Detection of anomalies in multivariate data

• US 10,474,932 B2
• Filed: 12/01/2016
• Issued: 11/12/2019
• Est. Priority Date: 09/01/2016
• Status: Active Grant

• Current Assignee: Uptake Technologies, Inc.
• Original Assignee: Uptake Technologies, Inc.
• Inventors: Fineis, Frank, Horrell, Michael, Li, Tuo, Herzog, James
• Primary Examiner(s): Breene, John E
• Assistant Examiner(s): Morgan, Jeffrey C
• Application Number:
  US15/367,012
• Publication Number:
  US 20180060703A1
• Time in Patent Office: 1,076 Days
• CPC Class Codes: G01D 21/00 Measuring or testing not otherwise provided for
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06F 18/2135 based on approximation criteria, e.g. principal component analysis
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection

Abstract

Disclosed herein are systems, devices, and methods for detecting anomalies in multivariate data received from an asset-related data source, such as signal data and/or other data from an asset. According to an example, a platform may receive multivariate data from an asset in an original coordinate space and transform the data in the original coordinate space to a transformed coordinate space having a relatively fewer number of dimensions. Additionally, the platform may standardize the data in the transformed coordinate space and modify the standardized data based on a comparison between the standardized data and a set of threshold values previously defined via training data reflective of normal asset operation. Thereafter, the platform may inversely transform the modified data back to the original coordinate space and perform an analysis to detect anomalies.

Claims

1. A computing device comprising:

a network interface;

at least one processor;

a non-transitory computer-readable medium; and

program instructions stored on the non-transitory computer-readable medium that, when executed by the at least one processor, cause a computing device to;

receive, via the network interface, multivariate data in an original coordinate space having a number of dimensions equal to the number of variables included in the multivariate data, wherein the multivariate data relates to operation of an asset;

transform the received multivariate data from the original coordinate space to a transformed coordinate space having fewer dimensions than the original coordinate space;

standardize the data in the transformed coordinate space;

modify the standardized data in the transformed coordinate space based on a set of threshold values, wherein the set of threshold values are defined based on training data reflective of normal asset operation;

inversely transform the modified data from the transformed coordinate space to the original coordinate space; and

analyze the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset.

2. The computing device of claim 1, wherein the program instructions that are executable to cause the computing device to transform the received multivariate data from the original coordinate space to the transformed coordinate space having fewer dimensions than the original coordinate space comprise program instructions that are executable to cause a computing device to:

apply Principal Component Analysis (PCA) to the received multivariate data in the original coordinate space, wherein the application of PCA comprises;

identifying a set of Principal Components that describe the variability in the received multivariate data;

based on the set of Principal Components, linearly transforming the received multivariate data in the original coordinate space to the transformed coordinate space, wherein each dimension of the transformed coordinate space corresponds to a Principal Component belonging to the set of Principal Components.

3. The computing device of claim 1, wherein the program instructions that are executable to cause the computing to analyze the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset comprise program instructions that are executable to cause the computing device to:

compare the received multivariate data and the inversely-transformed data in the original coordinate space; and

identify statistically-significant discrepancies in at least one variable value between the received multivariate data and the inversely-transformed data.

4. The computing device of claim 1, wherein the program instructions that are executable to cause the computing device to standardize the data in the transformed coordinate space comprise program instructions that are executable to cause the computing device to:

rescale the data in the transformed coordinate space, wherein the rescaled data is centered around an origin of the transformed coordinate space and adheres to a standard normal distribution.

5. The computing device of claim 1, wherein the program instructions that are executable to cause a computing device to modify the standardized data in the transformed coordinate space based on the set of threshold values comprise program instruction that are executable to cause the computing device to:

compare a given standardized data point'"'"'s value for each dimension in the transformed coordinate space to a defined threshold value for that dimension; and

determine whether one or more of the standardized data point'"'"'s values exceed the defined threshold value for that variable.

6. The computing device of claim 1, wherein the program instructions that are executable to cause the computing device to modify the standardized data in the transformed coordinate space based on the set of threshold values comprise program instruction that are executable to cause the computing device to:

identify a standardized data point in the transformed coordinate space having a value in at least one given dimension that exceeds a defined threshold value for the given dimension;

reduce the magnitude of the value in at least the given dimension to be equal to the defined threshold value for the given dimension.

7. The computing device of claim 6, wherein the program instructions that are executable to cause the computing device to reduce the magnitude of the value in at least the given dimension to be equal to the defined threshold value for the given dimension comprise program instruction that are executable to cause the computing device to:

reduce the magnitude of the value in at least the given dimension using at least one of vector shrinkage or component shrinkage.

8. A non-transitory computer-readable medium having program instructions stored thereon that are executable to cause a computing system to:

receive multivariate data in an original coordinate space having a number of dimensions equal to the number of variables included in the multivariate data, wherein the multivariate data relates to operation of an asset;

transform the received multivariate data from the original coordinate space to a transformed coordinate space having fewer dimensions than the original coordinate space;

standardize the data in the transformed coordinate space;

modify the standardized data in the transformed coordinate space based on a set of threshold values, wherein the set of threshold values are defined based on training data reflective of normal asset operation;

inversely transform the modified data from the transformed coordinate space to the original coordinate space; and

analyze the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset.

