Multi-layer anomaly detection framework

Patent metadata

Field	Value
Publication number	US-10372120-B2
Application number	US-201615287249-A
Country	US
Kind code	B2
Filing date	Oct 6, 2016
Priority date	Oct 6, 2016
Publication date	Aug 6, 2019
Grant date	Aug 6, 2019

Abstract

According to some embodiments, a system and method are provided to receive a first plurality of data from a machine associated with a first time period. A normal operation of the machine is automatically determined based on the first plurality of data. A second plurality of data may be received from the machine associated with a second time period. An anomaly in the second plurality of data is determined.

First claim

The invention claimed is:

1. A method of determining an anomaly associated with an engine, the method comprising:
receiving, from the engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders;
automatically determining, via a processor, a normal operation of the engine based on the first plurality of time-series data, wherein the automatically determining of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements;
receiving a second plurality of time-series data from the engine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors;
automatically determining an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors.

2. The method of claim 1 , further comprising:
receiving a plurality of data associated with the anomaly;
determining if the anomaly is a known anomaly;
in a case that the anomaly is a known anomaly, transmitting a notification of the known anomaly; and
in a case that the anomaly is an unknown anomaly, transmitting a request for feedback to an end user.

3. The method of claim 2 , further comprising:
determining a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly;
receiving feature vectors based on an output of the shapelet transform; and
feeding the feature vectors into a classifier where the classifier returns an anomaly class.

4. A non-transitory computer-readable medium comprising instructions that are executable by a processor to perform a method of creating a framework to automatically detect anomalies, the method comprising:
creating, via a processor, a first layer to
receive, from an engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders,
automatically determine a normal operation of the engine based on the first plurality of time-series data, wherein the automatic determination of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements,
receive a second plurality of time-series data from the machine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors, and
determine an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors;

creating, via the processor, a second layer to receive a plurality of data associated with the anomaly, determine if the anomaly is a known anomaly where in a case that the anomaly is a known anomaly, transmit a notification of the known anomaly and, in a case that the anomaly is an unknown anomaly, transmit a request for feedback to an end user.

5. The medium of claim 4 , wherein the second layer determines a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly, receiving feature vectors based on an output of the shapelet transform and inputting the feature vectors into a classifier where the classifier returns an anomaly class.

6. A system for early detection of problems associated with a machine, the system comprising:
a processor;
a non-transitory computer-readable medium comprising instructions executable by the processor to perform a method to automatically detect anomalies, the method comprising:
receiving, from an engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders;
automatically determining, via the processor, a normal operation of the engine based on the first plurality of data, wherein the automatic determination of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements;
receiving a second plurality of time-series data from the engine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors; and
determining an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors.

7. The system of claim 6 , further comprising instructions for:
receiving a plurality of data associated with the anomaly;
determining if the anomaly is a known anomaly;
in a case that the anomaly is a known anomaly, transmitting a notification of the known anomaly; and
in a case that the anomaly is an unknown anomaly, transmitting a request for feedback to an end user.

8. The system of claim 7 , further comprising instructions for:
determining a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly;
receiving feature vectors based on an output of the shapelet transform; and
feeding the feature vectors into a classifier where the classifier returns an anomaly class.

Assignees

• Gen Electric

Inventors

• Patil Sundeep R
• Kapil Ansh
• Sagel Alexander
• Michael Lutter
• Baptista Oliver
• Kleinsteuber Martin

Classifications

• G05B23/0243 Primary

  model based detection method, e.g. first-principles knowledge model · CPC title

• G05B23/0281

  Quantitative, e.g. mathematical distance; Clustering; Neural networks; Statistical analysis · CPC title

• G05B23/0235 Primary

  based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold · CPC title