Learning process and associated anomaly detection process for detecting anomalies from a multivariate data set

Abstract

One aspect of the invention relates to a learning process for detecting anomalies on a microcontroller comprising a memory storing a predefined number of classes and receiving a multivariate set from a sensor, the method comprising the steps of: computing a mean and a covariance matrix for a group of data sets; if the covariance matrix is poor: adding the data set to a group of learning data sets and updating the mean and covariance matrix; creating a class associated with the mean and covariance matrix in the memory; for each class, computing a measure of distance between the class and each other class; selecting the class corresponding to the first minimum distance measure and combining the selected two classes.

Description

Technical Field

[0001] The technical field of this invention is the technical field of anomaly detection processing, and more specifically, the technical field of anomaly detection processing implemented on a microcontroller for detecting anomalies from a multivariate dataset.

[0002] This invention relates to a learning process for detecting anomalies, and more particularly to a progressive learning process implemented on a microcontroller for detecting anomalies from a multivariate dataset. The invention also relates to anomaly detection processes for microcontrollers used to implement the learning and / or detection processes, devices embedded in the microcontroller, and computer program products. Background Technology

[0003] To detect anomalies in a system monitored from several variables (e.g., temperature, pressure, and humidity) via at least one sensor, techniques such as those based on neural networks are known to allow for high detection rates. These techniques typically require powerful processors and substantial memory resources to function.

[0004] Therefore, these technologies are incompatible with implementations on microcontrollers that are limited in terms of memory resources, but they are highly integrated due to their reduced size.

[0005] Therefore, there is a need to design an algorithm for detecting anomalies from multivariate data that allows for performance comparable to that of other known techniques for anomaly detection implemented on microcontrollers that can be embedded in any device regardless of its environment. Summary of the Invention

[0006] Because the algorithm is implemented on a highly integrated microcontroller, this invention provides a solution to the aforementioned problems by allowing the detection of anomalies from multivariate data.

[0007] A first aspect of the invention relates to a progressive learning process for detecting anomalies implemented on a microcontroller including at least one memory, the microcontroller being configured to receive a multivariate data set from at least one sensor, the memory being configured to store a predetermined number of categories, the categories being associated with a mean and a covariance matrix, the process comprising the following steps:

[0008] - Initialization, including at least one sub-step of creating a category and storing the category in memory, such that the number of categories created is strictly less than the predetermined number of categories;

[0009] - For at least one set of learning data:

[0010] Calculate the mean and covariance matrix of the set of learning data;

[0011] If the condition for poor adjustment of the covariance matrix of the training dataset is verified, the following condition is performed, which depends on the LU factorization of the covariance matrix:

[0012] - Add the dataset to the training dataset and update the mean and covariance matrix of the training dataset;

[0013] Create a category associated with the mean and covariance matrix of the set of learning data, and store the category in memory;

[0014] For each category stored in the memory, a first measurement of the distance between the category and each other category stored in the memory is calculated from the associated device and covariance matrix;

[0015] Select two categories corresponding to the first minimum distance measurement, and create a single category by merging the two selected categories.

[0016] Because of this invention, categories are created for a set of learning data to avoid creating categories that do not provide new information about existing categories. The test for obtaining a well-regulated covariance matrix is ​​performed without computationally decomposing it into singular values, a common procedure for testing the good regulation of matrices, as this would require a large amount of computation incompatible with the reduced computational capacity of the microcontroller. The test for good regulation of the covariance matrix is ​​performed using an adaptive LU factorization of the matrix, which requires far less computation.

[0017] To avoid exceeding the predetermined number of categories allocated in the microcontroller's memory, each category is compared to the others using a distance measurement once a new category is created in memory. The two closest categories (i.e., those with the lowest distance measurement) are then merged into a single category to free up space in memory and enable the creation of new categories that better represent other data sets.

[0018] In addition to the features just mentioned in the preceding paragraphs, the method according to the first aspect of the invention may have one or more of the following additional features, either individually or in combination of all technically possible features.

