System and method for detecting and predicting anomalies based on analysis of time-series data

Patent metadata

Field	Value
Publication number	US-9952921-B2
Application number	US-201414582746-A
Country	US
Kind code	B2
Filing date	Dec 24, 2014
Priority date	Oct 10, 2014
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

Provided are a system and method for detecting and predicting anomalies based on analysis of time-series data. According to an embodiment of the present disclosure, an abnormality detecting and predicting system includes a database configured to store past case data related to a state of a monitored object; a data collector configured to collect time-series status information of the monitored object; an abnormality detector configured to compare the status information with an abnormality detecting reference in a preset detecting interval and detect an occurrence of an abnormality of the monitored object; a similar case selector configured to select a similar case having a highest degree of similarity to the status information among the past case data when the occurrence of an abnormality is detected by the abnormality detector; and a predictor configured to predict proliferation or diminishing of a detected abnormality using the similar case and an abnormality proliferation predicting reference.

First claim

What is claimed is:

1. An abnormality detecting and predicting system, comprising:
a database configured to store past case data related to a state of a monitored object;
a data collector configured to collect status information from the monitored object;
an abnormality detector configured to compare the status information, in a preset detecting interval, with an abnormality detecting reference, and to detect an occurrence of an abnormality of the monitored object;
a similar case selector configured to select a first case having a highest degree of similarity to the status information among the past case data when the occurrence of the abnormality is detected by the abnormality detector;
a predictor configured to predict proliferation or diminishing of the detected abnormality after the occurrence of the detected abnormality, by using the first case and an abnormality proliferation predicting reference; and
an abnormality detecting reference updater configured to adjust a length of the preset detecting interval based on a prediction result of the predictor and a change of the status information in a preset verification interval,
wherein the abnormality detector is further configured to transmit a warning message to an administrator in response to the occurrence of the abnormality of the monitored object,
wherein the past case data includes the monitored object's pattern of changing status information over time when a past abnormality is detected and information of the detected past abnormality either proliferating or diminishing in a corresponding case,
wherein the preset verification interval corresponds to one of a first interval starting from a time of the occurrence of the abnormality in the preset detecting interval and ending at an additional preset time interval after an ending of the preset detecting interval, and a second interval which starts from the ending of the preset detecting interval and ending after the additional preset time interval, and
wherein the data collector, the abnormality detector, the similar case selector, and the predictor are executed by at least one central processing unit (CPU) or at least one hardware processor.

2. The system of claim 1 , wherein the abnormality detecting reference comprises:
the length of the preset detecting interval;
a threshold value of the occurrence of an abnormality; and
at least one reference pattern of abnormality detection.

3. The system of claim 2 , wherein the abnormality detector determines that the abnormality has occurred in the monitored object when there is at least one value exceeding the threshold value of the occurrence of the abnormality in the status information in the preset detecting interval, or the status information matches the at least one reference pattern of the abnormality detection.

4. The system of claim 1 , wherein the warning message is one of a visual message and an auditory message.

5. The system of claim 1 , wherein the similar case selector compares one or more patterns of the past case data with a pattern of the status information in the preset detecting interval, and selects an optimal past case data having a highest degree of similarity to the pattern of the status information as the first case.

6. The system of claim 1 , wherein the predictor predicts that a detected abnormality is proliferated when the first case is relevant to an abnormality proliferating case or the status information satisfies the abnormality proliferation predicting reference, and predicts that the detected abnormality diminishes when the first case is relevant to an abnormality diminishing case and the status information does not satisfy the abnormality proliferation predicting reference, to yield the prediction result.

7. The system of claim 6 , wherein the predictor determines that the abnormality proliferation predicting reference is satisfied when an average value of the status information in the preset detecting interval exceeds a preset threshold value of abnormality detection, or more than a predetermined number of values exceeding a threshold value of the occurrence of the abnormality are included in the status information in the preset detecting interval.

8. The system of claim 1 , wherein the abnormality detecting reference updater compares one or more patterns of the past case data with a pattern of the status information in the preset verification interval, and adjusts the length of the preset detecting interval based on the prediction result and proliferation or diminishing of the abnormality using the past case data having a highest similarity to the pattern of the status information in the preset verification interval.

9. A method of detecting and predicting an abnormality, comprising:
collecting status information from a monitored object;
comparing the status information and an abnormality detecting reference in a preset detecting interval, and detecting an occurrence of an abnormality of the monitored object;
selecting a first case having a highest degree of similarity to the status information among past case data when the occurrence of the abnormality is detected;
predicting proliferation or diminishing of the detected abnormality after the occurrence of the detected abnormality, by using the first case and an abnormality proliferation predicting reference;
adjusting a length of the preset detecting interval based on a prediction result and a change of the status information in a preset verification interval; and
transmitting a warning message to an administrator in response to the occurrence of the abnormality of the monitored object,
wherein the past case data includes the monitored object's pattern of changing status information over time when a past abnormality is detected and information of the detected past abnormality either proliferating or diminishing in a corresponding case, and
wherein the preset verification interval corresponds to one of a first interval starting from a time of the occurrence of the abnormality in the preset detecting interval and ending at an additional preset time interval after an ending of the preset detecting interval, and a second interval which starts from the ending of the preset detecting interval and ending after the additional preset time interval.

10. The method of claim 9 , wherein the abnormality detecting reference comprises:
the length of the preset detecting interval;
a threshold value of the occurrence of an abnormality; and
at least one reference pattern of abnormality detection.

11. The method of claim 10 , wherein the detecting of the occurrence of the abnormality includes determining that the abnormality has occurred in the preset detecting interval when one or more values in the status information exceed the threshold value of the occurrence of the abnormality in the preset detecting interval, or the status information matches the at least one reference pattern of the abnormality detection.

12. The method of claim 9 , wherein
the warning message is one of a visual message and an auditory message.

13. The method of claim 9 , wherein the selecting of the first case includes comparing one or more patterns of the past case data with a pattern of the status information in the preset detecting interval, and selecting an optimal past case data having a highest degree of similarity to the pattern of the status information as the first case.

14. The method of claim 9 , wherein the predicting includes predicting that a detected abnormality is proliferated when the first case is relevant to an abnormality proliferating case or the status information satisfies the abnormality proliferatio

Assignees

• Samsung Sds Co Ltd

Inventors

• Kim Sundeuk
• Oh Hyuntaek
• Kim Sungil

Classifications

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/008

  Reliability or availability analysis · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0787

  Storage of error reports, e.g. persistent data storage, storage using memory protection · CPC title