Method for generating anti-factual data from real data

Abstract

The invention relates to a method executed by a computer for generating anti-factual data from real data consisting of a time sequence representing a data flow in a telecommunication network, where the real data represents the telecommunication network and where the method comprises the following steps: (a) training a contrast auto-encoder on the real data, where the contrast auto-encoder comprises a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence representing a time sequence; wherein the auto-encoder comprises an encoder and a decoder, and wherein the representation in the submerged space comprises at least one hybrid dimension and at least one separation dimension, (b) creating an anti-fact data representation from the real data representation in the submerged space by modifying all or part of the separation dimension, (c) generating anti-fact data from the anti-fact data representation, the method is characterized in that during step (a), the cost function used is of the type wherein-is the input data or observation,-is an encoder function,-is a decoder function,-is a representation of data or observation in the submerged space, such that the submerged space of the encoder output is subdivided into two parts or two sets of dimensions, respectively denoted as a sum,-is an encoder function,-is an encoder function,-is a decoder function,-is a representation of data or observation in the submerged space,-is a decoder function,-is a decoder function,-is a representation of data or observation in the submerged space. The method is characterized in that mixing and separation dimensions or variables, namely similarity penalty and weight, are formed respectively, namely, the Sinkhorn distance between two subgroups of latent observations, and the observations are subdivided into two sets of similar size, namely, two sets of similar size, namely, two subgroups of similar size, namely, two subgroups of similar size, namely, two subgroups of similar size, namely, two subgroups of similar size, namely, two subgroups of similar size. Wherein the sum is from the observation and is in a group, in particular a second group or a negative group, and in a group, in particular a first group or a positive group, respectively, wherein the sum is randomly subdivided into two sets of similar size and wherein the sum is randomly subdivided into two sets of similar size,-.

Description

Technical Field

[0001] This document relates to a method for generating counterfactual data from real data, wherein the real data represents a technical system. Background Technology

[0002] Detecting bias in artificial intelligence systems poses a critical challenge to ensuring their acceptability and credibility. The term "bias" refers to an imbalance in the predictions generated by the system relative to a variable identified as sensitive. Here, the sensitive variable divides observations into two groups: one group may potentially make a less fair decision than the second. In this context, developing methods to identify, quantify, and correct these biases is essential for maintaining the fairness or effectiveness of decisions made by AI systems.

[0003] A common practice is to have training and test datasets that are imbalanced relative to the sensitive variable. More subtly, new forms of bias can emerge both during the training phase and when making subsequent decisions (when new data is incorporated). This underscores the need to be able to accurately and reliably assess the presence of bias, with the goal of certifying the compliance of algorithmic decisions.

[0004] In practice, training and test databases are often imbalanced relative to the sensitive variables. More subtly, new types of bias may emerge in both the training and test databases and the AI ​​decisions based on them when new data is used. Therefore, being able to quantify bias and measure it accurately and reliably is a significant problem. Indeed, if the concept of bias can be mathematically defined using the concept of dependency in probability, providing a strategy for certifying the presence or absence of bias in automated decision-making on both training and test databases is fundamental to demonstrating the compliance of algorithmic decisions.

[0005] Therefore, it is imperative to develop a new approach for assessing biases toward sensitive variables by incorporating robust features in relation to the data used. This new approach specifically aims to provide more credible and consistent measures of bias to ensure the certification and acceptability of AI systems across diverse contexts.

[0006] This document proposes a method that falls under this line of thinking.

[0007] Therefore, there is a need to define a new way to provide a measure of bias relative to sensitive variables that have robust properties in relation to the data used, particularly with their certification as the goal.

[0008] To remedy the instability of bias measurement tools relative to sensitive variables, one solution involves generating a counterfactual observation for each observation from which bias will be measured. Since the sensitive variable divides the set of known observations into two groups, the counterfactual of an observation corresponds to an equivalent observation of what is most likely to be in the other group. See the paper De Lara L., González-Sanz A., Asher N., Risser L. & Loubes JM (2021). “Transport-based counterfactual models.” https: / / arxiv.org / abs / 2108.13025 As shown, bias measurement measures are used on the set of observations and its counterfactual observations to stabilize and increase the robustness of bias measurement.

