Claims:We Claim:
1. A processor implemented method (200) of anomaly detection, comprising:
collecting (202) a time-series data from a plurality of sensors, via one or more hardware processors, as input data;
generating (204) an evaluation matrix, via the one or more hardware processors, wherein the evaluation matrix comprises score indicating a relative importance of the time-series data received from each of the plurality of sensors;
constructing (206) a decision matrix by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, via the one or more hardware processors, wherein values in the decision matrix represent a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors; and
clustering (208) the plurality of sensors based on the relative impact, via the one or more hardware processors, to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data.

2. The method as claimed in claim 1, wherein generating the evaluation matrix comprises:
computing (302) a histogram for a selected time span for each of the plurality of sensors;
normalizing (304) the histogram;
computing (306) a median of the histogram for each of the plurality of sensors;
computing (308) a Kullback-Leibler Divergence (KLD) score for the time-series data from each of the plurality of sensors; and
generating (310) the evaluation matrix using the computed KLD score of the plurality of sensors.

3. The method as claimed in claim 1, wherein constructing the decision matrix by applying the ASM function comprises:

generating (402) a mapping function, wherein the mapping function maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar;
restricting (404) the mapping function to satisfy a relation, wherein the relation is defined as
, wherein the restricted mapping function forms the ASM;
constructing (406) a data driven dependency graph using a Mutual Information Criterion (MIC) by keeping the anomalous sensor as a root node and the plurality of sensors other than the anomalous sensor forming branches of a tree structure, wherein the sensors from among the plurality of sensors, that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node.

4. The method as claimed in claim 3, wherein determining all anomalous sensors from among the plurality of sensors, using the constructed data driven dependency graph comprises:

obtaining (502) a vector with a single row and a plurality of columns, from the constructed data driven dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp;
clustering (504) the sensor values by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters; and
determining (506) a cluster having highest score, from among the plurality of clusters, as a cluster representing anomalous time stamps where one or more faults have occurred.

5. A system (100) for anomaly detection, comprising:
one or more hardware processors (102);
a communication interface (112); and
a memory (104) storing a plurality of instructions, wherein the plurality of instructions when executed, cause the one or more hardware processors to:
collect a time-series data from a plurality of sensors as input data;
generate an evaluation matrix, wherein the evaluation matrix comprises score indicating a relative importance of the time-series data received from each of the plurality of sensors;
construct a decision matrix by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, wherein values in the decision matrix represents a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors; and
cluster the plurality of sensors based on the relative impact, to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data.

6. The system as claimed in claim 5, wherein the one or more hardware processors are configured to generate the evaluation matrix by:
computing a histogram for a selected time span for each of the plurality of sensors;
normalizing the histogram;
computing a median of the histogram for each of the plurality of sensors;
computing a Kullback-Leibler Divergence (KLD) score for the time-series data from each of the plurality of sensors; and
generating the evaluation matrix using the computed KLD score of the plurality of sensors.

7. The system as claimed in claim 5, wherein the one or more hardware processors are configured to construct the decision matrix by applying the ASM function, by:

generating a mapping function, wherein the mapping function maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar;
restricting the mapping function to satisfy a relation, wherein the relation is defined as
, wherein the restricted mapping function forms the ASM;
constructing a data driven dependency graph using a Mutual Information Criterion (MIC) by keeping the anomalous sensor as a root node and the plurality of sensors other than the anomalous sensor forming branches of a tree structure, wherein the sensors from among the plurality of sensors, that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node.

8. The system as claimed in claim 7, wherein the one or more hardware processors are configured to determine all anomalous sensors from among the plurality of sensors, using the constructed data driven dependency graph, by:

obtaining a vector with a single row and a plurality of columns, from the constructed data driven dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp;
clustering the sensor values by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters; and
determining a cluster having highest score, from among the plurality of clusters, as a cluster
representing anomalous time stamps where one or more faults have occurred.

Dated this 14th Day of March 2022

Tata Consultancy Services Limited
By their Agent & Attorney

(Adheesh Nargolkar)
of Khaitan & Co
Reg No IN-PA-1086 , Description:FORM 2

THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENT RULES, 2003

COMPLETE SPECIFICATION
(See Section 10 and Rule 13)

Title of invention:
METHOD AND SYSTEM FOR TIME SERIES DATA PROCESSING AND ANOMALY DETECTION

Applicant
Tata Consultancy Services Limited
A company Incorporated in India under the Companies Act, 1956
Having address:
Nirmal Building, 9th floor,
Nariman point, Mumbai 400021,
Maharashtra, India

Preamble to the description:
The following specification particularly describes the invention and the manner in which it is to be performed.
TECHNICAL FIELD
The disclosure herein generally relates to data processing, and, more particularly, to method and system for time series data processing and anomaly detection.

