Method for detecting anomalies in observed time series of values of physical quantity representative of system performance

Abstract

The invention relates to a method for detecting anomalies in an observed time series of values of a physical quantity representative of the performance of a system (2), characterized in that it involves implementing, via a data processing device (11) of a server (1), the following steps: (A) determining a residual error corresponding to the observed time series; wherein a predictable portion of the observed time series is removed from the observed time series; (B) segmenting the residual into a plurality of consecutive segments, thereby minimizing a score representing inhomogeneity within the segments; (C) for at least the nearest segment, statistically analyzing the distribution of the values of the residuals in the segment in order to draw a conclusion whether there is an anomaly in the segment.

Description

Technical Field

[0001] The present invention relates to the field of monitoring, in particular computer data, and more particularly to a method for detecting anomalies in observed time series values of a physical quantity representing the performance of a system. Background Art

[0002] Surveillance is the activity of monitoring and measuring computer activities for the purpose of oversight.

[0003] In particular, we may attempt to observe the performance of a computer system, for example in terms of its response time, its availability, its integrity, etc.

[0004] Generally speaking, the values of various physical quantities (called “metrics”) are measured over time, and we try to identify or even predict anomalies from these values so that we can issue alerts and corrective mechanisms before an event occurs. The term “time series” refers to a continuous set of values of a metric and the corresponding curve.

[0005] For example, Figure 1 This is a time series showing CPU usage of a computer system (over a weekly period). Each circle has a significant anomaly. For example, on July 19th, we noticed a cascading anomaly that caused CPU usage to briefly drop to 0% for several hours, leading to a service outage. We also see other modest variations in usage that may or may not be related to the anomaly.

[0006] Pure monitoring solutions consisting of setting thresholds and detecting when they are crossed are insufficient in practice: every system is different and has its own behavior.

[0007] Even assuming that we define individual thresholds, the behavior of a metric can evolve over time without us having anomalies, whereas we might have anomalies when it comes to metrics being maintained.

[0008] exist Figure 1 In the example above, we could set a threshold of 80% CPU usage (below which we consider ourselves to be in an anomaly situation), which proved relevant in most cases. However, during the initial set of anomalies at dawn on July 19 (which would lead to a cascade of other anomalies and a complete outage of the service), CPU usage was close to 95%, thus well above the detection threshold.

[0009] Therefore, solutions based on dynamically determining confidence intervals have been proposed.

[0010] In particular, application EP3672153 proposes determining the “residuals” corresponding to what remains of the metric once the predictable component (corresponding to normal behaviour) has been removed, and calculating confidence intervals (with thresholds) for these residuals.

[0011] This approach is satisfactory, but it is desirable to further improve its accuracy and thereby reduce the number of false positives / false negatives. Summary of the Invention

[0012] Thus, according to a first aspect, the present invention relates to a method for detecting anomalies in an observed time series of values of a physical quantity representative of system performance, the method being characterized in that it involves the following steps being carried out by data processing means of a server:

[0013] (a) determining a residual corresponding to the observation time series, wherein a predictable portion of the observation time series has been removed from the observation time series;

[0014] (b) split the residual into multiple continuous segments so as to minimize the score representing the heterogeneity within the segment;

[0015] (c) For at least the most recent segment, statistically analyzing the distribution of the values of the residuals in the segment in order to draw a conclusion on whether an anomaly exists in the segment.

[0016] According to the advantageous and non-limiting features:

[0017] Step (a) comprises determining the predictable portion from the observed time series; and subtracting the predictable portion from the time series to obtain the residual.

[0018] Determining the predictable portion includes subjecting the observed time series to a prediction model trained on a reference time series of the same physical quantity representing the performance of the system.

[0019] The method comprises a step (a0) of acquiring, by the system or by a device for monitoring the system, said observation time series of values of a physical quantity representative of the performance of the system.

[0020] Step (b) comprises proposing a plurality of candidate segmentations, in particular each candidate segmentation defining a plurality of different segments, and selecting the candidate segmentation having said lowest score representing intra-segment heterogeneity.

