Multivariate anomaly detection with explainability

Question

I have several time serieses, based on aggregation of measurements of different sensors. Each sensor create boolean measurements every hour, and I aggregate them to corresponding time series.

For example:

Let's say one sensor measures the existence of three signals in different time points:

time	A	B	C
10:00:00	1	0	1
11:00:00	0	1	1
12:00:00	0	1	0

We can now take the measurements of signals from various sensors and aggregate them together to time series, per each measurements:

time	A	B	C
10:00:00	50	21	12
11:00:00	56	0	13
12:00:00	47	15	14

My task is to identify an anomaly on all signals together, which led me to different multivariate anomaly detection techniques.

I want to identify not only an anomaly at a specific hour, but which sensors led to the anomaly, or in other words, contributed the most to the anomaly.

Is there any known approach to add such explainability to the model?

Answer 1

Finding anomalies in the aggregated data is quite straightforward, just use standard methods like e.g. insolation forest on your table rows.

The "explainability" is less clear: since each sensor can only contribute one signal increment per signal type and hour, there will never be much difference between the sensors. E.g., consider the anomaly, that in one hour there is no signal of any type whatsoever (presuming that this is indeed anomalous behavior, i.e. there are usually many signal counts at each hour). Then all sensors would contribute equally to this anomaly.

So maybe you have to clearify, what exactly is meant by "explainability".