Operational systems generate high-frequency telemetry that is difficult to monitor using static thresholds or black-box ML. This session presents an explainable, unsupervised approach for multivariate telemetry focused on operational robustness and integrated with modern data platforms. Based on statistical modelling and continuous adaptation, it trains on years of data with limited resources, runs on standard CPUs, and delivers up to two orders of magnitude faster training and over 95% lower training time compared to deep learning baselines.

Target Audience: Data Engineers, Analytics and Data Science practitioners, operations and reliability engineers.
Prerequisites: N/A
Level: Advanced

Extended Abstract:
Modern industrial and operational systems generate large volumes of high-frequency, multivariate telemetry data. In such environments, manual monitoring and static threshold-based alerting quickly become ineffective, leading to alert fatigue, spurious peaks, and fragmented incident handling. 

This session presents a vendor-neutral, unsupervised anomaly detection approach designed specifically for operational telemetry environments where robustness, interoperability, and lifecycle management are as important as detection performance. The approach has been applied in industrial settings and validated using space operations data. 

Methodologically, the solution is based on multivariate statistical process control and dimensionality reduction techniques such as Principal Component Analysis. It learns normal system behaviour directly from data without requiring labelled anomalies and monitors new observations using established statistical indicators. The novelty does not lie in individual algorithms, but in their systematic operationalization for real-world monitoring scenarios. 

A central innovation is the focus on explainability at event level. For each detected anomaly, the approach identifies the telemetry channels contributing most to the deviation, enabling root-cause-oriented investigation rather than opaque anomaly scores. 

To address typical shortcomings of anomaly detection in production, dedicated post-processing mechanisms are applied to eliminate spurious peaks, consolidate related anomaly events, and reduce noise. This results in significantly fewer alerts for the same underlying problem and supports effective incident handling. Across industrial use cases and ESA benchmark datasets, the approach achieves a 30–50% reduction in false alarms compared to static threshold-based methods and several ESA benchmark algorithms, along with improved F0.5 accuracy, emphasizing precision over raw detection volume. 

In addition to detection performance, the approach was explicitly designed for computational efficiency. In one representative ESA benchmark scenario, the system trains on multi-year telemetry histories with 100 channels in a few minutes on standard CPU hardware, achieving one to two orders of magnitude faster training and over 95% lower training time than state-of-the-art deep learning baselines. This low computational footprint enables frequent retraining and deployment in resource-constrained operational environments. 

Continuous model updates using a sliding training window allow the system to adapt automatically to evolving system behaviour while maintaining low computational overhead. The session also discusses architectural and data engineering aspects, including data preprocessing, model lifecycle management, and integration into existing data platforms and operational pipelines. 

Attendees will gain practical insights into how combining explainable analytics, event-level reasoning, and continuous adaptation enables reliable anomaly detection in telemetry-intensive environments.