Anomaly detection method, program, and system

Patent metadata

Field	Value
Publication number	US-10133703-B2
Application number	US-201615273301-A
Country	US
Kind code	B2
Filing date	Sep 22, 2016
Priority date	Jun 14, 2012
Publication date	Nov 20, 2018
Grant date	Nov 20, 2018

Abstract

A method providing an analytical technique introducing label information into an anomaly detection model. Effective utilization of label information is based on introducing the degree of similarity between samples. Assuming, for example, there is a degree of similarity between normally labeled samples and no similarity between normally labeled and abnormally labeled samples. Also each sensor value is generated by the linear sum of a latent variable and a coefficient vector specific to each sensor. However, the magnitude of observation noise is formulated to vary according to the label information for the sensor values, and set so that normal label≤unlabeled≤anomalously labeled. A graph Laplacian is created based on the degree of similarity between samples, and determines the optimal linear transformation matrix according to a gradient method. A optimal linear transformation matrix is used to calculate an anomaly score for each sensor in the test samples.

First claim

What is claimed is:

1. A computer implemented method to detect an anomaly based on measurement data, the method comprising the steps of:
determining a similarity matrix indicating a relationship between measurement data;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

2. A method according to claim 1 further comprising: the step of calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

3. A method according to claim 2 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

4. A method according to claim 1 , wherein the similarity matrix is a N×N square matrix, where N is the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f.

5. A method according to claim 4 , wherein a, b, c, d, e, and f are b≤c≤a, e≤d≤f.

6. A method according to claim 5 , wherein c and f are a value equal to or approximate to a, and e is a value equal to or approximate to b on condition that an unlabeled sampled can be assumed to be a normal sample.

7. A method according to claim 5 , wherein c is a value equal to or approximate to b, and e and f are a value equal to or approximate to d on condition that an unlabeled sampled can be assumed to be an anomalous sample.

8. A method according to claim 1 , wherein observed values serving as samples use a model determined by a latent variable, an inner product of parameters, and a noise term.

9. A method according to claim 8 , wherein the noise term depends on whether a sample is a normal sample, anomalous sample, or unlabeled sample, so that the noise term of a normal sample≤the noise term of an unlabeled sample≤the noise term of an anomalous sample.

10. A computer executed program to detect an anomaly based on measurement data, the program executing in a computer the steps of:
determining a similarity matrix indicating a relationship between measurement data;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

11. A program according to claim 10 further comprising the step of: calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

12. A program according to claim 11 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

13. A program according to claim 10 , wherein the similarity matrix is a N×N square matrix, where N is the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f.

14. A program according to claim 13 , wherein a, b, c, d, e, and f are b≤c≤a, e ≤d≤f.

15. A program according to claim 14 , wherein c and f are a value equal to or approximate to a, and e is a value equal to or approximate to b on condition that an unlabeled sample can be assumed to be a normal sample.

16. A program according to claim 14 , wherein c is a value equal to or approximate to b, and e and f are a value equal to or approximate to d on condition that an unlabeled sample can be assumed to be an anomalous sample.

17. A program according to claim 10 , wherein observed values serving as samples use a model determined by a latent variable, an inner product of parameters, and a noise term.

18. A program according to claim 17 , wherein the noise term depends on whether a sample is a normal sample, anomalous sample, or unlabeled sample, so that the noise term of a normal sample≤the noise term of an unlabeled sample≤the noise term of an anomalous sample.

19. A computer implemented system to detect an anomaly based on measurement data, the system comprising:
storage means;
means for determining a similarity matrix indicating a relationship between measurement data;
means for defining a penalty based on the similarity matrix and for calculating parameters in accordance with an updating equation having a term reducing the penalty; and
means for calculating a degree of anomaly based on the calculated parameters.

20. A system according to claim 19 further comprising the step of: calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

21. A system according to claim 20 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

22. A system according to claim 19 , wherein the similarity matrix is a N×N square matrix, where N denotes the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f.

23. A system according to claim 22 , wherein a, b, c, d, e, and f are b≤c≤a, e≤d≤f.

Assignees

• IBM

Inventors

• Ide Tsuyoshi
• Morimura Tetsuro
• Tong Bin

Classifications

• G06F2218/12

  Classification; Matching · CPC title

• G06F18/2433 Primary

  Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection · CPC title

• G06F17/18 Primary

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• G06F18/24

  Classification techniques · CPC title

• G06K9/6267

  Physics · mapped topic