Fair anomaly detection and localization

Abstract

The technology for fair anomaly detection includes generating an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution. The mean vector and the precision matrix can be generated by reducing a function below a threshold, wherein the function may include a Gaussian distribution, a first regularization term, and a second regularization term, the first regularization term being configured to generate similar anomaly scores for inputs having similar fairness characteristics and independent of unfair characteristics, and the second regularization term being configured to generate similar anomaly location scores for inputs having similar fairness characteristics and independent of unfair characteristics. The technology further includes inputting new data into the anomaly detection model and generating an anomaly score and anomaly location score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

Description

Technical Field

[0001] The present disclosure relates to anomaly detection, and more particularly to fair anomaly detection and localization. Background Art

[0002] Anomaly detection and localization are important aspects of data analysis. Anomaly detection can identify the occurrence of anomalies, and anomaly localization can identify the abnormal characteristics, causes, or sources of detected anomalies. In other words, anomaly detection indicates that an abnormal or unexpected event has occurred, while anomaly localization indicates where and / or why the abnormal or unexpected event has occurred.

[0003] One challenge in the field of anomaly detection and localization is related to fairness. In other words, anomalies should not be identified based on unfair features in the data. For example, in the case of a vehicle's dashcam, anomaly detection can be used to detect dangerous driving caused by driver behavior, driver fatigue, vehicle malfunction, etc. At the same time, anomaly localization can identify the root cause of the detected anomaly. Automakers, auto insurance companies, auto parts suppliers, civil engineers, etc. can use this data to improve the safety, reliability, and efficiency of vehicles, roads, and drivers. Continuing with the above example, for anomalies detected in a dashcam, anomaly localization can indicate that the driver's braking pattern is abnormal compared to normal braking patterns. However, some features used in anomaly detection and localization may be unfair. Continuing with the above example of a dashcam, it is unfair to infer abnormal (e.g., dangerous) driving behavior from features that are unrelated to the driver's operation, such as vertical acceleration (e.g., due to route topography or road surface characteristics), temperature, probability of severe weather, driver age, car model, etc. However, completely ignoring these "unfair" features may reduce the performance of anomaly detection and localization systems. Therefore, there is a need for techniques and systems that can reduce the impact of unfair features on anomaly detection and localization models while maintaining acceptable accuracy of the anomaly detection and localization models. Summary of the invention

[0004] Aspects of the present disclosure relate to a system comprising: a vehicle; a plurality of sensors that receive observed vehicle data; a dash cam configured to aggregate and store the observed vehicle data; and an anomaly detection system communicatively coupled to the dash cam. The anomaly detection system comprises a probability distribution of historical vehicle data, wherein parameters of the probability distribution are tuned to reduce a function below a threshold. The function is based on the probability distribution conditioned on the historical vehicle data and at least one regularization term configured to generate similar outputs of the probability distribution for inputs having similar fairness characteristics and independent of unfair characteristics. The anomaly detection system also includes an anomaly score and an anomaly localization score based on the probability distribution, the parameters, and the observed vehicle data.

[0005] The foregoing embodiments achieve a number of advantages. First, these embodiments achieve improved anomaly detection fairness, where the anomaly scores and anomaly localization scores are based on fair (rather than unfair) features, such as those corrected using at least one regularization term. Second, the foregoing improvements in fairness do not hurt performance. In fact, the use of at least one regularization term has been shown to improve fairness while maintaining or improving performance (see the discussion of Figure 6 Experimental results discussed in

[0045] ). Third, the additional computational complexity introduced by at least one regularization term is either non-existent (e.g., the regularization term associated with the anomaly score) or acceptably small (e.g., the regularization term associated with the anomaly localization score).

[0006] Other aspects of the present disclosure are directed to a method, comprising: training an anomaly detection system, the anomaly detection system being configured to generate an anomaly score and an anomaly location score for vehicle data. The anomaly detection system can be trained to generate similar anomaly scores and anomaly location scores for historical vehicle data having similar fair characteristics and dissimilar unfair characteristics using a first regularization term and a second regularization term. The method further includes receiving new vehicle data at the anomaly detection system and a dashcam that collects data from multiple sensors on the vehicle, and generating a first anomaly score and a first anomaly location score associated with the new vehicle data. The method further includes performing a mitigation action based on the first anomaly score and the first anomaly location score, wherein the mitigation action changes the vehicle.

[0007] The foregoing embodiments achieve a number of advantages. First, these embodiments achieve improved fairness in anomaly detection, where the anomaly score and anomaly localization score are based on fair (rather than unfair) features as corrected using the first regularization term and the second regularization term. Second, the foregoing improvements in fairness do not harm performance. In fact, the use of the first and second regularization terms is shown to maintain or improve performance while also improving fairness (see for example the use of the first and second regularization terms). Figure 6 Third, the additional computational complexity introduced by the first regularization term does not exist, while the additional computational complexity introduced by the second regularization term is acceptably small.

[0008] A further aspect of the present disclosure relates to a method, comprising: generating an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, wherein the mean vector and the precision matrix are generated by reducing a function to below a threshold, wherein the function includes the Gaussian distribution, a first regularization term, the first regularization term being configured to generate similar anomaly scores for inputs having similar fairness characteristics and being independent of unfair characteristics; and a second regularization term, the second regularization term being configured to generate similar anomaly localization scores for inputs having similar fairness characteristics and being independent of unfair characteristics. The method further comprises inputting new data to the anomaly detection model. The method further comprises generating an anomaly score and anomaly localization score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

[0009] The foregoing embodiments achieve a number of advantages. First, these embodiments achieve improved fairness in anomaly detection, where the anomaly score and anomaly localization score are based on fair (rather than unfair) features as corrected using the first regularization term and the second regularization term. Second, the foregoing improvements in fairness do not harm performance. In fact, the use of the first and second regularization terms is shown to improve fairness while maintaining or improving performance (see the discussion of Figure 6 Third, the additional computational complexity introduced by the first regularization term does not exist, while the additional computational complexity introduced by the second regularization term is acceptably small.

[0010] Another aspect of the present disclosure according to the above method also includes using stochastic gradient descent (SGD) or block coordinate gradient descent to reduce the function. Advantageously, using SGD or block coordinate gradient descent reduces the computational burden associated with reducing the function below a threshold.

[0011] Another aspect of the present disclosure according to the above method also includes: the anomaly score is the negative log-likelihood of the new data based on the Gaussian distribution, mean vector and precision matrix of the historical data. Advantageously, as long as most of the computational burden exists in the training phase associated with learning the precision matrix, the computational cost of calculating the anomaly score can be low when based on the Gaussian distribution and the precision matrix. In other words, according to these embodiments, the anomaly score can be calculated quickly with low processing overhead.

