Pyod

Cross-asset correlation on the open stack, and what it actually buys: fewer false alarms, not more catches

Two spindles, one PyOD model that scores them jointly, rendered on the same Grafana dashboard. The cross-asset feature the vendor quote priced at a premium, built for the cost of the second carrier the second asset needed anyway. The result is mostly a false-positive filter, which is the opposite of how the feature is sold.

Issue 06 deployed a single-asset Isolation Forest in 80 lines of Python and priced the vendor quote against it line by line. One line item survived as genuinely not built: cross-asset correlation, which the SaaS markets as ensemble-learning anomaly detection with cross-asset correlation and which issue 06 estimated at roughly one engineer-week. Issue 07 builds it. A second i.MX 8M Plus carrier on a second spindle publishes to the same broker, a PyOD model scores both assets in one joint feature frame, and a common-mode detector flags the case where both assets move together. The result reframes what cross-asset correlation is for. It catches almost nothing the single-asset model does not. Its real value is the inverse: it rejects the environmental false positives from issue 06, the cooling-system cross-talk and the floor-vibration bleed-through, by recognizing them as plant-wide rather than asset-specific. That is a meaningful feature, and it is not the feature the marketing describes.