[0009] Comparing an individual observation with its counterfactual observation also allows for the interpretation of what criteria distinguished that observation from those in another group. If that group is an automatic classifier's prediction on technical data (such as time series from sensors), it helps explain what criteria the classifier used to make its decisions. It may also allow for confirmation that the decision was made justifiably if the person comparing the observation and its counterfactual has data expertise.

[0010] Computing the counterfactual of complex observations (such as time series from sensors) remains a complex task because only a portion of the data structure may allow for the differentiation between the two sets of observations. Similarly, this discriminative structure may not be represented by directly observed variables, but can only be inferred from nonlinear combinations of observed variables. These are then called latent variables.

[0011] The purpose of this document is, in particular, to calculate the counterfactual of complex observations in the sense that sensitive variables are not directly expressed by observed variables. Summary of the Invention

[0012] For this purpose, this document relates to a computer-executed method for generating counterfactual data from real data, said real data being a time series representing data streams in a telecommunications network. Composition, wherein the real data represents the telecommunications network and wherein the method includes the following steps: (a) A contrastive autoencoder is trained on real data belonging to a first group or positive group and a second group or negative group, respectively, wherein the autoencoder comprises an encoder capable of generating data representations in a latent space and a decoder capable of generating output data from the representations in the latent space, wherein the representations in the latent space comprise at least one dimension or variable called a blending dimension or variable representing features extracted from the data that are as independent as possible from the group to which the data belongs, and at least one dimension or variable called a disjoint dimension or variable representing features extracted from the data that are as dependent as possible from the group to which the data belongs. (b) Creating a counterfactual data representation from the real data representation obtained by an encoder through a trained contrastive autoencoder by modifying all or part of the separation dimension of the representation of the real data. (c) Generating counterfactual data from the counterfactual data representation using a decoder of a trained contrastive autoencoder. The characteristic is that during step (a), the cost function used is For the following types:

[0013] in - It is either input data or observation results. It is an encoder function. It is a decoder function. It is a representation of data or observations in the latent space, making The latent space of the encoder output It is subdivided into two parts or two groups of dimensions, denoted as follows: and These respectively form mixed and separate dimensions or variables. It is a similarity penalty. and Weight, - ,in These are two latent observation subgroups. The Sinkhorn distance between them, where these observations Divided into two sets of similar size , - ,in and It comes from The observation results and in the groups respectively Specifically, the second group or the negative group and Specifically, in the first group or the positive group, among which Randomly subdivided into two sets of similar size And among them Randomly subdivided into two sets of similar size , - .

[0014] Real data refers to actual observations collected. It involves authentic data from specific sources that reflects real events, behaviors, or phenomena. This real data can include various data types, such as images, text, time series, audio recordings, and other types of data from sensors.

[0015] Counterfactual data from a technological system refers to hypothetical observations that represent alternative realities or scenarios for that system. In other words, it involves data describing how the system would react or function differently if specific conditions were modified.

[0016] In the context of technological systems, counterfactual data is used to understand how the system will react if key variables or parameters are adjusted. This can be useful for assessing the impact of various modifications on system operation, predicting potential outcomes, or analyzing causal relationships.

[0017] For example, consider an industrial furnace equipped with a temperature control system. Data about the furnace temperature along with furnace command signals can be collected. Counterfactual data in this context might be hypothetical observations showing how the furnace temperature would change if the control signals were adjusted in a specific way. This is used to assess how various control strategies might affect the system's behavior.

[0018] In summary, counterfactual data for technological systems are simulated or hypothetical data that help explore potential outcomes by changing key variables of the system while keeping the rest of the environment constant. This can be a useful approach for making informed decisions about adjustments or improvements to a technological system.

[0019] The resulting counterfactual data can be used to rebalance the data distribution in cases of bias. In particular, when a particular group is underrepresented, counterfactual examples can be created for that group to increase its representativeness in the dataset.

[0020] A technical system is an interconnected collection of components, devices, or processors—whether mechanical, electronic, electrical, computer, or other types—that work together to perform a specific function. The technical system may be equipped with sensors. The technical system is capable of providing information or signals that can provide information about the state of the technical system.

