Patent Application
20200386656
This disclosure is generally related to a system and method for anomaly detection in operation of industrial machines or systems. More specifically, this disclosure is related to detection of anomaly in high-dimensional sensor data.
With the increasing use of Internet of Things (IoT) enabled equipments in numerous industrial applications, e.g., digital manufacturing, a large amount of sensor data is readily available. Such sensor data include actionable information that can be used to optimize operational efficiency of factory machines. In particular, detecting operation anomalies has been one of the most pursued objectives for its immediate application to reduce factory downtime and improve productivity and efficiency in manufacturing processes. However, it is a challenging task to develop anomaly detection techniques that can reliably scale to various settings in different factory setups. This is because the sensor data can be ill-conditioned due to poor data quality and lack of label information. For example, the sensor data can include a large number of missing, corrupted, noisy and highly correlated values.
Many real-world industry IoT applications do not perform optimally due to the ill-conditioned nature of available sensor data. Without appropriate data pre-processing and model selection, parameter estimation is prone to large bias and distortion which would lead to significant errors in anomaly detection. To avoid such errors, a data pre-processing stage is often needed to select, filter, and resample sensor data.
In conventional anomaly detection approaches for industry IoT applications, such data pre-processing is performed with prior domain knowledge of sensor data, and often without much automation. Due to the difficulty of obtaining labeled sensor data and lack of a fully automated anomaly detection method, the conventional approaches at best provide unreliable anomaly detection over different data sets. Furthermore, labeled datasets are rarely available or expensive to be obtained. In other words, there is no a priori knowledge about which points are normal or abnormal. Therefore, a clear definition of anomaly is not given. Without a normal or abnormal example, there is a need to perform unsupervised learning from the available sensor data. Such unsupervised learning can impose significant constraints on algorithm development, because an inherent performance trade-off exists between precision and recall (e.g., sensitivity), which in turn can cause unreliability of anomaly detection over different data sets. To make anomaly detection methods scale well to real-world applications, anomaly analysis workflow needs to be automated for data pre-processing, model selection, and anomaly detection.
According to one embodiment of the present invention, a system for detecting anomalies for high-dimensional senor data associated with one or more machines is provided. During operation, the system can obtain sensor data from a set of sensors associated with the machine, with the set of sensors including a target sensor and a set of feature sensors, apply data exploration techniques to the sensor data to identify a subset of feature sensors from the set of feature sensors, apply an unsupervised machine-learning technique to the identified subset of feature sensors and the target sensor to learn a set of pair-wise univariate models, and determine whether and how an anomaly occurs in the operation of the one or more machines based on the set of pair-wise univariate models.
In a variation on this embodiment, applying the data exploration techniques can include one or more of: applying a data pre-processing technique, applying a data cleansing technique, and applying a feature engineering technique.
In a variation on this embodiment, applying the data cleansing technique includes: replacing missing values in the sensor data by linear interpolation, when an amount of the missing values during a recording period of target sensor data is less than a threshold value; and dropping missing values in the sensor data, when the amount of missing values during the recording period of the target sensor data is more than the threshold value.
In a variation on this embodiment, applying the feature engineering technique includes: adjusting a set of time delays between a set of feature sensors and target sensor; computing a correlation between the delay adjusted set of feature sensors and the target sensor; and ranking the set of feature sensors based on their correlation values.
In a further variation, each pair-wise univariate anomaly model from the set of pair-wise univariate anomaly models can be associated with a feature sensor from the subset of feature sensors and a target sensor.
In a further variation on this embodiment, the unsupervised machine-learning technique includes: determining a set of regression coefficients for measuring a fitness of the set of pair-wise univariate anomaly models; and using the set of regression coefficients to compute a set of anomaly distances between the subset of feature sensors and the target sensor.
In a further variation, the unsupervised machine-learning technique can also include: computing a set of voting scores associated with the set of pair-wise univariate anomaly models by applying a set of clustering functions to the set of anomaly distances; computing a set of weights for the set of voting scores; combining the set of weights and the set of voting scores to detect the anomaly; and quantifying an accountability of the subset of the feature sensors for the detected anomaly event.
The patent or application file contains at least one drawing executed in color. Copies of this patent or patent application publication with color drawing(s) will be provided by the Office upon request and payment of the necessary fee.
