System and method for detecting and predicting anomalies based on analysis of time-series data

• US 9,952,921 B2
• Filed: 12/24/2014
• Issued: 04/24/2018
• Est. Priority Date: 10/10/2014
• Status: Active Grant

• Current Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Original Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Inventors: Kim, Sundeuk, Oh, Hyuntaek, Kim, Sungil
• Primary Examiner(s): Bonzo, Bryce P
• Assistant Examiner(s): Arcos, Jeison C
• Application Number:
  US14/582,746
• Publication Number:
  US 20160103724A1
• Time in Patent Office: 1,217 Days
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Provided are a system and method for detecting and predicting anomalies based on analysis of time-series data. According to an embodiment of the present disclosure, an abnormality detecting and predicting system includes a database configured to store past case data related to a state of a monitored object; a data collector configured to collect time-series status information of the monitored object; an abnormality detector configured to compare the status information with an abnormality detecting reference in a preset detecting interval and detect an occurrence of an abnormality of the monitored object; a similar case selector configured to select a similar case having a highest degree of similarity to the status information among the past case data when the occurrence of an abnormality is detected by the abnormality detector; and a predictor configured to predict proliferation or diminishing of a detected abnormality using the similar case and an abnormality proliferation predicting reference.

Claims

1. An abnormality detecting and predicting system, comprising:

a database configured to store past case data related to a state of a monitored object;

a data collector configured to collect status information from the monitored object;

an abnormality detector configured to compare the status information, in a preset detecting interval, with an abnormality detecting reference, and to detect an occurrence of an abnormality of the monitored object;

a similar case selector configured to select a first case having a highest degree of similarity to the status information among the past case data when the occurrence of the abnormality is detected by the abnormality detector;

a predictor configured to predict proliferation or diminishing of the detected abnormality after the occurrence of the detected abnormality, by using the first case and an abnormality proliferation predicting reference; and

an abnormality detecting reference updater configured to adjust a length of the preset detecting interval based on a prediction result of the predictor and a change of the status information in a preset verification interval,

wherein the abnormality detector is further configured to transmit a warning message to an administrator in response to the occurrence of the abnormality of the monitored object,

wherein the past case data includes the monitored object'"'"'s pattern of changing status information over time when a past abnormality is detected and information of the detected past abnormality either proliferating or diminishing in a corresponding case,

wherein the preset verification interval corresponds to one of a first interval starting from a time of the occurrence of the abnormality in the preset detecting interval and ending at an additional preset time interval after an ending of the preset detecting interval, and a second interval which starts from the ending of the preset detecting interval and ending after the additional preset time interval, and

wherein the data collector, the abnormality detector, the similar case selector, and the predictor are executed by at least one central processing unit (CPU) or at least one hardware processor.

2. The system of claim 1, wherein the abnormality detecting reference comprises:

the length of the preset detecting interval;

a threshold value of the occurrence of an abnormality; and

at least one reference pattern of abnormality detection.

3. The system of claim 2, wherein the abnormality detector determines that the abnormality has occurred in the monitored object when there is at least one value exceeding the threshold value of the occurrence of the abnormality in the status information in the preset detecting interval, or the status information matches the at least one reference pattern of the abnormality detection.

4. The system of claim 1, wherein the warning message is one of a visual message and an auditory message.

5. The system of claim 1, wherein the similar case selector compares one or more patterns of the past case data with a pattern of the status information in the preset detecting interval, and selects an optimal past case data having a highest degree of similarity to the pattern of the status information as the first case.

6. The system of claim 1, wherein the predictor predicts that a detected abnormality is proliferated when the first case is relevant to an abnormality proliferating case or the status information satisfies the abnormality proliferation predicting reference, and predicts that the detected abnormality diminishes when the first case is relevant to an abnormality diminishing case and the status information does not satisfy the abnormality proliferation predicting reference, to yield the prediction result.

7. The system of claim 6, wherein the predictor determines that the abnormality proliferation predicting reference is satisfied when an average value of the status information in the preset detecting interval exceeds a preset threshold value of abnormality detection, or more than a predetermined number of values exceeding a threshold value of the occurrence of the abnormality are included in the status information in the preset detecting interval.

