Method and apparatus for interpreting anomalies in time series of a production process at least within a time window

Abstract

The invention relates to a method for interpreting an anomaly (100) in a time series (102) to be interpreted of a production process at least within a time window (104), wherein the anomaly (100) is detected by means of a detection model.

Description

Technical Field

[0001] The present invention relates to a method and an apparatus for interpreting anomalies in a time series of a production process, at least within a time window. Background Technology

[0002] Explainable artificial intelligence (XAI) is an increasingly important area of ​​machine learning research, particularly in security-critical applications such as medical, financial, or industrial monitoring systems. While numerous methods exist for post-hoc interpretation of model results for tabular and image-based data, such methods are relatively scarce for time-series data. In particular, most existing methods focus on classification tasks, and to date, no interpretation method specifically conceived for anomaly detection in time series data is known.

[0003] Existing methods for interpretability of time series models can be categorized into different types. Gradient-based methods evaluate the significance of individual time points based on the magnitude of gradients in the neural network; however, they are limited to differentiable deep-learning models. Example-based methods interpret time series by comparing them to representative curves (such as so-called shapelets), where these methods heavily depend on the availability of appropriate representatives and can be computationally very expensive. Another possibility offers perturbation-based methods, where portions of the input data are masked or altered to analyze their impact on predictions. However, this technique is particularly challenging in the case of time series because manipulation of individual segments often introduces artificial anomalies, which can affect the persuasiveness of the interpretation.

[0004] The challenges in interpretability of time series models, particularly in the area of ​​anomaly identification, make it clear that current methods have reached their limits and new approaches are needed to enable reliable and interpretable model-based decision analysis in this field.

[0005] The objective of this invention is to describe an improved method and / or an improved apparatus, particularly for time series analysis.

[0006] This task is solved by the method according to the features of claim 1. This task is solved by the apparatus according to the features of claim 10. Summary of the Invention

[0007] According to the first aspect, a method is proposed for explaining anomalies in a time series of a production process, at least within a time window, wherein the anomalies are detected by means of a detection model. Here, the method includes at least the following steps: providing an anomaly-free model time series of the production process, and a time series to be explained; determining the nearest neighbors of the anomaly-free model time series relative to the time series to be explained, which is potentially at least segmentally anomalous; determining, using linear interpolation, the linear function component between the function value of the time series to be explained at the start of a time window and the function value of the time series to be explained at the end of a predetermined time window; determining the residual component function relative to the nearest neighbor between the start and end of the time window; replacing the function segment of the time series to be explained within the time window, using the linear function component and the residual component function, to generate a replacement time series within the time window; determining an anomaly score for the replacement time series within the time window using the detection model; comparing the anomaly score of the replacement time series within the time window with the anomaly score of the time series to be explained within the time window that can be determined by the detection model, to generate an interpretability curve for the anomaly within the time window; and optionally, performing an action within the production process using the interpretability curve.

[0008] "Time series to be explained" preferably refers to a sequence of measurements over time, which is analyzed to identify biases or patterns.

[0009] The method preferably includes the steps of providing an anomaly-free model time series of the production process and the time series to be interpreted, wherein "anomaly-free" preferably means that the time series does not contain significant deviations or unwanted disturbances. Alternatively, it may refer to "disturbance-free model time series" or "reference model time series".

[0010] Another step preferably includes: determining the nearest neighbors of the non-anomaly model time series relative to the time series to be explained, which is potentially at least segmentally anomalous. "Nearest neighbor algorithm" preferably refers to a machine learning or pattern recognition method in which similarity between datasets is determined based on a distance metric. During the nearest neighbor search, elements between the start and end points of the window are preferably weighted such that these elements do not contribute to the nearest neighbor search. This reduces potential information leakage.

[0011] Furthermore, preferably, linear interpolation is used to determine the linear function component between the function value of the time series to be explained at the beginning of the time window and the function value of the time series to be explained at the end of the time window. "Linear interpolation" preferably refers to a mathematical method used to calculate the intermediate value between two known points based on a straight line connecting them.

[0012] Finally, preferably, the residual component function relative to the nearest neighbor between the start and end points of the time window is determined. The "residual component function" preferably represents the difference between the actual time series function and the determined linear function component, so that the remaining patterns or deviations are visible. Alternatively, "difference function" or "deviation component" may be used. A preferred technical advantage is that nonlinear deviations and patterns can be observed and further analyzed in isolation to specifically identify anomalies.

[0013] In the step of replacing function segments or interpolation, it is preferable to visually preserve the linear components within the window and replace only the nonlinear residuals within the time window with the corresponding values ​​of the nearest neighbor function segments.

