Learning sparsity-constrained gaussian graphical models in anomaly detection

Patent metadata

Field	Value
Publication number	US-11216743-B2
Application number	US-201816103220-A
Country	US
Kind code	B2
Filing date	Aug 14, 2018
Priority date	Aug 14, 2018
Publication date	Jan 4, 2022
Grant date	Jan 4, 2022

Abstract

A first dependency graph is constructed based on a first data set by solving an objective function constrained with a maximum number of non-zeros and formulated with a regularization term comprising a quadratic penalty to control sparsity. The quadratic penalty in constructing the second dependency graph is determined as a function of the first data set. A second dependency graph is constructed based on a second data set by solving the objective function constrained with the maximum number of non-zeros and formulated with the regularization term comprising a quadratic penalty. The quadratic penalty in constructing the second dependency graph is determined as a function of the first data set and the second data set. An anomaly score is determined for each of a plurality of sensors based on comparing the first dependency graph and the second dependency graph, nodes of which represent sensors.

First claim

What is claimed is:

1. A method, comprising:
receiving a first data set comprising sensor data detected by a plurality of sensors coupled to equipments in operation during a first period of time;
constructing a first dependency graph based on the first data set by solving a first objective function constrained with a maximum number of non-zeros and formulated with a regularization term comprising a first quadratic penalty to control sparsity, wherein the first quadratic penalty is determined as a function of the first data set in constructing the first dependency graph;
receiving a second data set comprising sensor data detected by the plurality of sensors coupled to the equipments in operation during a second period of time;
constructing a second dependency graph based on the second data set by solving the first objective function constrained with the maximum number of non-zeros and formulated with the regularization term comprising a second quadratic penalty, wherein the second quadratic penalty is determined as a function of the first data set and the second data set in constructing the second dependency graph; and
determining an anomaly score for each of the plurality of sensors based on comparing the first dependency graph and the second dependency graph.

2. The method of claim 1 , further comprising:
responsive to determining that an anomaly score associated with a sensor in the plurality of sensors meets a threshold value indicative of abnormal functioning, automatically performing a corrective action to correct equipment coupled to the sensor.

3. The method of claim 1 , wherein the first object function is solved by a projected gradient algorithm.

4. The method of claim 3 , wherein the projected gradient algorithm embeds an approximate Newton method, wherein feasibility with respect to sparsity constraint is handled via projection, and a symmetric positive-definiteness of iterates is ensured through a line-search procedure.

5. The method of claim 1 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a conditional expected Kullback-Liebler divergence between the first dependency graph and the second dependency graph.

6. The method of claim 1 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a stochastic nearest neighbors algorithm measuring dissimilarity between neighborhood of i-th variable representing a sensor between the first dependency graph and the second dependency graph.

7. The method of claim 1 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a sparsest subgraph approximation based on the first dependency graph and the second dependency graph.

8. The method of claim 1 , wherein the equipments comprise equipments of an industrial process.

9. The method of claim 1 , wherein the equipments comprise equipments of a manufacturing process manufacturing a product.

10. A computer readable storage device storing a program of instructions executable by a machine to perform a method comprising:
receiving a first data set comprising sensor data detected by a plurality of sensors coupled to equipments in operation during a first period of time;
constructing a first dependency graph based on the first data set by solving a first objective function constrained with a maximum number of non-zeros and formulated with a regularization term comprising a first quadratic penalty to control sparsity, wherein the first quadratic penalty is determined as a function of the first data set in constructing the first dependency graph;
receiving a second data set comprising sensor data detected by the plurality of sensors coupled to the equipments in operation during a second period of time;
constructing a second dependency graph based on the second data set by solving the first objective function constrained with the maximum number of non-zeros and formulated with the regularization term comprising a second quadratic penalty, wherein the second quadratic penalty is determined as a function of the first data set and the second data set in constructing the second dependency graph; and
determining an anomaly score for each of the plurality of sensors based on comparing the first dependency graph and the second dependency graph.

11. The computer readable storage device of claim 10 , further comprising:
responsive to determining that an anomaly score associated with a sensor in the plurality of sensors meets a threshold value indicative of abnormal functioning, automatically performing a corrective action to correct equipment coupled to the sensor.

12. The computer readable storage device of claim 10 , wherein the first object function is solved by a projected gradient algorithm.

13. The computer readable storage device of claim 12 , wherein the projected gradient algorithm embeds an approximate Newton method, wherein feasibility with respect to sparsity constraint is handled via projection, and a symmetric positive-definiteness of iterates is ensured through a line-search procedure.

14. The computer readable storage device of claim 10 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a conditional expected Kullback-Liebler divergence between the first dependency graph and the second dependency graph.

15. The computer readable storage device of claim 10 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a stochastic nearest neighbors algorithm measuring dissimilarity between neighborhood of i-th variable representing a sensor between the first dependency graph and the second dependency graph.

16. The computer readable storage device of claim 10 , wherein the determining of the anomaly score for each of the plurality of sensors comprises implementing a sparsest subgraph approximation based on the first dependency graph and the second dependency graph.

17. A system, comprising:
a hardware processor coupled with a communication interface;
a memory device coupled to the hardware processor;
the hardware processor operable to receive via the communication interface, a first data set comprising sensor data detected by a plurality of sensors coupled to equipments in operation during a first period of time;
the hardware processor operable to construct a first dependency graph based on the first data set by solving a first objective function constrained with a maximum number of non-zeros and formulated with a regularization term comprising a first quadratic penalty to control sparsity, wherein the first quadratic penalty is determined as a function of the first data set in constructing the first dependency graph;
the hardware processor operable to receive a second data set comprising sensor data detected by the plurality of sensors coupled to the equipments in operation during a second period of time;
the hardware processor operable to construct a second dependency graph based on the second data set by solving the first objective function constrained with the maximum number of non-zeros and formulated with the regularization term comprising a second quadratic penalty, wherein the second quadratic penalty is determined as a function of the first data set and the second data set in constructing the second dependency graph; and
the hardware processor operable to determine an anomaly score for each of the plurality of sensors based on comparing the first dependency graph and the second dependency graph.

Assignees

• IBM

Inventors

• Phan Dzung
• Menickelly Matthew
• Kalagnanam Jayant R
• Ide Tsuyoshi

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06N7/02 Primary

  using fuzzy logic (computing arrangements based on biological models G06N3/00; computing arrangements using knowledge-based models G06N5/00) · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title