8. The system of claim 1, wherein the abnormality detecting reference updater compares one or more patterns of the past case data with a pattern of the status information in the preset verification interval, and adjusts the length of the preset detecting interval based on the prediction result and proliferation or diminishing of the abnormality using the past case data having a highest similarity to the pattern of the status information in the preset verification interval.

9. A method of detecting and predicting an abnormality, comprising:

collecting status information from a monitored object;

comparing the status information and an abnormality detecting reference in a preset detecting interval, and detecting an occurrence of an abnormality of the monitored object;

selecting a first case having a highest degree of similarity to the status information among past case data when the occurrence of the abnormality is detected;

predicting proliferation or diminishing of the detected abnormality after the occurrence of the detected abnormality, by using the first case and an abnormality proliferation predicting reference;

adjusting a length of the preset detecting interval based on a prediction result and a change of the status information in a preset verification interval; and

transmitting a warning message to an administrator in response to the occurrence of the abnormality of the monitored object,

wherein the past case data includes the monitored object'"'"'s pattern of changing status information over time when a past abnormality is detected and information of the detected past abnormality either proliferating or diminishing in a corresponding case, and

wherein the preset verification interval corresponds to one of a first interval starting from a time of the occurrence of the abnormality in the preset detecting interval and ending at an additional preset time interval after an ending of the preset detecting interval, and a second interval which starts from the ending of the preset detecting interval and ending after the additional preset time interval.

10. The method of claim 9, wherein the abnormality detecting reference comprises:

the length of the preset detecting interval;

a threshold value of the occurrence of an abnormality; and

at least one reference pattern of abnormality detection.

11. The method of claim 10, wherein the detecting of the occurrence of the abnormality includes determining that the abnormality has occurred in the preset detecting interval when one or more values in the status information exceed the threshold value of the occurrence of the abnormality in the preset detecting interval, or the status information matches the at least one reference pattern of the abnormality detection.

12. The method of claim 9, wherein

the warning message is one of a visual message and an auditory message.

13. The method of claim 9, wherein the selecting of the first case includes comparing one or more patterns of the past case data with a pattern of the status information in the preset detecting interval, and selecting an optimal past case data having a highest degree of similarity to the pattern of the status information as the first case.

14. The method of claim 9, wherein the predicting includes predicting that a detected abnormality is proliferated when the first case is relevant to an abnormality proliferating case or the status information satisfies the abnormality proliferation predicting reference, and predicting that the detected abnormality diminishes when the first case is relevant to an abnormality diminishing case 5 and the status information does not satisfy the abnormality proliferation predicting reference, to yield the prediction result.

15. The method of claim 14, wherein the predicting includes determining that the abnormality proliferation predicting reference is satisfied when an average value of the status information in the preset detecting interval exceeds a preset threshold value of abnormality detection, or more than a predetermined number of values exceeding a threshold value of the occurrence of the abnormality are included in the status information in the preset detecting interval.

16. The method of claim 9, wherein the adjusting the length of the preset detecting interval further comprises:

comparing one or more patterns of the past case data with a pattern of the status information in the preset verification interval; and

adjusting the length of the preset detecting interval based on the prediction result and proliferation or diminishing of the abnormality using the past case data having highest similarity to the pattern of the status information in the preset verification interval.

17. A computer program stored in a non-transitory computer-readable recording medium combined with hardware, the computer program configured to execute:

collecting status information of a monitored object;

comparing the status information with an abnormality detecting reference in a preset detecting interval and detecting an occurrence of an abnormality of the monitored object;

selecting a first case having a highest degree of similarity to the status information among past case data when the occurrence of the abnormality is detected;

predicting proliferation or diminishing of the detected abnormality after the occurrence of the detected abnormality, by using the first case and an abnormality proliferation predicting reference;

adjusting a length of the preset detecting interval based on a prediction result and a change of the status information in a preset verification interval; and

transmitting a warning message to an administrator in response to the occurrence of the abnormality of the monitored object,

wherein the past case data includes the monitored object'"'"'s pattern of changing status information over time when a past abnormality is detected and information of the detected past abnormality either proliferating or diminishing in a corresponding case, and

wherein the preset verification interval corresponds to one of a first interval starting from a time of the occurrence of the abnormality in the preset detecting interval and ending at an additional preset time interval after an ending of the preset detecting interval, and a second interval which starts from the ending of the preset detecting interval and ending after the additional preset time interval.