[0021] Step (c) comprises constructing a possible statistical model of the values of the residuals in the segment and determining, for at least the most recent segment, a p-value of the statistical model of the distribution of the values of the residuals in the segment.

[0022] If the p-value is below a threshold, an abnormality is concluded at step (c).

[0023] The threshold value is predetermined, in particular 5%.

[0024] The threshold is calculated in particular for a desired false positive rate by using the Benjamini Hochberg method.

[0025] The expected false positive rate over the segment for which the p-value is determined is calculated based on the expected false positive rate over the entire time series.

[0026] A first threshold calculated for the expected false positive rate over the entire time series and a second threshold calculated for the expected false positive rate over the segment are applied consecutively.

[0027] Step (c) comprises constructing a plurality of possible statistical models of the residual values in the segments and selecting the best model of the plurality of models for which the p-value is determined for at least the most recent segment, the best model being the one that best describes the tail of the distribution of the values of the residuals in the most recent segment.

[0028] The method includes the step (d) of performing an action if an anomaly is detected on at least one segment.

[0029] Step (d) includes triggering an alarm and / or requesting equipment for diagnosing and maintaining the system.

[0030] According to a second aspect, the present invention relates to a server for detecting anomalies in an observation time series of values of a physical quantity representing performance of a system, characterized in that it comprises data processing means configured to:

[0031] - determining a residual corresponding to the observation time series, wherein a predictable portion of the observation time series has been removed from the observation time series;

[0032] - Split the residual into multiple consecutive segments so as to minimize the score representing the heterogeneity within the segment;

[0033] - For at least the most recent segment, a statistical analysis is performed on the distribution of the residual values in said segment in order to conclude whether an anomaly exists on this segment.

[0034] According to a third aspect, the invention relates to an assembly consisting of a server according to the second aspect, a system and equipment for diagnosing and maintaining the system.

[0035] According to the fourth and fifth aspects, the present invention relates to a computer program product comprising code instructions for executing the method according to the first aspect, which is used to detect anomalies in an observation time series of values of a physical quantity representing system performance; and a storage device readable by a computer equipment, on which a computer program product is recorded, which comprises code instructions for executing the method according to the first aspect for detecting anomalies in an observation time series of values of a physical quantity representing system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Other features and advantages of the present invention will become apparent upon reading the following description of preferred embodiments. This description will be given with reference to the accompanying drawings, in which:

[0037] [ Figure 1 ]Previously described Figure 1 An example of a time series with significant anomalies.

[0038] [ Figure 2 ] Figure 2 is a schematic diagram of a system for implementing the method according to the present invention;

[0039] [ Figure 3 ] Figure 3 is a flow chart showing the steps of a preferred embodiment of the present invention;

[0040] [ Figure 4 ] Figure 4 shows the determination of residuals from an example of an observed time series;

[0041] [ Figure 5 ] Figure 5 represents the case where a reference segment is constructed based on the current segment being analyzed and a recently analyzed segment that is very similar in terms of mean and variance;

[0042] [ Figure 6 ] Figure 6 Shown Figure 4 Segmentation of the residuals of the example in ;

[0043] [ Figure 7 ] Figure 7 represents the case where a reference segment is constructed based on the current segment being analyzed and a recently analyzed segment that is very similar in terms of mean and variance;

[0044] [ Figure 8 ] Figure 8 express Figure 7 Example of probability density on a segment of .

[0045] [ Figure 9 ] Figure 9 Shows the Figure 4 、 6 and 7 for the results of the statistical analysis performed on the current segment of the example. Figure 9 The current segment in corresponds to Figure 7 , which provides more data that allows for robust anomaly detection.

[0046] [ Figure 10 ] Figure 10 Corresponding to Figure 9 , using a threshold calculated for the desired false positive rate.

[0047] [ Figure 11 ] Figure 11 is a graph showing the best control of false positive rate. DETAILED DESCRIPTION

[0048] Architecture

[0049] The present invention relates to a method for detecting anomalies in an observation time series of values of a physical quantity representing the performance of a system 2 .

[0050] System 2 is typically a computer server providing a service, such as network equipment, a bank server performing transactions, industrial control equipment, etc. Assume that we have a physical quantity representing the performance of said system 2 .