[0021] Below, as an example, is a non-exhaustive list of physical quantities or properties that can be measured by sensors in a technical system, as well as the output information that various technical systems can provide: - Mechanical systems: Position (encoder, position sensor), speed (speed sensor, revolution counter), acceleration (accelerometer), force (force sensor, dynamometer), pressure (pressure gauge, pressure sensor), deformation (deformation sensor), vibration (vibration sensor), temperature (thermometer), rotation (rotation sensor), liquid level (liquid level sensor) - Electronic or electrical systems: voltage (voltmeter), current (ammeter), resistance (ohmmeter), frequency (frequency meter), power (wattmeter), power factor (power factor indicator), frequency response curve (spectrum analyzer), ripple (oscilloscope), threshold voltage (threshold detector), light intensity (photometer). - Information systems or software: Data (data flow), Status (system status, errors), Execution time (timestamps), CPU usage (performance monitor), Used memory (memory monitor), Latency (latency measurement), Network flow rate (traffic analyzer), Events (event logs) - Environmental system: ambient temperature (thermometer), humidity (hygrometer), atmospheric pressure (barometer), sound level (sound level meter), air quality (air quality sensor), solar radiation (solar radiation meter), wind speed (anemometer), precipitation (rain gauge). - Control and automation systems: Commands (command signals), status (system status), alarms (fault alarms), errors (error messages), feedback signals (system feedback), switch status (switch status, relay), activation status (motor status, actuator).

[0022] Contrastive autoencoders, also known as autoencoders with contrast pairs, are variants of traditional autoencoders designed to learn useful representations by focusing on the differences and similarities between input data. This type of autoencoder is commonly used to learn discriminative features in classification, dimensionality reduction, or anomaly research contexts.

[0023] The contrastive approach in contrastive autoencoders involves encouraging the model to capture relevant information used to distinguish different training sample pairs. Unlike simply minimizing the reconstruction differences between input and output (as in traditional autoencoders), contrastive autoencoders maximize the similarity between positive pairs (which should be similar) and minimize the similarity between negative pairs (which should be different).

[0024] In other words, a contrastive autoencoder attempts to project similar examples to nearby locations in the latent representation space (or latent space) while separating different examples. This allows the model to learn representations that capture significant variations and differences between examples.

[0025] Contrastive autoencoders are known in particular from the document “Contrastive Variational Autoencoder Enhances Salient Features”, Abubakar Abid and James Zou, 2019, arXiv 1902.04601.

[0026] The architecture and / or hyperparameters of the encoder and decoder can be conventional and adapted to the type and dimension of the input data. Similarly, the number of dimensions of the latent space can be adapted to the use case.

[0027] The method may include a prior step of measuring real data using at least one sensor equipped with the telecommunications network before step (a).

[0028] The method may include subsequent steps of analyzing real data and counterfactual data, followed by steps of correcting the operating parameters of the technical system based on the analysis.

[0029] An autoencoder can be a variational autoencoder. Autoencoders are known in particular from the document Diederik P. Kingma et Max Welling, “Auto-Encoding Variational Bayes”, arXiv:1312.6114.

[0030] During autoencoder training, a cost function (also known as an error or penalty function) is routinely used to measure the difference between the input data and the output data reconstructed by the model, for a set of training data.

[0031] The primary goal of training is to minimize this cost function, which means the neural network seeks to adjust its parameters to reduce the error between predictions and target values. Optimization involves finding parameter values ​​that minimize the cost function, resulting in more accurate and faithful predictions to the training data.

[0032] and It can be defined by the user.

[0033] Can be equal to Other regular similarity functions can be used.

[0034] punish Tendency to distribute data. Penalty. The tendency is to group data from the first group independently of each other, and to group data from the second group independently of each other. (Penalty) There is a tendency to mix data from both groups.

[0035] The Sinkhorn distance can be calculated in the following way.

[0036] make Let be a probability measure and let If the value is greater than 0, then the entropy-regularized optimal transport problem is defined as follows:

[0037] This problem allows for dual representations.

