Method and system for anomaly detection

• US 20070028219A1
• Filed: 06/16/2006
• Published: 02/01/2007
• Est. Priority Date: 10/15/2004
• Status: Abandoned Application

• Current Assignee: ETAS, Inc. (Robert Bosch GmbH), Robert Bosch GmbH
• Original Assignee: ETAS, Inc. (Robert Bosch GmbH), Robert Bosch GmbH
• Inventors: Marko, Kenneth, Miller, William, Liu, Jianbo, Djurdjanovic, Dragan
• Application Number:
  US11/454,295
• Publication Number:
  US 20070028219A1
• Time in Patent Office: Days
• US Class Current: 717/124
• CPC Class Codes: G05B 23/021 adopting a different treatment of each operating region or a different mode of the monitored system, e.g. transient modes; different operating configurations of monitored system
• CPC Class Codes: G05B 23/0243 model based detection method, e.g. first-principles knowledge model
• CPC Class Codes: G05B 23/0275 Fault isolation and identification, e.g. classify fault; estimate cause or root of failure
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

A system and method for detecting anomalies in a system are described. The system incorporates a diagnostic agent. The diagnostic agent identifies a current operational region of the system and determines current performance based on a local model of normal system performance in that region.

Claims

1. A system for detecting anomalies, the system comprising:

a diagnostic agent comprising;

a regionalization tool responsive to data indicative of system operation, the regionalization tool configured to identify a current operational region;

a performance assessment tool configured to compare actual operational behavior of the system in the current operational region to normal operational behavior of the system in the current operational region;

wherein the normal operational behavior is determined from a local model for the current operational region.

2. The system of claim 1, further comprising:

a first hardware system that generates outputs, the hardware system arranged such that anomalies in the first hardware system are detected by the diagnostic agent;

a first run-time environment having a bi-directional link to an integrated development environment, the first run-time environment including;

a first control system that controls the hardware system through control inputs to the hardware system; and

a second diagnostic agent for detecting anomalies in the control system.

3. The system of claim 2, wherein the first and second diagnostic agents can detect anomalies by detecting gradual degradation of performance of the system.

4. The system of claim 2, wherein:

the integrated development environment includes a collection of software and hardware development tools operating within the integrated development environment that enable deployment of the first and second diagnostic agents into the run-time environment.

5. The system of claim 2, wherein:

the hardware system comprises a plurality of hardware systems.

6. The system of claim 2, wherein:

the diagnostic agent comprises a plurality of diagnostic agents.

7. The system of claim 2, wherein:

the second diagnostic agent comprises a plurality of second diagnostic agents.

8. The system of claim 2, wherein:

the bi-directional link receives the anomalies from the first run-time environment and passes the anomalies to the integrated development environment.

9. The system of claim 1, wherein:

the performance assessment tool generates a performance indicator representative of deviation of the actual operational behavior from the normal operational behavior within the current operational region.

10. The system of claim 9, wherein:

the performance assessment tool detects anomalies based on the performance indicator.

11. The system of claim 1, wherein:

the performance assessment tool sets a threshold on residual error within the current operational region.

12. The system of claim 11, wherein:

the performance assessment tool determines whether the difference in output is within the threshold on residual error.

13. The system of claim 1, wherein:

the regionalization tool is configured to identify a Voronoi cell in a self-organizing map to identify the current operational region.

14. A method of detecting anomalies in a system comprising:

identifying a current operational region of a system, the current operational region selected from a plurality of operational regions;

comparing actual operational behavior of the system with normal operational behavior within the current operational region to calculate a performance indicator, the performance indicator representative of a degree of deviation from the normal operational behavior within the current operational region;

wherein the normal operational behavior is determined from a local model for the current operational region.

15. The method of claim 14, wherein:

identifying includes selecting the current operational region based on current data values of a system input to the system and of an initial condition of an output of the dynamic system.

16. The method of claim 14, wherein:

identifying includes selecting the current operational region generated by vector quantization.

17. The method of claim 16, wherein:

identifying includes selecting the current operational region of a self-organizing map trained in accordance with data indicative of the normal operational behavior.

