Method for detecting anomalies in a time series data with trajectory and stochastic components

• US 9,146,800 B2
• Filed: 07/01/2013
• Issued: 09/29/2015
• Est. Priority Date: 07/01/2013
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Research Laboratories, Inc. (Mitsubishi Electric Corporation)
• Original Assignee: Mitsubishi Electric Research Laboratories, Inc. (Mitsubishi Electric Corporation)
• Inventors: Jones, Michael J
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US13/932,238
• Publication Number:
  US 20150006972A1
• Time in Patent Office: 820 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit

Abstract

A method detects anomalies in time series data by comparing universal features extracted from testing time series data with the universal features acquired from training time series data to determine a score. The universal features characterize trajectory components of the time series data and stochastic components of the time series data. Then, an anomaly is detected if the anomaly score is above a threshold.

Claims

1. A method for detecting anomalies in time series data, comprising the steps of:

partitioning the time series data into overlapping and sliding time windows;

determine features for each window;

clustering features of similar windows to obtain universal features, wherein the universal feature includes a stochastic component, wherein statistics of the stochastic component include a mean, a standard deviation, a mean of an absolute value of a first difference, a number of mean crossings, a percentage of positive values in the first difference, a percentage of zero values in the first difference, and an average length of a run of positive differences of the time series data in the window, and standard deviations of the statistics;

comparing the universal features extracted from testing time series data with the universal features acquired from training time series data to determine a score, wherein the universal features characterize trajectory components of the time series data and stochastic components of the time series data; and

detecting an anomaly if the anomaly score is above a threshold, wherein the steps are performed in a processor.

2. The method of claim 1, wherein the time series data are acquired from a machine by a sensor.

3. The method of claim 1, wherein the trajectory component is represented by a smooth curve, and the stochastic component is represented by random fluctuations around the smooth curve.

4. The method of claim 1, wherein a trajectory component of the universal feature includes moving means and bounds of the means of the time series data.

5. The method of claim 1, wherein a trajectory component of the universal feature characterizes low frequency components of the time series data.

6. The method of claim 1, wherein a stochastic component of the universal feature characterizes high frequency components of the time series data.