System, Method and Program for Detecting Anomalous Events in a Utility Network

• US 20120036250A1
• Filed: 08/06/2010
• Published: 02/09/2012
• Est. Priority Date: 08/06/2010
• Status: Active Grant

• Current Assignee: Itron Networked Solutions, Inc. (Itron, Inc.)
• Original Assignee: Silver Spring Networks, Inc. (Itron, Inc.)
• Inventors: Vaswani, Raj, van Greunen, Jana, Dubey, Aditi, Shah, Kunal Pankaj
• Granted Patent: US 8,423,637 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G01D 2204/22 Arrangements for detecting or reporting faults, outages or leaks
• CPC Class Codes: G01D 4/004 Remote reading of utility meters to a fixed location
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: Y02B 90/20 Smart grids as enabling technology in buildings sector smart grids supporting the management or operation of end-user stationary applications in general, or like technologies with no associated climate change mitigation effect Y04S20/00
• CPC Class Codes: Y04S 20/30 Smart metering, e.g. specially adapted for remote reading

Abstract

A utility network communication device is provided to detect whether anomalous events occur with respect to at least one node in a utility network. The communication device has recorded therein threshold operating information and situational operating information. The threshold operating information includes data indicative of configured acceptable operating parameters of the nodes in the utility network based on respective locational information of the nodes. The situational information includes data indicative of configured operation data expected to be received from nodes in the utility network during a predetermined time period, based on a condition and/or event occurring during the predetermined time period. The communication device receives operation data from nodes in the network, and determines whether the received operation data from a node in the network constitutes an anomalous event based on a comparison of the received operation data with (i) the threshold operating information defined for the node and (ii) the situational information. The communication device outputs notification of any determined anomalous event.

Claims

1. A utility network communication device configured to detect anomalous events occurring in connection with at least one node in a utility network, the communication device comprising:

a memory unit having threshold operating information and situational information defined and recorded therein, the threshold operating information including data indicative of configured acceptable operating parameters of nodes in the utility network based on respective locational information of the nodes in the utility network, and the situational information including data indicative of configured operation data expected to be received from nodes in the utility network during a predetermined time period based on at least one of a condition and an event that is occurring during the predetermined time period;

a communication unit configured to receive operation data from nodes in the utility network;

a control unit configured to compare the operation data received from a node in the utility network with (i) the threshold operating information defined for the node from which the operation data was received and (ii) the situational information, and to determine whether the operation data received from the node constitutes an anomalous event based on the comparison of the received operation data with (i) the threshold operating information defined for the node and (ii) the situational information; and

a notification unit configured to output notification of the determined anomalous event.

2. The communication device according to claim 1, wherein the threshold operating information defined for a node in the utility network includes information defining at least one of:

a maximum threshold value of consumption of a commodity in a predetermined time period;

historical operating patterns of the node for which the threshold operating information is defined;

a connection state of the node to a distribution network;

load devices serviceable at the node;

an excessive number of remote connect/disconnects for the node in the utility network;

an excessive number of remote connect/disconnects for a plurality of nodes in a predetermined geographical area in which the node for which the threshold operating information is defined, is located;

an order of requested commands from other nodes in the utility network;

a predetermined order of requested commands receivable from the node with respect to a current operational state of the node;

security credentials of the node for communicating with other nodes in the utility network;

a maximum number of communications to be received by the node from other nodes in the utility network in a predetermined time period;

geographical coordinate information of the node;

a number of other nodes located in a predetermined geographical area in which the node for which the threshold operating information is defined, is located;

a number of other nodes in the utility network being serviced by a common access point as the node for which the threshold operating information is defined;

a number of other nodes in the utility network being serviced by a common distribution device of a distribution network as the node for which the threshold operating information is defined;

operational parameters of a distribution device of a distribution network arranged in a distribution automation system;

a connection/disconnection protocol of a predetermined number of remote terminal units in a predetermined geographic region; and

acceptable operational parameters of a load device serviceable at the node.

3. The communication device according to claim 1, wherein the locational information of a node includes unique information about the node, relative to other nodes in the utility network, such that unique threshold operating information is defined for each node in the utility network based on the unique locational information respectively defined for each node.

4. The communication device according to claim 3, wherein the locational information of a node includes at least one of:

geographic information about a premises at which the node is located;

connection information indicating whether the node is currently connected to a distribution network to receive distribution of a commodity from the distribution network;

residential usage information of the premises at which the node is located;

attribute information of the premises at which the node is located;

premises comparison information indicating a comparative size of the premises at which the node is located relative to other premises at which other nodes in the utility network are located;

load usage information indicating at least one device serviceable at the node;

functional information indicating a functional use of the premises at which the node is located;

periodic usage patterns indicating a historical consumption of a commodity during a predetermined time period;

financial information indicating a current account status with a distribution network to which the node is connected to receive distribution of a commodity distributed by the distribution network; and

construction information indicating at least one of a construction date and a repair date of the premises at which the node is located.

