I just want to preface this post with the fact that I have absolutely no idea what I am doing and just starting to dip my toes into this field.

I have this system that fires an alert whenever certain feature thresholds of the system are crossed. When an alert is fired, we have people with highly specialized domain knowledge look at those features and its current state and previous states and then bucket the triggered alert belonging to either events A, B, or C.

Right now, I am tasked with removing this manual process by automating this with a machine learning model (I wish it was as simple as hardcoding IF/ELSE statements). So, I have this data set with F number of features (I narrowed it down to these features because these were what the specialists with domain knowledge recommended) but I also want to feed to my model what these features looked like H hours ago. My question is how should I represent these F features for each H hour (where each hour represents the state of the system at that particular time)? Should they be their own "unique" feature (meaning I will end up feeding FxH features into my model).

For example, this is what my current dataset looks like below. Every record in my dataset represents the state of the system (the "state" of the system would be defined by the features) during an alert at a given time interval (these intervals are set 1 hour apart). How do I show my ML model all feature values for all time intervals for each alert? Do I need to transpose my dataset such that each row represents 1 alert and all of its time intervals?

alert_id  time_interval  feature_1  feature_2
1234      0              00         0.06
1234      1              12         1.15
1234      2              15         0.98
1234      3              12         0.00
1234      4              00         0.00
1234      5              00         0.00
5678      0              00         0.00
5678      1              00         0.00
5678      2              00         0.00
5678      3              18         1.32
5678      4              34         -1.05
5678      5              12         0.52
9123      0              00         0.00

Side question: would a simple model such a random forest, logistic, or SVM be appropriate for this?

  • $\begingroup$ a small example of your actual data might be useful here. prepare it as a csv file . $\endgroup$
    – IrishStat
    Apr 11 '20 at 10:50
  • $\begingroup$ Hi @IrishStat, I have updated my problem with a small sample $\endgroup$ Apr 12 '20 at 8:57
  • $\begingroup$ Given that an alert has occurred are the values for the features the readings taken 1 hour ago , 2 hours ago ... 5 hours ago ? $\endgroup$
    – IrishStat
    Apr 12 '20 at 17:23
  • $\begingroup$ @IrishStat yep, that is correct. Each row represents the features of each alert for every i-th hour $\endgroup$ Apr 12 '20 at 18:19
  • $\begingroup$ Is feature 1 always 0.0 when the alert is initiated... If so then if one could predict feature 1 from both the past of feature 1 and the past of feature 2 ... does that make sense ? $\endgroup$
    – IrishStat
    Apr 12 '20 at 18:45

There are several ways of dealing with the problem:

1) You may treat you feature data as time series and then employ time series models such as RNNs, LSTMs etc. These models come along with a large number of parameters though.

2) You may treat you feature data as time series and then extract time series features (mean, max and the like). There are automated tools for that, such as TSfresh

3) You may indeed employ all of the $FxH$ features in your model, as you've described, provided the total number of features doesn't blow up in comparison to the number of data points (alerts) in your training set

3) If your training set is too small for (3), which most likely is the case, then go for dimensionality reduction (PCA etc.) to boil down your vast feature set.

Hope this helps...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.