Alternative methods for novelty detection and correlations
I'm doing something similar and found that the best approach has to be comprehensive. My process obtains a ranking of signals based on degree and measure of anomaly, both as a function of 'bads' (if available). If information on 'bads' is unavailable then I perform the same study but as a function of the degree of anomaly. In both cases, I perform hierarchical clusters. These are helpful in grouping signals that have similar behavior.