5. The communication device according to claim 1, wherein the situational information defines operation data expected to be received during the predetermined time period based on at least one of an event-based, operational-based, seasonal-based and weather-based condition occurring at the predetermined time period.

6. The communication device according to claim 5, wherein the situational information includes an adjustment value for operational parameters defined in the threshold operating information for a node based on the at least one of the event-based, operational-based, seasonal-based and weather-based condition occurring at the predetermined time period.

7. The communication device according to claim 1, wherein the at least one node is a utility network interface device associated with a utility meter.

8. The communication device according to claim 1, wherein the control unit is configured to:

compare the operation data received from a node with the threshold operating information defined for the node from which the operation data was received;

determine whether the received operation data represents an acceptable operating condition based on the comparison of the received operation data with the threshold operating information;

compare the received operation data with the situational information, if the control unit determines that the received operation data represents an acceptable operating condition based on the comparison of the received operation data with the threshold operating information;

determine whether the received operation data represents operation data that is expected to be received based on the comparison of the received operation data with the situational information;

determine that the received operation data represents an anomalous event, if the control unit determines that the received operation data does not represent expected operation data based on the comparison of the received operation data with the threshold operating information;

determine whether acceptable operating parameters included in the threshold operating information defined for the node are altered by the situational information, if the control unit determines that the received operation data does not represent an acceptable operating condition based on the comparison of the received operation data with the threshold operating information;

determine that the received operation data represents an anomalous event, if the control unit determines that the acceptable operating parameters included in the threshold operating information defined for the node are not altered by the situational information;

compare the received operation data with the situational information, if the control unit determines that the acceptable operating parameters included in the threshold operating information defined for the node are altered by the situational information;

determine whether the received operation data represents operation data that is expected to be received based on the comparison of the received operation data with the situational information, if the control unit determines that the acceptable operating parameters included in the threshold operating information defined for the node are altered by the situational information; and

determine that the received operation data represents an anomalous event, if the control unit determines that the received operation data does not represent expected operation data based on the comparison of the received operation data with the threshold operating information, and if the control unit determines that the acceptable operating parameters included in the threshold operating information defined for the node are altered by the situational information.

9. The communication device according to claim 8, wherein the control unit is configured to wait for new operation data to be received if the control unit does not determine that the compared operation data represents an anomalous event.

10. The communication device according to claim 1, wherein the control unit is configured to:

compare the received operation data with the situational information;

determine whether the received operation data represents operation data that is expected to be received based on the comparison of the received operation data with the situational information;

compare the received operation data with the threshold operating information defined for the node, if the control unit determines that the received operation data represents expected operation data based on the comparison of the received operation data with the situational information;

determine whether the received operation data represents an acceptable operating parameter based on the comparison of the received operation data with the threshold operating information;

determine that the received operation data represents an anomalous event, if the control unit does not determine that the received operation data represents an acceptable operating parameter based on the comparison of the received operation data with the threshold operating information; and

determine that the received operation data represents an anomalous event, if the control unit determines that the received operation data does not represent expected operation data based on the comparison of the received operation data with the threshold operating information.

11. The communication device according to claim 10, wherein the control unit is configured to wait for new operation data to be received if the control unit does not determine that the compared operation data represents an anomalous event.

12. The communication device according to claim 1, wherein the control unit is configured to:

compare the received operation data with the threshold operation defined for the node;

compare the received operation data with the situational information;

determine whether the received operation data represents an acceptable operating parameter based on the comparison of the received operation data with the threshold operating information;

determine whether the received operation data represents operation data that is expected to be received based on the comparison of the received operation data with the situational information; and

determine that the received operation data represents an anomalous event, if the control unit determines that at least one of (i) the received operation data does not represent an acceptable operating parameter based on the comparison of the received operation data with the threshold operating information, and (ii) the received operation data does not represent expected operation data based on the comparison of the received operation data with the situational information.

13. The communication device according to claim 12, wherein the control unit is configured to wait for new operation data to be received if the control unit does not determine that the compared operation data represents an anomalous event.

14. The communication device according to claim 1, wherein the notification unit is configured to output the notification of the anomalous event at the time the control unit determines that the anomalous event has occurred.

15. The communication device according to claim 1, wherein the communication device includes a user interface configured to receive a modification of at least one of the threshold operating information and the situational information recorded in the memory unit.