[0014] The actions may include, for example, matching process parameters of the production process or changing production conditions.

[0015] Alternatively or supplementarily, this method can also be used for classification tasks. In this case, a method is proposed for interpreting the classification of time series of a production process at least within a predetermined time window, wherein the classification is determined by means of a classification model. The method here comprises at least the following steps: providing a correctly classified model time series of the production process, and a time series to be explained, which may be misclassified if necessary; determining the nearest neighbor of the model time series relative to the time series to be explained using a nearest neighbor algorithm; determining, using linear interpolation, the linear function component between the function value of the time series to be explained at the start of a time window and the function value of the time series to be explained at the end of a predetermined time window; determining the residual component function relative to the nearest neighbor between the start and end of the time window; replacing the function segment of the time series to be explained within the time window, using the linear function component and the residual component function, to generate a replacement time series within the time window; determining the classification probability of the replacement time series within the time window using a classification model; comparing the classification probability of the replacement time series within the time window with the classification probability of the time series to be explained within the time window, which can be determined by the classification model, to generate an interpretability curve for anomalies within the time window; and optionally, performing an action within the production process using the interpretability curve. The same description also applies similarly to the corresponding equipment.

[0016] It should be understood that the steps and other optional steps according to the invention do not necessarily have to be performed in the stated order, but may be performed in other orders. Furthermore, other intermediate steps may be provided. Each step may also include one or more sub-steps without departing from the scope of the method according to the invention.

[0017] According to a second aspect, an apparatus is proposed for explaining anomalies in a time series of a production process, at least within a time window, wherein the anomalies can be detected by means of a detection model. The apparatus includes an evaluation and calculation device configured to perform the following steps: providing an anomaly-free model time series of the production process, and the time series to be explained; determining, using a nearest neighbor algorithm, the nearest neighbors of the anomaly-free model time series relative to the time series to be explained, which is potentially at least segmentally anomaly; and determining, using linear interpolation, the linear function component between the function value of the time series to be explained at the beginning of the time window and the function value of the time series to be explained at the end of the predetermined time window. The process involves: determining the residual component function relative to the nearest neighbor between the start and end points of the time window; replacing the function segment of the time series to be explained within the time window using the linear function component and the residual component function to generate a replacement time series within the time window; determining anomaly scores for the replacement time series within the time window using the detection model; comparing the anomaly scores of the replacement time series within the time window with the anomaly scores of the time series to be explained within the time window that can be determined by the detection model to generate an interpretability curve for anomalies within the time window; and optionally, performing actions within the production process using the interpretability curve.

[0018] The descriptions of the method apply accordingly to the device. It should be understood that, according to linguistic convention, linguistic variations of features expressed in the form of a method can be restated for the device, without needing to explicitly state such a description here.

[0019] This method preferably uses nearest neighbor search on the time series to be explained in order to identify time series instances that are as similar as possible to the time series under study, provided that the time series instance is not anomaly or has not been misclassified. Then, the nearest neighbor is used to replace function segments or for interpolation. For this purpose, a set of model time series or time series instances is preferably needed, which comprehensively covers the data distribution of non-anomaly or correctly classified time series as comprehensively as possible for possible changes in the production process.

[0020] This invention describes the significance of each time step of a time series for predictions made by an ML model. More specifically, it describes a novel perturbation-based technique for calculating importance assessments in the time domain of one-dimensional or multi-dimensional time series. In particular, this invention can be used to interpret anomaly assessments generated by ML models used for anomaly identification by emphasizing anomalous segments of the time series. This invention offers several advantages over existing methods. It is one of the earliest interpretation methods specifically developed for identifying time series anomalies. Like other perturbation-based techniques, this invention is based on the premise that the ML model is a black box and therefore can be used to interpret multiple models. Furthermore, this invention can provide quantifiable interpretations for each time step. In the case of this invention, importance values ​​are generated for each measurement in the time series, compared to existing methods. Moreover, this invention enables non-invasive occlusion or interpolation. Here, the invention preferably includes a novel interpolation technique that avoids introducing artificial anomalies—a significant limitation of existing perturbation-based techniques to date. In particular, the present invention preserves the linear component of the window during the interpolation step, thereby preferably avoiding artificial jumps in the interpolated time series. Such jumps would typically be highly anomalous in themselves and would therefore lead to unreliable or erroneous interpretations.

[0021] This invention can be used to interpret predictions for one-dimensional or multi-dimensional time series instances of any time series classification model and / or anomaly identification model. In particular, it can be used to identify and evaluate anomalous segments in production process curves. Thus, for example, experts can locate anomalies within the process curve, thereby gaining a better understanding of the causes of the anomalies and / or distinguishing between different error types.

