Patent Application
20220253733
The present disclosure relates to methods and devices for detection, diagnosis/prognosis, and mitigation of anomalies (also referred to as abnormalities herein).
There are a considerable number of conventional machine-learning-based abnormality detection methods that are generally used to detect abnormalities in data sets with high dimensions.
An abnormality detection method and device that are able to determine dependence and causal relationship for an abnormality in a data set are provided. In one embodiment, a method includes detecting an abnormality in a test data set, generating a counterfactual data set for the test data set, determining a quantitative feature dependence between the test data set and the counterfactual data set, determining a causal relationship of the abnormality based on the quantitative feature dependence, and generating a causal graph that represents the causal relationship of the abnormality. In one embodiment, an action may be implemented, based on the causal graph, to mitigate an occurrence of the abnormality.
In one embodiment, an abnormality detection device includes a processor and a non-transitory computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include detecting an abnormality in a test data set, generating a counterfactual data set for the test data set, determining a quantitative feature dependence between the test data set and the counterfactual data set, determining a causal relationship of the abnormality based on the quantitative feature dependence, and generating a causal graph that represents the causal relationship of the abnormality. In one embodiment, the operations further include implementing an action, based on the causal graph, to mitigate an occurrence of the abnormality.
In one embodiment, an abnormality detection device comprises a processor and a plurality of non-transitory modules that store instructions, which, when executed by the processor, cause the processor to perform operations. The plurality of modules comprises a knowledge processing module for enabling a user to input information in a first form and for converting the information in the first form to a second form, a minimum correlated feature subset detection module for determining a minimum correlated feature subset; an abnormality detection module for detecting an abnormality of test data sets and for generating counterfactual data sets via an abnormality detection model; a dependence interpretation module for training a feature dependence interpretation model of dependence among features and for generating quantitative feature dependence for test data and counterfactual data sets; a causality analyzation module for discovering causal relationships of generated feature dependence via causality discovery algorithms; and a causal-graph-based interpretation generation module for generating a causal graph on which the quantitative feature dependence and the causal relationships are represented to interpret the abnormality process.
The teaching of the present disclosure can be readily understood by considering the following detailed description in conjunction with the accompanying drawings, in which:
To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures.
The present disclosure broadly discloses abnormality detection based on causal graphs that represent causal relationships of abnormalities and mitigation of an occurrence of an abnormality. As discussed above, there are a considerable number of conventional machine-learning-based abnormality detection methods that are generally used to detect an abnormality of data sets with high dimensions. Despite conventional machine-learning-based abnormality detection methods indicating abnormality scores or other indices, conventional methods fail to infer dependence of multiple abnormal features or interpret causalities and provide indications thereof. Accordingly, in the absence of such an interpretation of detected abnormalities and identification of corresponding sources of the detected abnormalities, conventional abnormality detection methods are not able to assist in the mitigation of an occurrence of an abnormality.
The present disclosure describes abnormality detection based on causal graphs that represent causal relationships of abnormalities. The disclosed abnormality detection may be utilized to mitigate an occurrence of an abnormality caused by a plurality of abnormal features and/or causalities.
To aid in understanding the present disclosure,
The method 100 of
In operation 104, the method generates a plurality of counterfactual data sets for the test data set.
In operation 106, the method determines a quantitative feature dependence between the test data set and the plurality of counterfactual data sets.
In operation 108, the method determines a causal relationship of the abnormality based on the quantitative feature dependence.
In operation 110, the method generates a causal graph that represents the causal relationship of the abnormality.
In operation 112, the method implements an action, based on the causal graph, to mitigate an occurrence of the abnormality.
In operation 113, the method ends.