[0038]

[0039]

[0040] When the probability is discrete, there exists The algorithm is used to calculate the Sinkhorn transfer plan. Therefore, the Sinkhorn distance is calculated, which is described in the document M. Cuturi, “Sinkhorn distances: Lightspeed computation of optimal transport, Advances in neural information processing systems”, 26, 2013.

[0041] Due to the representation of data or observations in the latent space during step (b) The latent dimensions or variables are divided into two groups. and , respectively form Mixed and separated dimensions or variables, corresponding counterfactual data The representation can be achieved through the connection group. and Obtain, form separately The mixing and separation dimensions, where And among them The latent space is represented by using functions and Paired observations The separation of parts means minimizing the parts from the group. Specifically, the second group or the negative group and Specifically, it refers to the Sinkhorn distance between two point clouds in the first group or the positive group.

[0042] In particular, for the purpose of calculation Consider using an encoder The set of observations obtained The separation of the latent space Similarly, consider each observation. Category It is known. Observations Will be selected in category and Includes a sufficient number of observations (typically per class) (One observation). Then from the group and of The pairing of observations was accomplished by minimizing the Sinkhorn distance between the two point clouds. Once this pairing was complete, This will be through observation results Different groups The pairings in the middle are estimated to be the closest. of .

[0043] Within the scope of this document, the technical system can be a telecommunications network. In this case, the actual data can be represented by a time series depicting data streams within the telecommunications network. composition.

[0044] Network flow monitoring is the collection, analysis, and monitoring of traffic on a network or a given network segment.

[0045] This monitoring is used to obtain data from network flows. This data can be extensive and can include various categories, such as the amount of information exchanged, established connections, incoming connections, outgoing connections, port numbers of the final source and destination points, protocols, processor activity, memory access activity, data about the IP addresses of connections, processor temperature, the amount of data exchanged, etc. This data can belong to multiple categories (binary, sequential, ordinal, etc.) and is all timestamped.

[0046] As a first step, a training database can be created, in which the data... Events are represented using timestamps in time series format. This yields the observed time series training database. For this data... Each of the binary variables ( )or( ) can indicate Is it related to an attack?

[0047] In the second step, the contrastive autoencoder can be used for each Find a compact representation space To refer to this space, it is called latent space. For example, Can contain A time series with a time step? It can represent from Extracted These are characteristics. Through the principles of these autoencoders themselves, This compact representation will be particularly informative because it contains enough information for reconstruction. A faithful approximation.

[0048] The purpose of the aforementioned cost function is then to represent the latent expression. Divided into two parts, by distinguishing all Common features (features here) ) and features that will be used to distinguish between attack contexts. The method described in this document is then used to convert network flow signals into normal signals and thus understand why an attack was detected by comparing them with the initial signals. This may simultaneously yield a signal detector and a signal creator, which interpret what needs to be changed in order to be classified as normal.

[0049] The invention also relates to a computer program that includes instructions for implementing methods of the aforementioned type when the program is executed by a processor.

[0050] The invention also relates to a computer-readable non-volatile storage medium having a program recorded thereon for implementing the methods of the aforementioned type when the program is executed by a processor.

[0051] The invention also relates to an information system, comprising: - Input interface for receiving time series representing data streams in a telecommunications network. The data that makes up the data; - Memory for storing instructions of at least one computer program of the aforementioned type; - The processor accesses memory to read the instructions and then executes a method of the aforementioned type; - Output interface for providing counterfactual data generated during step (c). Attached Figure Description

[0052] Other features, details, and advantages will become apparent as you read the following detailed description and analyze the accompanying figures, which illustrate various aspects: Figure 1 This illustration shows an example of an information system according to the present invention; Figure 2 The training of the contrast autoencoder is shown; Figure 3 This demonstrates the generation of counterfactual data using a trained contrastive autoencoder. Detailed Implementation

[0053] Figure 1 Information system 1 is illustrated schematically, including: - Input interface 2 (IN) is used to receive time series representing data streams in a telecommunications network. The data that makes up the data; - Memory 3 (MEM) for storing at least one instruction of a computer program according to this document; - Processor 4 (PROC) accesses memory 3 to read the instructions and then executes the method according to this document; - Output interface 5 (OUT) is used to provide counterfactual data.