[0012] Another aspect of the present disclosure according to the aforementioned method further includes: the anomaly localization score is the negative log conditional likelihood of the features of the new data conditioned on other features of the new data according to the Gaussian distribution of the historical data, the mean vector and the precision matrix. Advantageously, the computational cost of calculating the anomaly localization score can be low when based on the Gaussian distribution and the precision matrix, as long as most of the computational burden exists in the training phase associated with learning the precision matrix. In other words, according to these embodiments, the anomaly localization score can be calculated quickly with low processing overhead.

[0013] Other aspects of the present disclosure relate to systems and computer program products configured to perform the above methods.The present disclosure is not intended to illustrate every aspect, every implementation, and / or every implementation of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings included in this application are incorporated into the specification and form a part of the specification. They illustrate embodiments of the present disclosure and are used to explain the principles of the present disclosure together with the description. The accompanying drawings only illustrate certain embodiments and do not limit the present disclosure.

[0015] Figure 1 A block diagram illustrating an example vehicle communicatively coupled to an anomaly detection system according to some implementations of the present disclosure.

[0016] Figure 2 A block diagram of an example system communicatively coupled to an anomaly detection system according to some implementations of the present disclosure is shown.

[0017] Figure 3 A flow chart of an example method for utilizing an anomaly detection system according to some implementations of the present disclosure is shown.

[0018] Figure 4 A flowchart of an example method for generating or training an anomaly detection system or model according to some embodiments of the present disclosure is shown.

[0019] Figure 5 Table showing experimental results according to some embodiments of the present disclosure.

[0020] Figure 6 A block diagram of an exemplary computer according to some embodiments of the present disclosure is shown.

[0021] Figure 7 A cloud computing environment is depicted according to some implementations of the present disclosure.

[0022] Figure 8 Abstract model layers according to some embodiments of the present disclosure are depicted.

[0023] The present disclosure may be in different modified and alternative forms, the details of which have been shown in the drawings by way of example and will be described in detail. However, it should be understood that the present disclosure is not limited to the specific embodiments described. On the contrary, it is intended to cover all modifications, equivalents and replacements that fall within the scope of the present disclosure. DETAILED DESCRIPTION

[0024] Aspects disclosed in the present disclosure are directed to anomaly detection, and more specifically, to fair anomaly detection and localization. Although not limited to such applications, embodiments of the present disclosure may be better understood in light of the above context.

[0025] There are various fairness strategies in supervised learning, but there is no known strategy that can handle fairness in anomaly detection and localization using unsupervised learning and unlabeled training data. Fairness related to anomaly detection has different definitions. The first definition is that the prediction of anomalies is independent of any unfair features. However, this definition ignores unfair features that may cause performance degradation of anomaly detection and localization models. The second definition of fairness in anomaly detection is that there is no causal relationship between unfair features and predicted anomalies. However, causality is difficult to explicitly derive from machine learning models. Therefore, this definition is impractical to implement in machine learning applications. The third definition of fairness in anomaly detection indicates that the prediction of anomalies is independent of unfair features conditioned on other features. Aspects disclosed in the present disclosure utilize the third definition of fairness in anomaly detection and localization. Advantageously, the third definition allows the use of unfair features to maintain the performance of anomaly detection and localization models, while using regularization terms to balance (e.g., make more similar) the output of data with similar fair features and dissimilar unfair features.

[0026] Aspects of the present disclosure implement one or more of the following features. First, aspects of the present disclosure utilize a first regularization term to increase the fairness of anomaly detection in an anomaly detection and localization model. The first regularization term can be defined as a term that is configured to reduce the difference between two anomaly scores calculated from two samples having different unfair features and similar fair features. Making the anomaly scores of the two samples discussed above approximately equal indicates that dissimilar unfair features have no effect on the anomaly scores (e.g., the output of the model is independent of the unfair features). Returning to the above dash cam example, different unfair features may be car models (e.g., vans, convertibles, etc.), age, etc., while similar fair features may involve speed, acceleration, position, braking mode, etc.

[0027] The second aspect of the present disclosure uses a second regularization term to increase the fairness of anomaly localization in an anomaly detection and localization model. Similar to the first regularization term, the second regularization term related to anomaly localization can be defined as a term configured to reduce the difference between two anomaly localization scores calculated from two samples with dissimilar unfair features and similar fair features (e.g., making the output of the model independent of the unfair features).

[0028] According to a third aspect of the present disclosure, the anomaly score may be the negative likelihood (or negative log likelihood) of a sample according to an anomaly detection and localization model trained on normal (non-abnormal) data. In some embodiments, the anomaly detection and localization model trained on normal data may be based on a Gaussian probability distribution (e.g., a normal probability distribution) and / or use a maximum likelihood estimation (MLE) technique.

[0029] According to a fourth aspect of the present disclosure, the anomaly localization score may be based on the negative conditional likelihood (or negative log conditional likelihood) of an anomaly detection and localization model trained on normal data. In other words, the anomaly localization score may indicate those features (e.g., anomaly scores) that contribute most to the determination of anomalies.

[0030] Turning now to a more detailed discussion of some aspects of the present disclosure, aspects of the present disclosure may learn parameters of a Gaussian distribution of a model based on a feature vector x. Although Gaussian distributions are primarily discussed herein, any number of other probability distributions are also within the scope of the present disclosure. Subsequently, an anomaly score may be based on the likelihood that a newly observed data x will occur according to the Gaussian distribution. Only the Gaussian distribution is learned in training. The precision matrix Λ of the vector is obtained by calculating the precision matrix Λ. The precision matrix Λ (sometimes referred to as the concentration matrix) can be the inverse matrix of the covariance matrix. Advantageously, the zeros in the precision matrix Λ can indicate conditional independence between the corresponding variables. Therefore, the precision matrix Λ is uniquely suitable for identifying the influence (including unfair influence) between the variables (e.g., based on the non-zero elements of the precision matrix Λ), quantifying the degree of influence (e.g., based on how close each element of the precision matrix Λ is to zero), and reducing the influence of unfair features on anomaly detection and localization (e.g., by introducing a regularization term that reduces the elements in the precision matrix Λ that reflect the dependency between unfair features and fair features).

[0031] Equation 1 determines a value of the precision matrix Λ that minimizes (e.g., falls below a threshold, or minimizes according to a computational parameter) a function of the log-likelihood of a Gaussian distribution, an L1 regularization term (e.g., least absolute shrinkage and selection operator (LASSO) regression regularization) of the precision matrix Λ, a first regularization term (e.g., anomaly score regularization term), and a second regularization term (e.g., anomaly localization score regularization term).