[0019] According to one variant, the initialization step includes the following sub-steps:

[0020] - If it is verified that the number of categories stored in memory is strictly less than the predetermined number of categories, then:

[0021] For a set of initial data:

[0022] - Calculate the mean and covariance matrix of the initial set of data;

[0023] If the covariance matrix of an initialized dataset is verified under poorly adjusted conditions, then:

[0024] - Add a data set to the initial data set of this group, and update the mean and covariance matrix of the initial data set of this group;

[0025] Create a category associated with the mean and covariance matrix of the initial dataset and store the category in memory.

[0026] Therefore, if the number of categories has not reached the predetermined number minus one, a new category is created, which allows the new category created during the learning period to be compared with the maximum value of other categories.

[0027] According to the variant compatible with the aforementioned variant, the first distance measurement is the Bhattacharyya distance.

[0028] A second aspect of the invention relates to an anomaly detection process implemented on a microcontroller including at least one memory, the microcontroller being configured to receive a multivariate data set from at least one sensor, the memory being configured to store a predetermined number of categories, the categories being associated with a mean and a covariance matrix, the process including steps of a learning process according to a first aspect of the invention, followed by the following steps:

[0029] - For each received data set:

[0030] The data set is stored in the memory;

[0031] For each category stored in the memory, a second measurement of the distance between the dataset and the category is calculated, and the second minimum distance measurement is selected;

[0032] If the condition that the second minimum distance measurement is greater than the distance threshold is verified, an anomaly is detected;

[0033] Delete the data set from the memory.

[0034] Therefore, the anomaly detection process according to the second aspect of the invention uses the categories created during the learning process according to the first aspect of the invention to effectively detect anomalies by measuring the distance between the dataset and each category stored in memory. If the dataset is too far from a category stored in memory, it is considered an anomaly.

[0035] According to the variant, the second distance measurement is the Mahalanobis distance.

[0036] According to variants compatible with previous variants, the distance threshold is from χ 2The distribution was obtained using the chi-square distribution.

[0037] Depending on the variant compatible with the previous variant, the distance threshold is weighted by a sensitivity factor.

[0038] Therefore, the sensitivity of processing abnormal data sets can be adjusted.

[0039] A third aspect of the invention relates to a computer configured to implement the steps of a learning process according to a first aspect of the invention and / or the steps of an anomaly detection process according to a second aspect of the invention, including a processor and a memory, and receiving a multivariate data set from at least one sensor.

[0040] According to one variant, the computer according to the invention is a microcontroller.

[0041] The fourth aspect of the invention relates to a device for embedding a microcontroller according to the third aspect of the invention.

[0042] The fifth aspect of the invention relates to a computer program product comprising instructions which, when executed by a computer, direct the computer to perform steps of a learning process according to the first aspect of the invention and / or steps of an anomaly detection process according to the second aspect of the invention.

[0043] A better understanding of the invention and its various applications will be gained by reading the following description and examining the accompanying drawings. Attached Figure Description

[0044] The accompanying drawings are shown for illustrative purposes and not for limiting the scope of the invention.

[0045] Figure 1 This is a block diagram illustrating the sequence of steps in the learning process according to the present invention.

[0046] Figure 2 This is a block diagram illustrating a first embodiment of the initialization steps of the learning process according to the present invention.

[0047] Figure 3 This is a block diagram illustrating the sequence of steps in the anomaly detection process according to the present invention.

[0048] Figure 4 This is a schematic diagram of a device with an embedded microcontroller according to the present invention. Detailed Implementation

[0049] Unless otherwise stated, the same elements appearing in different figures have a single figure reference numeral.

[0050] The first aspect of the present invention relates to a progressive learning process for detecting anomalies.

[0051] The term "progressive learning" refers to learning from data received over time.

[0052] A second aspect of the invention relates to a process for detecting anomalies, comprising a learning process according to the first aspect of the invention.

[0053] Both the learning process according to the first aspect of the present invention and the anomaly detection process according to the second aspect of the present invention consist of a multivariate dataset.

[0054] A multivariate dataset is a dataset that includes several variables, that is, several types of data or a single type of data with multiple dimensions.

[0055] Variables include, for example, pressure measurements, temperature measurements, vibration measurements, or even humidity measurements.

[0056] Therefore, a multivariate dataset can include, for example, pressure measurements, temperature measurements, and humidity measurements. A multivariate dataset consists of three variables.

[0057] The term "anomaly detection" refers to identifying a specific set of data that is significantly different from the set of data processed during the learning phase.

