Anomaly detection system and a method of teaching it

• US 20030225520A1
• Filed: 03/07/2003
• Published: 12/04/2003
• Est. Priority Date: 09/11/2000
• Status: Active Grant

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Sorvari, Antti, Hoglund, Albert, Hatonen, Kimmo
• Granted Patent: US 7,613,668 B2
• Time in Patent Office: Days
• US Class Current: 702/1
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/08 Learning methods

Abstract

A method for teaching an anomaly detecting mechanism in a system comprising observable elements (302), at least one of which has a periodic time-dependent behaviour, the anomaly detecting mechanism comprising a computerized learning mechanism (314). The method comprises assembling indicators (304) indicating the behaviour of the elements (302) and arranging the assembled indicators such that each observable element'"'"'s indicators are assigned to the same input data component. The learning mechanism (314) is taught so that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators (304). Points which approximate the input data are placed in the input space. A presentation of time (420-424) is incorporated into at least one input data component wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with periodic time-dependent behaviour.

Claims

1. A method for teaching an anomaly detecting mechanism in a system comprising observable elements, at least one of which has a periodic time-dependent behaviour, the anomaly detecting mechanism comprising a computerized learning mechanism having an input space for defining input data consisting of input data components;

the method comprising the following steps;

assembling indicators indicating the behaviour of the observable elements and arranging the assembled indicators such that each observable element'"'"'s indicators are assigned to the same input data component;

teaching the learning mechanism such that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators; and

placing points which approximate the input data in the input space;

incorporating a presentation of time into at least one input data component;

wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with periodic time-dependent behaviour.

2. A method according to claim 1, wherein the learning mechanism is or comprises a self-organizing map.

3. A method according to claim 1, wherein the presentation of time has a first period and at least one second period which is a multiple of the first period.

4. A method according to claim 1, further comprising scaling the input data components such that each has the same variance, preferably one.

5. A method according to claim 1, wherein the presentation of time has a variable resolution such that one bit corresponds to different units of time depending on the changes in the time-dependent behaviour.

10. A computer readable storage medium comprising software for a computer, wherein executing the software in the computer causes the computer to carry out the steps of claim 1.

6. An arrangement for detecting anomalies in a system comprising observable elements, at least one of which has a periodic time-dependent behaviour;

the arrangement comprising;

a computerized learning mechanism having an input space for defining input data consisting of input data components;

means for assembling indicators indicating the behaviour of the observable elements and arranging the assembled indicators such that each observable element'"'"'s indicators are assigned to the same input data component;

means for teaching the learning mechanism such that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators;

means for placing points which approximate the input data in the input space;

at least one input data component comprising a presentation of time;

wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with periodic time-dependent behaviour.

7. An arrangement according to claim 6, wherein the learning mechanism is or comprises a self-organizing map.

8. An arrangement according to claim 6, wherein the presentation of time has a first period and at least one second period which is a multiple of the first period.

9. An arrangement according to claim 6, wherein the arrangement is comprised in a single network element.