Cluster Trending Method for Abnormal Events Detection

• US 20070239629A1
• Filed: 04/10/2006
• Published: 10/11/2007
• Est. Priority Date: 04/10/2006
• Status: Abandoned Application

• Current Assignee: Bo Ling
• Original Assignee: Bo Ling
• Inventors: Ling, Bo
• Application Number:
  US11/308,596
• Publication Number:
  US 20070239629A1
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G05B 23/024 Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence

Abstract

A method and system is provided for detecting abnormal events by utilizing cluster trending construction and analysis mechanism. Two cluster profiles can be constructed: normal profile constructed during system normal operations; and real-time profile constructed during the actual operation of the system being monitored. This method can be used in many applications, including equipment failure detection, control loop performance assessment, plan monitoring, military target detection, etc.

Claims

1. The way that cluster trend is used to detect the abnormal events is unique and new. In particular, a moving window is used to segment the data and the number of clusters in this window is estimated based on unsupervised machine learning mechanism such as ASOM (Adaptive Self-Organizing Maps).

2. The way that normal cluster trend profile is constructed. Specifically, a portion of the total normal data is used to construct the normal profile. The thresholding level is estimated based on the entropy and a small portion of remaining normal data. The thresholding reflects two properties of event indicators:

how dense of the indicators within one window, and if there is a large gap between two groups of indicators.

3. The way that the normal cluster trend profile and actual trend are statistically compared to determine the existence of abnormal events. Theoretically, any statistical hypothesis test algorithms can be used to trigger the abnormal event indicator. Practically, speed and computation complexity must be factored when choosing the method.

4. The way that the number of clusters is used for the detection of abnormal events. Basically, the number of clusters is used as the features associated with the raw data. As the cluster window moves, a sequence of number of clusters is obtained. This sequence of cluster numbers can be treated as a vector or a time series. This vector or series is protected under this patent.

5. Although the present invention only describes the cluster trend in 1D application, i.e., detecting the abnormal event from a single variable. The same logic is valid for multi-variables. For multiple variables, a multi-dimensional clustering algorithm such as multi-dimensional ASOM can be used to estimate the number of clusters in a moving window. The detection procedure detailed here can be used without any changes.

6. When dealing with multi-dimensional data, the cluster trending method can be used to detect the abnormal events embedded in multiple variables. They are grouped together to form a multi-dimensional data vector which is used for clustering. Once abnormal events are detected, the same procedure can be applied to individual variable to identify the source of abnormal events.

7. The event indicators don'"'"'t have to be binary (0 or 1). For certain applications (e.g., data fusion) where continuous values of indicators are desired, the statistical confidence band or other continuous values such as p-value can be used as the indicator values. Sometimes, both continuous or binary values can be mixed to achieve a better detection results.

8. To reduce the false alarms (both positive or negative), this cluster trending based detection method can be combined with some other specialized classification methods. In this case, the cluster trending detection method disclosed here will provide the potential abnormal events. Some specialized classifiers can utilize various features to further discriminate the abnormal events from nuisance events. These features can be any features suitable for the classifiers chosen.

9. This clustering trending method does not have to apply to the raw data. Filtered data can be definitely used. It can be applied to image pixel values. It can also be applied to other data such as features (Fourier, wavelet, etc.). It can also be applied to mixed data (different raw data, different features, etc.). In general, any data with sequential behavior can be used.