[0051] The physical quantity is naturally selected according to the nature of the system 2 and the services it provides. For example, for network equipment, we can calculate the CPU usage (described above). Figure 1 For example, it can also calculate memory usage, bandwidth, number of connected users, number of packets passed, etc. For a bank server, this quantity can be the number of completed transactions, the rate of rejected transactions, etc. For industrial control equipment, it can be quantities involved in the industrial process, such as temperature, pressure, etc.

[0052] We will not be limited to one type of system or physical quantity, what is important is that the physical quantity represents the performance of the system 2 , ie makes sense to a person skilled in the art regarding the service provided by the system 2 .

[0053] A time series of values of a physical quantity is understood to represent a sequence of values that change over time, with each value corresponding to an observation of System 2, e.g., one value per minute. This time series can be considered a vector of values. Here, we refer to the "observed" time series as the sequence of values currently being examined, in contrast to the "reference" time series, which corresponds to a specific past example that forms the basis for learning.

[0054] The observation time series may be directly acquired by the system 2 or acquired by the device 20 for monitoring the system 2 .

[0055] The method described is a method for detecting anomalies in time series, i.e. it aims to determine whether a value is normal or not. More precisely, although, as mentioned previously, normal variations in values are expected, some values may in practice be abnormal and constitute a weak signal that a system degradation is ongoing or imminent, and by this we mean an event when the system 2 is no longer able to perform its service. Figure 1 In the example above, the network equipment, which has crashed due to CPU usage, can no longer properly manage network traffic, and users will quickly experience slowdowns or even disconnections. In this case, the incident is the consequence of an abnormal event.

[0056] The concept of anomaly itself is statistical, the causes may be diverse, and the purpose of the present method is not to determine these causes per se, but simply to raise an alarm as quickly as possible and initiate corrective actions to avoid or at least limit the event (diagnosis, troubleshooting, starting backup systems, etc.), as well as to identify and evaluate the type of anomaly based on the selection of filters and appropriate criteria.

[0057] With current detection methods, we try to avoid both false negatives (situations where an anomaly is not detected) and false positives (situations where we think we have detected an anomaly but in fact there is nothing).

[0058] refer to Figure 2 The method is implemented by a server 1 comprising data processing means 11 (typically a processor) and general data storage means 12 (memory). The server 1 is also provided with an interface 13 for reporting detected anomalies, which may be an HMI, but also means for connecting to other diagnostic and maintenance equipment 3 and / or a terminal 4 (e.g. an administrator).

[0059] The connection between the different equipment (servers 1 , 3 , system 2 , device 20 and / or terminal 4 ) may be via a communication network 10 , such as the Internet.

[0060] method

[0061] refer to Figure 3 The method typically begins with a step (a0) of obtaining, for example, by means 20, an observation time series of values of a physical quantity representative of the performance of system 2. Typically, the performance of system 2 is observed at regular intervals, with a new value being obtained at each observation to complete the series. It will be appreciated that system monitoring is well known to those skilled in the art. In network applications, this is typically on the order of one observation per second.

[0062] The sequence can be provided to the server 1 all at once, or it can be provided in tail form value by value (especially in real time) and reconstructed. The method can also be implemented for each new value obtained. From this point of view, it can be understood that the method can be well implemented:

[0063] - independently across the entire time series, we attempt to detect a posteriori whether the series contains anomalies, or

[0064] - in an iterative manner, specifically in real time, we then try to proactively detect for each new observation whether there is an anomaly (we try to detect as early as possible, or even predict events).

[0065] In all cases, the time series are advantageously timestamped, ie associated with an initial timestamp (for the first value) and / or a final timestamp (for the last value) corresponding to the observation time.

[0066] In step (a), which is the first step in processing the observed time series implemented by the data processing device 11 of the server 1, the "residual" of the observed time series is determined. The residual corresponds to the observed time series from which the predictable part (i.e., the prediction error) has been removed. The residual and the predictable part are themselves time series values.

[0067] In this regard, step (a) preferably comprises:

[0068] - determining said predictable portion from the observed time series, and

[0069] - Subtracting the predictable part from the observed time series, ie for each value of the time series we subtract the corresponding value of the predictable part.