[0054] The following symbols will be used in the remainder of the description: - : A set of input observations. Each input observation can be, for example, a set of tables, images, or curves.

[0055] - From The group of input observations. As is customary. The specified observation i is in the potentially discriminated-against group, and Specify the rest of the observations.

[0056] - : Compare the encoder part of the autoencoder.

[0057] - : Compare the decoder part of the autoencoder.

[0058] - : Compare the latent representation of the data in the autoencoder. Therefore, we have .

[0059] - Encoder Output potential space It is divided into two parts. and From The latent variables represent from Extracted and group Features that are as independent as possible. (From...) The latent variables represent from Extracted and group Features that you rely on as much as possible. and These properties will be facilitated by using a penalty or cost function during training.

[0060] - Compared to binary variables The counterfactual is recorded as If regarding the observation results have ,but equal ,in For example The observation results. Group and The pairing of observations will be accomplished through optimal transmission as described below.

[0061] - : Data is reconstructed by comparing with an autoencoder. Therefore, there is .

[0062] - Training of the autoencoder (AEC) The training of AEC differs from that of a conventional autoencoder in that it uses a penalty or cost function, which imparts a latent space to facilitate counterfactual computation. The training steps are shown in... Figure 2 .

[0063] Note that during training, the two weights and It can be set by the user.

[0064] During the training step, let observation i come from a mini-batch of the training dataset, then: First calculate . The latent variables were then divided into two groups. and Next, we will calculate the prediction. .

[0065] The predicted total penalty will then be determined as follows:

[0066] in yes and Common similarity penalties between them (e.g.) ), and other punishments , and The description is as follows.

[0067] Then, calculations are performed using backpropagation. Compared to and The gradient of the parameters. Last update. and The parameters.

[0068] The goal of the penalty is to promote the general dispersion of data while mixing groups. and The latent representation of the observation results. The goal of the penalty is to promote the general dispersion of data while distributing each group and The latent representations of the observations are grouped independently of each other.

[0069] - Punishment used during training make Two latent observation subgroups The Sinkhorn distance between them.

[0070] Based on this distance, three types of penalties can be defined, which are applied to a subset of the latent variables of the autoencoder.

[0071] - punish

[0072] Observation results Randomly subdivided into two sets of similar size .Then:

[0073] This penalty tends to scatter the data.

[0074] - punish

[0075] make and They are from And in the group and The observations in the study.

[0076] Randomly subdivided into two sets of similar size .

[0077] Randomly subdivided into two sets of similar size .

[0078] Then:

[0079] The punishment tends to come from the group. The data are grouped independently of each other, and the data from the second group will be... The data are grouped independently of each other.

[0080] - punish

[0081] From And in the group and The observations in the data are named respectively. and .

[0082] Then:

[0083] The punishment tends to be mixed from groups. and from group The data.

[0084] - Estimation of counterfactual observations Group and group Latent observation results The pairings are completed as described below. Symbols Meaning and They are different groups, and Is with Paired observations.

[0085] The different steps of the calculation are shown in Figure 3 .

[0086] Group and The calculation of counterfactual observations between them is achieved through Optimal transmission completed. and Compared to having low dimensionality.

[0087] Observation results Counterfactual observation The calculation is performed as follows, starting with the trained autoencoder.

[0088] Sure . The latent variables were then divided into two groups. and Next, we will determine through calculation. Then connect and The resulting counterfactual latent observations are denoted as... Final confirmation .

[0089] symbol Meaning and They are different groups, and Is with Observations of pairing. Pairing is... Minimize the pairing. The details of this calculation are described in the document M. Cuturi, “Sinkhorn distances: Lightspeed computation of optimal transport”, Advances in neural information processing systems, 26, 2013.