[0032] Equation 1:

[0033]

[0034] In Equation 1, x represents input data, where x can be associated with any number of dimensions representing any number D of different data inputs, features, or sources d. In other words, The D-dimensional input data of the training sample N may be represented. In some embodiments, x is normalized so that the mean vector is zero. In some embodiments, normalizing x so that the mean vector is zero includes determining the mean of each of the D different data inputs and converting the mean to zero by a function such that when the function is applied to any individual data input, positive values ​​represent deviations above the mean and negative values ​​represent deviations below the mean. In some embodiments, the mean vector refers to the mean vector of a Gaussian distribution. The unfairness feature may be classified as x u , and the remaining features (e.g., fairness features) can be classified as x -u (For example, unfair feature x u The term Λ represents The precision matrix of the Gaussian distribution. The term p(x) is the basic probability distribution of x, while the term E involves the expected value on p(x). The terms ρ and α are coefficients that can be adjusted according to the design of the anomaly detection model. The term I(x -u ,x′ -u ) is a function whose -u = x′ -u (e.g., similar fairness features between different inputs) returns one (1) otherwise it returns zero (0), where x and x' are different input samples. More generally, the components of Equation 1 can be summarized as: is equal to the negative log-likelihood of the Gaussian distribution, the term ρ|Λ| refers to the L1 regularization term, and the term reflects the degree of equilibrium probability (e.g., likelihood) of anomaly detection between different input data with similar fair features and dissimilar unfair features, and Reflects the degree of equilibrium probability (e.g., conditional likelihood) of outlier localization between input data with similar fair features and dissimilar unfair features.

[0035] Equation 1 can be simplified to Equation 2, where Equation 2 can eliminate redundant terms, approximate E (eg, using the sample mean), and utilize the empirical covariance matrix S.

[0036] Equation 2:

[0037]

[0038] To better understand the components of Equation 2, the terms of Equation 2 can be grouped together. For example, the part -ln det(Λ)+tr(SΛ) represents the negative log-likelihood of the Gaussian distribution, the part ρ|Λ| holds the L1 regularization term, and the part reflects the degree of equilibrium probability (e.g., likelihood) of anomaly detection between input data with similar fair features and dissimilar unfair features, and partly Reflects the degree of equilibrium probability (e.g., conditional likelihood) of outlier localization between input data with similar fair features and dissimilar unfair features.

[0039] In some embodiments, the anomaly detection model learns the precision matrix Λ by determining to minimize (e.g., reduce to below a threshold or minimize according to a computational parameter) the precision matrix Λ of equation 2 using stochastic gradient descent (SGD). In other embodiments, the anomaly detection model learns the precision matrix Λ by minimizing equation 2 using block coordinate gradient descent or another method (such as, but not limited to, cyclic block coordinate descent, randomly permuted cyclic block coordinate descent, random block coordinate descent, etc.). In addition, although aspects of the present disclosure discuss minimizing the functions of equations 1 or 2 by manipulating the precision matrix Λ, the term minimize can refer to any reduction in the function and does not necessarily refer to an absolute minimum. For example, in some embodiments, these functions are reduced to below a threshold amount, or in other embodiments, these functions are reduced for a number of predetermined computational iterations or approximations.

[0040] Embodiments utilizing Glasso (e.g., graphical LASSO) along with block coordinate gradient descent are advantageous because the gradient of each matrix component can be calculated separately (even according to the first regularization term and the second regularization term as discussed in Equations 1 and 2). Furthermore, before performing block coordinate gradient descent (or any other gradient descent method), the sum of the first regularization term and the second regularization term discussed in Equations 1 and 2 can be calculated for the training sample x (N*N repetitions). This means that for the accuracy matrix Λ d,i There are no N samples or D features to sum over at each gradient step. Therefore, as long as the order of computing these terms is O(1) at each gradient step, the order of computational complexity does not change due to the introduction of the first regularization term.

[0041] In contrast, the computational complexity of the preprocessing step increases in order from O(D^2*N) (which is the cost for computing the empirical covariance matrix S) to O(D^2*N^2) (N times larger) (which is the cost of preprocessing for the second regularization term). However, it should be noted that this computation only needs to be performed before the stochastic gradient descent (SGD) operation, where the number of SGD steps can be several times the number of training samples N or more. Thus, the additional computational complexity introduced by the second regularization term is relatively insignificant.

[0042] In general, Equations 1 and 2 can be simplified so that the anomaly score can be based on the negative log-likelihood of the Gaussian probability of the training dataset and the precision matrix (e.g., ), and the anomaly localization score can be based on the input feature x d The complementary feature x -d and the precision matrix as the conditional input feature x d The negative log-conditional likelihood of the Gaussian probability of the training dataset (e.g., ).

[0043] Turning now to the accompanying drawings, Figure 1 A block diagram of an example vehicle 100 having a dash cam 102 communicatively coupled to an anomaly detection system 112 (also referred to as an anomaly detection model) via a network 130 is shown in accordance with some embodiments of the present disclosure. For ease of discussion, the network 130 is shown, but in other embodiments, one or more permanent or intermittent networks of similar or different types may be used to connect multiple vehicles 100 to the anomaly detection system 112. As non-limiting examples, the network 130 may include a wide area network (WAN), a local area network (LAN), an intranet, the Internet, a cellular network (e.g., 3G, 4G, 5G), a personal area network (PAN), etc. In some embodiments, the network 130 is a short-range network connection (e.g., a network utilizing the Institute of Electrical and Electronics Engineers (IEEE) 802.15 standard, the IEEE 1902.1 standard, a personal area network (PAN), Bluetooth TM network, Near Field Communication (NFC) network, Infrared Data Association (IrDA) network, Internet Protocol version 6 (IPv6) over Low Power Wireless Personal Area Network (6LoWPAN), DASH7 Alliance Protocol (D7A) network, RuBee network, Ultra Wideband (UWB) network, Frequency Modulation (FM)-UWB network, Wireless Ad Hoc Network (WANET), Z-Wave network, ZigBee TM network, and other short-range networks), or another connection that enables communication between the vehicle 100 and the anomaly detection system 112.

[0044] The vehicle 100 may be any non-autonomous, semi-autonomous, or autonomous vehicle. The vehicle 100 may include a dashcam 102 thereon, which is adapted to aggregate, store, and transmit data associated with vehicle performance and / or operator performance of the vehicle 100. The dashcam 102 may collect data from various sensors, such as, but not limited to, an accelerometer 104 (e.g., collecting linear acceleration or angular acceleration data), a speedometer 106 (e.g., collecting speed data), a global positioning system (GPS) 108 (e.g., collecting latitude, longitude, country, region, state, city, and / or other location data), and / or other sensors 110 (e.g., temperature sensors, pressure sensors, position sensors, etc.). The other sensors 110 may collect various other types of data associated with the vehicle 100, such as throttle position, engine temperature, engine revolutions per minute (RPM), steering wheel position, braking level, driving mode (e.g., cruise control, adaptive cruise control, semi-autonomous, etc.), engine vehicle code, and / or other data.

[0045] The dash cam 102 may transmit the data collected by the dash cam 102 to the anomaly detection system 112 via the network 130. In various embodiments, the data may be transmitted continuously, semi-continuously, or in batches.