BACKGROUND
In the context of data analysis and processing, anomaly detection is performed to identify anomalous data and in turn to detect components that are responsible for the anomalous data. For example, in manufacturing, aviation, and other industries, in which multiple components contribute to overall functioning of the industry, one or more components malfunctioning may adversely affect overall result/throughout. At the same time, as quantity of the data generated at any instance may be huge, identifying the malfunctioning component/equipment may be a difficult task. The anomaly detection mechanism is used to process such data, which is collected in a time-series format, and identify anomalies. Upon identifying anomalies in the data, further analysis helps in identifying the malfunctioning/anomalous components.
When a system is being monitored for anomalies, most of the existing approaches use a subset of the actual data to arrive at conclusions, due to practical difficulties in processing the huge amount of data. However, not analysing major chunk of the data affects quality and accuracy of the anomaly detection.

SUMMARY
Embodiments of the present disclosure present technological improvements as solutions to one or more of the above-mentioned technical problems recognized by the inventors in conventional systems. For example, in one embodiment, a processor implemented method of anomaly detection is provided. In this method, initially a time-series data from a plurality of sensors is collected as input data via one or more hardware processors. Further, an evaluation matrix is generated via the one or more hardware processors, wherein the evaluation matrix comprises score indicating a relative importance of the time-series data received from each of the plurality of sensors. Further, a decision matrix is constructed by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, via the one or more hardware processors, wherein values in the decision matrix represent a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors. Further, the plurality of sensors are clustered based on the relative impact, to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data.
In another aspect, generating the evaluation matrix includes the following steps. Initially, a histogram is computed for a selected time span for each of the plurality of sensors. The histogram is then normalized. Further, a median of the histogram is computed for each of the plurality of sensors. Further, a Kullback-Leibler Divergence (KLD) score is computed for the time-series data from each of the plurality of sensors. Then the evaluation matrix is generated using the computed KLD score of the plurality of sensors.
In yet another aspect, constructing the decision matrix by applying the ASM function comprises the following steps. Initially, a mapping function is generated, wherein the mapping function maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar. The mapping function is then restricted to satisfy a relation, wherein the relation is defined as:
, wherein the restricted mapping function forms the ASM.
Further, a data driven dependency graph is constructed using a Mutual Information Criterion (MIC) by keeping the anomalous sensor as a root node and the plurality of sensors other than the anomalous sensor forming branches of a tree structure, wherein the sensors from among the plurality of sensors, that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node.
In yet another aspect, determining all anomalous sensors from among the plurality of sensors, using the constructed data driven dependency graph includes the following steps. Initially, a vector with a single row and a plurality of columns is obtained from the constructed data driven dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp. Further, the sensor values are clustered by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters. Further, a cluster having highest score, from among the plurality of clusters, is determined as a cluster representing anomalous time stamps where one or more faults have occurred.
In yet another aspect, a system for anomaly detection is provided. The system includes one or more hardware processors, a communication interface, and a memory storing a plurality of instructions, wherein the plurality of instructions when executed, cause the one or more hardware processors to initially collect a time-series data from a plurality of sensors, as input data. Further, Further, an evaluation matrix is generated via the one or more hardware processors, wherein the evaluation matrix comprises score indicating a relative importance of the time-series data received from each of the plurality of sensors. Further, a decision matrix is constructed by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, via the one or more hardware processors, wherein values in the decision matrix represent a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors. Further, the plurality of sensors are clustered based on the relative impact, to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data.
In yet another aspect, the one or more hardware processors of the system are configured to generate the evaluation matrix using the following steps. Initially, a histogram is computed for a selected time span for each of the plurality of sensors. The histogram is then normalized. Further, a median of the histogram is computed for each of the plurality of sensors. Further, a Kullback-Leibler Divergence (KLD) score is computed for the time-series data from each of the plurality of sensors. Then the evaluation matrix is generated using the computed KLD score of the plurality of sensors.
In yet another aspect, the one or more hardware processors in the system are configured to construct the decision matrix by applying the ASM function by executing the following steps. Initially, a mapping function is generated, wherein the mapping function maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar. The mapping function is then restricted to satisfy a relation, wherein the relation is defined as:
, wherein the restricted mapping function forms the ASM.
Further, a data driven dependency graph is constructed using a Mutual Information Criterion (MIC) by keeping the anomalous sensor as a root node and the plurality of sensors other than the anomalous sensor forming branches of a tree structure, wherein the sensors from among the plurality of sensors, that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node.