9. The non-transitory computer-readable medium of claim 8, wherein the program instructions that are executable to cause the computing system to transform the received multivariate data from the original coordinate space to the transformed coordinate space having fewer dimensions than the original coordinate space comprise program instructions that are executable to cause a computing device to:

apply Principal Component Analysis (PCA) to the received multivariate data in the original coordinate space, wherein the application of PCA comprises;

identifying a set of Principal Components that describe the variability in the received multivariate data;

based on the set of Principal Components, linearly transforming the received multivariate data in the original coordinate space to the transformed coordinate space, wherein each dimension of the transformed coordinate space corresponds to a Principal Component belonging to the set of Principal Components.

10. The non-transitory computer-readable medium of claim 8, wherein the program instructions that are executable to cause the computing system to analyze the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset comprise program instructions that are executable to cause the computing device to:

compare the received multivariate data and the inversely-transformed data in the original coordinate space; and

identify statistically-significant discrepancies in at least one variable value between the received multivariate data and the inversely-transformed data.

11. The non-transitory computer-readable medium of claim 8, wherein the program instructions that are executable to cause the computing system to standardize the data in the transformed coordinate space comprise program instructions that are executable to cause the computing device to:

rescale the data in the transformed coordinate space, wherein the resealed data is centered around an origin of the transformed coordinate space and adheres to a standard normal distribution.

12. The non-transitory computer-readable medium of claim 8, wherein the program instructions that are executable to cause the computing system to modify the standardized data in the transformed coordinate space based on the set of threshold values comprises program instruction that are executable to cause the computing device to:

compare a given standardized data point'"'"'s value for each dimension in the transformed coordinate space to a defined threshold value for that dimension; and

determine whether one or more of the standardized data point'"'"'s values exceed the defined threshold value for that variable.

13. The non-transitory computer-readable medium of claim 8, wherein the program instructions that are executable to cause the computing system to modify the standardized data in the transformed coordinate space based on the set of threshold values comprises program instruction that are executable to cause the computing device to:

identify a standardized data point in the transformed coordinate space having a value in at least one given dimension that exceeds a defined threshold value for the given dimension;

reduce the magnitude of the value in at least the given dimension to be equal to the defined threshold value for the given dimension.

14. The non-transitory computer-readable medium of claim 13, wherein the program instructions that are executable to cause the computing system to reduce the magnitude of the value in at least the given dimension to be equal to the defined threshold value for the given dimension comprise program instruction that are executable to cause the computing system to:

reduce the magnitude of the value in at least the given dimension using at least one of vector shrinkage or component shrinkage.

15. A computer-implemented method, the method comprising

receiving multivariate data in an original coordinate space having a number of dimensions equal to the number of variables included in the multivariate data, wherein the multivariate data relates to operation of an asset;

transforming the received multivariate data from the original coordinate space to a transformed coordinate space having fewer dimensions than the original coordinate space;

standardizing the data in the transformed coordinate space;

modifying the standardized data in the transformed coordinate space based on a set of threshold values, wherein the set of threshold values are defined based on training data reflective of normal asset operation;

inversely transforming the modified data from the transformed coordinate space to the original coordinate space; and

analyzing the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset.

16. The computer-implemented method of claim 15, wherein transforming the received multivariate data from the original coordinate space to the transformed coordinate space having fewer dimensions than the original coordinate space comprises:

applying Principal Component Analysis (PCA) to the received multivariate data in the original coordinate space, wherein the application of PCA comprises;

identifying a set of Principal Components that describe the variability in the received multivariate data;

based on the set of Principal Components, linearly transforming the received multivariate data in the original coordinate space to the transformed coordinate space, wherein each dimension of the transformed coordinate space corresponds to a Principal Component belonging to the set of Principal Components.

17. The computer-implemented method of claim 15, wherein analyzing the inversely-transformed data in the original coordinate space to identify anomalies in the multivariate data that are indicative of a potential problem at the asset comprises:

comparing the received multivariate data and the inversely-transformed data in the original coordinate space; and

identifying statistically-significant discrepancies in at least one variable value between the received multivariate data and the inversely-transformed data.

18. The computer-implemented method of claim 15, wherein standardizing the data in the transformed coordinate space comprises:

resealing the data in the transformed coordinate space, wherein the resealed data is centered around an origin of the transformed coordinate space and adheres to a standard normal distribution.

19. The computer-implemented method of claim 15, wherein modifying the standardized data in the transformed coordinate space based on the set of threshold values comprises:

comparing a given standardized data point'"'"'s value for each dimension in the transformed coordinate space to a defined threshold value for that dimension; and

determining whether one or more of the standardized data point'"'"'s values exceed the defined threshold value for that variable.

20. The computer-implemented method of claim 15, wherein modifying the standardized data in the transformed coordinate space based on the set of threshold values comprises:

identifying a standardized data point in the transformed coordinate space having a value in at least one given dimension that exceeds a defined threshold value for the given dimension;

reducing the magnitude of the value in at least the given dimension to be equal to the defined threshold value for the given dimension.