Anomaly detection in spatial and temporal memory system

• US 9,412,067 B2
• Filed: 08/29/2013
• Issued: 08/09/2016
• Est. Priority Date: 09/05/2012
• Status: Active Grant

• Current Assignee: Numenta, Inc.
• Original Assignee: Numenta, Inc.
• Inventors: Hawkins, Jeffrey C., Agarwal, Rahul
• Primary Examiner(s): Chaki, Kakali
• Assistant Examiner(s): Zidanic, Michael
• Application Number:
  US14/014,237
• Publication Number:
  US 20140067734A1
• Time in Patent Office: 1,076 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

Detecting patterns and sequences associated with an anomaly in predictions made a predictive system. The predictive system makes predictions by learning spatial patterns and temporal sequences in an input data that change over time. As the input data is received, the predictive system generates a series of predictions based on the input data. Each prediction is compared with corresponding actual value or state. If the prediction does not match or deviates significantly from the actual value or state, an anomaly is identified for further analysis. A corresponding state or a series of states of the predictive system before or at the time of prediction are associated with the anomaly and stored. The anomaly can be detected by monitoring whether the predictive system is placed in the state or states that is the same or similar to the stored state or states.

Claims

1. A method of detecting anomaly in a predictive system, comprising:

changing from a prior state of the predictive system to an updated state of the predictive system according to an input data received at a first time by at least activating or deactivating cells of the predictive system, the prior state of the predictive system indicating at least activation states of the cells before receiving the input data at the first time, the updated state of the predictive system indicating at least the activation states of the cells after receiving the input data at the first time;

generating a prediction output by the predictive system by at least detecting the cells that are activated after receiving the input data at the first time, the prediction output representing a predicted value or state at a second time subsequent to the first time;

storing at least the updated state of the predictive system;

determining presence of an anomaly associated with the input data by at least comparing the predicted value or state corresponding to the predictive output with an actual value or state at the second time; and

associating the anomaly with the stored state of the predictive system.

2. The method of claim 1, further comprising receiving a request to detect a subsequent occurrence of the anomaly.

3. The method of claim 2, further comprising monitoring the predictive system to detect an occurrence of the stored state of the predictive system associated with the anomaly at a third time subsequent to the second time responsive to receiving the request.

4. The method of claim 3, further comprising detecting an occurrence of an event associated with the anomaly responsive to detecting the occurrence of the stored state of the predictive system associated with the anomaly.

5. The method of claim 2, wherein determining the anomaly comprises comparing tallying accuracy of predicted values or states corresponding to predictive outputs over a first time period including the first time relative to actual values or states over a second time period including the second time.

6. The method of claim 1, wherein the predictive system is configured to learn and detect temporal sequences of spatial patterns in the input data by activating or deactivating the cells.

7. The method of claim 1, generating the prediction output comprises:

generating a series of spatial pooler outputs in sparse distributed representation by processing the input data over time by a spatial pooler, each of the spatial pooler outputs indicating a spatial pattern detected in the input data at a time; and

generating, by a sequence processor, the prediction output by a least activating or deactivating the cells to represent stored temporal relationships between the series of spatial pooler outputs.

8. The method of claim 7, wherein the prior state and the updated state of the predictive system comprises states of the cells in the sequence processor.

9. The method of claim 7, wherein determining the anomaly comprises comparing the prediction output at the first time with the spatial pooler output at the second time.

10. The method of claim 1, wherein detecting the anomaly comprises determining whether the predicted value or state deviates from the actual value or state above at the second time beyond a threshold difference.

11. A non-transitory computer-readable storage medium storing instructions thereon, the instructions when executed by a processor causing the processor to:

change from a prior state of a predictive system to an updated state of the predictive system according to an input data received at a first time by at least activating or deactivating cells of the predictive system, the prior state of the predictive system indicating at least activation states of the cells before receiving the input data at the first time, the updated state of the predictive system indicating at least the activation states of the cells after receiving the input data at the first time;

generate a prediction output by a predictive system by at least detecting the cells that are activated after receiving the input data at the first time, the prediction output representing a predicted value or state at a second time subsequent to the first time;

store at least the updated state of the predictive system;

determine presence of an anomaly associated with the input data by at least comparing the predicted value or state corresponding to the predictive output with an actual value or state at the second time; and

associate the anomaly with the stored state of the predictive system.

12. The medium of claim 11, further comprising instructions causing the processor to receive a request to detect a subsequent occurrence of the anomaly.

13. The medium of claim 12, further comprising instructions causing the processor to monitor the predictive system to detect of the stored state of the predictive system associated with the anomaly at a third time subsequent to the second time responsive to receiving the request.

14. The medium of claim 13, further comprising detecting an occurrence of an event associated with the anomaly responsive to detecting the occurrence of the stored state of the predictive system associated with the anomaly.

15. The medium of claim 12, wherein the anomaly is determined by comparing-accuracy of predicted values or states corresponding to predictive outputs over a first time period including the first time relative to actual values or states over a second time period including the second time.

16. The medium of claim 11, wherein the predictive system is configured to learn and detect temporal sequences of spatial patterns in the input data by activating or deactivating the cells.

17. The medium of claim 11, wherein instructions for generating the prediction output comprises instructions causing the processor to:

generate a series of spatial pooler outputs in sparse distributed representation by processing the input data over time by a spatial pooler, each of the spatial pooler outputs indicating a spatial pattern detected in the input data at a time; and

generate, by a sequence processor, the prediction output by at least activating or deactivating the cells to represent stored temporal relationships between the series of spatial pooler outputs.

18. The medium of claim 17, wherein the prior state and the updated state of the predictive system comprises states of the cells in the sequence processor.

19. The medium of claim 17, wherein instructions to determine the anomaly comprises instructions causing the processor to compare the prediction output at the first time with the spatial pooler output at the second time.

20. The medium of claim 11, wherein instructions to detect the anomaly comprises instructions causing the processor to determine whether the predicted value or state deviates from the actual value or state above at the second time beyond a threshold difference.

21. A computing system, comprising:

a processor;

a predicting system configured to;

change from a prior state to an updated state according to an input data received at a first time by at least activating or deactivating cells of the predictive system, the prior state of the predictive system indicating at least activation states of the cells before receiving the input data at the first time, the updated state of the predictive system indicating at least the activation states of the cells after receiving the input data at the first time; and

generate a prediction output by the predictive system by at least detecting the cells that are activated after receiving the input data at the first time, the prediction output representing a predicted value or state at a second time subsequent to the first time; and

an anomaly detector configured to;

store at least the updated state of the predictive system;

determine presence of an anomaly associated with the input data by at least comparing the predicted value or state corresponding to the predictive output with an actual value or state at the second time; and

associate the anomaly with the stored state of the predictive system.