In the example of
The knowledge processing module 202 is configured to enable a user to input information in certain forms and to convert the information that is input into one or more other forms that are recognizable by other modules. For example, information in a first form may be input and converted to a second form. The knowledge processing module can accept at least, but not limited to, the following information:
A feature labelling is used to denote a specific one of the features of a data set. Each feature labelling also indicates a weight for the specific feature. In one embodiment, the smaller the weight of the feature labelling of a specific feature, the more impact the specific feature, when found in the test and training data sets, will have with respect to anomaly detection relative to another feature labelling having a larger weight. For example, example labels and weights of feature labelling are illustrated in Table 1.
In particular, Table 1 indicates that label Fb is utilized to identify a control loop feedback and is assigned a weight of 4.0. Although example Table 1 includes information related to five feature labels, it should be noted that Table 1 may include information related to any number of feature labels that is greater than one (1). In addition, it should be noted that a weight associated with a feature labelling can be set to value other than those illustrated in Table 1.
The provided abnormality detection is able to determine the dependence and causal relationship for an abnormality in a data set based on monitored features of the data set. For example, Table 2 illustrates an example of feature labelling for a data set comprising nine features.
In particular, Table 2 indicates that the feature AirFlow is a control loop feedback that is assigned a weight of 4.0. Although example Table 2 includes information related to nine features, it should be noted that Table 2 may include information related to any number of features that is greater than one (1). In addition, it should be noted that any feature labelling may be utilized to describe feature.
Feature dependence refers to knowledge such as data monotonic constraints, causal relationships, and the like, which are typically definable by the user.
The minimum correlated feature subset detection module 204 is configured to determine a minimum correlated feature subset that may be utilized to mitigate negative impact outnumbered strong correlated features exert on the generalization performance of the device 200. When the correlation between features is greater than a correlation threshold, the features are said to be strongly correlated features. Strong correlated features are said to be outnumbered when the number of strong correlated features is greater than a threshold.
As noted above, the minimum correlated feature subset detection module is configured to utilize a correlation threshold to evaluate the correlation strength of features of a training data set. If the correlation strength of features is greater than the correlation threshold, the correlated features are identified as having strong correlation and one or multiple correlated features are extracted to a subset. The extracted subset shall be a minimum subset such that the strength of correlated features of the training data set, when the minimum subset is eliminated from the training data set, are below the correlation threshold. The subset of correlated features that remain after elimination of the minimum subset from the training subset and whose correlation is below the correlation threshold is called the maximum weak correlation subset.
The abnormality detection module 206 is configured to detect an abnormality of test data sets and generate counterfactual data sets via an abnormality detection model.
The dependence interpretation module 208 is configured to determine dependence among features and generate a quantitative feature dependence for test data and counterfactual data sets. Once a feature dependence interpretation model learns feature dependence via training, the feature dependence interpretation model will be able to describe the feature dependence in a quantitative way and provide the quantitative feature dependence as input for causality analysis.
The causality analyzation module 210 is configured to determine causal relationships of generated feature dependence via causality discovery algorithms.
The causal-graph-based interpretation generation module 212 is configured to generate a causal graph in which the quantitative feature dependence and causal relationships that interpret an abnormality are represented. In one embodiment, the module 201 for abnormality detection based on causal graphs representing causal relationships of abnormalities may also include an action module that implements, based on the causal graph, an action to mitigate an occurrence of an abnormality. For example, such an action may control one or more of a limit, a control loop setpoint, and the like, that are associated with a feature.
Although only one processor element is shown, it should be noted that the computing device may employ a plurality of processor elements. Furthermore, although only one computing device is shown in
Further, one or more hardware processors can be utilized in supporting a virtualized or shared computing environment. The virtualized computing environment may support one or more virtual machines representing computers, servers, or other computing devices. In such virtualized virtual machines, hardware components such as hardware processors and computer-readable storage devices may be virtualized or logically represented.