[0070] Figure 4 Specifically shown is step (a): from left to right we see the time series, the predictable part and the obtained residuals.

[0071] The idea is to consider the observed time series as the sum of "normal" and "abnormal" behavior of a physical quantity. Normal behavior is expected and therefore predictable, while abnormal behavior is different and is random.

[0072] In this regard, we know that artificial intelligence models, especially artificial neural networks such as N-beats, are capable of predicting time series.

[0073] Therefore, in a preferred embodiment, the server 1 has a prediction model which takes as input an observation time series and generates as output said predictable part of the observation time series.

[0074] The prediction model can be trained in an unsupervised manner on a learning basis of reference time series of the same physical quantity representing the performance of the system 2 (i.e., no labels are associated with these reference series), advantageously corresponding to past observations under comparable conditions. In fact, the physical quantity in question naturally varies, for example, throughout the day, and this "normal" trend can be explained by the prediction model.

[0075] For this purpose, the server 1 can store the learning basis on its data storage device 12 and the data processing device 11 can carry out the learning of the prediction model, even if this is entirely possible by a separate server and the learning model is directly obtained by the server 1 .

[0076] It should be understood that such models and their learning are well known to those skilled in the art; the N-Beats model cited above may be used, or other recurrent networks (such as LSTM) adapted for predicting time series, for example. Reference may also be made to the aforementioned application EP3672153.

[0077] Initially, in step (b), the data processing means 11 implement a segmentation of the residuals into a number of consecutive segments, minimizing a fraction representing the intra-segment heterogeneity. Inhomogeneity or heterogeneity here refers to the variability of the law that produces the observed values, and in practice refers to the variability of the residual values, for example converted by changes in the variance. A perfectly uniform segment will exhibit constant residuals throughout its range. In contrast, a very heterogeneous segment will have residual values of very large magnitude. Note that only intra-segment heterogeneity is considered here (i.e. within a segment), and possible inter-segment heterogeneity (i.e. one segment compared to another segment) is not considered. For example, Figure 5 Representing the values of the time series, we notice that there is a variation in the variance that defines the central segment.

[0078] Segmentation refers to dividing the residual into n consecutive segments. It will be understood that, in the same way as the values of physical quantities, the segments are temporally ordered, so that the "last" segment is the most recent.

[0079] Segmentation aims to more precisely determine the N-1 breakpoints that constitute the most abrupt points of change (heterogeneity), and where the boundaries between segments lie.

[0080] The idea is that we can obtain segments that are homogeneous to each other, on which we can perform valid statistical analysis.

[0081] In fact, known techniques implement global or sliding window statistical analysis, and we note that working piecewise allows a more precise adaptation to changes in mean and variance.

[0082] For example, if we Figure 1 For example, the anomaly on the morning of July 19th was definitely close to 95% CPU usage, but we already had a drop, and the variance was too abrupt compared to normal behavior (close to sinusoidal - while the drop before the total event was almost linear). This segmentation will bring up the specific segment corresponding to the morning of July 19th.

[0083] To implement step (b) in practice, any known breakpoint detector can be used, including breakpoint detectors used in the context of genetic analysis (e.g., analysis of copy number variations in DNA). For example, the so-called "KernSeg" method is described by A. Celisse, G. Marot, M. Pierre-Jean, GJ Rigaill in the document "New efficient algorithms for multiple change-point detection with reproducing kernels".

[0084] Preferably, the processing means 11 proposes a plurality of candidate segments, preferably at least one candidate segment for each value of the number of segments n, and then calculates the value of said score representing the intra-segment heterogeneity for each segment. The candidate segment is then selected that presents said score representing the lowest intra-segment heterogeneity, i.e. the segment that minimizes the score among all candidate segments.

[0085] Regarding the scores, we could specifically take a score for each segment (e.g., the deviation from the segment's mean, but we could use any cost function that tends to 0 when the segment tends to a constant value) and sum the scores of the segments. However, we prefer a score based on a reproduction kernel, allowing detection of all types of breakpoints, not just mean breaks (e.g., variance changes).