[0090] - Applications in the field of cybersecurity In the context of cybersecurity, for example, consider time series representing data flows in telecommunications networks. The set of observations. Each of them has a constant number of time steps and has been labeled as normal ( (or risk) This label can correspond to the output of a pre-trained classifier used to detect risky flows. This can also be done by experts. The reasons for belonging to the normal or risky group are assumed to be unknown. If a classifier is used, it could be based on a neural network-type model or a random forest, for example, if the algorithmic processing of the reference data makes its internal mechanisms difficult to interpret. If experts label the sequences, they may no longer be usable to explain their choices.

[0091] The goal of the previously described method is to allow users to explain why a particular time series is at risk. Consider the series... "For risk" means to satisfy We hypothesize that this series is a mixture of normal criteria (e.g., traffic variations due to the time of day) and risk criteria (e.g., sudden overactivity due to an attack). To understand... Due to the inherent risks, a contrastive autoencoder can be used to generate counterfactual series. It is consistent with all non-risk-related criteria. Similar, but with the same standards related to this risk. Different. Series This can then be interpreted as meaning there is no risk. What will it be? Visually speaking... and Users can then interpret the risk detection rules for that specific situation (which are unknown).

[0092] By generating counterfactual data, conventional bias measurement tools from the literature can then be used on both the original data and the counterfactual data.

[0093] Of course, the same method can be used in other technical fields.

Claims

1. A computer-executed method for generating counterfactual data from real data, said real data being a time series representing data streams in a telecommunications network. Composition, wherein the real data represents the telecommunications network and wherein the method includes the following steps: (a) A contrastive autoencoder is trained on real data belonging to a first group or positive group and a second group or negative group, respectively, wherein the autoencoder comprises an encoder capable of generating data representations in a latent space and a decoder capable of generating output data from the representations in the latent space, wherein the representations in the latent space comprise at least one dimension or variable called a blending dimension or variable representing features extracted from the data that are as independent as possible from the group to which the data belongs, and at least one dimension or variable called a disjoint dimension or variable representing features extracted from the data that are as dependent as possible from the group to which the data belongs. (b) Creating a counterfactual data representation from the real data representation obtained by an encoder through a trained contrastive autoencoder by modifying all or part of the separation dimension of the representation of the real data. (c) Generating counterfactual data from the counterfactual data representation using a decoder of a trained contrastive autoencoder. The characteristic is that during step (a), the cost function used is For the following types: in - It is either input data or observation results. It is an encoder function. It is a decoder function. It is a representation of data or observations in the latent space, making The latent space of the encoder output It is subdivided into two parts or two groups of dimensions, denoted as follows: and These respectively form mixed and separate dimensions or variables. It is a similarity penalty. and Weight, - ,in These are two latent observation subgroups. The Sinkhorn distance between them, where these observations Divided into two sets of similar size , - ,in and It comes from The observation results and in groups Specifically, the second group or the negative group and Specifically, in the first group or the positive group, among which Randomly subdivided into two sets of similar size And among them Randomly subdivided into two sets of similar size , - 。 2. The method of claim 1, further comprising a prior step of measuring real data using at least one sensor equipped with the telecommunications network prior to step (a).

3. The method according to any one of the preceding claims, characterized in that, Due to the representation of data or observations in the latent space during step (b) The latent dimensions or variables are divided into two groups. and , respectively form Mixed and separated dimensions or variables, corresponding counterfactual data The representation is through the connection group and Obtain, form separately The mixing and separation dimensions, where And among them The latent space is represented by using functions and Paired observations The separation of parts means minimizing the parts from the group. Specifically, the second group or the negative group and Specifically, it refers to the Sinkhorn distance between two point clouds in the first group or the positive group.

4. A computer program comprising, when executed by a processor, instructions for implementing the method according to any one of the preceding claims.

5. A computer-readable non-volatile storage medium having a program recorded thereon for carrying out the method according to any one of claims 1 to 3 when executed by a processor.

6. Information system (1), which includes: - Input interface (2), for receiving time series representing data streams in a telecommunications network The data that makes up the data; - Memory (3) for storing at least one instruction of a computer program according to claim 5; - The processor (4) accesses the memory (3) to read the instructions and then executes the method according to any one of claims 1 to 3; - Output interface (5) for providing counterfactual data generated during step (c) of the method according to any one of claims 1 to 3.

Images