Anomaly detection method, program, and system

Patent metadata

Field	Value
Publication number	US-9805002-B2
Application number	US-201615152867-A
Country	US
Kind code	B2
Filing date	May 12, 2016
Priority date	Jun 14, 2012
Publication date	Oct 31, 2017
Grant date	Oct 31, 2017

Abstract

A method providing an analytical technique introducing label information into an anomaly detection model. The method includes the steps of: inputting measurement data having an anomalous or normal label and measurement data having no label as samples; determining a similarity matrix indicating the relationship between the samples based on the samples; defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and calculating a degree of anomaly based on the calculated parameters. The present invention also provides a program and system for detecting an anomaly based on measurement data.

First claim

What is claimed is:

1. A computer implemented method to detect an anomaly based on measurement data, the method comprising the steps of:
inputting measurement data having an anomalous or normal label and measurement data having no label as samples;
determining a similarity matrix indicating the relationship between the samples based on the samples, wherein the similarity matrix is a N×N square matrix, where N is the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

2. The method according to claim 1 , wherein a, b, c, d, e, and f are b≦c≦a, e≦d≦f.

3. The method according to claim 2 , wherein c and f are a value equal to or approximate to a, and e is a value equal to or approximate to b on condition that an unlabeled sampled can be assumed to be a normal sample.

4. The method according to claim 2 , wherein c is a value equal to or approximate to b, and e and f are a value equal to or approximate to d on condition that an unlabeled sampled can be assumed to be an anomalous sample.

5. A computer executed program to detect an anomaly based on measurement data, the program executing in a computer the steps of:
inputting measurement data having an anomalous or normal label and measurement data having no label as samples;
determining a similarity matrix indicating the relationship between the samples based on the samples, wherein the similarity matrix is a N×N square matrix, where N is the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f;
defining a penalty based on the similarity matrix and calculating parameters in accordance with an updating equation having a term reducing the penalty; and
calculating a degree of anomaly based on the calculated parameters.

6. The program according to claim 5 , wherein a, b, c, d, e, and f are b≦c≦a, e≦d≦f.

7. The program according to claim 6 , wherein c and f are a value equal to or approximate to a, and e is a value equal to or approximate to b on condition that an unlabeled sample can be assumed to be a normal sample.

8. The program according to claim 6 , wherein c is a value equal to or approximate to b, and e and f are a value equal to or approximate to d on condition that an unlabeled sample can be assumed to be an anomalous sample.

9. A computer implemented system to detect an anomaly based on measurement data, the system comprising:
storage means;
measurement data having an anomalous or normal label and measurement data having no label stored in the storage means as samples;
means for determining a similarity matrix indicating the relationship between the samples based on the samples, wherein the similarity matrix is a N×N square matrix, where N denotes the number of samples, each row and each column corresponding to samples, an element corresponding to a normal (labeled) sample and a normal sample being positive number a, an element corresponding to a normal sample and an anomalous sample being non-positive number b, an element corresponding to a normal sample and an unlabeled sample being c, an element corresponding to an anomalous sample and an anomalous sample being d, an element corresponding to an anomalous sample and an unlabeled sample being e, and an element corresponding to an unlabeled sample and an unlabeled sample being f;
means for defining a penalty based on the similarity matrix and for calculating parameters in accordance with an updating equation having a term reducing the penalty; and
means for calculating a degree of anomaly based on the calculated parameters.

10. The system according to claim 9 , wherein a, b, c, d, e, and f are b≦c≦a, e≦d≦f.

Assignees

• IBM

Inventors

• Ide Tsuyoshi
• Morimura Tetsuro
• Tong Bin

Classifications

• G06F2218/12

  Classification; Matching · CPC title

• G06F18/2433 Primary

  Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection · CPC title

• G06F17/18 Primary

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• G06F18/24

  Classification techniques · CPC title

• G06K9/6284

  Physics · mapped topic