Anomaly detection method, program, and system

Patent metadata

Field	Value
Publication number	US-9495330-B2
Application number	US-201313916744-A
Country	US
Kind code	B2
Filing date	Jun 13, 2013
Priority date	Jun 14, 2012
Publication date	Nov 15, 2016
Grant date	Nov 15, 2016

Abstract

A method providing an analytical technique introducing label information into an anomaly detection model. Effective utilization of label information is based on introducing the degree of similarity between samples. Assuming, for example, there is a degree of similarity between normally labeled samples and no similarity between normally labeled and abnormally labeled samples. Also each sensor value is generated by the linear sum of a latent variable and a coefficient vector specific to each sensor. However, the magnitude of observation noise is formulated to vary according to the label information for the sensor values, and set so that normal label≦unlabeled≦anomalously labeled. A graph Laplacian is created based on the degree of similarity between samples, and determines the optimal linear transformation matrix according to a gradient method. A optimal linear transformation matrix is used to calculate an anomaly score for each sensor in the test samples.

First claim

What is claimed is:

1. A computer implemented method to detect an anomaly based on measurement data, the method comprising the steps of:
inputting measurement data having an anomalous or normal label and measurement data having no label as samples;
determining a similarity matrix indicating the relationship between the samples based on the samples;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

2. A method according to claim 1 further comprising: the step of calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

3. A method according to claim 2 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

4. A computer executed program to detect an anomaly based on measurement data, the program executing in a computer the steps of:
inputting measurement data having an anomalous or normal label and measurement data having no label as samples;
determining a similarity matrix indicating the relationship between the samples based on the samples;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

5. A program according to claim 4 further comprising the step of:
calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

6. A program according to claim 5 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

7. A computer implemented system to detect an anomaly based on measurement data, the system comprising:
storage means;
measurement data having an anomalous or normal label and measurement data having no label stored in the storage means as samples;
means for determining a similarity matrix indicating the relationship between the samples based on the samples;
means for defining a penalty based on the similarity matrix and for calculating parameters in accordance with an updating equation having a term reducing the penalty; and
means for calculating a degree of anomaly based on the calculated parameters.

8. A system according to claim 7 further comprising the step of: calculating a graph Laplacian from the similarity matrix prior to the step of calculating the parameters, the step for calculating the parameters using the calculated graph Laplacian.

9. A system according to claim 8 , wherein the penalty based on the similarity is a Mahalanobis distance based on the similarity matrix or graph Laplacian.

Assignees

• IBM

Inventors

• Ide Tsuyoshi
• Morimura Tetsuro
• Tong Bin

Classifications

• G06F2218/12

  Classification; Matching · CPC title

• G06F18/2433 Primary

  Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection · CPC title

• G06F17/18 Primary

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• G06F18/24

  Classification techniques · CPC title

• G01B21/30

  for measuring roughness or irregularity of surfaces · CPC title