Detecting anomalies in an internet of things network
First Claim
1. A computer-implemented method comprising:
- receiving, by operation of a computer system, a dataset of a plurality of data records, each of the plurality of data records comprising a plurality of features and a target variable associated with the plurality of features, each feature of the plurality of features representing a reading of a separate sensor coupled to a machine and measuring a condition of the machine, and the target variable representing a status of the machine;
identifying a set of normal data records from the dataset based on the target variable;
identifying inter-feature correlations by performing correlation analysis on the set of normal data records; and
performing predictive maintenance on the machine based on a detection of an anomaly based on the inter-feature correlations for predictive maintenance, wherein the detection of the anomaly comprises;
identifying a cluster of correlated features based on the inter-feature correlations;
building a model that estimates a first feature in the cluster of correlated features based on one or more other features in the cluster of correlated features;
receiving a data record that includes an observed value of the first feature and observed values of the one or more other features in the cluster of correlated features;
determining an estimated value of the first feature according to the model based on the values of the one or more other features in the cluster of correlated features;
comparing the estimated value of the first feature with the observed value of the first feature; and
determining whether the data record is a normal data record or an abnormal data record based on the comparison.
1 Assignment
0 Petitions
Accused Products
Abstract
The present disclosure describes methods, systems, and computer program products for detecting anomalies in an Internet-of-Things (IoT) network. One computer-implemented method includes receiving, by operation of a computer system, a dataset of a plurality of data records, each of the plurality of data records comprising a plurality of features and a target variable, the plurality of features and target variable including information of a manufacturing environment; identifying a set of normal data records from the dataset based on the target variable; identifying inter-feature correlations by performing correlation analysis on the set of normal data records; and detecting anomaly based on the inter-feature correlations for predictive maintenance.
22 Citations
17 Claims
-
1. A computer-implemented method comprising:
-
receiving, by operation of a computer system, a dataset of a plurality of data records, each of the plurality of data records comprising a plurality of features and a target variable associated with the plurality of features, each feature of the plurality of features representing a reading of a separate sensor coupled to a machine and measuring a condition of the machine, and the target variable representing a status of the machine; identifying a set of normal data records from the dataset based on the target variable; identifying inter-feature correlations by performing correlation analysis on the set of normal data records; and performing predictive maintenance on the machine based on a detection of an anomaly based on the inter-feature correlations for predictive maintenance, wherein the detection of the anomaly comprises; identifying a cluster of correlated features based on the inter-feature correlations; building a model that estimates a first feature in the cluster of correlated features based on one or more other features in the cluster of correlated features; receiving a data record that includes an observed value of the first feature and observed values of the one or more other features in the cluster of correlated features; determining an estimated value of the first feature according to the model based on the values of the one or more other features in the cluster of correlated features; comparing the estimated value of the first feature with the observed value of the first feature; and determining whether the data record is a normal data record or an abnormal data record based on the comparison. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A non-transitory, computer-readable medium storing computer-readable instructions executable by a computer and configured to perform operations comprising:
-
receiving, by operation of a computer system, a dataset of a plurality of data records, each of the plurality of data records comprising a plurality of features and a target variable associated with the plurality of features, each feature of the plurality of features representing a reading of a separate sensor coupled to a machine and measuring a condition of the machine, and the target variable representing a status of the machine; identifying a set of normal data records from the dataset based on the target variable;
identifying inter-feature correlations by performing correlation analysis on the set of normal data records; andperforming predictive maintenance on the machine based on a detection of an anomaly based on the inter-feature correlations for predictive maintenance, wherein the detection of the anomaly comprises; identifying a cluster of correlated features based on the inter-feature correlations; building a model that estimates a first feature in the cluster of correlated features based on one or more other features in the cluster of correlated features; receiving a data record that includes an observed value of the first feature and observed values of the one or more other features in the cluster of correlated features; determining an estimated value of the first feature according to the model based on the values of the one or more other features in the cluster of correlated features; comparing the estimated value of the first feature with the observed value of the first feature; and determining whether the data record is a normal data record or an abnormal data record based on the comparison. - View Dependent Claims (11, 12, 13)
-
-
14. A system, comprising:
-
a memory; at least one hardware processor interoperably coupled with the memory and configured to perform operations comprising; receiving, by operation of a computer system, a dataset of a plurality of data records, each of the plurality of data records comprising a plurality of features and a target variable associated with the plurality of features, each feature of the plurality of features representing a reading of a separate sensor coupled to a machine and measuring a condition of the machine, and the target variable representing a status of the machine; identifying a set of normal data records from the dataset based on the target variable; identifying inter-feature correlations by performing correlation analysis on the set of normal data records; and performing predictive maintenance on the machine based on a detection of an anomaly based on the inter-feature correlations for predictive maintenance, wherein the detection of the anomaly comprises; identifying a cluster of correlated features based on the inter-feature correlations; building a model that estimates a first feature in the cluster of correlated features based on one or more other features in the cluster of correlated features; receiving a data record that includes an observed value of the first feature and observed values of the one or more other features in the cluster of correlated features; determining an estimated value of the first feature according to the model based on the values of the one or more other features in the cluster of correlated features; comparing the estimated value of the first feature with the observed value of the first feature; and determining whether the data record is a normal data record or an abnormal data record based on the comparison. - View Dependent Claims (15, 16, 17)
-
Specification