16. The communication device according to claim 1, wherein the at least one node is selected from the group consisting of:

a utility network interface device associated with a meter in the utility network, an access point in the utility network, a remote terminal unit equipped with a utility network interface device, a distribution device of a distribution network, and a terminal of a distribution automation system equipped with a utility network interface device.

17. A method of operating a utility network communication device to detect anomalous events occurring in connection with at least one node in a utility network, the method comprising:

defining, in the communication device, threshold operating information for nodes in the utility network, the threshold operating information including data indicative of configured acceptable operating parameters of the nodes in the utility network based on respective locational information of the nodes in the utility network;

defining, in the communication device, situational information for the nodes in the utility network, the situational information including data indicative of configured operation data expected to be received from nodes in the utility network during a predetermined time period, based on at least one of a condition and an event that is occurring during the predetermined time period;

recording the defined threshold operating information and situational information in a memory unit of the communication device;

receiving operation data from at least one node in the utility network;

comparing, in a processing unit of the communication device, the received operation data with (i) the threshold operating information and (ii) the situational information which are respectively defined for the at least one node from which the operating data was received;

determining, in a processing unit of the communication device, whether the received operation data constitutes an anomalous event based on the comparison of the received operation data with (i) the threshold operating information and (ii) the situational information; and

outputting, from a notification unit of the communication device, notification of a determined anomalous event.

18. A computer-readable recording medium having a computer program recorded thereon that causes a control unit of a utility network communication device communicatively connected to the computer-readable recording medium to detect anomalous events occurring in connection with at least one node in a utility network, the program causing the control unit of the communication device to execute operations comprising:

defining threshold operating information for nodes in the utility network, the threshold operating information including data indicative of configured acceptable operating parameters of the nodes in the utility network based on respective locational information of the nodes in the utility network;

defining situational information for the nodes in the utility network, the situational information including data indicative of configured operation data expected to be received from nodes in the utility network during a predetermined time period, based on at least one of a condition and an event that is occurring during the predetermined time period;

recording the defined threshold operating information and situational information in a memory unit of the communication device;

receiving operation data from at least one node in the utility network;

comparing the received operation data with (i) the threshold operating information and (ii) the situational information which are respectively defined for the at least one node from which the operating data was received;

determining whether the received operation data constitutes an anomalous event based on the comparison of the received operation data with (i) the threshold operating information and (ii) the situational information; and

outputting notification of a determined anomalous event.

19. A node in a utility network, the node comprising:

a network interface configured to enable the node to communicate with at least one other node in the utility network;

a control unit configured to detect anomalous events occurring in connection with the node in the utility network; and

a memory unit having defined and recorded therein threshold operating information including data indicative of configured acceptable operating parameters of the node during a predetermined time period, the threshold operating information recorded in the memory unit including a threshold value indicating a maximum number of times that the network interface transmits a communication failure message to a first other node in the utility network attempting to communicate with the node during the predetermined time period,

wherein the control unit is configured to

adjust a value of a counter each time that the network interface transmits a communication failure message to the first other node, and generate operation data representing the adjusted value of the counter,

compare the value of the counter represented in the generated operation data with the threshold value included in the threshold operating information recorded in the memory unit,

determine that an anomalous event has occurred when the threshold value included in the recorded threshold operating information has been reached based on the comparison of the value of the counter with the threshold value included in the threshold operating information, and

generate a notification signal indicating the determination of the anomalous event, and

wherein the node further comprises a notification unit configured to transmit the notification signal generated by the control unit to a second other node in the utility network distinct from the first other node in the utility network.

20. The node in the utility network according to claim 19, wherein:

the node in the utility network is a utility meter comprising the network interface, the memory unit, the control unit, and the notification unit; and

the network interface comprises a transceiver configured to enable the utility meter to communicate wirelessly with at least one of the first other node and the second other node in the utility network.

21. The node in the utility network according to claim 19, wherein:

the node in the utility network is a utility network interface device associated with a first utility meter;

the first other node in the utility network is another node associated with a second utility meter in the utility network; and

the second other node in the utility network is one of another node associated with a third utility meter in the utility network, an access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

22. The node in the utility network according to claim 19, wherein:

the node in the utility network is a first access point in the utility network;

the first other node in the utility network is another node associated with a first utility meter; and

the second other node in the utility network is one of a second access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

23. A node in a utility network, the node comprising:

a network interface configured to enable the node to communicate with at least one other node in the utility network;

a control unit configured to detect anomalous events occurring in connection with the node in the utility network; and

a memory unit having defined and recorded therein threshold operating information including data indicative of configured acceptable operating parameters of the node during a predetermined time period, the threshold operating information recorded in the memory unit including a threshold value indicating a maximum number of times that the network interface receives a communication from a first other node in the utility network attempting to communicate with the node during the predetermined time period,

wherein the control unit is configured to

adjust a value of a counter each time that the network interface receives a communication from the first other node, and generate operation data representing the adjusted value of the counter,

compare the value of the counter represented in the generated operation data with the threshold value included in the threshold operating information recorded in the memory unit,

determine that an anomalous event has occurred when the threshold value included in the recorded threshold operating information has been reached based on the comparison of the value of the counter with the threshold value included in the threshold operating information, and

generate a notification signal indicating the determination of the anomalous event, and

wherein the node further comprises a notification unit configured to transmit the notification signal generated by the control unit to a second other node in the utility network distinct from the first other node in the utility network.

