IoT Sensor Fleet: Streaming Anomaly Detection

Fleet Controls

Sensor nodes 16

Report interval 600 ms

EWMA smoothing α 0.20

Anomaly z-threshold 3.0σ

Live Stream — Sensor #1

raw reading EWMA μ anomaly

Analytics Readouts

Messages / sec

0.0

Anomalies (total)

Fleet mean μ

0.0

Fleet σ

0.0

How it works

Each of the N sensor nodes streams a noisy reading x_t to a central hub on a fixed report interval — an edge-to-cloud ingestion pipeline. Instead of storing the whole history, the hub keeps a running summary using an exponentially-weighted moving average (EWMA), the same estimator real streaming-analytics systems (Datadog, Prometheus, Kafka Streams) use for online monitoring:

μ_t = α·x_t + (1-α)·μ_(t-1)
σ²_t = (1-α)·(σ²_(t-1) + α·(x_t - μ_(t-1))²)
z_t  = (x_t - μ_t) / σ_t

A reading is flagged anomalous when |z_t| exceeds the threshold slider — a classic online outlier detector that needs no stored window, just the previous mean and variance. Small α reacts slowly and rides out noise; large α tracks recent values closely but false-flags more spikes as "trend shift" rather than "outlier".

Sensor nodes — more nodes raise the aggregate message rate without changing any single sensor's statistics.
Report interval — how often each node transmits; drives the live messages/sec readout.
α slider — the EWMA smoothing factor shared by every node's local detector.
z-threshold — how many standard deviations away from μ a reading must be before the hub calls it an anomaly (flashes red).
Inject Spike — forces one random sensor's next reading to a large deliberate outlier, so you can watch the detector catch it in real time.

Sensor node Anomalous reading Analytics hub

msg/s: 0.0
anomalies: 0

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.