Method and systems for anomaly detection

• US 20060101402A1
• Filed: 10/15/2004
• Published: 05/11/2006
• Est. Priority Date: 10/15/2004
• Status: Abandoned Application

• Current Assignee: ETAS, Inc. (Robert Bosch GmbH), Robert Bosch GmbH
• Original Assignee: ETAS, Inc. (Robert Bosch GmbH), Robert Bosch GmbH
• Inventors: Liu, Jianbo, Djurdjanovic, Dragan, Miller, William L.
• Application Number:
  US10/967,102
• Publication Number:
  US 20060101402A1
• Time in Patent Office: Days
• US Class Current: 717/124
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

A system for detecting anomalies includes a first hardware system and a first run-time environment. The first hardware system generates outputs. The first run-time environment has a bi-directional link to an integrated development environment. The first run-time environment includes a first control system, a first diagnostic agent, and a second diagnostic agent. The first control system controls the hardware system through control inputs to the hardware system. The first diagnostic agent detects anomalies in the hardware system. The second diagnostic agent detects anomalies in the control system. A method of detecting anomalies in a system including an integrated development environment and a run-time environment bi-directionally linked by a link includes partitioning the run-time environment into at least one operational region; learning normal operating behaviors within the operational region; monitoring current operating behaviors within the operational region during operation of the system; comparing the current operating behaviors to the normal operating behaviors; detecting anomalies when a deviation exists between the current operating behaviors and the normal operating behaviors; tracing the anomalies back to the integrated development environment; and identifying the anomalies in the integrated development environment based on the tracing of the anomalies.

Claims

1. A system for detecting anomalies, the system comprising:

a first hardware system that generates outputs;

a first run-time environment having a bi-directional link to an integrated development environment, the first run-time environment including;

a first control system that controls the hardware system through control inputs to the hardware system;

a first diagnostic agent for detecting anomalies in the hardware system; and

a second diagnostic agent for detecting anomalies in the control system;

wherein the first and second diagnostic agents can detect anomalies by detecting gradual degradation of the performance of the system by comparing current operating behavior to normal operating behavior within the first run-time environment and tracing the anomalies back to the integrated development environment through the bi-directional link.

2. A system according to claim 1, wherein:

the integrated development environment includes a collection of software and hardware development tools operating within the integrated development environment that enable deployment of the first and second diagnostic agents into the run-time environment.

3. A system according to claim 1, further comprising:

a second hardware system that generates outputs;

a second run-time environment having a bi-directional link to the integrated development environment, the second run-time environment including;

a second control system that controls the hardware system through control inputs to the hardware system;

a third diagnostic agent for detecting anomalies in the hardware system; and

a fourth diagnostic agent for detecting anomalies in the control system;

wherein the third and fourth diagnostic agents can detect anomalies by detecting gradual degradation of the performance of the system by comparing current operating behavior to normal operating behavior within the second run-time environment and tracing the anomalies back to the integrated development environment through the bi-directional link.

4. A system according to claim 1, wherein:

the bi-directional link includes a development run-time development link that is associated with a combination of data-bases and message passing to contain configuration data produced by the integrated development environment and pass the configuration data to the first run-time environment for deployment of the first and second diagnostic agents in the first run-time environment.

5. A system according to claim 4, wherein:

the bi-directional link receives the anomalies from the first run-time environment and passes the anomalies to the integrated development environment.

6. A system according to claim 1, wherein:

the first diagnostic agent includes a plurality of first diagnostic agents; and

the second diagnostic agent includes a plurality of second diagnostic agents.

7. A system according to claim 1, wherein:

the first run-time environment includes a plurality of run-time environments.

8. A method of detecting anomalies in a system including an integrated development environment and a run-time environment bi-directionally linked by a link, the method comprising:

partitioning the run-time environment into at least one operational region;

learning normal operating behaviors within the operational region;

monitoring current operating behaviors within the operational region during operation of the system;

comparing the current operating behaviors to the normal operating behaviors;

detecting anomalies when a deviation exists between the current operating behaviors and the normal operating behaviors;

tracing the anomalies back to the integrated development environment through the link; and

identifying the anomalies in the integrated development environment based on the tracing of the anomalies.