In yet another aspect, the one or more hardware processors are configured to determine all anomalous sensors from among the plurality of sensors, using the constructed data driven dependency graph includes the following steps. Initially, a vector with a single row and a plurality of columns is obtained from the constructed data driven dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp. Further, the sensor values are clustered by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters. Further, a cluster having highest score, from among the plurality of clusters, is determined as a cluster representing anomalous time stamps where one or more faults have occurred.
In yet another aspect, a non-transitory computer readable medium for anomaly detection is provided. The non-transitory computer readable medium includes a plurality of instructions, which when executed, cause the following steps. Initially a time-series data from a plurality of sensors is collected as input data via one or more hardware processors. Further, an evaluation matrix is generated via the one or more hardware processors, wherein the evaluation matrix comprises score indicating a relative importance of the time-series data received from each of the plurality of sensors. Further, a decision matrix is constructed by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, via the one or more hardware processors, wherein values in the decision matrix represent a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors. Further, the plurality of sensors are clustered based on the relative impact, to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data, and the data from each of the clusters selected as the clusters having anomalous data are identified as anomalous data.
In yet another aspect, the non-transitory computer readable medium is configured to generate the evaluation matrix by executing the following steps. Initially, a histogram is computed for a selected time span for each of the plurality of sensors. The histogram is then normalized. Further, a median of the histogram is computed for each of the plurality of sensors. Further, a Kullback-Leibler Divergence (KLD) score is computed for the time-series data from each of the plurality of sensors. Then the evaluation matrix is generated using the computed KLD score of the plurality of sensors.
In yet another aspect, the non-transitory computer readable medium is configured to construct the decision matrix by applying the ASM function comprises the following steps. Initially, a mapping function is generated, wherein the mapping function maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar. The mapping function is then restricted to satisfy a relation, wherein the relation is defined as:
, wherein the restricted mapping function forms the ASM.
Further, a data driven dependency graph is constructed using a Mutual Information Criterion (MIC) by keeping the anomalous sensor as a root node and the plurality of sensors other than the anomalous sensor forming branches of a tree structure, wherein the sensors from among the plurality of sensors, that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node.
In yet another aspect, the non-transitory computer readable medium is configured to determine all anomalous sensors from among the plurality of sensors, using the constructed data driven dependency graph, by executing the following steps. Initially, a vector with a single row and a plurality of columns is obtained from the constructed data driven dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp. Further, the sensor values are clustered by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters. Further, a cluster having highest score, from among the plurality of clusters, is determined as a cluster representing anomalous time stamps where one or more faults have occurred.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS
The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate exemplary embodiments and, together with the description, serve to explain the disclosed principles:
FIG. 1 illustrates an exemplary system for anomaly detection, according to some embodiments of the present disclosure.
FIG. 2 is a flow diagram depicting steps involved in the process of anomaly detection by the system of FIG. 1, according to some embodiments of the present disclosure.
FIG. 3 is a flow diagram depicting steps involved in the process of generating an evaluation matrix, by the system of FIG. 1, according to some embodiments of the present disclosure.
FIG. 4 is a flow diagram depicting steps involved in the process of generating a decision matrix, by the system of FIG. 1, according to some embodiments of the present disclosure.
FIG. 5 is a flow diagram depicting steps involved in the process of determining anomalous sensors using a constructed data driven dependency graph, by the system of FIG. 1, according to some embodiments of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENTS
Exemplary embodiments are described with reference to the accompanying drawings. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. Wherever convenient, the same reference numbers are used throughout the drawings to refer to the same or like parts. While examples and features of disclosed principles are described herein, modifications, adaptations, and other implementations are possible without departing from the scope of the disclosed embodiments.
Referring now to the drawings, and more particularly to FIG. 1 through FIG. 5, where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments and these embodiments are described in the context of the following exemplary system and/or method.
FIG. 1 illustrates an exemplary system for anomaly detection, according to some embodiments of the present disclosure. The system 100 includes or is otherwise in communication with hardware processors 102, at least one memory such as a memory 104, and an I/O interface 112. The hardware processors 102, memory 104, and the Input /Output (I/O) interface 112 may be coupled by a system bus such as a system bus 108 or a similar mechanism. In an embodiment, the hardware processors 102 can be one or more hardware processors.
The I/O interface 112 may include a variety of software and hardware interfaces, for example, a web interface, a graphical user interface, and the like. The I/O interface 112 may include a variety of software and hardware interfaces, for example, interfaces for peripheral device(s), such as a keyboard, a mouse, an external memory, a printer and the like. Further, the I/O interface 112 may enable the system 100 to communicate with other devices, such as web servers, and external databases.
