Unsupervised anomaly detection, diagnosis, and correction in multivariate time series data

Patent metadata

Field	Value
Publication number	US-11169514-B2
Application number	US-201916549146-A
Country	US
Kind code	B2
Filing date	Aug 23, 2019
Priority date	Aug 27, 2018
Publication date	Nov 9, 2021
Grant date	Nov 9, 2021

Abstract

Methods and systems for anomaly detection and correction include generating original signature matrices that represent a state of a system of multiple time series. The original signature matrices are encoded using convolutional neural networks. Temporal patterns in the encoded signature matrices are modeled using convolutional long-short term memory neural networks for each respective convolutional neural network. The modeled signature matrices using deconvolutional neural networks. An occurrence of an anomaly is determined using a loss function based on a difference between the decoded signature matrices and the original signature matrices. A corrective action is performed responsive to the determination of the occurrence of the anomaly.

First claim

What is claimed is:

1. A method anomaly detection and correction, comprising:
generating original signature matrices that represent a state of a system of multiple time series, wherein each original signal matrix represents correlation values between two respective time series and is formed from values:

m
ij
t

=

∑

δ
=
0

W

⁢

x
i

t
-
δ

⁢

x
j

t
-
δ

κ

where t is a time, where w is a duration of a time period, δ is an index from time step t−w to t, x i t-δ is a value of a first time series at a particular time t−δ,x j t-δ is a value of a second time series at the time t−δ, and κ is a rescale factor;
encoding the original signature matrices using a plurality of convolutional neural networks;
modeling temporal patterns in the encoded signature matrices using a plurality of convolutional long-short term memory (LSTM) neural networks for each respective convolutional neural network;
decoding the modeled signature matrices using a plurality of deconvolutional neural networks;
determining an occurrence of an anomaly using a loss function based on a difference between the decoded signature matrices and the original signature matrices; and
performing a corrective action responsive to the determination of the occurrence of the anomaly.

2. The method of claim 1 , wherein each convolutional neural network of the plurality of convolutional neural networks includes a plurality of steps.

3. The method of claim 2 , wherein each convolutional LSTM neural network accepts an output of a respective step of one of the convolutional neural networks.

4. The method of claim 1 , wherein decoding the signature matrices comprises sequentially deconvolving an output using a deconvolutional neural network and concatenating the deconvolved output with a next output of the LSTM neural networks.

5. The method of claim 1 , wherein encoding the original signature matrices comprises feeding an output of each convolutional neural network to an input of a next convolutional neural network until a final convolutional neural network is reached.

6. The method of claim 1 , wherein determining the occurrence of the anomaly comprises comparing an output of the loss function to a threshold.

7. The method of claim 1 , further comprising determining a severity of the anomaly using signature matrices at a plurality of different time scales.

8. The method of claim 1 , wherein the corrective action is selected from the group consisting of changing a security setting for an application or hardware component of the monitored system, changing an operational parameter of an application or hardware component of the monitored system, halting or restarting an application of the monitored system, halting or rebooting a hardware component of the monitored system, changing an environmental condition of the monitored system, and changing status of a network interface of the monitored system.

9. An anomaly detection and correction system, comprising:
a neural network configured to encoding original signature matrices, which represent a state of a system of multiple time series, using a plurality of convolutional neural network stages, to model temporal patterns in the encoded signature matrices using a plurality of convolutional long-short term memory (LSTM) neural network stages for each respective convolutional neural network, and to decode the modeled signature matrices using a plurality of deconvolutional neural network stages, wherein each original signal matrix represents matrix represents correlation values between two respective time series and is formed from values:

m
ij
t

=

∑

δ
=
0

W

⁢

x
i

t
-
δ

⁢

x
j

t
-
δ

κ

where t is a time, where w is a duration of a time period, δ is an index from time step t−w to t, x i t-δ is a value of a first time series at a particular time t−δ,x j t-δ is a value of a second time series at the time t−δ, and κ is a rescale factor;
an anomaly detector configured to determine an occurrence of an anomaly using a loss function based on a difference between the decoded signature matrices and the original signature matrices; and
a controller configured to perform a corrective action responsive to the determination of the occurrence of the anomaly.

10. The system of claim 9 , wherein each convolutional neural network stage of the plurality of convolutional neural network stages includes a plurality of steps.

11. The system of claim 10 , wherein each convolutional LSTM neural network stage accepts an output of a respective step of one of the convolutional neural network stages.

12. The system of claim 9 , wherein the neural network is configured to deconvolve an output of an LSTM neural network stage using a deconvolutional neural network stage and to concatenate the deconvolved output with a next output of the LSTM neural network stages.

13. The system of claim 9 , wherein the neural network is further configured to feed an output of each convolutional neural network stage to an input of a next convolutional neural network stage until a final convolutional neural network stage is reached.

14. The system of claim 9 , wherein the anomaly detector is further configured to compare an output of the loss function to a threshold.

15. The system of claim 9 , wherein the anomaly detector is further configured to determine a severity of the anomaly using signature matrices at a plurality of different time scales.

16. The system of claim 9 , wherein the controller is further configured to perform a corrective action selected from the group consisting of changing a security setting for an application or hardware component of the monitored system, changing an operational param

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Song Dongjin
• Chen Yuncong
• Lumezanu Cristian
• Chen Haifeng
• Zhang Chuxu

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title