In the figures, like reference numerals refer to the same figure elements.
The following description is presented to enable any person skilled in the art to make and use the embodiments, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present disclosure. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.
The embodiments described herein solve the technical problem of detecting and accounting for anomalies in operation of industrial machines. More specifically, an anomaly-monitoring-and-detection system can obtain sensor data from target sensors and feature sensors embedded in the machines, preprocess the sensor data to deal with missing values, outliers, and noise. The system then selects only relevant feature sensors for further processing. Specifically, the system uses the relevant feature sensors to build a set of pair-wise univariate anomaly models, with each model corresponding to a pair of a feature sensor and the target sensor. A set of anomaly distances are computed from the set of pair-wise univariate anomaly models. By applying unsupervised machine-learning technique to the set of anomaly distances, followed by a weighted majority voting process, the system can automatically detect anomalies and their associated feature sensors' accountability in operation of the machines.
In many real-world industry IoT applications, sensor data recorded during operation of one or more machines are large in number and often ill-conditioned. In other words, the collected sensor data can include missing, corrupted, noisy, and highly correlated values.
In addition to missing values, other deficiencies can also be present in sensor data. Sensor data can be obtained from a plurality of sensors embedded in one or more machines. From among the plurality of sensors, anomaly associated with one of the sensors may be of interest, this sensor is identified as a target sensor and the remaining sensors can be identified as feature sensors.
Hence, in order to avoid errors in anomaly detection due to the condition of the sensor data, it is desirable to pre-process the sensor data prior to applying any anomaly detection techniques.
During operation, the system can first obtain sensor data (operation 202). The system then pre-processes the sensor data to select a set of feature sensors based on the predetermined target sensor (operation 204). In one embodiment, the system can cleanse the pre-processed sensor data to address missing values, outliers, and noise in the selected sensor data (operation 206). The data cleansing operation can improve quality of the sensor data and reduce the amount of sensor data, thereby also reducing the computational cost. Subsequent to the data cleansing operation, the system performs feature engineering (operation 208). In one embodiment, feature engineering adjusts the delays associated with data from the feature sensors with respect to the target sensor. The delay-shifted feature sensor data are then ranked based on their correlation with the target sensor. Feature sensors that have a high correlation with the target sensor are used for further processing in the anomaly detection system, while feature sensors with low correlation can be omitted.
Subsequent to performing data selection according to the process illustrated in flowchart in
After the missing values in the sensor data have been replaced, the system can perform univariate analysis to determine a feature type and to find outliers in each feature sensor data. Typically, there are two kinds of feature types: a monotonical feature type and an instant feature type. Based on these feature types, outliers can be identified and replaced by linear interpolation. In particular, for the instant feature type, the outliers can be found using inter-quartile range (IQR) method. For example, if xij represents an ith sample of jth feature sensor, then xij is an outlier if
xij∉[Q1−α·IQR, Q3+α·IQR] (1)
IQR=Q3−Q1 (2)
Q1 and Q3 correspond to upper and lower quartiles of the feature sensor xj. For monotonical features, an ith sample of jthfeature sensor is an outlier if
x
ij
−x
(i−1)j<0, ∀i>0. (3)
After the outliers have been identified, the system can replace the outliers by interpolation and reduce other variations in the sensor data by performing a moving average on the sensor data with a pre-defined window size.
Subsequent to performing data cleansing shown in
In real-world industrial IoT applications, delay usually exists within data collected from different parts of production lines in a factory layout. Hence, data associated with some of the feature sensors can exhibit a time delay with respect to the target sensor. Delays between the feature sensor data and the target sensor data can be calculated by using normalized cross-correlation (operation 604), which is expressed as:
Where μxj and μy represent the mean value of the jthfeature sensor and target sensor y, respectively; σxj and σy represent standard deviation of the jthfeature sensor and target sensor y, respectively; (*) represents a convolution operator; ∥xj∥ represents the length of xj. The feature sensor xj is then shifted by the delay calculated in equation (6).
The delay-shifted feature sensors are fed to a feature correlation module. In this module correlation between the delay shifted feature sensor xj and the target sensor y is calculated (operation 606) by:
ρx
where cov(xj, y) represents covariance between xj and y.