[0058] Anomaly detection can be used, for example, to monitor industrial machinery in the context of predictive maintenance, to detect excessive energy consumption in homes, or even to detect intruders in a room.

[0059] Both the learning process according to the first aspect of the invention and the anomaly detection process according to the second aspect of the invention are implemented on a microcontroller that receives a multivariate data set from at least one sensor.

[0060] A third aspect of the invention relates to a microcontroller configured to implement a learning process according to a first aspect of the invention and / or a detection process according to a second aspect of the invention.

[0061] Therefore, the same microcontroller can be used to implement the learning process according to the first aspect of the invention and the detection process according to the second aspect of the invention.

[0062] [ Figure 4 ] Figure 4 A schematic representation of a microcontroller 200 according to a third aspect of the present invention is shown.

[0063] The microcontroller 200 is an integrated circuit that includes at least one microprocessor 202 and at least one memory 201.

[0064] exist Figure 4 In this microcontroller 200, there is a single memory 201 and a single microprocessor 202.

[0065] The microprocessor 202 has a frequency, for example, greater than 2 MHz. The microprocessor 202 is, for example, a 50 MHz microprocessor.

[0066] Memory 201 may have, for example, at least 2 kilobytes of random access memory. Memory 201 may have, for example, 4 kilobytes of random access memory.

[0067] Assume that the categories follow a Gaussian distribution that can be associated with the mean and covariance matrix.

[0068] The microcontroller 200 receives a set of multivariate data that allows at least one sensor 203 to perform a learning process according to a first aspect of the invention and / or a detection process according to a second aspect of the invention.

[0069] Since the dataset is multivariable, if the microcontroller 200 receives a multivariable dataset from a single sensor 203, the sensor 203 can acquire different types of data.

[0070] Using the previous example with a multivariate dataset including three variables, a single sensor 203 can then perform pressure, temperature, and humidity measurements.

[0071] The microcontroller can also receive multivariate data sets from multiple sensors 203. Each sensor 203 can acquire a single type or different types of data.

[0072] exist Figure 4 In this process, the microcontroller receives a set of multivariable data from three sensors 203.

[0073] Using the previous example, which included a multivariate dataset with three variables, the first sensor 203 was able to perform pressure measurements, the second sensor 203 performed temperature measurements, and the third sensor 203 performed humidity measurements.

[0074] Sensor 203 is, for example, an accelerometer with a given sampling frequency and, for example, a number of axes equal to 3. The measurement then comprises 3 values, each corresponding to one axis.

[0075] Sensor 203 is, for example, a thermometer that transmits temperature measurements.

[0076] Sensor 203 is, for example, a barometer that transmits pressure measurements.

[0077] Sensor 203 is, for example, a thermal camera. Measurements are, for example, an 8×8 pixel matrix.

[0078] According to the first embodiment, each sensor 203 is connected to the microcontroller 200 via a serial data bus (e.g., I2C, SPI, CAN, or UART serial data bus).

[0079] According to the second embodiment, the microcontroller 200 receives a set of multivariate data from each sensor 203, for example, via a wired connection (e.g., an Ethernet link) or a wireless connection (e.g., a Bluetooth or Wi-Fi connection).

[0080] exist Figure 4 In this process, the microcontroller 200 is embedded in the device 300.

[0081] exist Figure 4 In this configuration, sensor 203 is also embedded in device 300. In this case, device 300 can be a device intended to perform anomaly detection.

[0082] [ Figure 1 ] Figure 1 This is a block diagram illustrating the sequence of steps in a learning process 11 according to a first aspect of the present invention.

[0083] Learning process 11 is an unsupervised progressive learning process performed on a multivariate data set provided by sensor 203.

[0084] The term "unsupervised learning" refers to machine learning using unlabeled data, i.e., raw data provided by sensor 203.

[0085] The learning process 11 includes a first initialization step 111, in which at least one category is created and then stored in the memory 201 of the microcontroller.

[0086] During the first step 111, the number of categories created is strictly less than the predetermined number of categories, that is, less than or equal to the predetermined number of categories minus one.

[0087] Select a predetermined number of categories such that the storage capacity of memory 201 allows it to store at least the predetermined number of categories.

[0088] For example, if memory 201 has 4 kilobytes of random access memory, allowing it to store, for example, up to 10 categories, then the predetermined number of categories is less than or equal to 10.

[0089] Figure 2 This is a block diagram illustrating a first exemplary embodiment of the initialization step 111 of the learning process 11.

[0090] If condition CN is validated, then execute. Figure 2 The first step 111 is shown. If the number of categories stored in the memory 201 of the microcontroller 200 is strictly less than the predetermined number of categories, then the verification condition CN is performed.

[0091] For example, if the predetermined number of categories is 22, then if there are no 21 categories stored in memory 201, then the first step 111 is executed.

[0092] If the CN condition is not verified or is no longer verified, complete the first step 111 and continue to the second step 112 of the learning process 11.

[0093] The sub-steps of the first step 111 are performed on at least one set of multivariate data, referred to below as a set of initialization data.

[0094] The first sub-step 1111 of the first step 111 includes calculating the mean and covariance matrix for the initialization set of data for this group.

[0095] Let's consider a set of data i containing p variables. Such a data set i can be represented by a vector. To model, so that:

[0096]

[0097] We consider a dataset consisting of n data sets, and therefore n×p variables. These can then be represented by vectors. To model this dataset, such that:

[0098]

[0099] The mean m of the initial set of data is then calculated as follows:

[0100]

[0101] To avoid needing to store the entire data set, the average can be calculated incrementally, i.e.:

[0102]

[0103] Then the covariance matrix Cov of a set of initialized data is calculated as follows:

[0104]

[0105] Let cov(Y, Z), the covariance between variables Y and Z, be expressed as:

[0106]

[0107] To avoid needing to memorize the entire dataset, the covariance matrix can be calculated incrementally:

[0108]

[0109] The defined covariance matrix Cov is a square matrix.

[0110] Consider a simple example where each data set includes two variables and the data set comprises three data sets, and we obtain:

[0111]

[0112]

[0113]

[0114] If the covariance matrix of the initial data set satisfies condition CS, then proceed to the second sub-step 1112 of the first step 111. If the condition of the covariance matrix of the given set is poor, then verify the condition CS of the given set.

[0115] For example, if the LU factorization of the covariance matrix satisfies certain conditions on the diagonal elements, such as if the ratio between the minimum and maximum diagonal elements is greater than a threshold, then the condition CS is considered unverified.

[0116] The LU decomposition of the covariance matrix Cov can be written as:

[0117] Cov=LU

[0118] L is a lower triangular matrix, and U is an upper triangular matrix.

[0119] This threshold is, for example, between 0.0001 and 0.1.

[0120] If the inverse of a square matrix is ​​sensitive to slight modifications to its elements, then the condition is poor.

[0121] Therefore, if there is no verification condition CS for the initial set of data of the initial group, that is, if the covariance matrix calculated for the initial set of data of the initial group is well tuned, then the second sub-step 1112 is not executed, and the third sub-step 1113 of the first step 111 continues.

[0122] The second sub-step 1112 includes adding the data set to the group initialization data set, and then updating the mean and covariance matrix of the group initialization data set, that is, recalculating the mean and covariance matrix of the group initialization data set to which the data set has been added.

[0123] If condition CS is still validated after the second sub-step 1112, then the second sub-step 1112 is executed again, and so on, until condition CS is no longer validated.

[0124] Once the initialization data group for which at least one new data group has been added is no longer validated for condition CS, proceed to the IO of the third sub-step 1113.

[0125] The third sub-step 1113 involves creating a category associated with the mean and covariance matrix of the initial data set, and then storing the created category in the memory 201 of the microcontroller 200.

[0126] The covariance matrix associated with the category is the covariance matrix of the condition CS not being validated, i.e., the covariance matrix of the good condition. The covariance matrix associated with the category can be the covariance matrix calculated for the initial set of data initialized for the initial group or for the initial set of data initialized for the initial group that has been added during the second sub-step 1112.

[0127] If condition CN is verified, i.e., if the number of categories stored in memory 201 is strictly less than the predetermined number of categories, then the sub-step of the first step 111 is executed.

[0128] According to a second exemplary embodiment, the first initialization step 111 may involve creating a number of categories that is strictly lower than a predetermined number of categories by associating a random or predetermined mean and covariance matrix with each category.

[0129] The following steps of learning process 11 are performed on at least one set of multivariate data, hereinafter referred to as the learning data set set.

[0130] The second step 112 of the learning process 11 is to calculate the mean and covariance matrix of a set of learning data.

[0131] If the conditional CS is validated for the set of learning data, that is, if the condition of the covariance matrix associated with the set of learning data is poor, then the third step 113 of the learning process 11 is performed.

[0132] If there is no validation condition CS for the initial group's learning dataset, that is, if the covariance matrix associated with the learning dataset is well-adjusted, then step 113 is not performed and the fourth step 114 of the learning process 11 is continued.

[0133] The third step 113 involves adding the dataset to the learning dataset and then updating the mean and covariance matrix of the learning dataset, which means recalculating the mean and covariance matrix of the learning dataset that has already been added to the dataset.

[0134] If condition CS is still validated after step 3 113, then step 3 113 is executed again, and so on, until condition CS is no longer validated.

[0135] Once the condition CS is no longer validated for a group of learning datasets that have already had at least one new dataset added, proceed to step 4, 114.

[0136] The fourth step 114 involves creating categories associated with the mean and covariance matrix of the set of learning data, and then storing the created categories in memory 201.

[0137] The covariance matrix associated with the category is the covariance matrix of the conditional CS that has not been validated, i.e., the covariance matrix of the good condition. The covariance matrix associated with the category can be the covariance matrix calculated for the initial group of the learning dataset or for the initial group of the learning dataset for which one or more datasets have been added during step 113.

[0138] Step 515 then includes calculating a first measurement of the distance between each category stored in memory 201 and each other category.

[0139] For example, if the first category, the second category, and the third category are stored in memory 201, then the fifth step 115 includes calculating a first measurement of the distance between the first category and the second category, a first measurement of the distance between the first category and the third category, and a first measurement of the distance between the second category and the third category.

[0140] The first measure of the distance between the first category associated with the mean m1 and covariance matrix M1 and the second category associated with the mean m2 and covariance matrix M2 is, for example, the Bhattacharyya distance D. B It is defined as:

[0141]

[0142] Among them: A T It is the transpose of matrix A, A -1 Let M be the inverse of matrix A, det A be the determinant factor of matrix A, ln be the natural logarithm operator, and matrix M be defined as:

[0143]

[0144] Step 6, 116, then involves selecting two categories from those for which the first minimum distance measurement was calculated in step 5, 115, i.e., the first distance measurement with the lowest value among all the first distance measurements calculated in step 5, 115, and then merging the two selected categories to create a single category.

[0145] To merge the first category associated with the data set n1, the mean m1, and the covariance matrix M1, and the second category associated with the data set n2, the mean m2, and the covariance matrix M2, a category is created, for example, associated with n sets of data, the mean m, and the covariance matrix M, such that:

[0146] n = n1 + n2

[0147]

[0148]

[0149] The two categories merged in step 6, 116, can be the category created in step 4, 114, and another category stored in memory 201, or two categories stored in memory 201 that are different from the category created in step 4, 114.

[0150] [ Figure 3 ] Figure 3 This is a block diagram illustrating the sequence of steps in the anomaly detection process 10 according to the second aspect of the present invention.

[0151] Once the learning process 11 has been executed, the steps of the anomaly detection process 10 according to the second aspect of the invention are performed on each data set received by the sensor 203.

[0152] exist Figure 3 In this process, the learning process 11 is considered to be the first step 11 of the anomaly detection process 10.

[0153] The second step 12 of the anomaly detection process 10 includes storing the received data set in the memory 201 of the microcontroller 200.

[0154] The third step 13 of the anomaly detection process 10 includes: for each category stored in the memory 201, calculating a second measurement of the distance between the data set and the category.

[0155] For example, if the first category, the second category, and the third category are stored in memory 201, then the third step 13 includes calculating a second measurement of the distance between the data set and the first category, a second measurement of the distance between the data set and the second category, and a second measurement of the distance between the data set and the third category.

[0156] A second measure of the distance between a dataset modeled by a vector X and the categories associated with the mean m and covariance matrix M is, for example, the Mahalanobis distance D. M It is defined as:

[0157]

[0158] Then, the third step 13 includes selecting the second minimum distance measurement, that is, the second distance measurement with the lowest value among all the second distance measurements calculated in the third step 13.

[0159] If the conditional CP is validated, then step 14 of the anomaly detection process 10 is executed. If the second minimum distance measurement is greater than the distance threshold, then the conditional CP is validated.

[0160] If the condition CP is not verified, that is, if the second minimum distance measurement is less than the distance threshold, then step 4 (14) is not executed, and step 5 (15) is executed directly.

[0161] Distance thresholds, for example, are determined by selecting the number of variables in the dataset as degrees of freedom from χ². 2 (Chi-square) distribution obtained.

[0162] The distance threshold is weighted by a sensitivity factor, for example. The sensitivity factor may be between 0.5 and 1.5. By default, the sensitivity factor is set to 1.

[0163] Step 4, number 14, includes detecting anomalies.

[0164] Step 4, 14, can be, for example, triggering an alarm or sending an alarm message to a given device.

[0165] The fifth step 15 of the anomaly detection process 10 is to delete the data set received from the memory 201 of the microcontroller 200.

Claims

1. A progressive learning method for detecting anomalies implemented on a microcontroller, the microcontroller including at least one memory, the microcontroller being configured to receive a multivariate data set from at least one sensor, the memory being configured to store a predefined number of categories, each category being associated with a mean and a covariance matrix, the method being characterized in that its Includes the following steps: Initialization includes at least one sub-step of creating categories and storing the categories in the memory, such that the number of categories created is strictly less than a predetermined number of categories; For at least one set of learning data: Calculate the mean and covariance matrix for the set of learning data; If the condition that the covariance matrix of the set of learning data is poorly adjusted is verified, the following is performed, the condition depending on the LU factorization of the covariance matrix: add the data set to the set of learning data, and update the mean and the covariance matrix of the set of learning data; Create categories associated with the mean and covariance matrix of the set of learning data, and store the categories in the memory; For each category stored in the memory, a first distance measurement between that category and each other category stored in the memory is calculated from the associated mean and covariance matrix; Select two categories corresponding to the minimum first distance measurement, and create a single category by merging the two selected categories.

2. The learning method according to claim 1, characterized in that, The initialization step includes the following sub-steps: If the condition that the number of categories stored in the memory is strictly less than the predetermined number of categories is verified, then: For a set of initial data: Calculate the mean and covariance matrix for the set of initial data; If the condition that the covariance matrix of the set of initial data is poorly adjusted is verified, then: add the data set to the set of initial data and update the mean and covariance matrix of the set of initial data; Create categories associated with the mean and covariance matrix of the set of initialized data, and store the categories in the memory.

3. The learning method according to claim 1 or 2, characterized in that, The first distance measurement is the Bhattacharyya distance.

4. An anomaly detection method implemented on a microcontroller, the microcontroller including at least one memory, the microcontroller being configured to receive a multivariate data set from at least one sensor, the memory being configured to store a predetermined number of categories, the categories being associated with a mean and a covariance matrix, the method being characterized in that it includes the steps of the learning method according to any one of claims 1-3, followed by the following steps: For each received data set: The data set is stored in the memory; For each category stored in the memory, a second distance measurement between the data set and the category is calculated, and the smallest second distance measurement is selected; If the condition that the minimum second distance measurement value is greater than the distance threshold is verified, an anomaly is detected; Delete the data set from the memory.

5. The anomaly detection method according to claim 4, characterized in that, The second distance measurement is the Mahalanobis distance.

6. The anomaly detection method according to claim 4 or 5, characterized in that, The distance threshold is obtained from the chi-square distribution.

7. The anomaly detection method according to claim 4 or 5, characterized in that, The distance threshold is weighted by a sensitivity factor.

8. A computer configured to implement the steps of the learning method according to any one of claims 1 to 3 and / or the steps of the anomaly detection method according to any one of claims 4 to 7, characterized in that, The computer includes a processor and memory, and receives a multivariate data set from at least one sensor.

9. A microcontroller comprising the computer of claim 8.

10. A device embedded in a computer according to claim 8.

11. A computer program product comprising instructions which, when executed by a computer, direct the computer to perform steps of the learning method according to any one of claims 1 to 3 and / or steps of the anomaly detection method according to any one of claims 4 to 7.

Images