[0046] The anomaly detection system 112 can be trained using historical data 114 (also referred to as training data). In some embodiments, the historical data 114 is historical dashcam data representing normal (e.g., non-abnormal) driving behavior. The anomaly detection system 112 can be trained by: (i) normalizing the historical data 114 (e.g., so that the mean eigenvector is equal to zero), (ii) learning a Gaussian probability distribution 120 of the normalized historical data 114, and (iii) reducing the function 122 below a threshold by manipulating (e.g., modifying, tuning, etc.) the precision matrix Λ124 of the Gaussian probability distribution 120 by utilizing a first regularization term 126 related to anomaly detection fairness and / or a second regularization term 128 related to anomaly localization fairness. As previously discussed, the function 122 can be the function shown in Equation 1 and / or Equation 2. In addition, the first regularization term 126 can be (as shown in Equation 1) or (as shown in Equation 2). Meanwhile, the second regularization term 128 can be (as shown in Equation 1) or (As shown in Equation 2). In some embodiments, historical data 114 is unlabeled historical data, and the training of anomaly detection system 112 is unsupervised training.

[0047] After training anomaly detection system 112 (e.g., by learning a precision matrix Λ124 that reduces function 122 below a threshold), anomaly detection system 112 may receive data from dashcam 102 and output anomaly score 116 and anomaly localization score 118. In some embodiments, the data received from dashcam 102 is preprocessed to normalize it in a manner consistent with the normalization of historical data 114. In some embodiments, anomaly score 116 may be a Gaussian probability distribution 120 and a learned precision matrix Λ124 (e.g., ). The anomaly score 116 can be used to indicate whether an anomaly occurs. Further, in some embodiments, according to the Gaussian probability distribution 120 and the learned precision matrix Λ124 (e.g., )'s complementary feature x -d , according to x d The anomaly localization score 118 may be the negative log-conditional likelihood of the new data x. The anomaly localization score 118 may be used to indicate the source or cause of any detected anomaly.

[0048] The anomaly score 116 and the anomaly location score 118 can be used in a variety of ways. For example, automakers can use these scores to improve warranty, improve vehicle safety, and / or understand customer usage. Auto parts suppliers can use these scores to improve reliability and / or safety. Auto insurance companies can use scores to adjust insurance rates based on driving behavior. These scores can be used by civil engineers and urban planners to modify road designs to improve safety. In addition, the scores can be used by the vehicle 100 itself. For example, the vehicle 100 can present a notification or warning to the operator of the vehicle based on the score. For another example, the vehicle 100 can transmit the notification or warning to, for example, emergency services based on the score. As another example, the vehicle 100 can modify or change the function of the vehicle 100 based on the score (such as but not limited to acceleration, deceleration, steering, braking, etc.).

[0049] although Figure 1 The vehicle 100 is shown communicatively coupled to the anomaly detection system 112 via the network 130, but in other embodiments, the vehicle 100 may include the anomaly detection system 112 stored therein. For example, the anomaly detection system 112 may be co-located with the dash cam 102 in the vehicle 100. In such embodiments, the anomaly detection system 112 may be trained on a remote data processing system and downloaded to the vehicle 100. In other embodiments, a partially trained or untrained anomaly detection system 112 may be downloaded from the remote data processing system to the vehicle 100, and the anomaly detection system 112 may be self-trained in real-time or on-the-fly during operation of the vehicle 100 for embodiments that may require vehicle-specific and / or operator-specific training.

[0050] Reference now Figure 2 , showing the generation of some embodiments of the present disclosure for transmission to Figure 1 The anomaly detection system 112 shown in FIG. Figure 1 200 of an example system 202 analyzing data 202 by anomaly detection system 112. Figure 1 The driver recorder 102 in the vehicle 100 is discussed, but aspects of the present disclosure may be applied to any number of industries and applications. For example, the system 200 may be a device or application in a healthcare environment that generates data 202 (e.g., patient monitoring, patient billing, etc.), a device or application in an industrial environment (e.g., quality control data for parts in a manufacturing plant, process control data in a refinery, rig data for an onshore or offshore drilling rig, etc.), a financial application (e.g., loan origination, credit reporting, etc.), a travel application (e.g., understanding flight delays, cancellations, etc.), etc. Further, with Figure 1 In contrast, the driving recorder 102 collects data from sensors, such as Figure 2 As shown, data 202 need not necessarily come from a sensor (although it could), but may come from purely electronic data (eg, text messages, internet search terms, applications, resumes, etc.).

[0051] The anomaly detection system 112 may be Figure 2 works similarly in Figure 1 In addition to receiving the Figure 1 In the case of data received from the system 200 Figure 2 The data 202 in the data. The data 202 may have Figure 1 The data discussed has more features, fewer features, or a similar number of features.

[0052] although Figure 2 The system 200 is shown being communicatively coupled to the anomaly detection system 112 via the network 130, but in other embodiments, the system 200 may have the anomaly detection system 112 stored therein. For example, the anomaly detection system 112 may be co-located with the data 202 in the system 200. In such embodiments, the anomaly detection system 112 may be trained on a remote data processing system and downloaded to the system 200. In other embodiments, a partially trained or untrained anomaly detection system 112 may be downloaded from a remote data processing system to the system 200, and for embodiments where system-specific and / or operator-specific training may be desired, the anomaly detection system 112 may train itself in real time or on the fly during operation of the system 200.

[0053] Figure 3The method for utilizing the Figure 1 and Figure 2 Flowchart of an exemplary method 300 of the anomaly detection system 112 is shown in . The method 300 may be implemented by the anomaly detection system 112, a computer, a processor, or other configurations of hardware and / or software.

[0054] Operation 302 includes training (or generating) an anomaly detection system 112 using a first regularization term for anomaly score fairness and a second regularization term for anomaly localization score fairness. In some embodiments, the anomaly detection system 112 is trained by learning a precision matrix Λ124 that reduces a function 122 below a threshold, wherein the function includes at least one of the following: a negative log-likelihood of a Gaussian probability distribution 120 of training data 114, an L1 regularization term, a first regularization term 126 for anomaly score fairness, and a second regularization term 128 for anomaly localization score fairness. In some embodiments, the first regularization term 126 for anomaly score fairness makes anomaly scores 116 similar for inputs having similar fair features and dissimilar unfair features, thereby reducing or removing the influence of unfair features. Similarly, in some embodiments, the second regularization term 128 for anomaly localization score fairness makes anomaly localization scores 118 similar for inputs having similar fair features and dissimilar unfair features, thereby reducing or removing the influence of unfair features. In some embodiments, operation 302 includes downloading the anomaly detection system 112 from the remote data processing system to a device such as a computer, a server, the vehicle 100 , the system 200 , or another device.