Using the correlation calculated in operation 606 according to equation (8), the system can rank the feature sensors accordingly (operation 608). In one embodiment, the system only selects features that have a correlation value higher than a pre defined threshold ρthreshold. This is because features that exhibit low correlation with the target sensor might not be suitable for building a pair-wise univariate anomaly model.
The sensor database 802 stores sensor data {a1, a2, . . . , a} collected from a set of m sensors embedded in one or more machines. The data exploration module 804 can be responsible for automatically processing the sensor data {a1, a2, . . . , am} to repair the missing values, outliers, and noise. After the missing values, outliers, and noise have been repaired according to the flowcharts shown in
The model builder model 806 can build a set of pair-wise univariate anomaly models, with each pair-wise univariate anomaly model performing a pair-wise linear regression for a pair of feature sensor xj and a target sensor y.
Let y denote a normalized target matrix defined by y=[yi]n, where yi represents an ith sample of the target sensor for 1≤i≤n. Similarly, let X denote a normalized feature matrix defined by: X=[xij]np, where xij represents an ith sample of jth feature sensor for 1≤i≤n and 1≤j≤p. The column vector X.j=[x1j, x2j, . . . , xnj] represents data from jth feature sensor. Since all the sensor data are normalized, their variance is Var[y]=Var[X.j]=1 and mean is E[y]=E[X.j]=0.
A pair-wise univariate anomaly model for the jth feature sensor and the target sensor y is computed as follows. First, a functional relationship between a target sensor and a feature sensor is inferred by:
ŷ
ij
=x
ij{circumflex over (β)}j, ∀j=1, 2, . . . , p (9)
where ŷij denote a predicted ith target value for jth feature sensor and {circumflex over (β)}j is an estimate regression coefficient parameter. This estimated regression coefficient parameter can be as:
The estimated regression coefficient parameter can be used for measuring fitness of the pair-wise univariate anomaly model. The measure of model fitness is denoted by R2. The model fitness for the jth feature sensor can be denoted as: Rj2, with 0≤Rj2≤1. A higher value for Rj2 implies a better linear model for the jth feature sensor. Furthermore, the model fitness measure Rj2 for the jth feature sensor is related to the estimated regression coefficient {circumflex over (β)}j as follows:
R
j
2={circumflex over (β)}j2, −1≤{circumflex over (β)}j≤1. (11)
After the pair-wise univariate anomaly model has been predicted for the jth feature sensor, an orthogonal difference between an observed target sensor value yi and the predicted model for the jth feature sensor is determined by:
where dij can be referred to as an anomaly distance for ith sample and the jth feature sensor. The mean and variance of the orthogonal difference eij is given by:
Anomaly distances associated with all the feature sensors X=[xij]np can be denoted in an anomaly distance matrix form as: D=[dij]np. These anomaly distances are sent to an anomaly detection module 808 to determine a voting score for each model in the set of p pair-wise univariate anomaly models.
The anomaly detection module 808 applies a set of clustering functions to the anomaly distance matrix to determine the voting score. The set of clustering functions can be denoted by: G=[gj]p. Each clustering function is learnt from D.j independently for j=1,2, . . . , p. Each clustering function classifies an observed anomaly distance into binary outputs. Specifically, an output value is set to 1 if abnormal, otherwise the output value is set to 0. The clustering function gj can be expressed as:
gj: D.jV.j
where V denotes a voting matrix defined by [vij]np and vij ∈ {0,1}. For the set of clustering functions the voting matrix V can be expressed as: V=G(D).
In one embodiment, a Gaussian mixture model (GMM) clustering function G with two centroids (i.e., k=2) is used. Let s denote a random variable, a Gaussian distribution of the random variable is given by: N(s|μs, σs) with mean μs and standard deviation σs. For the GMM, a probability density function of dij is expressed in term of the Gaussian distribution by:
where πk represents a weight probability with 0≤πk≤1 and Σkπk=1. The GMM model can be trained by Expectation Maximization (EM) algorithm with training data {dij|i=1, 2, . . . , n}. With the assumption that μ0<μ1, an anomaly state can be set to abnormal by voting as vij=1, if GMMj(dij)=1, and 0 otherwise.
Although anomalies in feature sensors are voted by using a voting score vij, accuracy of anomaly detection can be improved by performing majority voting in the weighted voting module 810, according to one embodiment. In the weighted voting module 810, an anomaly weighting score at the ith target sample is computed by:
W
i
=S
i.
