Anomaly detection methods, devices and systems

• US 9,218,232 B2
• Filed: 04/12/2012
• Issued: 12/22/2015
• Est. Priority Date: 04/13/2011
• Status: Active Grant

• Current Assignee: BAR ILAN University
• Original Assignee: BAR ILAN University
• Inventors: Khalastchi, Eliahu, Kaminka, Gal, Lin, Raz, Kalech, Meir
• Primary Examiner(s): Ehne, Charles
• Application Number:
  US14/111,499
• Publication Number:
  US 20140149806A1
• Time in Patent Office: 1,349 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06F 2218/00 Aspects of pattern recognition specially adapted for signal processing

Abstract

A method for detecting an anomaly in operation of a data analysis device, comprising: receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings; determining which of said multiple sensors are correlated; computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and declaring an anomaly when said deviation exceeds a predetermined threshold.

Claims

1. A method for detecting an anomaly in operation of a data analysis device, the method comprising using at least one processor for:

receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings;

determining which of said multiple sensors are correlated;

computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declaring an anomaly when said deviation exceeds a predetermined threshold;

wherein said deviation comprises a Mahalanobis distance.

2. A method for detecting an anomaly in operation of a data analysis device, the method comprising using at least one processor for:

receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings;

determining which of said multiple sensors are correlated;

computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declaring an anomaly when said deviation exceeds a predetermined threshold;

wherein said determining which of said multiple sensors are correlated comprises calculating a Pearson correlation between said present and said past real-time readings of said multiple sensors.

3. The method according to claim 2, further comprising using said at least one processor for adjusting a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.

4. A method for detecting an anomaly in operation of a data analysis device, the method comprising using at least one processor for:

receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings;

determining which of said multiple sensors are correlated;

computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declaring an anomaly when said deviation exceeds a predetermined threshold; and

further comprising using said at least one processor for applying a normalization function to said past real-time readings;

wherein said normalization function comprises a Z-transformation.

5. A data analysis device comprising multiple sensors, a processor and a memory, wherein said processor is configured to:

receive present real-time readings from said multiple sensors, and maintain, in said memory, a history of past real-time readings;

determine which of said multiple sensors are correlated;

compute a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declare an anomaly when said deviation exceeds a predetermined threshold; and

further comprising a platform selected from the group consisting of;

a robot, a medical device, an intrusion detection system, a fraud detection system and an image processing system.

6. A data analysis device comprising multiple sensors, a processor and a memory, wherein said processor is configured to:

receive present real-time readings from said multiple sensors, and maintain, in said memory, a history of past real-time readings;

determine which of said multiple sensors are correlated;

compute a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declare an anomaly when said deviation exceeds a predetermined threshold;

wherein said deviation comprises a Mahalanobis distance.

7. A data analysis device comprising multiple sensors, a processor and a memory, wherein said processor is configured to:

receive present real-time readings from said multiple sensors, and maintain, in said memory, a history of past real-time readings;

determine which of said multiple sensors are correlated;

compute a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declare an anomaly when said deviation exceeds a predetermined threshold;

wherein determine which of said multiple sensors are correlated comprises calculating, by said processor, a Pearson correlation between said present and said past real-time readings of said multiple sensors.

8. The data analysis device according to claim 7, wherein said processor is further configured to adjust a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.

9. A data analysis device comprising multiple sensors, a processor and a memory, wherein said processor is configured to:

receive present real-time readings from said multiple sensors, and maintain, in said memory, a history of past real-time readings;

determine which of said multiple sensors are correlated;

compute a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and

declare an anomaly when said deviation exceeds a predetermined threshold;

wherein said processor is further configured to apply a normalization function to said past real-time readings, and said normalization function comprises a Z-transformation.

10. A method for online detection of an anomaly in operation of a data analysis device, the method comprising analyzing a behavior trend of multiple sensors of the device, and declaring an anomaly when a change of a predetermined magnitude in said behavior trend is detected;

wherein said analyzing of said behavior trend comprises computing a Mahalanobis distance between consecutive readings of said multiple sensors.

11. A method for online detection of an anomaly in operation of a data analysis device, the method comprising analyzing a behavior trend of multiple sensors of the device, and declaring an anomaly when a change of a predetermined magnitude in said behavior trend is detected;

wherein said multiple sensors are correlated sensors selected from a larger plurality of sensors of the device; and

further comprising calculating a Pearson correlation between consecutive readings of said larger plurality of sensors of the device, to select said correlated sensors.

12. A method for online detection of an anomaly in operation of a data analysis device, the method comprising analyzing a behavior trend of multiple sensors of the device, and declaring an anomaly when a change of a predetermined magnitude in said behavior trend is detected;

wherein said multiple sensors are correlated sensors selected from a larger plurality of sensors of the device; and

further comprising adjusting a threshold of said Pearson correlation, to trade-off between anomaly detection rate and false positive anomaly declarations.