18. The method of claim 17, wherein:

identifying includes determining a best-matching unit in the self-organizing map for operation of the system.

19. The method of claim 18, wherein:

identifying includes identifying a Voronoi cell in a self-organizing map as the current operational region.

20. The method of claim 14, further comprising:

detecting anomalies based on the performance indicator.

21. The method of claim 14, further comprising:

tracing the anomalies back to an integrated development environment through a link from a run-time environment;

22. The method of claim 21, further comprising:

identifying the anomalies in the integrated development environment based on the tracing of the anomalies.

23. The method of claim 14, wherein:

comparing includes determining whether the difference in output is within the threshold on residual error.

24. A method of training an anomaly detector for a system, the method comprising:

collecting normal operational data indicative of normal operational behavior of a system, the operational data comprising system input data and initial condition data for an output of the system;

partitioning the system into a plurality of operational regions to train a regionalization tool in the anomaly detector in accordance with the normal operational data; and

computing a local model of the normal operational behavior for at least one of the plurality of operational regions of the system.

25. The method of claim 24, wherein:

partitioning incorporates growing structure competitive learning.

26. The method of claim 24, wherein:

partitioning generates a number of operational regions proportional to nonlinearity of the system.

27. The method of claim 24, wherein:

partitioning includes partitioning an operational region having a high relative expected modeling error.

28. The method of claim 24, wherein:

computing includes estimating a local linear model for at least one neighborhood region to the at least one of the plurality of operational regions.

29. The method of claim 24, wherein partitioning includes creating new operational regions in operational regions where the system is highly nonlinear.

30. A computer program product readable by a computing system and encoding instructions diagnosing anomalies in a system, the computer process comprising:

collecting normal operational data indicative of normal operational behavior of a system, the operational data comprising system input data and initial condition data for an output of the system;

partitioning the system into a plurality of operational regions to train a regionalization tool in the anomaly detector in accordance with the normal operational data; and

computing a local model of the normal operational behavior for at least one of the plurality of operational regions of the system;

identifying the current operational region of a system, the current operational region selected from a plurality of operational regions; and

comparing actual operational behavior of the system with normal operational behavior within the current operational region to calculate a performance indicator, the performance indicator representative of a degree of deviation from the normal operational behavior within the current operational region.

31. The computer program product of claim 30, wherein:

partitioning includes growing structure competitive learning.

32. The computer program product of claim 30, wherein:

the computer process further comprises detecting anomalies based on the performance indicator.

33. The computer program product of claim 30, wherein:

comparing includes determining whether the difference in output is within the threshold on residual error.

34. The computer program product of claim 30, wherein:

partitioning incorporates growing structure competitive learning.

35. The computer program product of claim 30, wherein:

partitioning generates a number of operational regions according to normalized local modeling errors.

36. The computer program product of claim 30, wherein:

partitioning includes partitioning an operational region having a high relative expected modeling error.

37. A system for detecting anomalies, the system comprising:

a training agent comprising;

a collection tool configured to collect normal operational data indicative of normal operational behavior of a system, the operational data comprising system input data and initial condition data for an output of the system;

a partition tool configured to separate the system into a plurality of operational regions based on growing structure competitive learning;

a compute tool configured to generate a local model of the normal operational behavior for at least one of the plurality of operational regions of the system;

a diagnostic agent comprising;

a regionalization tool responsive to data indicative of system operation, the regionalization tool configured to identify the current operational region; and

a performance assessment tool configured to compare actual operational behavior of the system in the current operational region to normal operational behavior of the system in the current operational region.

38. A method for detecting anomalies comprising:

collecting normal operational data indicative of normal operational behavior of a system, the operational data comprising system input data and initial condition data for an output of the system;

partitioning the system into a plurality of operational regions based on growing structure competitive learning;

computing a local model of the normal operational behavior for at least one of the plurality of operational regions of the system;

identifying the current operational region of a system, the current operational region selected from a plurality of operational regions; and

comparing actual operational behavior of the system with the normal operational behavior within the current operational region to calculate a performance indicator, the performance indicator representative of a degree of deviation from the normal operational behavior within the current operational region.