[0086] Figure 6 Represent accordingly Figure 4 The residuals of the candidate segments obtained for n = 2, 3 and 4, and the corresponding inhomogeneity scores. We see that the score is smallest for n = 3 because at n = 2 the second segment is too inhomogeneous, and at n = 4+ we have too many segments.

[0087] It should be noted that in real-time operation, we usually already know the previously completed segments (due to the iterative implementation of the method), and we have a "current" (latest) segment. For each new observation, breakpoint detection determines whether to continue the current segment, or, on the contrary, whether a new segment has begun (the algorithm can retroactively split the current segment by placing a posteriori breakpoints multiple observations before).

[0088] Preferably, at the end of step (b), it is verified that the size of each segment (particularly the current segment) is greater than a predetermined significance score. In this regard, segments that are too short may not include enough values to allow relevant statistical analysis, which typically occurs in real-time operation at the beginning of a new segment.

[0089] If this is the case, we can add values from similar previous segments to the segment that was too short for the next step. Of course, we can stop using these previous values as soon as the current segment is long enough due to new observations.

[0090] For example, in Figure 7 In the case of , the segmentation obtained again consists of three segments, but the last one is too short: we only have 12 seconds of observation. If the significance threshold is, for example, 30 seconds, it is necessary to add the third segment to the most similar previous segment, in this case the first one. This set of segments then serves as a reference for defining normality.

[0091] In step (c), for at least the current segment (and possibly for each segment if the entire sequence is processed a posteriori), the distribution of the residual values in the segment is statistically analyzed to conclude whether an anomaly is present. If the method is implemented in real time, step (c) only concerns the current segment (since it is assumed that the previous segments have been similarly analyzed), but alternatively, if the entire sequence is processed a posteriori, step (c) is implemented for each segment identified in step (b).

[0092] Traditionally, the residuals should be Gaussian, i.e., they should conform to the central normal law (around 0), and we check if the significant distribution is compatible with the law under the probability term. In more realistic situations, the obtained distribution is not always Gaussian, making it more difficult to perform statistical analysis of the residuals and detect anomalies using classical methods.

[0093] The statistical analysis therefore aims to determine whether the significant distribution can be "explained" by statistical fluctuations or, on the contrary, it is not and therefore we are in an anomalous situation. Any known method can be used, in particular the method cited in application EP3672153, but it is advantageous if at least one possible statistical model of the residual values in the segments is constructed.

[0094] We may have several candidate models corresponding to several possible distributions, and update these models incrementally as we receive observations.

[0095] Preferably, one or more models are evaluated based on their ability to describe the distal parts of the distribution (called the "tail"). It is more common to select a model based on its ability to accurately describe the entire distribution, but such a model is biased towards the center rather than the tail of the distribution. However, it is in the tail of the distribution that any anomalies we wish to capture are observed.

[0096] The model or "best model" (if there are several) is selected and used to determine the alert threshold on the residual values.

[0097] For example, we can use the "p-value", which refers to the probability that the chosen statistical model will obtain an error as large as the observed error (i.e., the residual value). Therefore, a low p-value corresponds to an abnormally high prediction error, and therefore we are in an abnormal situation. Traditionally, a p-value threshold of 5% is used.

[0098] Estimating the p-value typically involves kernel density estimation (KDE) applied to the tails of the distribution, which allows estimating the probability density of the residuals by smoothing more or less estimates and the Grimshaw procedure (Computing Maximum Likelihood Estimates for the Generalized Pareto Distribution, Scott D. Grimshaw).

[0099] Figure 8 represents the probability density segments estimated by KDE with corresponding p-value thresholds.

[0100] Visually, the corresponding value threshold can be plotted on the residuals: if the threshold is exceeded, an anomaly is observed, see Figure 9 However, it will be appreciated that the p-value may be simply determined and compared to the threshold without recalculating the threshold for the residual values.

[0101] As before, the threshold may be predetermined, eg 5%, but alternatively it may be possible to calculate the expected false positive rate over the segments considered (particularly the most recent segment) in order to be more appropriate to decide on the presence of an anomaly.