The I/O interface 112 can facilitate multiple communications within a wide variety of networks and protocol types, including wired networks, for example, local area network (LAN), cable, etc., and wireless networks, such as Wireless LAN (WLAN), cellular, or satellite. For the purpose, the I/O interface 112 may include one or more ports for connecting several computing systems with one another or to another server computer. The I/O interface 112 may include one or more ports for connecting several devices to one another or to another server.
The one or more hardware processors 102 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, node machines, logic circuitries, and/or any devices that manipulate signals based on operational instructions. Among other capabilities, the one or more hardware processors 102 is configured to fetch and execute computer-readable instructions stored in the memory 104.
The memory 104 may include any computer-readable medium known in the art including, for example, volatile memory, such as static random access memory (SRAM) and dynamic random access memory (DRAM), and/or non-volatile memory, such as read only memory (ROM), erasable programmable ROM, flash memories, hard disks, optical disks, and magnetic tapes. In an embodiment, the memory 104 includes a plurality of modules 106.
The plurality of modules 106 include programs or coded instructions that supplement applications or functions performed by the system 100 for executing different steps involved in the anomaly detection being handled by the system 100. The plurality of modules 106, amongst other things, can include routines, programs, objects, components, and data structures, which performs particular tasks or implement particular abstract data types. The plurality of modules 106 may also be used as, signal processor(s), node machine(s), logic circuitries, and/or any other device or component that manipulates signals based on operational instructions. Further, the plurality of modules 106 can be used by hardware, by computer-readable instructions executed by the one or more hardware processors 102, or by a combination thereof. The plurality of modules 106 can include various sub-modules (not shown). The plurality of modules 106 may include computer-readable instructions that supplement applications or functions performed by the system 100 for executing the different steps involved in performing the anomaly detection being performed by the system 100.
The data repository (or repository) 110 may include a plurality of abstracted piece of code for refinement and data that is processed, received, or generated as a result of the execution of the plurality of modules in the module(s) 106.
Although the data repository 110 is shown internal to the system 100, it will be noted that, in alternate embodiments, the data repository 110 can also be implemented external to the system 100, where the data repository 110 may be stored within a database (repository 110) communicatively coupled to the system 100. The data contained within such external database may be periodically updated. For example, new data may be added into the database (not shown in FIG. 1) and/or existing data may be modified and/or non-useful data may be deleted from the database. In one example, the data may be stored in an external system, such as a Lightweight Directory Access Protocol (LDAP) directory and a Relational Database Management System (RDBMS). Functions of the components of the system 100 are now explained with reference to steps in flow diagrams in FIGS. 2 through FIG. 5.
FIG. 2 is a flow diagram depicting steps involved in the process of anomaly detection by the system of FIG. 1, according to some embodiments of the present disclosure.
At step 202 of the method 200 in FIG. 2, the system 100 collects a time series data from a plurality of sensors, via one or more hardware processors, as input data. The plurality of sensors may be of any appropriate type, such as but not limited to temperature sensor, pressure sensor, and so on, selected based on type of parameters to be monitored, and may be deployed at appropriate locations of a system being monitored for anomaly detection. As the values of the parameters may be collected continuously by the sensors, and may be in turn collected by the system 100 either continuously or at different time intervals as configured, the collected input data is a time series data.
At step 204, the system 100 generates an evaluation matrix, via the one or more hardware processors, wherein the evaluation matrix comprises score indicating a relative importance of data received from each of the plurality of sensors. Steps involved in the process of generating the evaluation matrix are depicted in FIG. 3, and are explained hereafter. At step 302 of the method 300, the system 100 computes a histogram for a selected time span for each of the plurality of sensors. The histogram is a representation of distribution of data collected using the plurality of sensors, over a selected period of time, for example, every 8 hours, or 24 hours. The system 100 uses the histogram as a method of data aggregation, which allows to summarize the entire data generated in the selected period of time. This in turn allows to consider and use the entire data generated to arrive at conclusions, as opposed to processing of only a subset of the generated data which affects quality of results or the conclusions.
Further at step 304, the system 100 normalizes the histogram. Normalizing the histogram includes processing the histogram to enhance finer details of the histogram, by normalizing each value in the histogram in the range 0 to 1. Enhancing the finer details enhances quality or efficiency with which the details in the histogram is processed in subsequent steps. To normalize the histogram, the system 100 finds a max-mix of frequency of data in a plurality of bins i.e. frequency of each of the bins, when the information in the histogram are segregated to be in a plurality of bins. Further, if the frequency of a bin is ‘x’, the system 100 calculates an optimum value x^', as:
x^'= ((x-min))/((max-min) ) --- (1)
such that 0= x^'=1
The histogram enhanced at step 304 is further processed at step 306.
At step 306, the system 100 computes a median of values captured in the histogram obtained from step 304. The median acts as an approximate average value, and reduces effect of outliers on the data. In an embodiment, the median of the histogram is computed for each of the plurality of sensors. Further at step 308, the system 100 computes a Kullback-Leibler Divergence (KLD) score for data from each of the plurality of sensors, to populate a matrix fi,j=KLD of ith sensor at jth instance of time with the median of the ith sensor. Further, at step 310, the evaluation matrix is generated using the computed KLD scores of the plurality of sensors. An example representation of the evaluation matrix is:

