghabozorgi et al., 2015). (Dani et
al., 2015) used the Density-Based Spatial Clustering of
Applications with Noise (DBSCAN) to cluster segments
extracted from the time series. Segments were generated using
the Adaptive Piecewise Constant Approximation (APCA)
which efficiently reduced the data size. The proposed
algorithm considers non-classified segments as abnormal.
Since it processes segments instead of time series, this
methodology does not capture time dependencies. (Deshmukh
and Hwang, 2019) used DBSCAN algorithm to class trajectory
observation into similar classes and to identify abnormalities.
Afterwards, one-Class Support Vector Machine was trained
only on normal data to build an equation for each normal class.
Anomalies are then detected using cluster’ patterns.
Hence, the research gap lies mainly in the fact that no anomaly
detection technique considers the cyclicity of each signal
within flight phases and gives insights about signals
responsible for anomalies. Besides that, most of the above-
discussed anomaly detection algorithms are computationally
time-consuming. The aim of this paper is to develop an
interpretable method that detects, and diagnoses abnormal
aircraft system behavior based on multivariate time series
analysis. The method can characterize each extracted anomaly
using interpretable symptoms. More specifically, the objective
is to build an anomaly detection method without any prior
knowledge of system behavior labels based on supervised and
unsupervised learning techniques. Since flight phases have
different behaviors and characteristics, this method will be
limited to flight time windows that start and end according to
a specific period. The proposed method can be divided into
four principles steps. The first one extracts and prepares flight
phases multivariate time series. The DBSCAN clustering
method is used to extract normal and abnormal profiles in the
second step. The third step proposes a new importance score
to calculate the contributions of each of the collected time
series to identify the obtained abnormal profiles. Finally, the
fourth step proposes a new anomaly detection technique called
the Silhouette test to detect unknown system behavior. In the
1583
case of known behavior, the Time Series Forest technique is
applied to predict a given phase’s profile.
The rest of this article is organized in 3 sections. Section 2
presents the proposed method for flight phases anomaly
detection. Section 3 applies and validates the method using a
real database. and discusses the obtained results. Section 4 is
dedicated for the conclusion and future research.
2. THE PROPOSED METHOD
Figure 1 depicts the proposed four-step method that discovers
and characterizes the normal and abnormal aircraft system
behavior profiles by clustering multivariate time series dataset.
Since the method uses an unsupervised learning technique,
expert validation and recommendations are very important to
explain the obtained profiles
Figure 1. Proposed four-step method
The extracted phases will be clustered using the DBSCAN
clustering algorithm together with the Dynamic Time Warping
(DTW) distance. The proposed algorithm takes into account
the cyclic nature of signals corresponding to flight phases as
well as the interaction between variables. Extracted profiles
will be diagnosed by comparing them with normal signals
based on a new importance score. This score allows for
identifying signals that have the most influence on the
distinction between the normal and each abnormal profile. In
this step, we go to experts to validate, characterize and
interpret extracted profiles based on their expertise. The result
of the methodology is a trained anomaly detection model based
on the new silhouette test for novelty detection and the Time
Series Forest for the classification of known profiles. The
different steps of the methodology will be detailed in the rest
of this section.
2.1 Step-1: Extract and prepare flight phases
Step-1 consists of defining and extracting the studied phase
time series from whole flight sessions based on experts’
recommendations. Pertinent parameters are chosen by an
expert to maximize the chance of finding anomalies the period
phases under consideration. The expert fixes start and end
events to extract the time phase period windows from full
session time series. Since aircrafts are monitored using
1584 Mohamed Ben Slimene et al. / IFAC PapersOnLine 55-10 (2022) 1582–1587
thousands of sensors, only consider signals deemed by experts
relevant to the considered flight phase are extracted.
2.2 Step-2: Discover normal and abnormal profiles
Step-2 focuses on the extraction of normal operation profiles
by grouping the time series based on their shapes and trends.
In order to do so, Step-2 combines both the DBSCAN and the
DTW distance techniques to group phases having similar
behavior in the same cluster. To compare two multivariate
time series that begin and end with the same events but not the
same length, the DTW distance measure is used to
discriminate between them. This method allows to compute an
optimal correspondence between two time series by
considering the deformation in time with some restrictions and
rules. Each of the extracted clusters represent different normal
operation profiles. Unclassified time series phases are
considered as abnormal profiles. To further refine the
clustering, the DBSCAN technique is applied several times
until the desired level of confidence is reached. The
unclassified times series may contain abnormal profiles.
