IoT Sensor Stream Monitor — EWMA Anomaly Detection

Network

Sensor nodes 8

Sample rate 1.5 Hz

Sensor noise σ_x 0.35

EWMA smoothing λ 0.20

Live Telemetry

Throughput

0.0 pkt/s

Active alarms

Total anomalies

Selected Sensor

Node S1

Reading x_t 0.00

EWMA z_t 0.00

Control band ±0.00

Status Normal

How it works

Each sensor emits a noisy reading x_t that drifts slowly around a moving baseline. Instead of flagging every noisy sample, the hub tracks it with an EWMA control chart — the standard statistical-process-control technique used in real IoT telemetry pipelines:

z_t = λ·x_t + (1−λ)·z_{t-1}        (EWMA of the signal)
r_t = x_t − z_t                     (residual vs. the tracked baseline)
σ²_t = (1−β)·σ²_{t-1} + β·r_t²      (running residual variance, β=0.1)
Anomaly if |r_t| > L·σ_t             (L=3 → a 3σ control limit)

λ (lambda) — how fast the EWMA baseline adapts. Small λ smooths out noise but reacts slowly to real drift; large λ tracks the raw signal almost exactly, so fewer deviations look anomalous.
σ_x — the raw sensor noise amplitude injected into every reading, independent of the control chart's own running variance estimate σ_t.
Inject anomaly spike — forces one random sensor's next sample far outside its control band, the same way a stuck actuator or a failing sensor would in a real deployment.
Every accepted sample is drawn as a packet travelling from its sensor node to the central hub; a packet turns red exactly when |r_t| crosses the 3σ band.

Real-world relevance: EWMA / Shewhart control charts are the standard method fleet-monitoring platforms (industrial IoT, data-center telemetry, medical devices) use to catch a sensor drifting out of spec without hand-tuning a fixed threshold per device.

Click a node to inspect it

Sensor — normal Sensor — anomaly Data packet

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.