Described herein are techniques for identifying anomalous behavior of a monitored entity. Features can be extracted from data related to operation of an entity. The features can be mapped to a plurality of states to generate a state sequence. An observed value of a metric can be compared to an expected value of the metric based on the state sequence.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method to identify anomalous behavior of a monitored entity, the method comprising, by a processing system: extracting features from data related to the operation of an entity; mapping the extracted features to states to generate a state sequence; determining an expected value of a metric based on the state sequence; and comparing the determined expected value of the metric to an observed value of the metric. 2. The method of claim 1, further comprising: presenting, via a user interface, a notification of anomalous behavior of the entity if the observed value of the metric differs from the expected value of the metric by a threshold amount. 3. The method of claim 1, wherein the metric is a performance metric or a sustainability metric. 4. The method of claim 1, wherein the data is reported by sensors monitoring various performance parameters of the entity. 5. The method of claim 4, wherein the data is recorded over the course of at east 24 hours of operation of the entity and the state sequence includes a plurality of distinct states. 6. The method of claim 1, wherein the expected value of the metric is determined using a state machine model previously trained on data related to the operation of one or more other entities of the same type as the entity. 7. The method of claim 1, wherein the expected value of the metric is determined using a mean value comparison technique, a distribution comparison technique, or a likelihood comparison technique. 8. A system to identify anomalous behavior of a monitored entity, the system comprising: sensors to report data regarding at least two parameters of an entity during operation; a feature extraction module to extract features from the reported data; a state sequence module to generate a state sequence by mapping the extracted features to a plurality of states; and an anomaly detection module to compare an expected value of a metric based on the state sequence to an observed value of the metric. 9. The system of claim 8, further comprising: a user interface to alert a user of anomalous behavior of the entity if the expected value of the metric differs from the observed value of the metric by a threshold amount. 10. The system of claim 9, wherein the user interface is configured to present a list of detected anomalies ordered by level of importance. 11. The system of claim 8, further comprising: a training module to build a state machine model based on observed operating parameters of one or more other entities of the same type as the entity. 12. The system of claim 8, further comprising: a memory storing a state machine model corresponding to the entity, wherein the anomaly detection module is configured to determine the expected value of the metric using information from the state machine model. 13. The system of claim 12, wherein the plurality of states into which the extracted features are mapped are predetermined based on state patterns in the state machine model. 14. The system of claim 13, wherein the state sequence module comprises a new-state detection module configured to detect a potential new state exhibited by a portion of the extracted features, wherein the potential new state corresponds to a pattern that does not exist in the state machine model. 15. The system of claim 8, wherein the system is configured to identify anomalous behavior in a plurality of monitored entities. 16. The system of claim 15, wherein the data reported by the sensors comprises measured parameters from each of the monitored entities, the state sequence module is configured to generate a state sequence for each of the monitored entities, and the anomaly detection module is configured to detect anomalous behavior in any one of or combination of the monitored entities. 17. The system of claim 15, wherein the plurality of monitored entities is an HVAC system. 18. A non-transitory computer-readable storage medium storing instructions for execution by a computer to identify anomalous behavior of a monitored entity, the instructions when executed causing the computer to: extract features from data characterizing operation of an entity during a time period; map the extracted features to states to generate a state sequence; determine an expected value of a metric based on the state sequence and a state machine model for the entity; compare the determined expected value of the metric to an observed value of the metric; and identify anomalous behavior if the expected value of the metric differs from the observed value of the metric. 19. The computer-readable storage medium of claim 18, the instructions when executed causing the computer to receive the data from a plurality of sensors monitoring performance parameters of the entity.