2.2.1 Distance measure
The Dynamic Time Warping (DTW) distance is intended to
compare two time series that begin and end with the same
events, such as the case of flight phases. Thus, A dissimilarity
measure is proposed to compare multidimensional cyclic
signals whose speed of behavior can vary. This technique
allows to compute an optimal correspondence between two
time series by considering the deformation in time with some
restrictions and rules. Thus, the distance corresponds to the
sum of the weights of the optimal path to make the alignment
between the observations of the two compared series (Yang et
al., 2019).
Since DTW uses Euclidean distance to compare time series,
the individual extract multivariate time series are normalized
to give equal weight to each dimension of the time series.
Thus, each variable will be normalized by removing its
average value and scaling the unit variance of the entire
dataset. The standard score of a sample x is calculated as z =
(x − u)
, where u is the average value and s is the standard
𝑠𝑠𝑠𝑠
deviation of the samples studied. Centering and scaling are
done independently for each dimension of the time series by
calculating the relevant statistics over all elements. As the
DTW technique distorts series in time to find the shortest
matching path, the time to the end of the cycle is inserted as a
new dimension in the dataset of series. This dimension will not
be normalized like the rest of the variables to give greater
weight to time. Thus, the deformation in time will penalize the
DTW distance since time has a higher average value.
2.2.2 DBSCAN clustering
The choice of DBSCAN technique is especially motivated by
its powerful ability to extract clusters with arbitrary shapes
where a cluster may be expanded if its neighbors are dense.
Using this technique, the unclassed elements may represent
anomalies. The DBSCAN clustering algorithm requires two
parameters: Eps which represents the minimum distance
between two time series to consider them as neighbors and
MinPts which denotes the minimum number of series required
to form a cluster. Hence, two elements of multivariate time
series are neighbors if the DTW distance between them is less
then Eps.
• Clustering evaluation
The quality of the clustering is evaluated using the Silhouette
score. The silhouette represents the difference between the
average distance of each element with the elements of the same
group as it (cohesion) and the average distance with the
elements of other neighboring groups (separation). If this
difference is negative, the point is on average closer to the
neighboring group than to its own; it is therefore poorly
classified. Conversely, if this difference is positive, the
element is on average closer to its group than to the
neighboring groups; it is therefore well classified (Rousseeuw,
1987). The silhouette of an element should be within the
interval [-1, 1]. The silhouette score is the average silhouette
of all elements of the cluster. A greater silhouette score
indicates that the clustering has a good structure. A partition
can be validated if its silhouette score is greater than 0.5.
2.2.3 Profile extraction
To identify normal and abnormal profiles, two iterations of the
DBSCAN algorithm is performed. First, we cluster all
elements for the purpose of labeling them to normal (landing
phases in clusters) and abnormal (unclassified phases). The
second clustering only concerns the unclassified elements.
This allows for the identification of abnormal profiles.
2.3 Step-3: Abnormal profiles characterization
Once normal and abnormal clusters are extracted, each
obtained cluster is characterized with its medoid. Each
abnormal profile will be diagnosed by comparing each of its
dimensions with reference to the normal profile. The medoid
denotes an average element from which the sum of distances
to all elements is minimal. Then, the contribution of each
signal in the identification of abnormal profile is measured
using an importance score. Hence, to identify the variable that
makes abnormal phases different from normal behaviours, the
average distance between univariate abnormal phases and the
medoids of its nearest normal clusters using the DTW distance
is calculated.
Univariate distances between abnormal phases and the normal
cluster medoid will be evaluated based on intra-cluster
distance mean and standard deviation. The importance score
of a parameter i in the identification of an abnormal phase j is
calculated using the following pseudocode:
For each signal 𝑖𝑖𝑖𝑖
Calculate the variance of univariate distance to normal
medoid within normal cluster
For each abnormal profile 𝑗𝑗𝑗𝑗
For each signal 𝑖𝑖𝑖𝑖
Calculate importance score of signal i in the
identification of profile 𝑗𝑗𝑗𝑗
Once the profiles are statistically validated, aircraft experts are
involved to interpret the obtained diagnosis variables of each
anomaly by comparing them to potential symptoms.
 Mohamed Ben Slimene et al. / IFAC PapersOnLine 55-10 (2022) 1582–1587
2.4 Step-4: Anomaly detection
Step-3 proposes a new anomaly detection model based on 2
stages (Figure 2):
• Stage-1. New profile detection. This stage detects whether
a new phase corresponds to a known profile using the
silhouette test or not.
• Stage-2. Profile classification. This stage predicts the
phase’s profile in the case of a known system behavior
using the Time Series Forest (TSF) classifier.
Figure 2. Anomaly detection flowchart
2.4.1 New profile detection
To test if a new phase can fit correctly in one of the predefined
profiles (normal and abnormal), we perform a silhouette test.
It consists of assigning the new time series to each of the
clusters and calculating its silhouette score. This score will be
compared to a predefined silhouette threshold for each profile
based on scores achieved by correctly classified phases.
For a given profile j, the silhouette threshold is 𝑆𝑆𝑆𝑆𝑇𝑇𝑇𝑇𝑗𝑗𝑗𝑗 = µ𝑗𝑗𝑗𝑗 −
3σj , where: µ𝑗𝑗𝑗𝑗 is the average silhouette of correctly classified
phases in profile 𝑗𝑗𝑗𝑗 and σj is the standard deviation of silhouette
score corresponding to correctly classified phases of the same
profile. The novelty behind the proposed clustering technique
consists of leveraging the silhouette score to detect unknown
profiles. The following pseudo code illustrates the proposed
technique.
Exist = 0
For each profile
Assign the new phase to the cluster
Calculate phase’s silhouette score
If silhouette score > profile’s silhouette threshold then
Return (Exist = 1)
Return (Exist)
In the case of a new abnormal profile, a new cluster will be
created. Otherwise, the Time Series Forest classifier is
employed to predict the new phase’s cluster.
2.4.2 Existing profile classification
Regarding the profile prediction, a variant of random forests
called Time Series Forest (TSF), will be used to regenerate the
classification labels. The model receives as input the
multivariate signal series and returns the corresponding
profile. TSF is an accurate and efficient time series classifier
that can extract the temporal features that distinguishes time
1585
series of different classes. This technique uses a transformer to
extract 3 statistical features from each window of the series:
the mean, the standard deviation, and the decay slope. This
transformer divides the time series into several windows and
calculates the 3 features at each interval. The extracted
variables are used as inputs to a random forest that randomly
samples the 3 variables from the intervals at each node of the
tree. To enable better classification, Random Forest uses a
combination of entropy gain and a distance measure, called
input gain (entropy and distance), to assess separation at each
node (Deng et al., 2013).
Since we are dealing with a highly imbalanced dataset (the
number of abnormal elements is very small compared to
normal elements), time series augmentation is performed on
minority profiles by adding white noise to rare abnormal
phases. We then train multiple Time Series Forest on both
augmented abnormal elements and a subset of the normal
cluster. The final classification result will be the majority vote
of these models. K-fold cross-validation technique is applied
to train and evaluate the classification model based on the
classification precision and recall.
3. STUDY CASE
The case study deals with an aircraft system during a specific
flight phase. The data is stored in Bombardier’s Aircraft
Health Management System (AHMS), which provides a large
amount of monitoring variables that can give us insights on
normal and abnormal operation modes of the aircraft.
3.1 Phases extraction results
The sample dataset contains full flight sessions recorded for
one year. The sample contains all recommended variables that
are used by aircraft experts for diagnosing the system failures.
The time window that delimits the phase relative to each flight
session is given by the by the experts. After the extraction of
phases from whole flight sessions, we ended up with a
database containing multivariate time series. We pre-
processed extracted phases by resampling time series and by
interpolating missing values.
3.2 Normal and abnormal profiles identification results
After extracting and pre-processing data, we perform 2
iterations of the DNSCAN algorithm (Step-2 of the method) to
extract normal profiles as well as abnormal ones. Before
performing clustering analysis on the extracted dataset, several
preliminary tests were performed on a sub-sample of 9% of
phases which correspond to the most recent complete sessions.
Several combinations of segmentation techniques such as
Piecewise Aggregate Approximation (PAA) and Symbolic
Aggregate approximation (SAX) with Dynamic Time warping
(DTW) and Euclidean distances were tested together with the
DBSCAN clustering algorithm are used to choose the best
clustering approach in terms of partition quality measured by
the silhouette score. The minimum number of phases to build
a cluster MinPts is set to 2 elements to be able to extract small
behavioral profiles. Table 1 summarizes clustering results for
each combination of techniques after tuning the Epsilon
hyperparameter.