[0022] This invention is preferably used to analyze data detected by sensors. Sensors can preferably determine environmental measurements in the form of sensor signals, which can preferably be used for further purposes. In the field of virtual sensors, this invention can preferably acquire information about elements encoded by the signal based on the sensor signal, enabling indirect measurements. Furthermore, this invention can preferably generate new signals indicating how important each measurement in the original time series is for prediction. In the scope of anomaly identification, this invention can preferably be used to map instance-based anomaly assessments to the time domain. This invention preferably does not compute its own anomaly assessment, but rather quantifies the significance of each time point for the anomaly assessment of the anomaly identification model. Furthermore, this invention can preferably be used to train anomaly type clustering by clustering importance values ​​to identify groups of anomaly types, such as anomalies at the beginning or in the middle of a time process. Furthermore, this invention can preferably be used to generate synthetic data by identifying prominent segments, which can preferably be added to other instances to generate artificial datasets.

[0023] In another aspect, it is proposed to repeat steps S2 to S7 on multiple window positions of the time window on the time series to be explained, in particular until the entire time series to be explained has been analyzed.

[0024] Particularly preferably, this method is repeated iteratively until the entire time series has been analyzed and thus made interpretable. Here, the analysis is preferably performed for all possible window positions within a predetermined time window. The time windows traversed by the iteration may overlap, for example. To avoid errors in the interpretability curve, it is preferable to determine the average of the corresponding score differences for the final interpretation curve. Alternatively or supplementarily, the time series or process curve to be interpreted may also be divided into multiple non-overlapping time windows. This saves computation time and improves efficiency compared to the classic sliding window scheme.

[0025] In another aspect, it is proposed that the provided anomaly-free model time series are cluster representations of multiple anomaly-free model time series, which have been determined from the multiple anomaly-free model time series by means of a clustering method.

[0026] The "clustering representation" preferably represents a generalized expression or representative prototype of clusters derived from groups of similar data points. A key advantage is the creation of a compact and efficient data structure that reduces the diversity of outlier-free model time series while preserving their essential characteristics.

[0027] These clustering representations are preferably determined from multiple anomaly-free model time series using clustering methods. "Clustering method" preferably refers to a machine learning or data analysis method in which a dataset is divided into groups or clusters based on similarity criteria. The technical advantage preferably lies in enabling data-driven and scalable construction of anomaly-free model time series, thereby achieving more efficient processing and more robust comparisons with new time series.

[0028] Therefore, instead of pre-storing multiple model time series, such as 1000 model time series, only the time series representing the time series cluster is stored as model time series, so that the model time series can be compared with one or more time series that are to be interpreted or studied, or that are anomalous if necessary, using the nearest neighbor algorithm.

[0029] In another aspect, it is proposed that the clustering method has the KMedoids clustering method.

[0030] "KMedoids clustering method" preferably refers to an algorithmic approach for cluster formation, where, instead of the arithmetic mean—as is the case with K-means—actually existing data points are selected as cluster centers (Medoids). Alternatively, one may refer to "medoid-based clustering analysis" or "representative grouping strategy".

[0031] The advantage lies preferably in achieving better interpretability and robustness relative to outlier measurements by selecting real time series as cluster centers. Furthermore, since the cluster representation is the actual time series from the original data and therefore provides higher relevance for the anomaly identification process, comparability with new time series is improved. Unlike in the case of KMeans, the centroids (Zentroides) of the KMedoids model correspond to actual data points in the training set. Accordingly, in the case of this invention, it is guaranteed that values ​​or function segments are interpolated using function values ​​that lie within the actual data distribution.

[0032] In another aspect, it is proposed that the time series to be interpreted be detected by sensors at least during the production process.

[0033] The detection is preferably performed using sensors, where a "sensor" is a technical component that measures physical or chemical parameters and converts them into digital or analog signals. The measurement preferably occurs during the production process, meaning that data detection is closely linked to the production flow. A key advantage is that anomalies can be identified during production, enabling early error detection and rapid response to avoid scrap or production disruptions.

[0034] In another aspect, it is proposed to change the time window size multiple times during the analysis of the time series to be interpreted. To interpret a given time series instance, the invention interpolates segments of the time series within a window scheme. Window interpolation is performed multiple times for different window sizes.