[0055] Operation 304 includes inputting new data (e.g., data from the bike recorder 102 or the data 202) into the anomaly detection system 112. Operation 306 includes generating, by the anomaly detection system 112, an anomaly score 116 and / or an anomaly localization score 118 based on the new data. In some embodiments, the anomaly score 116 may be based on the historical data 114 of the new data, the precision matrix Λ 124, and / or the negative log-likelihood of the Gaussian probability distribution 120 of the mean vector (e.g., ), and the anomaly localization score 118 may be based on the negative log-likelihood of the Gaussian probability distribution 120 of the historical data 114 of the features of the new data conditioned on the complementary features of the features of the new data, the precision matrix Λ124, and / or the mean vector (e.g., ).

[0056] Operation 308 includes transmitting anomaly score 116 and / or anomaly localization score 118 to another device, system, subsystem, or computer. In some embodiments, anomaly score 116 and / or anomaly localization score 118 is transmitted to a remote data processing system via network 130 .

[0057] Operation 310 includes performing a mitigation action based on the anomaly score 116 and / or the anomaly location score 118. The mitigation action may involve a notification, alert, report, or warning presented to a user, a notification, alert, report, or warning transmitted to, for example, emergency services, and / or modification of one or more devices or systems associated with the anomaly score 116 and / or the anomaly location score 118. In embodiments where the device associated with the anomaly score 116 and / or the anomaly location score 118 is a vehicle 100, the mitigation action may involve acceleration, deceleration, steering, braking, etc.

[0058] Figure 4 1 shows a flow chart of an exemplary method 400 for training anomaly detection system 112 according to some embodiments of the present disclosure. Method 400 may be implemented by anomaly detection system 112, a computer, a processor, or another configuration of hardware and / or software. In some embodiments, method 400 is Figure 3 A sub-method of operation 302.

[0059] Operation 402 includes extracting feature vectors from historical data 114. In some embodiments, operation 402 includes normalizing the feature vectors such that a mean vector equals zero.

[0060] Operation 404 includes determining a Gaussian probability distribution 120 of a feature vector of the historical data 114. Operation 406 includes calculating a pre-calculated portion of the function 122 (e.g., a pre-calculated portion of Equation 1 or 2). For example, in Equation 2, operation 406 may include calculating other pre-calculated portions of the empirical covariance matrix S and / or the regularization term.

[0061] Operation 408 includes learning the precision matrix Λ124 by manipulating the precision matrix Λ124 to reduce or minimize the function 122. In some embodiments, operation 406 includes using stochastic gradient descent (SGD). In other embodiments, the anomaly detection model learns the precision matrix Λ124 by using block coordinate gradient descent or another method (such as but not limited to cyclic block coordinate descent, randomly permuted cyclic block coordinate descent, randomized block coordinate descent, etc.). Operation 406 may include reducing the function 122 to below a predetermined threshold, reducing the function 122 until consecutive iterations result in a change below a predetermined threshold, reducing the function 122 for a predetermined number of iterations, reducing the function 122 until an absolute minimum is found, or another method for reducing the function 122 to an acceptable amount.

[0062] Figure 5Table 500 shows experimental results of some aspects of the present disclosure. Experimental validation of aspects of the present disclosure was performed on a synthetic dataset including N=1000 data points for training and testing and D=10 feature counts. The covariance matrix Σ was randomly generated with positive and semi-definite restrictions. The D-dimensional data was then generated from the distribution Set the unfairness feature to x u , and set the abnormal feature to x a (where x a Must not be equal to x u ). For half of the test data, a The relevant variances and covariances are destroyed.

[0063] Two types of area under the curve (AUC) data are used to evaluate the results. AUC-Anomaly Detection (AUCAD) is used to detect whether the anomaly classification of each input is correct, and AUC-Anomaly Localization (AUCAL) is used to determine whether the root cause of the detected anomaly is correct. In addition, fairness is evaluated by determining whether the anomaly scores 116 and anomaly localization scores 118 for data with similar fair characteristics and dissimilar unfair characteristics are actually similar. The fairness's Outlier Detection Balanced Odd (EOAD) measure constitutes the squared difference between two anomaly scores 116 calculated from two samples, while the fairness's Outlier Localization Balanced Odd (EOAL) measure (e.g., ) constitutes the squared difference between the two anomaly localization scores 118 for all features computed from the two samples (e.g., Table 500 compares the results of an anomaly detection model having neither the first regularization term (e.g., related to anomaly scores) nor the second regularization term (e.g., related to anomaly localization scores) to the results of an anomaly detection system 112 having the first regularization term, the second regularization term, and both the first regularization term and the second regularization term.

[0064] As shown in Table 500, for the AUC measure, the larger the better, and for the EO measure, the smaller the better. As shown in Table 500, the AUC AD and AUC AL of the three experimental models are equal to or greater than the AUC AD and AUC AL of the baseline model. Similarly, the EO AD and EO AL of each of the three experimental models are less than or equal to the EO AD and EO AL of the baseline model. Overall, these experimental results indicate that (i) performance is improved (or at least maintained) compared to the baseline model, (ii) fairness is improved in all cases compared to the baseline model, and (iii) performance improvements and fairness improvements are achieved when either of the regularization terms is used in isolation, and when the two regularization terms are used together. Therefore, Figure 5It is shown that aspects of the present disclosure successfully implement an anomaly detection system 112 with improved fairness without sacrificing performance.

[0065] Figure 6 FIG. 6 is a block diagram of an exemplary computer 600 according to some embodiments of the present disclosure. In various embodiments, the computer 600 may execute Figure 3-4 Any or all of the methods described in Figure 1-2 The functionality discussed in, and / or implementation of Figure 5 . In some embodiments, the computer 600 receives instructions related to the aforementioned methods and functions by downloading processor-executable instructions from a remote data processing system via the network 650. In other embodiments, the computer 600 provides instructions for the aforementioned methods and / or functions to a client machine, so that the client machine performs the method or a portion of the method based on the instructions provided by the computer 600. In some embodiments, the computer 600 is incorporated into the anomaly detection system 112, the vehicle 100, the dashcam 102, the system 200, and / or other aspects of the present disclosure (or functions similar to the computer 600 are virtually supplied to the anomaly detection system 112, the vehicle 100, the dashcam 102, the system 200, and / or other aspects of the present disclosure).

[0066] Computer 600 includes memory 625 , storage 630 , interconnect 620 (eg, a bus), one or more CPUs 605 (also referred to herein as processors), I / O device interface 610 , I / O devices 612 , and network interface 615 .