1586 Mohamed Ben Slimene et al. / IFAC PapersOnLine 55-10 (2022) 1582–1587

The best result was achieved by applying the DTW distance of the 9 abnormal profiles (red color) for the most important
on the PAA phases’ segments with a silhouette of 0.508. Also, variable.
we tried the PAA and the SAX warping distances, which did
not improve the partition quality. Since Euclidian distance
requires the same number of observations in the time series to
compare, we used it to cluster time series represented with both
techniques. Using the Euclidian distance, the best result was
achieved by the PAA segmentation with a silhouette score of
0.506. However, using the proposed DTW distance with non-
normalized time dimension gives the best silhouette score of
0.958. Based on previous preliminary results, the DTW
distance with non-normalized time to phase end together with
DBSCAN algorithm are applied on all data. This clustering
configuration has extracted one normal profile and 18
abnormal ones.
Table 1. Clustering results for phases sample Figure 3. Most important variable for profile 9

Metric S.tech. Eps Silh. # clus. # anom. A shown in Figure 3, the abnormal signal for profile 9 is much
None 96 0.465 1 1 higher than the normal one. A similar analysis has been carried
DTW PAA 12 0.508 1 1 out for all the abnormal profiles. For example, Figure 4 depicts
the profile 2 where it is easy to notice a time shift between the
SAX 23 0.214 1 1
normal and abnormal signals.
PAA warping PAA 180 0.506 1 1
SAX warping SAX 70 0.222 1 1
Euclidean PAA 12 0.506 1 1
Distance SAX 23 0.207 1 1
DTW with None 95 0.471 1 1
normalized PAA 12 0.507 1 1
time
SAX 23 0.225 1 1
DTW with None 800 0.958 1 18
non- PAA 81 0.889 1 4
normalized
time SAX 81 0.732 1 5
Figure 4. Most important variable for profile 2
After the isolation of the abnormal phases, a re-clustering is To validate the obtained normal and abnormal clusters,
performed on the unclassified elements to determinate the investigations are conducted on many other variables and
abnormal profiles and to facilitate interpretation. The same presented to the system expert to capture its feedback
DBSCAN algorithm is applied with a smaller minimum regarding the extracted profiles.
number of phases to consider a cluster (MinPts = 2). Thus, 9
abnormal profiles are found with a silhouette score of 0.80. 3.4 Build anomaly detection model
Abnormal phases distribution among abnormal profiles is
Before building the anomaly detection model, many
illustrated in Table 2.
techniques are applied to accurately detect anomalies. For
Table 2. Abnormal phases distribution of abnormal profiles example, we tried training and optimizing a deep LSTM
autoencoder as well as on reconstructing normal phases. This
Abnormal profile # 1 2 3 4 5 6 7 8 9 technique was not effective due to the overlap between normal
Number of phases 2 2 2 4 2 2 2 1 1 and abnormal phases reconstruction error histograms. We tried
other techniques such as the K-Nearest Neighbors (KNN)
3.3 Profile characterization results classifier coupled with modified DTW distance. Also, we
Ranking signals based on their contribution in the trained a one-class SVM on statistical features extracted from
identification of abnormal profile is the key to diagnose each phases time windows. But these two techniques achieved a
of the potential failures. The profile characterization of each classification accuracy of less than 50%. Since these
cluster is represented with its medoid. Hence, 1 normal medoid techniques failed to detect abnormalities with acceptable
and 9 abnormal ones are found. Based on the importance score accuracy, we applied the new anomaly detection model based
of each variable of the multivariate times series, for each on the silhouette test (Stage-1) and the Time Series Forest
abnormal profile, a ranking of its variables is given to facilitate classifier (Stage-2) according to the flowchart presented in
their interpretation. Figure 3 illustrates an example of the Figure 2. The results of Stage-1 are presented in Figure 4
normal medoid phase (green color) and the abnormal medoid where the silhouette score histogram of the normal profile
when we assign abnormal phases to is plotted and compared to
 Mohamed Ben Slimene et al. / IFAC PapersOnLine 55-10 (2022) 1582–1587
the silhouette threshold for that cluster (blue line). According
to Figure 4, it is easy to choose a silhouette threshold to
separate normal classes from misclassified classes. In this case
the threshold is set to 0.275 (µ = 0.958, σ = 0.227) ). Hence,
18 abnormal phases are correctly detected. Likewise, if we
misclassify a phase to the wrong abnormal profile, its
silhouette score will be much lower than other phases.
Figure 4. Silhouette score histogram for normal phases
Regarding the Stage-2 classification result, and due to the
unbalanced dataset, we performed a time series augmentation
by adding white noise to the rare abnormal phases. We trained
14 TSF models. Each time we took only 100 normal phases
and 100 abnormal phases. The final classification result is
based on the majority voting of these models. The K-fold
cross-validation technique is used to train and evaluate the
classification model by partitioning each subset 80% for
training (includes 20% for validation) and 20% for test. On
training dataset, the average classification accuracy, recall and
false positive ratio of the 14 TSFs are 92%, 88% and 0.001%,
respectively. Applied to the testing dataset, the model achieved
a precision of 89%, a recall of 84% and a false positive ratio
of 0.003%. This indicates that the TSF model efficiently
captured the anomaly detection logic.