Data in any row in the evaluation matrix V for any sensor represents failure of the sensor, but does not indicate at which time the failure occurred. Though the columns in the evaluation matrix V may represent the time stamp of anomaly, it does not directly indicate which sensor acts as the root cause of the anomaly. As a result, it is difficult to directly infer data from the evaluation matrix. So at step 206, the system 100 constructs a decision matrix by applying an Additive Standard Multifactorial (ASM) function on the evaluation matrix, wherein values in the decision matrix represent a relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors. Steps involved in the process of constructing the decision matrix are depicted in method 400 in FIG. 4, and are explained hereafter. At step 402, the system 100 generates a mapping function which maps m-dimensional values in the evaluation matrix to a corresponding one dimensional scalar. The mapping function is represented as M_m. The M_m is used by the system 100 to map each entry in the evaluation matrix, which is a m-dimensional vectors f=(f_1,f_2,...f_m ), into a corresponding one dimensional scalar i.e. M_m (f)=M_m (f_1,f_2,...f_m ). This allows mapping of each of the plurality of sensors to a corresponding single digit value generated by summing up values generated by each of the sensors multiple times over a period of time. Further, at step 404, the system 100 restricts the mapping function to satisfy a relation, defined as:
---- (1)

The restricted mapping function forms the ASM. The mapping function maps the sensor values into a scale of (0,1). In equation (1), ¦(n@?@i=1) indicates ANDing operation and ¦(m@?@i=1)f_i indicates ORing operation. Minimum value of the ANDing operation of all factors can be 0 whereas maximum value of ORing operation is 1. So, the equation (1) indicates that the mapping function maps each factor in a range of zero to 1. The ASM is then applied on the evaluation matrix V to obtain a multifactorial evaluation
V^'= (v_1,v_2,.....v_n ) --- (2)
Where,

v_i= M_m (v_(1_i ),v_(2_i ),....v_(n_i ) )? i=[1,n]

