SYSTEM AND METHOD FOR DEFINING NORMAL OPERATING REGIONS AND IDENTIFYING ANOMALOUS BEHAVIOR OF UNITS WITHIN A FLEET, OPERATING IN A COMPLEX, DYNAMIC ENVIRONMENT

• US 20080091630A1
• Filed: 05/31/2007
• Published: 04/17/2008
• Est. Priority Date: 05/31/2006
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Bonissone, Piero, Yan, Weizhong, Goebel, Kai, Varma, Anil, Iyer, Naresh
• Granted Patent: US 7,937,334 B2
• Time in Patent Office: Days
• US Class Current: 706/45
• CPC Class Codes: G05B 23/024 Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

Monitoring dynamic units that operate in complex, dynamic environments, is provided in order to classify and track unit behavior over time. When domain knowledge is available, feature-based models may be used to capture the essential state information of the units. When domain knowledge is not available, raw data is relied upon to perform this task. By analyzing logs of event messages (without having access to their data dictionary), embodiments allow the identification of anomalies (novelties). Specifically, a Normalized Compression Distance (such as one based on Kolmogorov Complexity) may be applied to logs of event messages. By analyzing the similarity and differences of the event message logs, units are identified that did not experience any abnormality (and locate regions of normal operations) and units that departed from such regions. Of particular interest is the detection and identification of units'"'"' epidemics, which is defined as sustained/increasing numbers of anomalies over time.

Claims

1. A method to monitor dynamic units that operate in complex, dynamic environments comprising:

collecting raw data to capture state information of the units;

analyzing the raw data to identify anomalies;

identifying abnormalities and regions of normal operations associated with units; and

detecting/identifying units'"'"' epidemics.

2. The method of claim 1, wherein the raw data comprises event message logs.

3. The method of claim 1, wherein analyzing the raw data to identify anomalies comprises determining a Normalized Compression Distance to determine similarity and differences of the raw data.

4. The method of claim 3, wherein the Normalized Compression Distance is computed using Kolmogorov Complexity.

5. The method of claim 1, wherein an epidemic comprises sustained/increasing numbers of anomalies over time.

6. The method of claim 1, wherein the raw data comprises FADEC messages associated with a fleet of aircraft.

7. The method of claim 1, wherein the units comprise CT scanners.

8. The method of claim 1, further comprising:

capturing state information of the units when domain knowledge is available with a feature-based models; and

analyzing the state information to identify anomalies.

9. The method of claim 8, wherein identifying abnormalities and regions of normal operations associated with units comprises combining:

featureless similarity based anomaly detection;

feature-based similarity based anomaly detection; and

statistical parametric analysis.

10. A method to monitor dynamic units that operate in complex, dynamic environments comprising:

capturing state information of the units when domain knowledge is available with a feature-based models; and

performing feature-based similarity based anomaly detection on the state information to identify anomalies;

collecting raw data to capture state information of the units;

performing featureless similarity based anomaly detection on the raw data to identify anomalies;

collecting statistical parametric data associated with the units;

performing statistical parametric based anomaly detection on the statistical parametric data to identify anomalies;

identifying abnormalities and regions of normal operations associated with units comprises combining;

featureless similarity based anomaly detection;

feature-based similarity based anomaly detection; and

statistical parametric analysis; and

detecting/identifying units'"'"' epidemics.

11. The method of claim 10, wherein the raw data comprises event message logs.

12. The method of claim 10, wherein analyzing the raw data to identify anomalies comprises determining a Normalized Compression Distance to determine similarity and differences of the raw data.

13. The method of claim 12, wherein the Normalized Compression Distance is computed using Kolmogorov Complexity.

14. The method of claim 10, wherein an epidemic comprises sustained/increasing numbers of anomalies over time.

15. The method of claim 10, wherein the raw data comprises FADEC messages associated with a fleet of aircraft.

16. The method of claim 10, wherein the units comprise CT scanners.

17. A method to monitor dynamic units of a fleet that operates in complex, dynamic environments comprising:

capturing state information of the units when domain knowledge is available with a feature-based models; and

performing feature-based similarity based anomaly detection on the state information to identify anomalies;

collecting event message logs to capture state information of the units;

performing featureless similarity based anomaly detection on the event message logs to identify anomalies;

collecting statistical parametric data associated with the units;

performing statistical parametric based anomaly detection on the statistical parametric data to identify anomalies;

identifying abnormalities and regions of normal operations associated with units comprises combining;

featureless similarity based anomaly detection;

feature-based similarity based anomaly detection; and

statistical parametric analysis; and

detecting/identifying units'"'"' epidemics.

18. The method of claim 17, wherein analyzing the event message logs to identify anomalies comprises determining a Normalized Compression Distance to determine similarity and differences of the raw data.

19. The method of claim 18, wherein the Normalized Compression Distance is computed using Kolmogorov Complexity.

20. The method of claim 17, wherein an epidemic comprises sustained/increasing numbers of anomalies over time.

21. The method of claim 17, wherein the raw data comprises FADEC messages associated with a fleet of aircraft.

22. The method of claim 17, wherein the units comprise CT scanners.