24. The node in the utility network according to claim 23, wherein:

the node in the utility network is a utility meter comprising the network interface, the memory unit, the control unit and the notification unit; and

the network interface comprises a transceiver configured to enable the utility meter to communicate wirelessly with at least one of the first other node and the second other node in the utility network.

25. The node in the utility network according to claim 23, wherein:

the node in the utility network is a utility network interface device associated with a first utility meter;

the first other node in the utility network is another node associated with a second utility meter in the utility network; and

the second other node in the utility network is one of another node associated with a third utility meter in the utility network, an access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

26. The node in the utility network according to claim 23, wherein:

the node in the utility network is a first access point in the utility network;

the first other node in the utility network is another node associated with a first utility meter; and

the second other node in the utility network is one of a second access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

27. A node in a utility network, the node comprising:

a network interface configured to enable the utility meter to communicate with at least one other node in the utility network;

a control unit configured to detect anomalous events occurring in connection with the node in the utility network; and

a memory unit having defined and recorded therein (i) a routing table including each downstream node which has registered with the node in the utility network to forward respective communications from the downstream nodes to another node constituting an upstream node of the node in the utility network, and (ii) threshold operating information including a threshold value indicating a number of the downstream nodes registered in the routing table which transmit an un-registration message to the network interface during a predetermined time period,

wherein the control unit is configured to

adjust a value of a counter each time that the network interface receives an un-registration message from a downstream node registered in the routing table recorded in the memory unit, and generate operation data representing the adjusted value of the counter,

compare the value of the counter represented in the generated operation data with the threshold value included in the threshold operating information recorded in the memory unit,

determine that an anomalous event has occurred when the threshold value included in the recorded threshold operating information has been reached based on the comparison of the value of the counter with the threshold included in the threshold operating information, and

generate a notification signal indicating the determination of the anomalous event, and

wherein the node in the utility network further comprises a notification unit configured to transmit the notification signal generated by the control unit to the upstream node of the utility network.

28. The node in the utility network according to claim 27, wherein:

the node in the utility network is a first utility network interface device associated with a first utility meter;

at least one of the downstream nodes is a second utility network interface device associated with a second utility meter; and

the upstream node is one of another node respectively associated with another utility meter, an access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

29. The node in the utility network according to claim 27, wherein:

the node in the utility network is a first access point in the utility network;

at least one of the downstream nodes is a utility network interface device associated with a utility meter; and

the upstream node in the utility network is one of a second access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.

30. A node in a utility network, the node comprising:

a network interface configured to enable the node to communicate with at least one other node in the utility network;

a control unit configured to detect anomalous events occurring in connection with the node in the utility network; and

a memory unit having defined and recorded therein threshold operating information including data indicative of configured acceptable operating parameters of the node in the utility network during a predetermined time period, the threshold operating information recorded in the memory unit including a threshold value indicating a maximum value of a commodity expected to be consumed at a premises at which the node is located during the predetermined time period,

wherein the control unit is configured to

monitor a value of consumption of the commodity at predetermined increments of the predetermined time period, and generate operation data representing the monitored consumption value,

compare the consumption value represented in the generated operation data with the threshold value included in the threshold operating information recorded in the memory unit,

determine that an anomalous event has occurred when the consumption value represented in the generated operation data is greater than or equal to the threshold value included in the threshold operating information recorded in the memory unit, and

generate a notification signal indicating the determination of the anomalous event, and

wherein the node in the utility network further comprises a notification unit configured to transmit the notification signal to another node in the utility network with which the node in the utility network is authorized to communicate.

31. The node in the utility network according to claim 30, wherein:

the node in the utility network is a utility meter comprising the network interface, the memory unit, the control unit, and the notification unit; and

the network interface comprises a transceiver configured to enable the utility meter to communicate wirelessly with the at least one other node in the utility network.

32. The node in the utility network according to claim 30, wherein:

the node in the utility network is a utility network interface device associated with a first utility meter; and

the other node in the utility network is at least one of another node associated with a second utility meter in the utility network, an access point in the utility network, and a utility network communication device associated with a communication station of a utility provider.