Multi-layer anomaly detection framework

• US 10,372,120 B2
• Filed: 10/06/2016
• Issued: 08/06/2019
• Est. Priority Date: 10/06/2016
• Status: Active Grant

• Current Assignee: GE Digital Holdings LLC (GE Vernova, Inc.)
• Original Assignee: General Electric Company
• Inventors: Patil, Sundeep R, Kapil, Ansh, Sagel, Alexander, Michael, Lutter, Baptista, Oliver, Kleinsteuber, Martin
• Primary Examiner(s): Nguyen, Lam S
• Application Number:
  US15/287,249
• Publication Number:
  US 20180100784A1
• Time in Patent Office: 1,034 Days
• Field of Search: 701104, 702176
• CPC Class Codes: G05B 23/0235 based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold
• CPC Class Codes: G05B 23/0243 model based detection method, e.g. first-principles knowledge model
• CPC Class Codes: G05B 23/0281 Quantitative, e.g. mathematical distance; Clustering; Neural networks; Statistical analysis

Abstract

According to some embodiments, a system and method are provided to receive a first plurality of data from a machine associated with a first time period. A normal operation of the machine is automatically determined based on the first plurality of data. A second plurality of data may be received from the machine associated with a second time period. An anomaly in the second plurality of data is determined.

Claims

1. A method of determining an anomaly associated with an engine, the method comprising:

receiving, from the engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders;

automatically determining, via a processor, a normal operation of the engine based on the first plurality of time-series data, wherein the automatically determining of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements;

receiving a second plurality of time-series data from the engine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors;

automatically determining an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors.

2. The method of claim 1, further comprising:

receiving a plurality of data associated with the anomaly;

determining if the anomaly is a known anomaly;

in a case that the anomaly is a known anomaly, transmitting a notification of the known anomaly; and

in a case that the anomaly is an unknown anomaly, transmitting a request for feedback to an end user.

3. The method of claim 2, further comprising:

determining a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly;

receiving feature vectors based on an output of the shapelet transform; and

feeding the feature vectors into a classifier where the classifier returns an anomaly class.

4. A non-transitory computer-readable medium comprising instructions that are executable by a processor to perform a method of creating a framework to automatically detect anomalies, the method comprising:

creating, via a processor, a first layer to

receive, from an engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders,

automatically determine a normal operation of the engine based on the first plurality of time-series data, wherein the automatic determination of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements,

receive a second plurality of time-series data from the machine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors, and

determine an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors;

creating, via the processor, a second layer to receive a plurality of data associated with the anomaly, determine if the anomaly is a known anomaly where in a case that the anomaly is a known anomaly, transmit a notification of the known anomaly and, in a case that the anomaly is an unknown anomaly, transmit a request for feedback to an end user.

5. The medium of claim 4, wherein the second layer determines a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly, receiving feature vectors based on an output of the shapelet transform and inputting the feature vectors into a classifier where the classifier returns an anomaly class.

6. A system for early detection of problems associated with a machine, the system comprising:

a processor;

a non-transitory computer-readable medium comprising instructions executable by the processor to perform a method to automatically detect anomalies, the method comprising;

receiving, from an engine, a first plurality of time-series data associated with a first time period, wherein at least a portion of the first plurality of time-series data comprises first sensor measurements from a plurality of sensors for a plurality of cylinders of the engine, each of the plurality of sensors corresponding to a respective cylinder of the plurality of cylinders;

automatically determining, via the processor, a normal operation of the engine based on the first plurality of data, wherein the automatic determination of the normal operation comprises an unsupervised creation of one or more models based on the first plurality of time-series data and an aggregation of the first sensor measurements;

receiving a second plurality of time-series data from the engine associated with a second time period, wherein at least a portion of the second plurality of time-series data comprises second sensor measurements from the plurality of sensors; and

determining an anomaly in the second plurality of time-series data based on comparing the second plurality of time-series data with the normal operation of the engine to at least detect one or more deviations in the sensor measurements for individual sensors of the plurality of sensors.

7. The system of claim 6, further comprising instructions for:

receiving a plurality of data associated with the anomaly;

determining if the anomaly is a known anomaly;

in a case that the anomaly is a known anomaly, transmitting a notification of the known anomaly; and

in a case that the anomaly is an unknown anomaly, transmitting a request for feedback to an end user.

8. The system of claim 7, further comprising instructions for:

determining a cause of the anomaly by applying a nonlinear shapelet transform to the plurality of data associated with the anomaly;

receiving feature vectors based on an output of the shapelet transform; and

feeding the feature vectors into a classifier where the classifier returns an anomaly class.