Further, at step 406, the system 100 constructs a data driven dependency graph using a Mutual information criterion (MIC) by keeping anomalous sensor as a root node and all other sensors from among the plurality of sensors forming branches of a tree structure, wherein the sensors that are farthest from the root node are determined as having least impact on the anomaly of the anomalous sensor forming the root node. In an embodiment, before constructing the data driven dependency graph, the system 100 performs a feature reduction to select only essential features (and sensors) for constructing the data driven dependency graph. For the feature reduction, the system 100 initially excludes a subset of n features from the total N features, based on a measured relevance, and total number of features becomes (N-n). Further, the system 100 uses a suitable algorithm such as a D3G algorithm in order to further reduce the number of features. At this stage the data set with (N-n) features is provided as input to the D3G algorithm, and information on a variable to be predicted (i.e., target parameter) also is specified as another input. The system 100 then constructs the data driven dependency graph starting from the target parameter. D3G finds out strength of relationships (a number between 0-1) between different variables starting from the target parameter. Here each node represents a feature (usually a sensor) and numbers on each edge represents the strengths of relationships. By default a node becomes disconnected if the strength of relationships becomes zero. The disconnected nodes are then removed. If the number of disconnected nodes is d, then remaining number of features is (N-n-d) are considered as the essential features, and form the data driven dependency graph. From the data driven dependency graph, the relative impact of each of the plurality of sensors on anomaly of every other sensor is determined, and this information is used to generate the decision matrix such that each value in the decision matrix represents the relative impact of each of the plurality of sensors on anomaly of a sensor identified as an anomalous sensor from among the plurality of sensors. In an embodiment, the decision matrix is a row vector i.e. a matrix having a single row and multiple columns.
Further, at step 208, the system 100 clusters the plurality of sensors based on the relative impact to form a plurality of clusters, wherein one or more clusters from among the plurality of clusters, having the relative impact exceeding a threshold of impact, are selected as clusters having anomalous data, and the data from each of the clusters selected as the clusters having anomalous data are identified as anomalous data. This results in the anomaly detection. Steps involved in the process of anomaly detection are depicted in method 500 of FIG. 5, and are explained hereafter. At step 502, the system 100 obtains a vector with a single row and a plurality of columns, from the constructed data dependency graph, wherein each of the plurality of columns represents an anomaly across all sensor values for a time stamp. The system 100 obtains the vector by considering value of a strength of relationships (on a scale of 0 to 1) determined between different variables starting from a variable considered as a target parameter from the data dependency graph. Here each node represents a feature (i.e., a sensor) and numbers on each edge represents the strengths of relationships. Further, at step 504, the system 100 clusters the sensor values by applying a K-means clustering with a fixed value of K, to obtain a plurality of clusters. In an embodiment, the value of K is pre-defined. In another embodiment, the value of K is dynamically configurable as per requirements. At this step, a K-means score calculated (using approach of known in the state of the art K-means clustering technique) for each of the sensors represents the relative impact of the sensor on the anomaly of the sensor forming the root node. Further, at step 506, the system 100 compares the determined relative impact with the threshold of impact, for each of the plurality of sensors, and all clusters having K-means score/relative impact exceeding the threshold of impact are determined as clusters representing anomalous time stamps where one or more faults have occurred.
The written description describes the subject matter herein to enable any person skilled in the art to make and use the embodiments. The scope of the subject matter embodiments is defined by the claims and may include other modifications that occur to those skilled in the art. Such other modifications are intended to be within the scope of the claims if they have similar elements that do not differ from the literal language of the claims or if they include equivalent elements with insubstantial differences from the literal language of the claims.
The embodiments of present disclosure herein address unresolved problem of anomaly detection in time series data. The embodiment thus provides a mechanism of processing data from all sensors to perform the anomaly detection.
It is to be understood that the scope of the protection is extended to such a program and in addition to a computer-readable means having a message therein; such computer-readable storage means contain program-code means for implementation of one or more steps of the method, when the program runs on a server or mobile device or any suitable programmable device. The hardware device can be any kind of device which can be programmed including e.g., any kind of computer like a server or a personal computer, or the like, or any combination thereof. The device may also include means which could be e.g., hardware means like e.g., an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination of hardware and software means, e.g., an ASIC and an FPGA, or at least one microprocessor and at least one memory with software processing components located therein. Thus, the means can include both hardware means and software means. The method embodiments described herein could be implemented in hardware and software. The device may also include software means. Alternatively, the embodiments may be implemented on different hardware devices, e.g., using a plurality of CPUs.
The embodiments herein can comprise hardware and software elements. The embodiments that are implemented in software include but are not limited to, firmware, resident software, microcode, etc. The functions performed by various components described herein may be implemented in other components or combinations of other components. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can comprise, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The illustrated steps are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope of the disclosed embodiments. Also, the words “comprising,” “having,” “containing,” and “including,” and other similar forms are intended to be equivalent in meaning and be open ended in that an item or items following any one of these words is not meant to be an exhaustive listing of such item or items, or meant to be limited to only the listed item or items. It must also be noted that as used herein and in the appended claims, the singular forms “a,” “an,” and “the” include plural references unless the context clearly dictates otherwise.
Furthermore, one or more computer-readable storage media may be utilized in implementing embodiments consistent with the present disclosure. A computer-readable storage medium refers to any type of physical memory on which information or data readable by a processor may be stored. Thus, a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the embodiments described herein. The term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage media.
It is intended that the disclosure and examples be considered as exemplary only, with a true scope of disclosed embodiments being indicated by the following claims.