ANOMALY DETECTION METHODS, DEVICES AND SYSTEMS

• US 20140149806A1
• Filed: 04/12/2012
• Published: 05/29/2014
• Est. Priority Date: 04/13/2011
• Status: Active Grant

• Current Assignee: BAR ILAN University
• Original Assignee: BAR ILAN University
• Inventors: Kaminka, Gal, Khalastchi, Eliahu, Lin, Raz, Kalech, Meir
• Granted Patent: US 9,218,232 B2
• Time in Patent Office: Days
• US Class Current: 714/49
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06F 2218/00 Aspects of pattern recognition specially adapted for signal processing

Abstract

A method for detecting an anomaly in operation of a data analysis device, comprising: receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings; determining which of said multiple sensors are correlated; computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and declaring an anomaly when said deviation exceeds a predetermined threshold.

Claims

1. A method for detecting an anomaly in operation of a data analysis device, the method comprising using at least one processor for:

receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings;

determining which of said multiple sensors are correlated;

computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declaring an anomaly when said deviation exceeds a predetermined threshold.

2. The method according to claim 1, wherein said deviation comprises a Mahalanobis distance.

3. The method according to claim 1, further comprising using said at least one processor for adjusting said predetermined threshold, to trade-off between anomaly detection rate and false positive anomaly declarations.

4. The method according to claim 1, wherein said determining which of said multiple sensors are correlated comprises calculating a Pearson correlation between said present and said past real-time readings of said multiple sensors.

5. The method according to claim 4, further comprising using said at least one processor for adjusting a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.

6. The method according to claim 1, further comprising using said at least one processor for applying a normalization function to said past real-time readings.

7. The method according to claim 6, wherein said normalization function comprises a Z-transformation.

8-15. -15. (canceled)

16. A data analysis device comprising multiple sensors, a processor and a memory, wherein said processor is configured to:

receive present real-time readings from said multiple sensors, and maintain, in said memory, a history of past real-time readings;

determine which of said multiple sensors are correlated;

compute a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declare an anomaly when said deviation exceeds a predetermined threshold.

17. The data analysis device according to claim 16, further comprising a platform selected from the group consisting of:

a robot, a medical device, an intrusion detection system, a fraud detection system and an image processing system.

18. The data analysis device according to claim 16, wherein said deviation comprises a Mahalanobis distance.

19. The data analysis device according to claim 16, wherein said processor is further configured to adjust said predetermined threshold, to trade-off between anomaly detection rate and false positive anomaly declarations.

20. The data analysis device according to claim 16, wherein determine which of said multiple sensors are correlated comprises calculating, by said processor, a Pearson correlation between said present and said past real-time readings of said multiple sensors.

21. The data analysis device according to claim 20, wherein said processor is further configured to adjust a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.

22. The data analysis device according to claim 16, wherein said processor is further configured to apply a normalization function to said past real-time readings.

23. The data analysis device according to claim 22, wherein said normalization function comprises a Z-transformation.

24. A method for online detection of an anomaly in operation of a data analysis device, the method comprising analyzing a behavior trend of multiple sensors of the device, and declaring an anomaly when a change of a predetermined magnitude in said behavior trend is detected.

25. The method according to claim 24, wherein said analyzing of said behavior trend comprises computing a Mahalanobis distance between consecutive readings of said multiple sensors.

26. The method according to claim 24, wherein said multiple sensors are correlated sensors selected from a larger plurality of sensors of the device.

27. The method according to claim 26, further comprising calculating a Pearson correlation between consecutive readings of said larger plurality of sensors of the device, to select said correlated sensors.

28. The method according to claim 26, further comprising adjusting a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.

29-40. -40. (canceled)