[0035] Preferably, the time window size is changed multiple times during the analysis of the time series to be interpreted. "Time window size" preferably refers to the length of the selected time series segment within which analysis or processing is performed. To interpret a given time series instance, the invention preferably interpolates segments of the time series in a windowed scheme. "Interpolation" preferably refers to supplementing or perfecting missing or incomplete data using an algorithmic method. Window interpolation is preferably performed multiple times for different window sizes. "Windowed scheme" preferably describes a systematic approach for splitting a time series into overlapping or non-overlapping segments for further analysis. Alternatively, "segment-based analysis" or "segmented processing" may also be used.

[0036] In another aspect, it is proposed that the detection model has a neural network, a tree-based model, or a linear model.

[0037] "Detection model" preferably refers to a mathematical or algorithmic method used to identify patterns or anomalies in a time series.

[0038] Preferably, a neural network is used as the detection model, where "neural network" refers to an architecture constructed from artificial neurons for processing and pattern recognition in complex data.

[0039] Alternatively, the detection model can preferably be a tree-based model. "Tree-based model" preferably refers to a class of algorithms that use a decision structure in the form of branches and nodes to perform prediction or classification.

[0040] Additionally or alternatively, a linear model may preferably be used as the probe model. "Linear model" preferably refers to a mathematical regression or classification method that establishes a linear relationship between input and output variables.

[0041] In another aspect, protection is also claimed for a controller included in a vehicle and / or robotic system and / or industrial machine with autonomous driving capabilities, and on which the method can be implemented in one of its aspects.

[0042] Another claim protects a computer program having program code for implementing at least a portion of the method in one aspect when the computer program is executed on a computer. In other words, a claim protects a computer program (product) comprising instructions that, when executed by a computer, cause the computer to implement the method / steps of the method in one aspect.

[0043] In another aspect, a computer-readable data carrier having program code of a computer program is proposed for implementing at least a portion of the method in one aspect when the computer program is executed on a computer. In other words, the present invention relates to a computer-readable (storage) medium comprising instructions that, when a program is executed by a computer, cause the computer to implement the method / steps of the method in one aspect.

[0044] Therefore, the present invention preferably provides a disturbance-based interpretation method for time series. Like tabular interpretation methods (e.g., LIME), these methods preferably quantify the significance of elements of the data input—preferably measurements over time—by masking portions of the input and observing changes in the model results. If, for example, a time series window is unterstellened using expected OK segments, and outliers are recalculated, the effect of the unterstellened window on the original outliers can be investigated. If, after unterstellening a particular window, the outliers become smaller, then that window may include outliers.

[0045] The difficulty here lies in making assumptions about the window with convincing expected OK values ​​without introducing artificial anomalies. Existing interpretation methods for classification often assume arbitrary values ​​(e.g., zero). However, in practice, the value used for the assumption is not so critical in the case of classification. The class probability is reduced as long as the features of the predicted class are masked, regardless of which value is used to mask the time series. Conversely, in the case of anomaly detection interpretation, the purpose of imputation is to reduce anomaly scores. Therefore, it is preferable that the imputation step does not make the time series more anomalous—this can be particularly prone to occur with naive schemes using existing methods. For example, imputing the window with 0 generally results in non-differentiable abrupt changes (Brüchen) in the time series, which are identified as anomalies by any reliable anomaly detection model. This, however, renders the interpretation invalid.

[0046] The described design and improvement schemes can be combined with each other arbitrarily.

[0047] Other possible designs, improvements, and implementations of the present invention also include combinations of features of the invention not explicitly mentioned in the preceding or hereinafter described with respect to embodiments. Attached Figure Description

[0048] The accompanying drawings should facilitate a further understanding of the embodiments of the invention. The drawings illustrate the embodiments and, in conjunction with the description, serve to explain the principles and concepts of the invention.

[0049] Many advantages, among others, are derived from the accompanying drawings. The elements shown in the drawings are not necessarily shown to scale.

[0050] Figure 1 A schematic flowchart illustrating an exemplary method is shown.

[0051] Figure 2 A schematic diagram illustrating the method based on a time series is shown.

[0052] Figure 3 This shows a time series with anomalies in the production process.

[0053] Figure 4 This illustrates the determination made by means of the method of the present invention from Figure 3 The interpretability curve of a known time series.

[0054] In the accompanying drawings, unless otherwise stated, the same reference numerals denote the same or functionally identical elements, components, or assemblies.

[0055] Refer to all Figures 1 to 4 The methods and devices are explained in this way, rather than always referring to the figures separately. Detailed Implementation

[0056] Figure 1 A schematic flowchart is shown for a method of interpreting anomalies 100 in a time series 102 of a production process for at least a time window 104. The time series 102 can map any arbitrary process parameter P of the production process over time t, wherein the process parameter P can be measured, for example, by at least one sensor.