It should be noted that the present disclosure can be implemented in software and/or in a combination of software and hardware, e.g., using application specific integrated circuits (ASIC), a programmable gate array (PGA) including a Field PGA, or a state machine deployed on a hardware device, a computing device or any other hardware equivalents, e.g., computer readable instructions pertaining to the methods discussed herein can be used to configure a hardware processor to perform the steps, functions and/or operations of disclosed methods
The processor executing the computer readable or software instructions relating to the above described method can be perceived as a programmed processor or a specialized processor. As such, the modules for detecting abnormality based on causal graphs that represent causal relationships of abnormalities (including associated data structures) of the present disclosure can be stored on a tangible or physical (broadly non-transitory) computer-readable storage device or medium, e.g., volatile memory, non-volatile memory, ROM memory, RAM memory, magnetic or optical drive, device or diskette and the like. Furthermore, a “tangible” computer-readable storage device or medium comprises a physical device, a hardware device, or a device that is discernible by the touch. More specifically, the computer-readable storage device may comprise any physical devices that provide the ability to store information such as data and/or instructions to be accessed by a processor or a computing device such as a computer or an application server. Additionally, the use of the term “non-transitory” is only intended to avoid claiming a signal per se, but it is not intended to mean that the computer-readable medium can never be altered or changed, e.g., due to a natural degradation of the computer-readable media over time.
In operation 304, the method determines which correlation metric that is able to evaluate nonlinear correlations is to be utilized by the method. In operation 306, the method applies the correlation metric to pairwise features of the training data sets in order to calculate correlation scores. In operation 308, the method accumulates the number of correlated features whose correlation scores are over a correlation threshold (e.g., the number of pairwise features having a correlation score greater than the correlation metric, as determined according to the correlation metric).
Operations 310 and 312 enable the method 300 to iterate the extraction of features with high correlation scores into the minimum correlated feature subset until pairwise correlation scores of the rest of the correlated features of a training set of the training data sets that are not extracted all become below the correlation threshold. In particular, operation 310 determines whether the number of correlated features outside the minimum correlated feature subset is greater than two (2). In particular, when the number of correlated features outside the minimum correlated feature subset is greater than two (2), the method proceeds to operation 312. In operation 312, the method adds into the minimum correlated feature subset, the feature that has the most correlated features while removing that feature from the set of correlated features and thereafter returns to operation 310.
Alternatively, when operation 310 determines that the number of correlated features outside the minimum correlated feature subset is not greater than two (2), in operation 314, the method outputs the minimum correlated feature subset and a correlation matrix. Thereafter, in operation 315, the method ends.
In operation 404, the method utilizes information comprising feature labelling provided via the knowledge processing module or provided by default, to generate feature weights. In operation 406, the method utilizes feature weights and the training data sets to train an abnormality detection model. In operation 408, after data cleansing is provided to the training data set to remove abnormal data, the abnormality detection model is further trained to be a counterfactual generation model configured to generate counterfactual data sets. For example, a counterfactual generation model may comprise a generative model, an interpretation-based model, or an algorithm that is capable of generating counterfactual data sets. In operation 409, the method ends.
In operation 504, the method acquires an abnormality score for the test data sets using an abnormality detection model that has been trained. In operation 506, the method determines whether the abnormality score is greater than a threshold. In particular, when the abnormality score is greater than the threshold such that an abnormality has been identified, the method proceeds to operation 508. In operation 508, the method adds the test data sets to the abnormality detection model that has been trained to generate counterfactual data sets. The method then proceeds to operation 511. In operation 511, the method ends.
Alternatively, when operation 506 determines that the abnormality score is not greater than the threshold, the method proceeds to operation 510. In operation 510, the method ends the testing for abnormalities. Thereafter, the method ends in operation 511.
In operation 604, the method determines, from information that was provided via the knowledge processing module 202 or by default, a portion of the information which is to be used to reinforce generalization performance of the device. In particular, the method searches for available information that was via the knowledge processing module. The reinforcement of generalization performance is achieved by using the available information as constraints when training. For example, available information may be utilized to restrict the monotonicity of target variable to certain independent variable. In operation 606, the method acquires a minimum correlated feature subset detected via the minimum correlated feature subset detection module (204). In operation 608, the method utilizes the minimum correlated feature subset to train a feature dependence interpretation model. Such training serves to mitigate the negative impact outnumbered strong correlated features exert on the generalization performance of the device 200 and may increase the training speed of the feature dependence interpretation model.