/∥S
i.∥1 (15)
ui=Wi, Vi
(16)
where S=[sij]np is referred to as anomaly score matrix and denotes an anomaly distance matrix rescaled by each feature sensor's R2 value as: S.j=Rj2D.j. The operation (a, b) denotes a linear product of a and b. The anomaly score matrix S can be used to visualize an anomaly pattern of a target sensor over time and the contributing feature sensors. Such a visualization can help a user to quickly identify interesting targets with outstanding anomaly patterns.
In one embodiment, the anomaly weight matrix W can be used to quantify each feature sensor's contribution to anomaly voting score. This quantification of each feature sensor's contribution can be used to rank importance of the feature sensors for anomaly.
For all feature sensors, the majority voting u=[ui]n can be written as:
u=(W∘V)·1p (17)
where ∘ is a Hadamard product and 1 is a p×1 unit matrix. A final decision 812 of anomaly for the ith target sample is defined by:
where 0≤Utr≤1 is a user-defined majority voting threshold.
In industrial IoT applications, due to the availability of increasing number of sensors, the amount of sensor data collected is significantly large. Furthermore, the sensor data usually contain a large number of ill-conditioned data that include missing, corrupted, noisy, and highly correlate values. When such poor quality sensor data are used for anomaly detection, the results would be incorrect and hence unreliable. Furthermore, the computational complexity of anomaly detection would increase significantly due to the availability of large number of sensor data. In order to improve the quality of the sensor data and reduce the number of feature sensors, data exploration is performed on the sensor data (operation 1104).
Subsequent to performing data exploration, the system can build a set of linear models. In other words, the system uses the data associated with each feature sensor and target sensor to build a pair-wise univariate anomaly model and infer a relationship between them. The system computes a set of anomaly distances for the set of feature sensors based on the inferred relationship (operation 1106).
During operation 1108, a set of anomaly “candidate” events are identified. Then based on majority voting in operations 1110 and 1112, they are confirmed as anomaly events, and the accountability is attributed to the feature sensor with highest score. Anomaly events are identified based on the inferred relationships between the target sensor and the set of feature sensors. In particular, a set of anomaly voting scores are calculated based on the set of anomaly distances and a set of clustering functions (operation 1108).
Finally, a collective decision is made for an anomaly by a majority voting procedure (operation 1110). Operation 1110 can be similar to the operation of the weighted voting module 810 shown in
Unsupervised anomaly-detection system 1220 can include instructions, which when executed by computer system 1200 can cause computer system 1200 to perform methods and/or processes described in this disclosure. Unsupervised anomaly-detection system 1220 can also include instructions for receiving sensor data associated with the one or more sensors (sensor data receiving module 1222), instructions for performing data exploration on the sensor data (sensor data exploration module 1224), and instructions for processing the sensor data after the data exploration stage (linear model builder module 1226). Furthermore, unsupervised anomaly-detection system 1220 can include instructions for detecting anomaly events (anomaly detection module 1228), and instructions for performing majority voting on the detected anomaly events (majority voting module 1230).
In general, embodiments of the present invention provide a method and system to detect and account for anomalies in high-dimensional and unlabeled sensor data using unsupervised learning with majority voting. Detecting anomalies in sensor date associated with factory machines has been used as an example. In practice, this solution is not limited to detecting anomalies associated with factory machines. It can also be used to detect anomalies in other types of equipment or machinery.
The methods and processes described in the detailed description section can be embodied as code and/or data, which can be stored in a computer-readable storage medium as described above. When a computer system reads and executes the code and/or data stored on the computer-readable storage medium, the computer system performs the methods and processes embodied as data structures and code and stored within the computer-readable storage medium.
Furthermore, the methods and processes described above can be included in hardware modules or apparatus. The hardware modules or apparatus can include, but are not limited to, application-specific integrated circuit (ASIC) chips, field-programmable gate arrays (FPGAs), dedicated or shared processors that execute a particular software module or a piece of code at a particular time, and other programmable-logic devices now known or later developed. When the hardware modules or apparatus are activated, they perform the methods and processes included within them.
The foregoing descriptions of embodiments of the present invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.