[0102] To do this, we can use the Benjamini-Hochberg method, which defines a threshold θ for the desired false positive rate α α , using the following formula:

[0103] in

[0104] P (k) : Analyze the kth minimum p-value in the sequence

[0105] m: the size of the analysis sequence

[0106] Those skilled in the art will be able to find alternative methods.

[0107] Preferably, we could even use a modified version of the Benjamini-Hochberg method:

[0108] - The expected false positive rate on the considered segment (called local rate) can be predetermined, but alternatively what can be predetermined is the expected false positive rate for the entire time series (called global rate). In fact, if we use a threshold θ α , then we can guarantee that the false positive rate on this segment will be lower than α, but this is not enough to guarantee the control of the false positive rate in the entire sequence, which is why we can set the second threshold θ calculated for the value α′ α′Applied to this segment, this value α′ corresponds to a small change in the global rate α so as to ensure the expected false positive rate over the entire time series (i.e., the expected false positive rate over the segment for which the p-value is determined is calculated as a function of the expected false positive rate over the entire time series), as Figure 10 As shown, in order to control the false positive rate of the entire time series analyzed by controlling the false positive rate of its subsequences. In particular, we can calculate the first threshold θ of the required ratio α over the entire time series by α and apply it to the considered segment (using the standard Benjamini-Hochberg method), calculate the proportion of anomalies Π1, and apply the formula where m′ is the size of the local subsequence (i.e. the number of values of the physical quantity in the segment). The second threshold θ for this segment is then calculated by applying the Benjamini-Hochberg method again but taking the ratio α′ α '.

[0109] In summary, in a preferred embodiment:

[0110] ● Calculate a first threshold θ for the expected false positive rate α (predetermined) over the entire time series α , and the first threshold θ α Applied to the segment under consideration;

[0111] Calculate the expected false positive rate α′ on the considered segment as a function of the expected false positive rate α on the entire time series (and the first threshold θ α Results applied to this segment):

[0112] • Calculate a second threshold θ for the desired false positive rate α′ on the considered segment α′ , and the second threshold θ α′ Applies to the segment under consideration.

[0113] - The reference size can be modified to ensure that errors in the estimation of the p-value do not prevent local and global control of the false positive rate. In fact, the number of points in the reference set must be chosen impartially to optimally control false positives. Figure 11 Shows the reference size of the control for the following selections It is particularly ideal where the index l is a hyperparameter chosen by the user. It is a positive integer (usually 1 or 2) that controls the size of the reference set. Choosing a larger reference set can reduce the number of false negatives but increases computation time.

[0114] In all cases, the method advantageously comprises a step (d) of implementing an action if an anomaly is detected on at least one segment:

[0115] - At least one alarm is to be triggered on the server 1 or on the interface 13 of the connection terminal 4

[0116] - Preferably, requesting possible equipment 3 for diagnosing and maintaining the system 2 , ie sending a request thereto so that the latter carries out tests to determine the nature of the anomaly and even resolve it, if possible even before an event occurs.

[0117] result

[0118] The present method has been tested for proactive detection of anomalies on a network equipment type system 2, such as a Denial of Service (DDoS) attack.

[0119] We notice that Server 1 manages to detect the anomaly 15 minutes earlier than using known methods with predefined thresholds.

[0120] Servers, Systems

[0121] According to a second aspect, the invention relates to a server 1 for implementing the method according to the invention.

[0122] The server for detecting anomalies in the observation time series of values of physical quantities representing the performance of system 2 includes a data processing device 11 and a general data storage device 12, such as a database for storing the observation time series of values of the physical quantities representing the performance of system 2, and an interface 15.

[0123] The device 11 is configured to:

[0124] - determining a residual corresponding to the observation time series, wherein a predictable portion of the observation time series has been removed from the observation time series;

[0125] – Split the residual into multiple continuous segments, minimizing the score representing the inhomogeneity within the segment:

[0126] - performing, for at least the most recent segment, a statistical analysis of the distribution of the residual values in said segment in order to conclude whether an anomaly exists on this segment.

[0127] Advantageously, if an anomaly is detected on at least one segment, an action is performed.

