Anomaly detection in streaming data

• US 9,218,527 B2
• Filed: 09/29/2011
• Issued: 12/22/2015
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company), Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Lakshminarayan, Choudur, Alvarado, Alexander Singh, Principe, Jose C., Kriminger, Evan
• Primary Examiner(s): Breene, John
• Assistant Examiner(s): Vo, Hien
• Application Number:
  US13/248,887
• Publication Number:
  US 20130085715A1
• Time in Patent Office: 1,545 Days
• Field of Search: 702/179, 726/25, 700/110
• US Class Current: 1/1
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06F 2218/08 Feature extraction
• CPC Class Codes: G06F 2218/12 Classification; Matching

Abstract

An example method for anomaly detection in streaming data includes applying statistical analysis to streaming data in a sliding window. The method also includes extracting a feature. The method also includes determining class assignment for the feature using class conditional probability densities and a threshold.

Claims

1. A method for anomaly detection in streaming data, the method implemented by a processor executing program code stored on non-transient computer-readable media, the method which when executed by the processor comprising:

applying statistical analysis to streaming data in a sliding window, wherein the streaming data is received from at least one data source;

extracting a feature from the streaming data, the feature identified based on a coefficient having a maximum magnitude in the sliding window;

determining class assignment for the feature using class conditional probability densities and a threshold; and

,

identifying an event based at least in part upon the class assignment for the feature and responding to the event.

2. The method of claim 1, further comprising defining a size of the sliding window.

3. The method of claim 1, further comprising estimating the class conditional probability densities for two classes.

4. The method of claim 1, wherein statistical analysis further comprises applying Fourier transform to the streaming data to determine a coefficient with maximum magnitude.

5. The method of claim 4, further comprising squaring the coefficient and ordering coefficients from largest to smallest.

6. The method of claim 5, further comprising moving the sliding window by one unit and repeating.

7. The method of claim 1, wherein statistical analysis further comprises classifying the streaming data based on peak-to-peak features.

8. The method of claim 1, wherein statistical analysis further comprises classifying the streaming data based on sample differences, wherein the sample differences are defined by window size and adjacent differences parameter.

9. The method of claim 1, wherein the class assignment indicates an oscillatory flow regime.

10. The method of claim 1, wherein the class assignment indicates a separate oscillatory flow regime and a non-oscillatory flow regime.

11. A system for anomaly detection in streaming data, the system including program code stored on non-transient computer-readable media and executable by a processor to:

apply statistical analysis to streaming data in a sliding window;

extract a feature; and

determine class assignment for the coefficient using class conditional probability densities and a threshold; and

identify an event based at least in part upon the class assignment for the feature to facilitate a response to the event.

12. The system of claim 11, wherein the program is further executable to define a size of the sliding window.

13. The system of claim 11, wherein the program is further executable to estimate the class conditional probability densities for two classes.

14. The system of claim 11, wherein the program is further executable to apply Fourier transform to the streaming data to determine a coefficient with maximum magnitude.

15. The system of claim 11, wherein the program is further executable to square the coefficient and order coefficients from largest to smallest.

16. The system of claim 11, wherein the program is further executable to move the sliding window and repeat.

17. The system of claim 11, wherein the class assignment is based on a peak-to-peak determination.

18. The system of claim 11, wherein the class assignment is based on determining sample differences, wherein the sample differences are defined by window size and adjacent differences parameter.

19. The system of claim 11, wherein the program is further executable to classify the streaming data as oscillatory and non-oscillatory.

20. The system of claim 11, wherein the program code is further executable to determine a number of samples (M) in a window (W) of samples, is M<

W to satisfy the threshold, and the number of samples (M) is a majority of points in the window (W) of samples.