Anomaly detection using deep learning on time series data

Patent metadata

Field	Value
Publication number	US-11494618-B2
Application number	US-201916558639-A
Country	US
Kind code	B2
Filing date	Sep 3, 2019
Priority date	Sep 4, 2018
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

Methods and systems for detecting and correcting anomalies include comparing a new time series segment, generated by a sensor in a cyber-physical system, to previous time series segments of the sensor to generate a similarity measure for each previous time series segment. It is determined that the new time series represents anomalous behavior based on the similarity measures. A corrective action is performed on the cyber-physical system to correct the anomalous behavior.

First claim

What is claimed is:

1. A method for detecting and correcting anomalies comprises:
generating a hash code for a new time series segment, generated by a sensor in a cyber-physical system, and for each of a plurality of previous time series segments of the sensor, by applying a sign function to each value in a vector of feature values to generate a hash vector that has a same dimensionality as the vector of feature values;
comparing the new time series segment to the plurality of previous time series segments to generate a similarity measure for each previous time series segment by determining a distance between the hash code for each previous time series segment and the new time series segment;
determining that the new time series segment represents anomalous behavior based on the similarity measures; and
performing a corrective action on the cyber-physical system to correct the anomalous behavior, the corrective action being selected from the group consisting of changing a security setting for an application or hardware component of the cyber-physical system, halting or rebooting a hardware component of the cyber-physical system, changing an environmental condition of the cyber-physical system, and changing status of a network interface of the cyber-physical system.

2. The method of claim 1 , wherein determining the distance comprises determining a Hamming distance between respective hash codes.

3. The method of claim 1 , wherein determining that the new time series segment represents anomalous behavior includes:
identifying a lowest distance among the determined distances between hash code of the new time series segment and the hash codes of the previous time series segments; and
comparing the lowest distance to a threshold value.

4. The method of claim 3 , wherein determining that the new time series segment represents anomalous behavior further includes determining that the lowest distance is above the threshold value.

5. The method of claim 3 , further comprising determining the threshold value by determining a Hamming distance between hash codes of each of the previous time series segments and selecting a highest Hamming distance as the threshold.

6. The method of claim 1 , wherein comparing comprises determining features of the new time series segment by weighting portions of the new time series segment according to an input attention neural network layer.

7. The method of claim 6 , wherein determining features further includes combining information from different portions of the new time series segment using long-short term memory neural network layers.

8. A system for detecting and correcting anomalies comprises:
an anomaly detector configured to generate a hash code for a new time series segment, generated by a sensor in a cyber-physical system, and for each of a plurality of previous time series segments of the sensor, by applying a sign function to each value in a vector of feature values to generate a hash vector that has a same dimensionality as the vector of feature values, to compare the new time series segment to the plurality of previous time series segments to generate a similarity measure for each previous time series segment by determining a distance between the hash code for each previous time series segment and the new time series segment, and to determine that the new time series segment represents anomalous behavior based on the similarity measures; and
a controller configured to perform a corrective action on the cyber-physical system to correct the anomalous behavior, the corrective action being selected from the group consisting of changing a security setting for an application or hardware component of the cyber-physical system, halting or rebooting a hardware component of the cyber-physical system, changing an environmental condition of the cyber-physical system, and changing status of a network interface of the cyber-physical system.

9. The system of claim 8 , wherein the anomaly detector is further configured to determine a Hamming distance between respective hash codes.

10. The system of claim 8 , wherein the anomaly detector is further configured to identify a lowest distance among the determined distances between hash code of the new time series segment and the hash codes of the previous time series segments and to compare the lowest distance to a threshold value.

11. The system of claim 10 , wherein the anomaly detector is further configured to determine that the lowest distance is above the threshold value.

12. The system of claim 10 , wherein the anomaly detector is further configured to determine a Hamming distance between hash codes of each of the previous time series segments and to select a highest Hamming distance as the threshold.

13. The system of claim 8 , wherein the anomaly detector is further configured to determine features of the new time series segment by weighting portions of the new time series segment according to an input attention neural network layer.

14. The system of claim 13 , wherein the anomaly detector is further configured to combine information from different portions of the new time series segment using long-short term memory neural network layers.

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Xia Ning
• Song Dongjin
• Chen Haifeng

Classifications

• G06N3/042 Primary

  Knowledge-based neural networks; Logical representations of neural networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• G06N3/084

  Backpropagation, e.g. using gradient descent · CPC title