SEQUENTIAL ANOMALY DETECTION

• US 20150052090A1
• Filed: 08/16/2013
• Published: 02/19/2015
• Est. Priority Date: 08/16/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lin, Ching-Yung, Wen, Zhen, Song, Yale
• Granted Patent: US 9,727,821 B2
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

A dataset including at least one temporal event sequence is collected. A one-class sequence classifier f(x) that obtains a decision boundary is statistically learned. At least one new temporal event sequence is evaluated, wherein the at least one new temporal event sequence is outside of the dataset. It is determined whether the at least one new temporal event sequence is one of a normal sequence or an abnormal sequence based on the evaluation. Numerous additional aspects are disclosed.

Claims

1. A method comprising:

collecting a dataset comprising at least one temporal event sequence;

learning statistically a one-class sequence classifier f(x) that obtains a decision boundary;

evaluating at least one new temporal event sequence, wherein the at least one new temporal event sequence is outside of the data set; and

determining whether the at least one new temporal event sequence is one of a normal sequence or an abnormal sequence based on the evaluating step.

2. The method of claim 1, wherein the at least one temporal event sequence of the dataset is unlabeled.

3. The method of claim 1, wherein evaluating the new temporal event sequence uses the learned classifier to compute a probabilistic distance of the new temporal event sequence to the decision boundary.

4. The method of claim 1 wherein learning the classifier further comprises:

randomly initializing a solution space (Ω

);

constructing an undirected graph for the at least one temporal event sequence in the dataset;

capturing at least one temporal dynamic of the at least one temporal event sequence of the dataset;

computing the probability of the at least one temporal event sequence of the dataset having a normal sequence or an abnormal sequence; and

refining the classifier.

5. The method of claim 4, wherein the dataset further comprises latent random variables, and wherein each latent random variable is associated with each event in the sequence.

6. The method of claim 4 further comprising:

repeating the steps for learning the classifier until a termination criterion is satisfied.

7. The method of claim 6, wherein repeating the steps for learning the classifier until a termination criterion is satisfied further comprises:

enforcing most data sets to have a higher probability of having a normal sequence while keeping a solution vector of the solution space (Ω

) with a small norm as compared to a user defined parameter

8. The method of claim 1, further comprising:

reviewing an automatic classification of at least one of the one or more temporal event sequences in the dataset as abnormal;

receiving a user inputted label of “

true anomaly”

for at least one of the reviewed automatically classified sequences;

adding the “

true anomaly”

labeled sequences to the dataset; and

re-training the classifier using the dataset including the “

true anomaly”

labeled sequences.

9. The method of claim 8, wherein during the re-training, a relative weight of the “

true anomaly”

labeled sequences is higher than a weight given to other sequences in the dataset by distribution-sensitive learning.

10. The method of claim 9, wherein the relative weight of the “

true anomaly”

labeled sequences is inversely proportional to a distribution of the sequences in the dataset.

11. The method of claim 1, wherein statistically learning the one-class classifier further comprises:

defining at least one view configuration adapted to organize at least one feature of the at least one temporal event sequence of the dataset into multiple views;

refining the classifier with at least one of the defined configuration of views using multi-view learning;

classifying the at least one new temporal sequence with the refined classifier;

receiving user input regarding automatic classification of the at least one temporal event sequence of the dataset with the refined classifier, said at least one temporal event sequence of the dataset having a negative label; and

generating at least one suggestion to adjust the at least one view configuration based on classification results of the refined classifier.

12. The method of claim 1, further comprising providing a system, wherein the system comprises distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise a data collection module, an optimization engine module, an evaluation engine module, and an analysis module;

wherein;

said dataset collection is carried out by said data collection module executing on at least one hardware processor;

said classifier learning is carried out by said optimization engine module executing on said at least one hardware processor;

said evaluating is carried out by said evaluation engine module executing on said at least one hardware processor; and

said determining is carried out by said analysis module executing on said at least one hardware processor.

13. A computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, said computer readable program code comprising:

computer readable program code configured to;

collect a dataset comprising at least one temporal event sequence;

learn statistically a one-class sequence classifier f(x) that obtains a decision boundary;

evaluate at least one new temporal event sequence, wherein the at least one new temporal event sequence is outside of the data set; and

determine whether the at least one new temporal event sequence is one of a normal sequence or an abnormal sequence based on the evaluating step.

14. An apparatus comprising:

a memory; and

at least one processor, coupled to said memory, and operative to;

collect a dataset comprising at least one temporal event sequence;

learn statistically a one-class sequence classifier f(x) that obtains a decision boundary;

evaluate at least one new temporal event sequence, wherein the at least one new temporal event sequence is outside of the data set; and

determine whether the at least one new temporal event sequence is one of a normal sequence or an abnormal sequence based on the evaluating step.

15. The apparatus of claim 14, wherein the at least one temporal event sequence of the dataset is unlabeled.

16. The apparatus of claim 14, wherein a probabilistic distance of the new temporal event sequence to the decision boundary is computed with the learned classifier to evaluate the at least one new temporal event sequence.

17. The apparatus of claim 14 wherein the at least one processor is operative to automatically classify at least one of the one or more temporal event sequences in the dataset as abnormal.

18. The apparatus of claim 17, wherein the at least one processor is operative to receive a user inputted label of “

true anomaly”

for at least one of automatically classified sequences.

19. The apparatus of claim 18, wherein the at least one processor is operative to re-train the classifier using the dataset including the “

true anomaly”

labeled sequences.

20. The apparatus of claim 14, further comprising a plurality of distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise a data collection module, an optimization engine module, an evaluation engine module, and an analysis module;

wherein;

said at least one processor is operative to collect said dataset by executing said data collection module;

said at least one processor is operative to learn said classifier by executing said optimization engine module;

said at least one processor is operative to evaluate said sequence by executing said evaluation engine module; and

said at least one processor is operative to determine whether the at least one new temporal event sequence is one of a normal sequence or an abnormal sequence by executing said analysis module.