Method and apparatus for multi-domain anomaly pattern definition and detection

• US 8,090,592 B1
• Filed: 10/31/2007
• Issued: 01/03/2012
• Est. Priority Date: 10/31/2007
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Goodall, Colin, Jacobson, Guy, Kinne, Greg B., Lent, Arnold
• Primary Examiner(s): O'Connor, Gerald J
• Assistant Examiner(s): PAULS, JOHN A
• Application Number:
  US11/931,789
• Time in Patent Office: 1,525 Days
• Field of Search: 378/165, 364/514.R, 435/4, 600/549, 702/187, 705/2
• US Class Current: 705/2
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: G16H 50/80 for detecting, monitoring or modelling epidemics or pandemics, e.g. flu
• CPC Class Codes: Y02A 90/10 Information and communication technologies [ICT] supporting adaptation to climate change, e.g. for weather forecasting or climate simulation

Abstract

Disclosed herein is a multi-domain anomaly pattern definition and detection module. The module receives raw data from different kinds of anomalies from a variety of detection algorithms and generates scores associated with the data. If one or more scores exceed a threshold, then the algorithm gathers further information which may include counts or listings of detailed data for a geographic region which may include such information as emergency department and lab department data related to a particular health concern such as a respiratory syndrome. Summaries are provided which may identify anomalies and numbers of events according to geographic region and utilizing probability algorithms. Other databases such as animal data collected under the Department of Agriculture may also be utilized. The data is presented in a familiar form such as a map or a table such that a subject matter expert may determine whether to further investigate an anomaly as a potential risk, for example, a health risk.

Claims

1. A method of performing multi-domain surveillance, the method comprising:

analyzing, via a computer processor, first streamed data to identify healthcare transaction signatures in the first streamed data;

based on the first streamed data, creating a database of signature patterns across multiple domains of biosurveillance activity according to at least one region and based on time;

analyzing, via a computer processor, second streamed data to identify healthcare transaction signature anomalies in the second streamed data, wherein the signature anomalies are identified by comparing healthcare transaction data contained in the second streamed data to the signature patterns in the database to yield a comparison;

accessing data in the database from the multiple domains to identify a plurality of anomalies based on the comparison of the signature patterns;

collecting the plurality of anomalies into a case for management, the case comprising a general container for the plurality of anomalies, sub-threshold and super-threshold scores in one of a single domain and multiple domains; and

using corroborating evidence across the multiple domains to adjust a likelihood that an event associated with the case should be investigated.

2. The method of claim 1, wherein the multiple domains comprise at least one of hospital data, school attendance data and medicare purchasing data.

3. The method of claim 1, further comprising:

monitoring for possible current events while simultaneously monitoring a current roster of cases to determine whether to add a new event to the current roster of cases.

4. The method of claim 1, further comprising:

receiving an input for supplementing the plurality of anomalies based on one or more anomalies across the multiple domains captured external to the processor.

5. A system for performing multi-domain surveillance, the system comprising:

a processor;

a first module configured to control the processor to analyze streamed data and identify healthcare transaction signatures in first streamed data;

a second module configured to control the processor, based on the first streamed data, to create a database of signature patterns across multiple domains of biosurveillance activity according to at least one region and based on time;

a third module configured to control the processor to analyze second streamed data to identify healthcare transaction signature anomalies in the second streamed data, wherein the signature anomalies are identified by comparing healthcare transaction data contained in the second streamed data to the signature patterns in the database to yield a comparison;

a fourth module configured to control the processor to access data in the database from the multiple domains to identify a plurality of anomalies from the signature patterns;

a fifth module configured to control the processor to collect the plurality of anomalies into a case for management, the case comprising a general container for the plurality of anomalies, sub-threshold and super-threshold scores in one of a single domain or multiple domains; and

a sixth module configured to control the processor to use corroborating evidence across the multiple domains to adjust a likelihood that an event associated with the case should be investigated.

6. The system of claim 5, wherein the multiple domains comprise at least one of hospital data, school attendance data and medicare purchasing data.

7. The system of claim 5, further comprising:

a seventh module configured to control the processor to monitor for possible current events while simultaneously monitoring a current roster of cases to determine whether to add a new event to the current roster of cases.