[0067] Each CPU 605 retrieves and executes programming instructions stored in memory 625 or storage device 630. Interconnect 620 is used to move data, such as programming instructions, between CPU 605, I / O device interface 610, storage device 630, network interface 615 and memory 625. Interconnect 620 can be implemented using one or more buses. In different embodiments, CPU 605 can be a single CPU, multiple CPUs, or a single CPU with multiple processing cores. In some embodiments, CPU 605 can be a digital signal processor (DSP). In some embodiments, CPU 605 includes one or more 3D integrated circuits (3DIC) (e.g., 3D wafer level packaging (3DWLP), 3D interposer-based integration, 3D stacked IC (3D-SIC), monolithic 3DIC, 3D heterogeneous integration, 3D system-level packaging (3DSiP) and / or stacked packaging (PoP) CPU configuration). Memory 625 is typically included as a representative random access memory (e.g., static random access memory (SRAM), dynamic random access memory (DRAM) or flash memory). Storage device 630 is generally included to represent non-volatile memory, such as a hard disk drive, a solid-state device (SSD), a removable memory card, an optical storage, or a flash memory device. In alternative embodiments, storage device 630 can be replaced by a storage area network (SAN) device, a cloud, or other device connected to computer 600 via I / O device interface 610 or connected to network 650 via network interface 615.

[0068] In some embodiments, memory 625 stores instructions 660. However, in different embodiments, instructions 660 are stored partially in memory 625 and partially in storage 630, or they are stored entirely in memory 625 or entirely in storage 630, or they are accessed over network 650 via network interface 615.

[0069] Instruction 660 may be used to execute Figure 3-4 any part or all of the method implemented in Figure 1-2 The functionality discussed in any part of Figure 5 Although instructions 660 are shown in memory 625 , instructions 660 may include program instructions commonly stored across a number of computer-readable storage media and executable by one or more CPUs 605 .

[0070] In various embodiments, I / O device 612 includes an interface capable of presenting information and receiving input. For example, I / O device 612 can present information to a user interacting with computer 600 and receive input from the user.

[0071] Computer 600 is connected to network 650 via network interface 615. Network 650 may include physical, wireless, cellular or different networks.

[0072] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, the embodiments of the present disclosure can be implemented in conjunction with any other type of computing environment now known or later developed.

[0073] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0074] Features are as follows:

[0075] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0076] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin-client platforms or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0077] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically do not have control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0078] Rapid elasticity: The ability to quickly and elastically provision capacity, in some cases automatically scaling down quickly and releasing quickly to scale up quickly. To the consumer, the capacity available for provisioning generally appears unlimited and can be purchased in any quantity at any time.

[0079] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0080] The service model is as follows:

[0081] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications can be accessed from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0082] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers using programming languages ​​and tools supported by the provider onto the cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the deployed applications and possible configuration of the application hosting environment.

[0083] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources, and consumers can deploy and run arbitrary software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and limited control over selected networking components (e.g., host firewalls).

[0084] The deployment model is as follows:

[0085] Private Cloud: Cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0086] Community cloud: Cloud infrastructure is shared by multiple organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0087] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0088] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0089] Cloud computing environments are service-oriented and focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0090] Reference now Figure 7, an illustrative cloud computing environment 50 is described. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud consumer can communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Figure 7 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0091] See now Figure 8 , showing the cloud computing environment 50 ( Figure 7 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 8 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present disclosure are not limited thereto. As described, the following layers and corresponding functions are provided:

[0092] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; servers based on RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0093] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0094] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources in anticipation of future demand according to the SLA.

[0095] The workload layer 90 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics processing 94; transaction processing 95; and fair anomaly detection and localization 96.

[0096] Embodiments of the present disclosure may be systems, methods and / or computer program products at any possible level of technical detail integration. A computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon for causing a processor to perform various aspects of the present disclosure.

[0097] Computer readable storage medium can be a tangible device that can retain and store instructions for use by instruction execution devices. Computer readable storage medium can be, for example but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device such as punch card or a protruding structure in a groove with instructions recorded thereon, and any suitable combination of the above. Computer readable storage medium as used herein should not be interpreted as a temporary signal itself, such as radio waves or other free propagating electromagnetic waves, electromagnetic waves propagated by waveguides or other transmission media (e.g., light pulses passing through fiber optic cables) or electrical signals emitted by wires.

[0098] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0099] The computer-readable program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming languages ​​or similar programming languages). The computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, executed as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or may be connected to an external computer (for example, using an Internet service provider via the Internet). In some embodiments, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized to execute computer-readable program instructions by utilizing the state information of the computer-readable program instructions to perform various aspects of the present disclosure.

[0100] The present disclosure will be described below with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0101] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which causes the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium in which the instructions are stored includes a manufactured product containing instructions for implementing aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0102] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in or in multiple boxes in the flowchart and / or block diagram.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations of possible implementations of the systems, methods and computer program products according to different embodiments of the present disclosure. To this end, each box in the flowchart or block diagram may represent a module, segment or subset of instructions, which includes one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions marked in the box may not occur in the order marked in the figure. For example, depending on the functions involved, the two blocks shown in succession may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0104] Although it is understood that processing software (e.g., Figure 6 Any instructions stored in the instructions 660 and / or configured to execute with respect to Figure 3-4 Any part of the method described and / or implemented in Figure 1-2Any software that is any part of the functionality discussed in the description above) can be deployed by manually loading it directly in the client, server, and proxy computer by loading storage media such as CDs, DVDs, etc., by sending the process software to a central server or a group of central servers, and the process software can also be automatically or semi-automatically deployed to the computer system. The process software is then downloaded to the client computer that will execute the process software. Alternatively, the process software is sent directly to the client system via email. Then, by executing a set of program instructions that separate the process software into directories, the process software is separated into directories or loaded into directories. Another alternative is to send the process software directly to a directory on the client computer hard drive. When there is a proxy server, the process will select the proxy server code, determine which computers to place the proxy server code on, transmit the proxy server code, and then install the proxy server code on the proxy server computer. The process software will be transmitted to the proxy server and then stored on the proxy server.

[0105] Embodiments of the present disclosure may also be delivered as part of a service engagement with a client company, non-profit organization, government entity, internal organizational structure, etc. These embodiments may include configuring a computer system to execute and deploy software, hardware, and web services that implement some or all of the methods described herein. These embodiments may also include analyzing the operation of a client, creating recommendations in response to the analysis, building a system that implements a subset of the recommendations, integrating the system into existing processes and infrastructure, metering the use of the system, allocating costs to users of the system, and billing, invoicing (e.g., generating invoices), or otherwise receiving payment for the use of the system.

[0106] The terms used herein are only used for the purpose of describing specific embodiments, and are not intended to limit various embodiments. As used herein, unless the context clearly indicates otherwise, the singular forms "one", "a kind of" and "the" are intended to also include plural forms. It should also be understood that when the terms "include" and / or "comprise" are used in this specification, they specify the presence of the features, wholes, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, parts and / or their combinations. In the previous detailed description of the example implementation of various embodiments, reference is made to the accompanying drawings (where the same numbers represent the same elements), which form a part thereof, and in which specific example implementations of various embodiments can be practiced are shown by way of illustration. These embodiments are described in sufficient detail to enable those skilled in the art to practice these embodiments, but without departing from the scope of different embodiments, other embodiments can be used and logical, mechanical, electrical and other changes can be made. In the previous description, many specific details are set forth to provide a thorough understanding of different embodiments. But different embodiments can be implemented without these specific details. In other examples, well-known circuits, structures and technologies are not shown in detail to avoid confusing the embodiments.