9. A method according to claim 8, wherein:

partitioning the system includes partitioning the system using self-organized maps into at least one operational region.

10. A method according to claim 9, wherein:

partitioning the system includes automated partitioning of the system using self-organized maps into at least one operational region.

11. A method according to claim 8, wherein:

detecting anomalies includes detecting anomalies using time-frequency analysis.

12. A method according to claim 11, wherein:

detecting anomalies includes detecting anomalies with high statistical accuracy using extensions to time-frequency analysis that recognize statistical deviations from the normal operating behaviors.

13. A method according to claim 8, wherein:

partitioning the system includes partitioning the system into at least one operational region called regionalization.

14. A method according to claim 8, wherein:

learning normal operating behaviors includes learning normal operating behaviors within the operational region called training.

15. A method according to claim 8, further comprising:

recognizing the operational region in the integrated development environment.

16. A method according to claim 8, wherein:

partitioning the system includes partitioning the system into at least one operational region that can be observed by a single anomaly detector.

17. A method according to claim 8, wherein:

identifying the anomalies in the integrated development environment based on the tracing of the anomalies includes identifying root causes of the anomalies in the integrated development environment based on the tracing of the anomalies.

18. A system for detecting anomalies in a system including an integrated development environment and a run-time environment bi-directionally linked by a link, the system comprising:

a partition module that partitions the run-time environment into at least one operational region;

a learn module that learns normal operating behaviors within the operational region;

a monitor module that monitors current operating behaviors within the operational region during operation of the system;

a compare module that compares the current operating behaviors to the normal operating behaviors;

a detect module that detects anomalies when a deviation exists between the current operating behaviors and the normal operating behaviors;

a tracing module that traces the anomalies back to the integrated development environment through the link; and

an identify module that identifies the anomalies in the integrated development environment based on the tracing of the anomalies.

19. A system according to claim 18, wherein:

the partition module uses self-organized maps.

20. A system according to claim 18, wherein:

the detect module uses time-frequency analysis.

21. A system according to claim 18, wherein:

the partition module partitions the system into at least one operational region that can be observed by a single anomaly detector.

22. A computer program product readable by a computing system and encoding instructions diagnosing model errors in a system including an integrated development environment and a run-time environment bi-directionally linked by a link, the computer process comprising:

partitioning the run-time environment into at least one operational region;

learning normal operating behaviors within the operational region;

monitoring current operating behaviors within the operational region during operation of the system;

comparing the current operating behaviors to the normal operating behaviors;

detecting anomalies when a deviation exists between the current operating behaviors and the normal operating behaviors;

tracing the anomalies back to the integrated development environment through the link; and

identifying the anomalies in the integrated development environment based on the tracing of the anomalies.

23. A computer program product according to claim 22, wherein:

partitioning the system includes partitioning the system using self-organized maps into at least one operational region.

24. A computer program product according to claim 23, wherein:

partitioning the system includes automated partitioning of the system using self-organized maps into at least one operational region.

25. A computer program product according to claim 22, wherein:

detecting anomalies includes detecting anomalies using time-frequency analysis.

26. A computer program product according to claim 25, wherein:

detecting anomalies includes detecting anomalies with high statistical accuracy using extensions to time-frequency analysis that recognize statistical deviations from the normal operating behaviors.

27. A computer program product according to claim 22, wherein:

partitioning the system includes partitioning the system into at least one operational region called regionalization.

28. A computer program product according to claim 22, wherein:

learning normal operating behaviors includes learning normal operating behaviors within the operational region called training.

29. A computer program product according to claim 22, further comprising:

recognizing the operational region in the integrated development environment.

30. A computer program product according to claim 22, wherein:

partitioning the system includes partitioning the system into at least one operational region that can be observed by a single anomaly detector.

31. A computer program product according to claim 22, wherein:

identifying the anomalies in the integrated development environment based on the tracing of the anomalies includes identifying root causes of the anomalies in the integrated development environment based on the tracing of the anomalies.