4. CONCLUSION
This paper presents a novel anomaly detection method that
detects, identifies, and diagnoses anomalies of aircraft system
based on multivariate time series analysis and hybrid
supervised/unsupervised machine learning techniques
combined with experts’ involvement. The method developed a
modified DTW distance that captures flight phase cyclicity. It
includes a novel importance score that helps experts to
diagnose the extracted anomalies, and a new leveraging
silhouette score to detect any new abnormal signal. The
proposed method succeeds to identify and explain 9 abnormal
profiles related to the system registered in Bombardier’s
AHMS dataset. The obtained results of the proposed two-stage
anomaly detection model overperform the deep learning
autoencoder as well as common classic supervised learning
techniques in terms of classification accuracy and recall.
Despite the effectiveness of the method, it can be improved by
applying it to systems with more sensor. The anomaly
detection and diagnosis can be refined in future works by
making it able to capture the anomaly dependency and
propagation through neighboring sub-systems.
1587
ACKNOWLEGEMENTS
The authors would like to thank Hugo Gagnon, Kerelous
Waghen, and Thomas Reid from Bombardier Aeronautic for
their valuable contributions and the richness of the scientific
exchanges throughout the project.
The project is supported by the Mitacs-accelarate program
under grant number IT23277.
REFERENCES
AGHABOZORGI, S., SHIRKHORSHIDI, A. S. & WAH, T. Y.
2015. Time-series clustering–a decade review. Information
Systems, 53, 16-38.
BOULFANI, F., GENDRE, X., RUIZ-GAZEN, A. & SALVIGNOL,
M. Anomaly detection for aircraft electrical generator using
machine learning in a functional data framework. 2020 Global
Congress on Electrical Engineering (GC-ElecEng), 2020. IEEE,
27-32.
BROCKWELL, P. J. & DAVIS, R. A. 2009. Time series: theory and
methods, Springer Science & Business Media.
DANI, M. C., FREIXO, C., JOLLOIS, F.-X. & NADIF, M.
Unsupervised anomaly detection for aircraft condition
monitoring system. 2015 IEEE Aerospace Conference, 2015.
IEEE, 1-7.
DENG, H., RUNGER, G., TUV, E. & VLADIMIR, M. 2013. A time
series forest for classification and feature extraction. Information
Sciences, 239, 142-153.
DESHMUKH, R. & HWANG, I. Anomaly detection using temporal
logic based learning for terminal airspace operations. AIAA
Scitech 2019 Forum, 2019. 0682.
GORINEVSKY, D., MATTHEWS, B. & MARTIN, R. Aircraft
anomaly detection using performance models trained on fleet
data. 2012 Conference on intelligent data understanding, 2012.
IEEE, 17-23.
LEE, H., LI, G., RAI, A. & CHATTOPADHYAY, A. 2020. Real-
time anomaly detection framework using a support vector
regression for the safety monitoring of commercial aircraft.
Advanced Engineering Informatics, 44, 101071.
NANDURI, A. & SHERRY, L. Anomaly detection in aircraft data
using Recurrent Neural Networks (RNN). 2016 Integrated
Communications Navigation and Surveillance (ICNS), 2016.
Ieee, 5C2-1-5C2-8.
ROUSSEEUW, P. J. 1987. Silhouettes: a graphical aid to the
interpretation and validation of cluster analysis. Journal of
computational and applied mathematics, 20, 53-65.
XIONG, P., ZHU, Y., SUN, Z., CAO, Z., WANG, M., ZHENG, Y.,
HOU, J., HUANG, T. & QUE, Z. Application of transfer learning
in continuous time series for anomaly detection in commercial
aircraft flight data. 2018 IEEE International Conference on Smart
Cloud (SmartCloud), 2018. IEEE, 13-18.
YAN, H., SUN, J. & ZUO, H. 2021. Anomaly detection based on
multivariate data for the aircraft hydraulic system. Proceedings of
the Institution of Mechanical Engineers, Part I: Journal of
Systems and Control Engineering, 235, 593-605.
YANG, C.-Y., CHEN, P.-Y., WEN, T.-J. & JAN, G. E. 2019. Imu
consensus exception detection with dynamic time warping—a
comparative approach. Sensors, 19, 2237.