[0107] Different instances of the word "embodiment" used in this specification do not necessarily refer to the same embodiment, but they may refer to the same embodiment. Any data and data structures shown or described herein are merely examples, and in other embodiments, different amounts of data, data types, fields, the number and type of fields, field names, rows, records, entries, or the number and type of data organizations may be used. In addition, any data may be combined with logic so that a separate data structure may not be required. Therefore, the foregoing detailed description should not be considered to have a restrictive meaning.

[0108] The description of different embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements to technologies found in the marketplace, or to enable those of ordinary skill in the art to understand the embodiments disclosed herein.

[0109] Although the present disclosure has been described in terms of specific embodiments, it is contemplated that changes and modifications will become apparent to those skilled in the art. It is therefore intended that the following claims be interpreted as covering all such changes and modifications that fall within the true scope of the present disclosure.

[0110] Any advantages discussed in this disclosure are exemplary advantages, and there may be embodiments of the disclosure that achieve all, some, or none of the advantages discussed while remaining within the scope of the disclosure.

[0111] A non-limiting list of examples is provided below to demonstrate some aspects of the present disclosure. Example 1 is a system. The system includes: a vehicle; a plurality of sensors that collect observed vehicle data; a dash cam configured to aggregate and store the observed vehicle data; and an anomaly detection system communicatively coupled to the dash cam, wherein the anomaly detection system includes a probability distribution of historical vehicle data, wherein parameters of the probability distribution are tuned to reduce a function below a threshold, wherein the function is based on the probability distribution conditioned on the historical vehicle data and at least one regularization term, wherein the regularization term is configured to generate similar outputs of the probability distribution for inputs having similar fairness characteristics and independent of unfairness characteristics, wherein the anomaly detection system also includes an anomaly score and an anomaly localization score based on the probability distribution, the parameters, and the observed vehicle data.

[0112] Example 2 includes the system of Example 1, including or excluding optional features. In this example, at least one regularization term includes a first regularization term and a second regularization term, the first regularization term is configured to generate similar anomaly scores for inputs having similar fair features and dissimilar unfair features, and the second regularization term is configured to generate similar anomaly localization scores for inputs having similar fair features and dissimilar unfair features.

[0113] Example 3 includes the system of any one of Examples 1 to 2, including or excluding the optional features. In this example, the probability distribution is a Gaussian distribution, and wherein the parameters include a mean vector and a precision matrix.

[0114] Example 4 includes the system of any one of Examples 1 to 3, including or excluding the optional features. In this example, reducing the function below a threshold is performed using stochastic gradient descent (SGD).

[0115] Example 5 includes the system of any one of Examples 1 to 4, including or excluding the optional features. In this example, the anomaly detection system is configured to perform a method including: performing a mitigation action based on the anomaly score and the anomaly localization score.

[0116] Example 6 is a computer-implemented method. The method includes: training an anomaly detection system, the anomaly detection system being configured to generate an anomaly score and an anomaly location score for vehicle data, wherein the anomaly detection system is trained to use a first regularization term and a second regularization term to generate similar anomaly scores and anomaly location scores for historical vehicle data having similar fairness characteristics and independent of unfair characteristics; receiving new vehicle data from a dashcam at the anomaly detection system, the dashcam collecting data from multiple sensors on the vehicle; generating a first anomaly score and a first anomaly location score associated with the new vehicle data; and performing a mitigation action based on the first anomaly score and the first anomaly location score, wherein the mitigation action changes the vehicle.

[0117] Example 7 includes the method of Example 6, including or excluding the optional features. In this example, training the anomaly detection system further includes: generating a Gaussian probability distribution of the historical vehicle data; and learning a mean vector and a precision matrix that reduce a function below a threshold, wherein the function is based on a negative log-likelihood given the Gaussian probability distribution of the historical vehicle data, an L1 regularization term of the precision matrix, the first regularization term, and the second regularization term. Optionally, the first anomaly score and the first anomaly localization score are based on the new vehicle data, the Gaussian probability distribution, the mean vector, and the precision matrix.

[0118] Example 8 is a computer-implemented method. The method includes: generating an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, wherein the mean vector and the precision matrix are generated by reducing a function to below a threshold, wherein the function includes the Gaussian distribution, a first regularization term, the first regularization term is configured to generate similar anomaly scores for inputs having similar fairness characteristics and independent of unfair characteristics, and a second regularization term, which is configured to generate similar anomaly localization scores for inputs having similar fairness characteristics and independent of unfair characteristics; inputting new data into the anomaly detection model; and generating an anomaly score and anomaly localization score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

[0119] Example 9 includes the method of Example 8, including or excluding the optional feature. In this example, the anomaly score indicates the presence of an anomaly, and wherein the anomaly localization score indicates a source of the anomaly.

[0120] Example 10 includes the method of any one of Examples 8 to 9, including or excluding the optional features. In this example, the function is reduced using stochastic gradient descent (SGD).

[0121] Example 11 includes the method of any one of Examples 8 to 10, including or excluding the optional features. In this example, the anomaly score is a negative log-likelihood of the new data based on a Gaussian distribution of the historical data, a mean vector, and a precision matrix.

[0122] Example 12 includes the method of any one of Examples 8 to 11, including or excluding the optional features. In this example, the anomaly localization score is the negative log conditional likelihood of the features of the new data conditioned on other features of the new data according to the Gaussian distribution, mean vector, and precision matrix of the historical data.

[0123] Example 13 includes the method of any one of Examples 8 to 12, including or excluding the optional feature. In this example, the anomaly detection model is generated using unsupervised learning, and wherein the historical data is unlabeled training data.

[0124] Example 14 includes the method of any one of Examples 8 to 13, including or excluding the optional feature. In this example, the method includes performing a mitigation action based on the anomaly score and the anomaly location score. Optionally, the mitigation action includes modifying a device associated with the new data.

[0125] Example 15 includes the method of any one of Examples 8 to 14, including or excluding the optional features. In this example, the method is performed by one or more computers according to software downloaded from a remote data processing system to the one or more computers. Optionally, the method further includes: metering usage of the software; and generating an invoice based on the metered usage.

[0126] Example 16 is a system. The system includes: one or more processors; and one or more computer-readable storage media storing program instructions, wherein the program instructions are configured to cause the one or more processors to perform a method according to any one of Examples 6 to 15 when executed by the one or more processors.

[0127] Example 17 is a computer program product. The computer program product includes one or more computer-readable storage media, and program instructions stored together on the one or more computer-readable storage media, the program instructions including instructions configured to cause one or more processors to perform the method according to any one of Examples 6 to 15.