[0128] According to a third aspect, a set of servers 1 and a system 2 is proposed. The set may include means 20 for monitoring the system 2, equipment 3 for diagnosing and maintaining the system 2 and / or terminals 4. All these elements 1, 2, 20, 3, 4 may be connected via a network 10.

[0129] Computer program product

[0130] According to a fourth and fifth aspect, the present invention relates to a computer program product comprising code instructions for executing (in particular on a data processing device 11) a method according to the first aspect of the invention for detecting anomalies in an observed time series of values of a physical quantity representing system performance, and a storage device readable by the computer equipment in which the computer program product is located (memory 12 of server 1).

Claims

1. A method for detecting anomalies in an observed time series of values of a physical quantity representing the performance of a system (2), said method being characterized in that it comprises the following steps carried out by a data processing device (11) of a server (1): (a) determining a residual corresponding to the observation time series, wherein a predictable portion of the observation time series has been removed from the observation time series; (b) segmenting the residual into a plurality of consecutive segments so as to minimize a score representing intra-segment heterogeneity; (c) performing a statistical analysis on the distribution of the values of the residuals in at least the most recent segment in order to conclude whether an anomaly exists in the segment.

2. The method of claim 1 , wherein step (a) comprises determining the predictable portion from the observed time series; and subtracting the predictable portion from the time series to obtain the residual.

3. The method according to claim 2, wherein determining the predictable portion comprises implementing a prediction model trained on a reference time series of the same physical quantity representing the performance of the system (2) on the observation time series.

4. The method according to any one of claims 1 to 3, comprising a step (a0) of acquiring, by the system (2) or by a device (20) for monitoring the system (2), the observation time series of values of the physical quantity representing the performance of the system (2).

5. The method according to any one of claims 1 to 4, wherein step (b) comprises proposing a plurality of candidate segments, in particular each candidate segment defining a plurality of different segments and selecting the candidate segment having said score representing the lowest intra-segment heterogeneity.

6. A method according to any one of claims 1 to 5, wherein step (c) comprises constructing a possible statistical model of the values of the residuals in the segments and determining, for at least the most recent segment, a p-value of the statistical model of the distribution of the values of the residuals in the segments.

7. The method of claim 6, wherein an abnormality is concluded in step (c) if the p-value is below at least one threshold value.

8. Method according to claim 7, wherein the threshold value is predetermined, in particular 5%, or is calculated in particular by using the Benjamini Hochberg method for an expected false positive rate on the segment for which the p-value is determined.

9. The method of claim 8, wherein the expected false positive rate over the segment for which the p-value is determined is calculated as a function of the expected false positive rate over the entire time series.

10. A method according to any one of claims 6 to 9, wherein step (c) comprises constructing a plurality of possible statistical models of the values of the residuals in the segments, and selecting the best model of the plurality of models for which the p-value is determined for at least the most recent segment, the best model being the one that best describes the tails of the distribution of the values of the residuals in the most recent segment.

11. A method according to any one of claims 1 to 10, comprising the step (d) of taking action if an anomaly is detected on at least one segment.

12. The method according to claim 11, wherein step (d) comprises triggering an alarm and / or requesting equipment (3) for diagnosing and maintaining the system (2).

13. A server (1) for detecting anomalies in an observation time series of values of a physical quantity representing performance of a system (2), characterized in that It comprises a data processing device (11) configured to: - determining a residual corresponding to the observation time series, wherein a predictable portion of the observation time series has been removed from the observation time series; - splitting the residual into a plurality of consecutive segments so as to minimize a score representing the heterogeneity within the segment; - performing, for at least the most recent segment, a statistical analysis of the distribution of the values of the residuals in said segment in order to conclude whether an anomaly exists on said segment.

14. An assembly consisting of a server (1) according to claim 13, the system (2) and equipment (3) for diagnosing and maintaining the system (2).

15. A computer program product comprising code instructions for executing the method according to any one of claims 1 to 12, for detecting anomalies in an observed time series of values of a physical quantity representative of performance of a system (2) when the program is executed on a computer.

16. A storage device capable of being read by a computer device and having recorded thereon a computer program product comprising code instructions for executing the method according to any one of claims 1 to 12 for detecting anomalies in an observed time series of values of a physical quantity representing performance of a system (2).

Images