Systems and methods for data-driven anomaly detection
First Claim
1. A computer-implemented method for data-driven anomaly detection, the method comprising:
- receiving, by a processor, a data set comprising data captured from one or more sensors monitoring an automated system;
identifying, by the processor, a region of interest data subset of the input data set based on a dimensionality reduction technique and a change point detection algorithm, wherein the region of interest data subset has at least one different characteristic from remainder of the input data set;
mapping, by the processor, the region of interest data subset to a predefined group of reference data representing normal sensor data of a mode of operation of the automated system, wherein the mapping is based on closeness between a mean vector of the predefined group of the reference data and the data points within the region of interest data subset;
determining, by the processor, whether the data points within the region of interest data subset are outside of a predefined control limit of the corresponding mapped group; and
detecting, by the processor, at least one abnormal event by applying a heuristic algorithm on the data points within the region of interest which are outside the control limit.
1 Assignment
0 Petitions
Accused Products
Abstract
The technique relates to a system and method for data-driven anomaly detection. This technique involves identifying region of interest from the data based on dimensionality reduction technique and change point detection algorithm. A reference data can be obtained separately or can be obtained from the test data also, wherein the reference data represent the normal operating condition of a system. The reference data are classified into different groups representing different modes of operation of the system. A control limit is determined for the different groups. The data within the region of interest are mapped with the different groups of the reference data and it is determined if the mapped data fall outside of the control limit of the mapped group. Finally, at least one abnormal event is detected by applying a heuristic algorithm on the data within the region of interest which are outside the control limit.
-
Citations
20 Claims
-
1. A computer-implemented method for data-driven anomaly detection, the method comprising:
-
receiving, by a processor, a data set comprising data captured from one or more sensors monitoring an automated system; identifying, by the processor, a region of interest data subset of the input data set based on a dimensionality reduction technique and a change point detection algorithm, wherein the region of interest data subset has at least one different characteristic from remainder of the input data set; mapping, by the processor, the region of interest data subset to a predefined group of reference data representing normal sensor data of a mode of operation of the automated system, wherein the mapping is based on closeness between a mean vector of the predefined group of the reference data and the data points within the region of interest data subset; determining, by the processor, whether the data points within the region of interest data subset are outside of a predefined control limit of the corresponding mapped group; and detecting, by the processor, at least one abnormal event by applying a heuristic algorithm on the data points within the region of interest which are outside the control limit. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A system for data-driven anomaly detection, comprising:
-
a plurality of sensors monitoring an automated system; a processor in operable communication with a processor-readable storage medium, the processor-readable storage medium containing one or more programming instructions whereby the processor is configured to implement; a region of interest identification module configured to receive input data obtained from the plurality of sensors and identify a region of interest data subset from the input data based on a dimensionality reduction technique and a change point detection algorithm, wherein the region of interest data subset is a portion of the input data; a mapping module configured to map the region of interest data subset with one or more predefined groups of reference data representing one or more modes of operation of a system based on closeness between a mean vector of the respective one or more predefined groups of reference data and the data within the region of interest data subset, wherein the reference data represent normal operating conditions of the system; a data analysis module configured to determine whether the data points within the region of interest data subset are outside of a control limit calculated based on the corresponding mapped group of the one or more predefined groups, wherein the determination identifies if the data within the region of interest is below a lower control limit or above an upper control limit; and an abnormal event detection module configured to detect at least one abnormal event by applying a heuristic algorithm on the data points within the region of interest data subset which are outside the control limit. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon for data-driven anomaly detection, the instructions comprising:
-
instructions for identifying a region of interest data subset from input data captured from one or more sensors monitoring an automated system based on a dimensionality reduction technique and a change point detection algorithm, wherein the region of interest data subset is a data subset of the input data and is calculated at least in part from a multi-modal pattern via cumulative sums of differences from the mean of the input data; instructions for mapping the region of interest data subset with at least one group of reference data from one or more predefined groups of reference data representing one or more modes of operation of a system based on closeness between a mean vector of the respective groups of reference data and the data points within the region of interest data subset, wherein the reference data represent normal operating conditions of the system; instructions for determining whether the data points within the region of interest data subset are outside of a control limit of the corresponding mapped at least one group of reference data of the one or more predefined groups of reference data, wherein the determination identifies if the data points within the region of interest data subset are below a lower control limit or above an upper control limit as determined based on the data of the corresponding mapped at least one group of reference data; and instructions for detecting at least one abnormal event by applying a heuristic algorithm on the data points within the region of interest data subset which are outside the control limit. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification