Method of generating anomaly detection model and method of detecting anomalies using such model

Abstract

Embodiments of the present disclosure relate to a method of generating an anomaly detection model and a method of detecting anomalies using such a model. According to an aspect, a computer-implemented method may be used to generate an anomaly detection model. The method includes obtaining a learning data stream from a physical system, incrementally calculating a major component of the learning data stream, performing orthogonal normalization on the calculated major component to obtain an orthogonal basis representing the learning data stream, and generating an anomaly detection model including the orthogonal basis and a detection threshold defined by a user. The anomaly detection model may then be applied to the physical system.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to French application No. 2306122, filed on June 15, 2023, which is incorporated herein by reference. Technical Field

[0003] The subject matter disclosed herein relates to methods of generating anomaly detection models and methods of using such models to detect anomalies. Background Art

[0004] Anomaly detection (or "outlier detection") in physical systems is a technique used to identify data that differs significantly from data representing the normal behavior of the physical system. Such data are often referred to as "anomalies" or "outliers."

[0005] Anomaly detection is of interest in many applications. Some applications use microcontrollers deployed in the physical system to be monitored. Such microcontrollers are then configured to implement anomaly detection.

[0006] Anomaly detection implemented by a microcontroller enables real-time monitoring using data acquired by at least one sensor in the system to detect abnormal behavior in a physical system. This technology can be used in a variety of fields such as automotive, aerospace, energy, manufacturing, health monitoring, etc.

[0007] In the context of anomaly detection, a microcontroller typically analyzes data collected by at least one sensor in the system using a model that represents the normal behavior of the system.

[0008] In particular, the model is used to compare current data collected by the sensor(s) with data of normal behavior. If the current data differs too much from the expected data, this may indicate that there is an anomaly or fault in the system. In this case, an alarm may be triggered to warn the operator of the system.

[0009] The anomaly detection thus achieved makes it possible to warn of malfunctions and failures of the system. This makes it possible to improve the reliability and safety of the system.

[0010] Models for detecting anomalies can be obtained using machine learning algorithms.

[0011] In particular, the machine learning algorithm is configured to generate a model for anomaly detection using learning data representing the normal behavior of the system. The anomaly detection model is generated to define the limits of the normal behavior of the system. The anomaly detection model can then be used by a microcontroller deployed in the physical system to be monitored.

[0012] In some applications, it may be difficult to obtain learning data before deploying the solution in the system to be monitored. It is then preferred that the learning is actually implemented within the physical system to be monitored, i.e., the anomaly detection model is generated. For example, the learning of the anomaly detection model is then implemented by a microcontroller deployed in the system to be monitored. Once the anomaly detection model is generated, the microcontroller is configured to use the anomaly detection model.

[0013] In this case, the learning is performed by the microcontroller at a user-defined period based on learning data acquired by at least one sensor.

[0014] In order to generate anomaly detection models from a data stream using a memory having limited capacity, the anomaly detection model can be generated incrementally. In other words, the anomaly detection model is generated as the learning data stream is acquired. Once these learning data are used to generate the anomaly detection model, an imprint of each learning data item is stored in the memory. The imprint may correspond to information extracted from the acquired learning data, or may correspond to the learning data itself.

[0015] There are multiple solutions for generating anomaly detection models that can achieve incremental anomaly detection.

[0016] For example, a Gaussian mixture model or a Z-score or standard score based approach may be used to generate such anomaly detection models.

[0017] However, these methods are not efficient enough in some applications. In addition, they may take up a lot of memory space and need to perform complex calculations. Summary of the invention

[0018] Embodiments may provide a solution for obtaining a model for anomaly detection that is easily implemented by a microcontroller.

[0019] According to one aspect, a computer-implemented method for generating an anomaly detection model is provided. The method includes obtaining a learning data stream, incrementally calculating the principal components of the learning data stream, performing orthogonal normalization on the calculated principal components to obtain an orthogonal basis representing the learning data stream, and generating an anomaly detection model including the orthogonal basis and a detection threshold defined by a user.

[0020] For example, the method for generating anomaly detection method corresponds to a learning phase for generating a detection model. The duration of the learning phase can be defined by the user.

[0021] This approach makes it possible to obtain an anomaly detection method suitable for implementing incremental anomaly detection. In particular, the detection model is suitable for classifying the data it receives as input as normal data or abnormal data. These data may be obtained from the physical system to be monitored. For example, the data may be data measured by an accelerometer in a rotating machine. The data may also correspond to the current consumed by the device, or to an audible signal associated with a given event.

[0022] The method makes it possible to simply define an orthogonal basis corresponding to the normal behavior of the physical system. The anomaly detection model comprises the orthogonal basis and the defined detection threshold. Therefore, the anomaly detection model is simple, occupies relatively little memory space, and can be implemented quickly. In this way, such a detection model can be generated and implemented by a microcontroller.

[0023] In an advantageous embodiment, computing principal components of the data stream increments comprises using a method for analyzing principal components of covariance-free increments.

[0024] This method makes it possible to obtain the main components of the learning data stream without calculating the covariance matrix of the data stream. Therefore, this method can reduce the memory usage of obtaining the main components of the learning data stream and has a faster implementation speed.

[0025] Preferably, orthogonal normalization of the basis comprises using a modified Gram-Schmidt algorithm using the principal components of the learning data stream.

[0026] Advantageously, the method further comprises producing a computer program product for detecting anomalies, the computer program product comprising instructions which, when executed by a computer, cause the computer to implement the detection model.

[0027] In an advantageous embodiment, the detection threshold is higher than or equal to 70%, for example of the order of 90%.The detection threshold represents the percentage of energy captured by the calculated basis.

[0028] According to another aspect, a computer-implemented method for anomaly detection includes: obtaining a data stream to be monitored, projecting the data vector to be monitored onto an orthogonal basis representing a learning data stream supplied by an anomaly detection model, calculating the energy of the data projected onto the orthogonal basis and calculating the energy of the data to be monitored, calculating the energy ratio between the calculated energy of the data to be monitored and the calculated energy of the data projected onto the orthogonal basis, comparing the calculated ratio with a detection threshold supplied by the anomaly detection model, and evaluating the data to be monitored as normal data or abnormal data based on the comparison result.

[0029] For example, the anomaly detection method corresponds to an inference phase using the generated detection model.

[0030] The advantage of this anomaly detection method is that the detection model used is simple and occupies little memory space. The anomaly detection method also has the advantage of requiring very few computing resources. Therefore, the anomaly detection method can be implemented quickly. Therefore, this anomaly detection method can be implemented by a microcontroller.

[0031] Preferably, when the ratio is higher than or equal to a detection threshold, the data is evaluated as normal, and when the ratio is lower than the detection threshold, the data is evaluated as abnormal.

[0032] Advantageously, the method further comprises, if the data to be monitored are assessed to be abnormal, generating an alarm signal in order to notify that an abnormality has been detected.

[0033] According to another aspect, a computer-implemented method comprises using a method for producing an anomaly detection method as described above, and then using an anomaly detection method as described above.

[0034] Thus, the method for generating anomaly detection models (learning phase) is followed by the detection method (inference phase). These two methods are then implemented consecutively, for example, by a microcontroller deployed in the physical system to be monitored.

[0035] According to another aspect, a computer program product for generating an anomaly detection model is provided. The computer program product comprises instructions. When the program is executed by a computer, the instructions cause the computer to implement the method for generating an anomaly detection model as described above.

[0036] According to another aspect, a computer program product for detecting anomalies is provided. The computer program product comprises instructions. When the program is executed by a computer, the instructions cause the computer to implement the anomaly detection method as described above.

[0037] According to one aspect, the microcontroller comprises a memory and a processing unit, the memory comprising a computer program product for generating an anomaly detection model as described above, the processing unit being configured to execute the computer program product.

[0038] Advantageously, the memory further comprises a computer program product for detecting anomalies as described above, and the processing unit is further configured to execute the computer program product. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Other advantages and features of the invention will become apparent from a study of the detailed description of a by no means limiting embodiment and from the accompanying drawings, in which:

[0040] Figure 1 A microcontroller MCU configured to implement an anomaly detection method is illustrated;

[0041] Figure 2A method for anomaly detection implemented by a computer is illustrated;

[0042] Figure 3 A method for generating an anomaly detection model implemented by a computer is illustrated;

[0043] Figure 4 A computer-implemented method for detecting anomalies in a physical system to be monitored is illustrated; and

[0044] Figure 5 Illustrated is a system in which an anomaly detection model may be used. DETAILED DESCRIPTION

[0045] Figure 1 A microcontroller MCU configured to implement the anomaly detection method is illustrated.

[0046] The microcontroller MCU can be integrated in a system that needs to monitor operational anomalies. The microcontroller MCU can be configured to receive data acquired by a system acquisition device. These acquired data then represent the operation of the system. For example, the physical system can be a rotating machine. In this case, the data can be data measured by an accelerometer in the rotating machine.

[0047] The microcontroller MCU comprises a processing unit UT and a memory MEM.

[0048] The memory MEM comprises a computer program PRG1 comprising instructions which, when they are implemented by the processing unit UT of the microcontroller, cause the processing unit to implement a method for generating anomaly detection models as described below. The method makes it possible to obtain an anomaly detection model MDL from learning data. More specifically, the method makes it possible to generate a computer program PRG2 comprising instructions which, when they are executed by the processing unit UT of the microcontroller, cause the processing unit to perform an anomaly detection method as described below using the generated anomaly detection model MDL.

[0049] Once the computer program has been generated, the memory MEM comprises this computer program PRG2 using the generated anomaly detection model MDL.

[0050] The computer program PRG2 can be executed by the processing unit UT to enable detection of anomalies from the data to be monitored.

[0051] Figure 2 The method for anomaly detection implemented by a computer is illustrated. The method can be performed as follows Figure 1 The described microcontroller MCU is implemented.

[0052] The method comprises a method implementation 20 for generating an anomaly detection method, and then an implementation 21 of the anomaly detection method using the generated anomaly detection model. The method for generating an anomaly detection method is described below with respect to Figure 3 The anomaly detection method is described below. Figure 4 Give a description.

[0053] Figure 3 The method for generating anomaly detection model implemented by a computer is illustrated. The computer may be a microcontroller MCU.

[0054] This method is used to define a model that determines the limits of the normal behavior of a physical system. Therefore, the method for generating an anomaly detection model corresponds to a learning phase for generating the detection model. In particular, the learning phase makes it possible to adjust the parameters of the detection model as a data stream representing the behavior of the physical system to be monitored is acquired. The duration of this learning phase can be defined by the user. The duration of the learning phase makes it possible to define the amount of learning data to be used to generate the detection model.

[0055] The method comprises a step 30 of acquiring a learning data stream. In this step 30, the learning data stream is supplied to the microcontroller. In particular, the learning data is acquired by an acquisition device, such as a sensor.

[0056] The learning data is data representing the normal behavior of the system. Each learning data item is represented by a vector of values.

[0057] The method then comprises a step 31 of incremental calculation of the principal components of the data stream. In particular, the processing unit of the microcontroller implements a method for analyzing incremental principal components without covariance. Such analysis methods are well known to those skilled in the art. In particular, the analysis method corresponds to an incremental algorithm for approximating principal components using a data stream. The number of principal components is fixed in advance. The algorithm updates the principal components at each data acquisition. The update is performed on the basis of various projection operations.

[0058] The method is implemented incrementally, ie, learning data is used as it is acquired.

[0059] This analysis method makes it possible to obtain the set of vectors of the main components of the data flow.

[0060] The advantage of this analysis method is that it avoids the calculation of the covariance matrix. Therefore, compared with traditional covariance-based methods, this method can iteratively extract the main components of the data set and use fewer resources (computational operations and memory).

[0061] The method then comprises a step 32 of orthogonal normalization of the set of vectors of the principal components of the data stream. Orthogonal normalization corresponds to transforming the set of vectors into an orthogonal basis. In particular, the processing unit executes a modified Gram-Schmidt algorithm well known to those skilled in the art.

[0062] In particular, for a vector set of principal components consisting of vectors xj,j ranging from 1 to n, where n corresponds to the number of vectors xj, the algorithm includes the initialization of vectors vj,j ranging from 1 to n. Each vector vj is initialized to the value of vector xj. Next, the algorithm includes a loop for calculating orthogonal vectors qj,j ranging from 1 to n. The loop for calculating orthogonal vectors qj includes the calculation of vector qj. The calculation of vector qj corresponds to the normalization of vector vj. Therefore, vector qj is equal to vector vj divided by its Euclidean norm qj=vj / ||vj||2. Next, the loop for calculating vector qj includes a loop for updating vector vk, where k is an index ranging from j+1 to n. The loop for updating vector vk includes calculating vector vk by the following formula:

[0063]

[0064] The orthogonal normalization step 32 makes it possible to obtain an orthogonal basis of the vector qj, which corresponds to the orthogonalized set of the initial vector xj. This orthogonal basis is used to correct any orthogonality error caused by the approximation of the calculated principal components. The orthogonal basis is also used to calculate the energy of the data carried by the basis.

[0065] The method comprises the generation 33 of an anomaly detection model comprising an orthogonal basis and a detection threshold defined by a user. The detection threshold may be higher than or equal to 70%, for example of the order of 90%.

[0066] Advantageously, the method further comprises the generation 34 of a computer program product comprising instructions which, when executed by a computer, cause the computer to implement the detection model.

[0067] This method makes it possible to obtain an anomaly detection model suitable for implementing incremental anomaly detection. In particular, the detection model is suitable for classifying the data it receives as input as normal data or anomaly data.

[0068] The method makes it possible to simply define a standard orthogonal basis corresponding to the normal behavior of the physical system. The anomaly detection model comprises the orthogonal basis and the defined detection threshold. Therefore, the anomaly detection model is simple, occupies relatively little memory space, and can be implemented quickly. In this way, such a detection model can be generated and implemented by a microcontroller.

[0069] Figure 4The invention illustrates a method for detecting anomalies in a physical system to be monitored by a computer.

[0070] The method comprises a step 40 of acquiring a data stream to be monitored. In this step 40, the data stream to be monitored is supplied to the microcontroller. In particular, the data to be monitored is acquired by an acquisition device arranged in the physical system to be monitored. Each data item is represented by a vector of values.

[0071] Then, the method comprises a vector projection step 41. In this step 41, the processing unit projects the data to be monitored onto an orthogonal basis. The vector projection corresponds to the scalar product between the data to be monitored and each vector of the orthogonal basis.

[0072] Then, the method comprises an energy calculation step 42. In this step 42, the processing unit calculates the energy of the data projected onto the orthogonal basis. The processing unit also calculates the energy of the data to be monitored. The energy of the vector corresponds to the sum of the squares of all elements of the sector.

[0073] Then, the method comprises an energy ratio calculation step 43. In this step 43, the processing unit calculates the ratio between the energy of the data to be monitored and the energy of the data projected onto an orthogonal basis.

[0074] The method then comprises a comparison step 44. In this step, the processing unit compares the calculated ratio with a detection threshold supplied by the detection model. This comparison makes it possible to determine whether the data to be monitored corresponds to normal data (such as the data used to train the detection model) or to data corresponding to abnormal data.

[0075] In particular, the method comprises an evaluation step 45. In this step, the processing unit evaluates the data to be monitored as a function of the comparison result.

[0076] More specifically, if the calculated ratio is higher than or equal to the detection threshold, the processing unit evaluates the data to be monitored as normal data.

[0077] If the calculated ratio is lower than the detection threshold, the processing unit evaluates the data to be monitored as abnormal data.

[0078] If the processing unit evaluates the data to be monitored as abnormal data, the method may include an alarm step. In this step, the processing unit generates an alarm signal to notify that an abnormality has been detected.

[0079] The advantage of this anomaly detection method is that it uses a simple detection model that occupies little memory space. The anomaly detection method also has the advantage of requiring very few computing resources. Therefore, the anomaly detection method can be implemented quickly. Therefore, this anomaly detection method can be implemented by a microcontroller deployed in the physical system to be monitored.

[0080] Figure 5 A system in which the methods disclosed herein may be used is illustrated. Figure 5 The system includes a microcontroller 50, such as Figure 1 The microcontroller 50 can be used to perform anomaly detection to monitor the physical system 52 in real time using data acquired by at least one sensor 51. Anomaly detection can be used to compare current data collected by (multiple) sensors 51 with data of normal behavior. If the current data differs too much from the expected data, it may indicate that there is an anomaly or fault in the system. In this case, an alarm 53 can be triggered to alert the operator of the system, so that the fault and failure of the system can be warned.

[0081] This technology can be used in a variety of fields, such as automotive, aerospace, energy, manufacturing, health monitoring, etc. For example, the data can be measured by an accelerometer in a rotating machine. The data can also correspond to the current consumed by the device, or to an audible signal associated with a given event.

Claims

1. A computer-implemented method for generating an anomaly detection model, the method comprising: Acquire learning data streams from physical systems; Incrementally computing principal components of the learning data stream; orthogonal normalization is performed on the calculated principal components so as to obtain an orthogonal basis representing the learning data stream; and The anomaly detection model is generated including the orthogonal basis and a detection threshold defined by a user.

2. The method according to claim 1, wherein obtaining the learning data stream comprises: Sensors are used to monitor the physical system.

3. The method of claim 1 , wherein the incremental calculation of the principal component of the data stream comprises: A method for analyzing principal components with no covariance increments was used.

4. The method of claim 1, wherein the orthogonal normalization comprises using a modified Gram-Schmidt algorithm that uses the principal components of the learning data stream.

5. The method according to claim 1, further comprising: A computer program product for detecting anomalies is generated, the computer program product comprising instructions which, when executed by a computer, cause the computer to implement the anomaly detection model.

6. The method according to claim 5, further comprising: The computer program is executed to perform real-time anomaly detection of real-world physical systems. The method of claim 1 , wherein the detection threshold is greater than or equal to 70%.

8. A non-transitory computer-readable storage medium storing a computer program product for implementing the method according to claim 1.

9. A computer-implemented method for detecting anomalies, the method comprising: Obtaining data streams to be monitored from sensors that monitor physical systems; performing a vector projection of the data to be monitored onto an orthogonal basis representing a learning data stream supplied by an anomaly detection model; calculating the energy of the data projected onto the orthogonal basis; Calculating the energy of the data to be monitored; calculating an energy ratio between a computational energy of the data to be monitored and a computational energy of the data projected onto the orthogonal basis; comparing the calculated ratio to a detection threshold supplied by the anomaly detection model; evaluating the data to be monitored as normal data or abnormal data according to the comparison result; as well as In response to evaluating the data as anomalous data, a notification is generated indicating an anomaly within the physical system.

10. The method of claim 9, wherein the sensor comprises an accelerometer and the physical system comprises a rotating machine.

11. The method of claim 9, wherein the physical system comprises an electrical device and the data to be monitored provides information related to electrical current consumed by the device.

12. The method of claim 9, wherein evaluating the data comprises: When the ratio is greater than or equal to the detection threshold, the data is evaluated as normal, and When the ratio is below the detection threshold, the data is evaluated as abnormal.

13. The method of claim 9, wherein evaluating the data comprises: The data is further evaluated as abnormal, and the method further includes: generating an alarm signal to notify that the abnormality is detected.

14. The method according to claim 9, further comprising: The anomaly detection model is generated.

15. The method of claim 14, wherein generating the anomaly detection model comprises: Acquiring the learning data stream; Incrementally computing principal components of the learning data stream; orthogonal normalization is performed on the calculated principal components so as to obtain an orthogonal basis representing the learning data stream; and The anomaly detection model is generated including the orthogonal basis and the detection threshold defined by a user.

16. A non-transitory computer-readable storage medium storing a computer program product for implementing the method according to claim 9.

17. A microcontroller comprising: Processing unit; as well as a non-transitory memory coupled to the processing unit and storing a computer program, the computer program comprising instructions that, when executed by the processing unit, cause the processing unit to: Get the data stream to be monitored; performing a vector projection of the data to be monitored onto an orthogonal basis representing a learning data stream supplied by an anomaly detection model; calculating the energy of the data projected onto the orthogonal basis; Calculating the energy of the data to be monitored; calculating an energy ratio between a computational energy of the data to be monitored and a computational energy of the data projected onto the orthogonal basis; performing a comparison of the calculated ratio with a detection threshold supplied by the anomaly detection model; as well as The data to be monitored is evaluated as normal data or abnormal data according to the comparison result.

18. A system, comprising: The microcontroller according to claim 17; Physical systems; as well as A sensor is coupled to the physical system and the microcontroller.

19. The system of claim 18, further comprising an alarm coupled to the microcontroller.

20. The system of claim 18, wherein the sensor comprises an accelerometer and the physical system comprises a rotating machine.

21. The system of claim 18, wherein the physical system comprises an electrical device and the sensor comprises a current sensor.

Images