In operation 610, based on the trained feature dependence interpretation model, the method utilizes a randomly selected subset of the training data set to further train the feature dependence interpretation model to be able to interpret the feature dependence in a quantitative way. In operation 611, the method ends.
In operation 704, the method calculates a difference in numerical value for each feature of abnormal data and median values of counterfactual data sets. In operation 706, after the interpretation models of the feature dependence interpretation model are exercised to generate feature contributions of abnormal data and counterfactual data sets, the method generates feature contributions for each numerical difference of features of the abnormal data of the test data set. Feature contributions may comprise individual contributions of features. Other types of feature contributions, such as feature interaction contributions, may be used alternatively or additionally to evaluate feature dependence.
In operation 708, in order to mitigate the negative impact of noise data, the method utilizes a threshold of contributions to eliminate weak feature dependence interpretations (e.g., those feature contributions for a numerical difference of features of the abnormal data of the test data set that are less than a threshold). In other words, weak feature dependence interpretations are those interpretations that have contributions that are less than a threshold. Each “interpretation” refers to the feature contributions generated for each numerical difference of features. In operation 710, the method transforms effective feature contributions into a table that comprises multiple rows. Effective feature contributions are those feature contributions for a numerical difference of features that are not less than a threshold. In one embodiment, each row of the table comprises elements such as A, B, R, w, each representing an inference that target feature R changes by w due to the joint effect of features A and B. In operation 711, the method ends.
In operation 804, the method searches for user-input causal relationships in the information provided via the knowledge processing module. In operation 806, the method determines whether there are any user-input causal relationships input for features x and y. For example, a user may have input a causal relationship for features x and y.
If operation 806 determines that there is not any user-input causal relationships for features x and y, the method proceeds to operation 808 for activation of a process for automatic causality recognition. In particular, in operation 808, the method utilizes the abnormality detection model and abnormal data sets to generate a predefined number of counterfactual data sets. Here, an abnormal data set specifically refers to abnormal data which needs to be interpreted. Further, in operation 810, the method evaluates pairwise causality by running pairwise causality discovery algorithms, such as the additive-noise model (ANM), the information geometric causal inference (IGCI) model, and the like, on the counterfactual data sets. Causality (e.g., a causal relationship) is recognized after the causality analyzation module iterates possible feature pairs of a subset of the elements in a table that quantitatively describes feature dependence.
In operation 812, the method outputs the causality (e.g. causal relationship) and proceeds to operation 815. In operation 815, the method ends.
Alternatively, if operation 806 determines that there is one or more user-input causal relationships for features x and y, the method proceeds to operation 814. At operation 814, the method outputs the available user-input causal relationships and proceeds to operation 815. At operation 815, the method ends.
It should be noted that although not specifically specified, one or more steps, functions or operations of the methods described herein may include a storing, displaying and/or outputting step as required for a particular application. In other words, any data, records, fields, and/or intermediate results discussed in the respective methods can be stored, displayed and/or outputted to another device as required for a particular application. Furthermore, steps, blocks or operations in the figures that recite a determining operation or involve a decision do not necessarily require that both branches of the determining operation be practiced. In other words, one of the branches of the determining operation can be deemed as an optional step. In addition, one or more steps, blocks, functions or operations of the above described methods may comprise optional steps, or can be combined, separated, and/or performed in a different order from that described above, without departing from the example embodiments of the present disclosure. Furthermore, the use of the term “optional” in the above disclosure does not mean that any other steps not labeled as “optional” are not optional. As such, any claims not reciting a step that is not labeled as optional is not to be deemed as missing an essential step, but instead should be deemed as reciting an embodiment where such omitted steps are deemed to be optional in that embodiment.
While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not a limitation. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.