Claims

1. A system for anomaly detection and location, comprising: vehicle; Multiple sensors,collect observed vehicle data; a driving recorder configured to aggregate and store observed vehicle data; as well as An anomaly detection system communicatively coupled to the drive recorder, wherein the anomaly detection system includes a probability distribution of historical vehicle data, wherein parameters of the probability distribution are tuned to reduce a function of an anomaly detection model below a threshold, wherein the function is based on the probability distribution conditioned on the historical vehicle data and at least one regularization term, the regularization term being configured to generate similar outputs of the probability distribution for inputs having similar fair features and independent of unfair features, wherein the similar fair features are related to an object of anomaly detection and the unfair features are independent of an object of anomaly detection, wherein the anomaly detection system further includes an anomaly score and an anomaly localization score, wherein the anomaly score and the anomaly localization score are based on the probability distribution, the parameters, and the observed vehicle data.

2. The system according to claim 1, wherein: The at least one regularization term includes a first regularization term and a second regularization term, the first regularization term is configured to generate a similar anomaly score for inputs having the similar fairness feature and independent of the unfair feature, and the second regularization term is configured to generate a similar anomaly localization score for inputs having the similar fairness feature and independent of the unfair feature.

3. The system according to claim 1 or 2, wherein: The probability distribution is a Gaussian distribution, and wherein the parameters include a mean vector and a precision matrix.

4. The system according to claim 1 or 2, wherein: Reducing the function below a threshold is performed using stochastic gradient descent (SGD).

5. The system according to claim 1, wherein: The anomaly detection system is configured to perform a mitigation action based on the anomaly score and the anomaly localization score.

6. A computer-implemented method for anomaly detection and location, comprising: training an anomaly detection system configured to generate an anomaly score and an anomaly localization score for vehicle data, wherein the anomaly detection system is trained to generate similar anomaly scores and anomaly localization scores for historical vehicle data having similar fair features and independent of unfair features using a first regularization term and a second regularization term, wherein the similar fair features are related to an object of anomaly detection and the unfair features are independent of the object of anomaly detection; receiving new vehicle data at the anomaly detection system from a drive recorder that collects data from a plurality of sensors on the vehicle; generating a first anomaly score and a first anomaly localization score associated with the new vehicle data; and A mitigation action is performed based on the first anomaly score and the first anomaly localization score, wherein the mitigation action changes the vehicle.

7. The method according to claim 6, wherein: Training the anomaly detection system further comprises: generating a Gaussian probability distribution of the historical vehicle data; and Learning a mean vector and a precision matrix that reduce a function below a threshold, wherein the function is based on a negative log-likelihood of the Gaussian probability distribution given the historical vehicle data, an L1 regularization term of the precision matrix, the first regularization term, and the second regularization term.

8. The method according to claim 7, wherein: The first anomaly score and the first anomaly localization score are based on the new vehicle data, the Gaussian probability distribution, the mean vector, and the precision matrix.

9. A computer-implemented method for anomaly detection and location, comprising: Generate an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, wherein the mean vector and the precision matrix are generated by reducing a function of the anomaly detection model below a threshold, wherein the function includes the Gaussian distribution, a first regularization term, and a second regularization term, wherein the first regularization term is configured to generate a similar anomaly score for inputs having similar fair features and being independent of unfair features, and the second regularization term is configured to generate a similar anomaly localization score for inputs having similar fair features and being independent of unfair features, wherein the similar fair features are related to an object of anomaly detection, and the unfair features are not related to the object of anomaly detection; inputting new data into the anomaly detection model; and An anomaly score and an anomaly localization score associated with the new data are generated based on the Gaussian distribution, the mean vector, and the precision matrix.

10. The method according to claim 9, wherein: The anomaly score indicates the presence of an anomaly, and wherein the anomaly localization score indicates a source of the anomaly.

11. The method according to claim 9 or 10, wherein: Stochastic gradient descent (SGD) is used to reduce the function.

12. The method according to claim 9 or 10, wherein: The anomaly score is a negative log-likelihood of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

13. The method according to claim 9, wherein: The anomaly localization score is the negative log conditional likelihood of features of the new data conditioned on other features of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

14. The method according to claim 9, wherein: The anomaly detection model is generated using unsupervised learning, and wherein the historical data comprises unlabeled training data.

15. The method according to claim 9, further comprising: A mitigation action is performed based on the anomaly score and the anomaly localization score.

16. The method according to claim 15, wherein: The mitigation action includes modification of a device associated with the new data.

17. The method according to claim 9, wherein: The method is performed by one or more computers according to software downloaded to the one or more computers from a remote data processing system.

18. The method according to claim 17, wherein: The method further comprises: Measuring the use of said software; and An invoice is generated based on the metered usage.

19. A system for anomaly detection and location, comprising: one or more processors; as well as One or more computer-readable storage media storing program instructions, which when executed by the one or more processors are configured to cause the one or more processors to perform a method comprising: Generate an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, wherein the mean vector and the precision matrix are generated by reducing a function of the anomaly detection model below a threshold, wherein the function includes the Gaussian distribution, a first regularization term, and a second regularization term, wherein the first regularization term is configured to generate a similar anomaly score for inputs having similar fair features and being independent of unfair features, and the second regularization term is configured to generate a similar anomaly localization score for inputs having similar fair features and being independent of unfair features, wherein the similar fair features are related to an object of anomaly detection, and the unfair features are not related to the object of anomaly detection; inputting new data into the anomaly detection model; and An anomaly score and an anomaly localization score associated with the new data are generated based on the Gaussian distribution, the mean vector, and the precision matrix.

20. The system of claim 19, wherein: Stochastic gradient descent (SGD) is used to reduce the function.

21. The system of claim 19, wherein: The anomaly score is a negative log-likelihood of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

22. The system of claim 19, wherein: The anomaly localization score is the negative log conditional likelihood of features of the new data conditioned on other features of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

23. A computer program product comprising one or more computer-readable storage media, and program instructions stored together on the one or more computer-readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method, the method comprising: Generate an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, wherein the mean vector and the precision matrix are generated by reducing a function of the anomaly detection model below a threshold, wherein the function includes the Gaussian distribution, a first regularization term, and a second regularization term, wherein the first regularization term is configured to generate a similar anomaly score for inputs having similar fair features and being independent of unfair features, and the second regularization term is configured to generate a similar anomaly localization score for inputs having similar fair features and being independent of unfair features, wherein the similar fair features are related to an object of anomaly detection, and the unfair features are not related to the object of anomaly detection; inputting new data into the anomaly detection model; and An anomaly score and an anomaly localization score associated with the new data are generated based on the Gaussian distribution, the mean vector, and the precision matrix.

24. The computer program product of claim 23, wherein: The anomaly score is a negative log-likelihood of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

25. The computer program product of claim 23, wherein: The anomaly localization score is the negative log conditional likelihood of features of the new data conditioned on other features of the new data based on the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

Images