[0057] This method can be implemented at least in part by device 1000 in any embodiment, which may include a plurality of components not shown in more detail, such as one or more providing means and / or at least one evaluation and computing means. It should be understood that the providing means may be constructed together with the evaluation and computing means, or may be different from the evaluation and computing means. Furthermore, the device 1000, which may be part of a system, may include storage means and / or output means and / or display means and / or input means.

[0058] The computer-implemented method includes at least the following steps: In step S1, an anomaly-free model time series 106 of the production process and a time series 102 to be interpreted are provided.

[0059] In step S2, the nearest neighbor algorithm is used to determine the nearest neighbor 108 of the non-anomaly model time series 106 relative to the time series 102 to be explained.

[0060] In step S3, by means of linear interpolation, the linear function component 110 between the function value 113 of the time series 102 to be explained at the start point 112 of the time window 104 and the function value 115 of the time series 102 to be explained at the end point 114 of the predetermined time window 104 is determined.

[0061] In step S4, the residual component function 116 between the start point 112 and the end point 114 of the time window relative to the nearest neighbor 108 is determined.

[0062] In step S5, when using linear function component 110 and residual component function 116, the function segment 118 of the time series 102 to be interpreted within the time window 104 is replaced to generate a replacement time series 120 within the time window 104.

[0063] In step S6, anomaly scores for the replacement time series 120 within time window 104 are determined using a detection model.

[0064] In step S7, the anomaly score of the replacement time series 120 within time window 104 is compared with the anomaly score of the time series 102 to be explained within time window 104 that can be determined by the detection model, in order to generate an interpretability curve 122 for the anomaly 100 within time window 104.

[0065] In the purely optional step S8, the action is performed within the production process using the interpretability curve 122.

[0066] according to Figure 3 and Figure 4 This method has been used to generate interpretability curves 122 for known time series with anomalies, which illustrate the significance of each time step for the obtained anomaly assessment. High values ​​in the interpretability curve 122 preferably indicate that segments within the time series 102 to be interpreted contribute more to the anomaly assessment. For example, from... Figure 3 and Figure 4 It is understood that this explanation successfully highlights the time step corresponding to the known anomaly 100.

Claims

1. A method for interpreting an anomaly (100) in a time series (102) of a production process for at least within a time window (104), wherein the anomaly (100) is detected by means of a detection model, the method comprising the steps of: - Provide (S1) the anomaly-free model time series (106) of the production process, and the time series to be interpreted (102). - Using the nearest neighbor algorithm, determine (S2) the nearest neighbor (108) of the non-anomaly model time series (106) relative to the time series to be explained (102). - By means of linear interpolation, determine (S3) the linear function component (110) between the function value (113) of the time series to be explained (102) at the start point (112) of the time window of the time window (104) and the function value (115) of the time series to be explained (102) at the end point (114) of the time window of the predetermined time window (104). - Determine (S4) the residual component function (116) between the start point (112) and the end point (114) of the time window relative to the nearest neighbor (108). - When using the linear function component (110) and the residual component function (116), replace (S5) the function segment (118) of the time series to be explained (102) within the time window (104) to generate a replacement time series (120) within the time window (104). - Determine (S6) the anomaly score for the replacement time series (120) within the time window (104) using the detection model; - Compare the anomaly score of the replacement time series (120) within the time window (104) with the anomaly score of the time series to be explained (102) within the time window (104) that can be determined by the detection model (S7) to generate an interpretability curve (122) for the anomaly (100) within the time window (104); and - Optionally, the (S8) action is performed within the production process when the interpretability curve (122) is used.

2. The method according to claim 1, wherein steps S2 to S7 are repeated on the time series to be explained (102) for multiple window positions of the time window (104), particularly until the entire time series to be explained (102) has been analyzed.

3. The method according to claim 1 or 2, wherein the provided anomaly-free model time series (106) are cluster representations of a plurality of anomaly-free model time series (106), the cluster representations having been determined from the plurality of anomaly-free model time series by means of a clustering method.

4. The method according to any one of the preceding claims, wherein the clustering method has the KMedoids clustering method.

5. The method according to any one of the preceding claims, wherein the time window size is changed multiple times during the analysis of the time series to be interpreted (102).

6. The method according to any one of the preceding claims, wherein the time series to be interpreted is detected by a sensor at least during the production process (102).

7. The method according to any one of the preceding claims, wherein the detection model has a neural network, a tree-based model, or a linear model.

8. A computer program having program code for implementing at least a portion of the method according to any one of claims 1 to 7 when the computer program is executed on a computer.

9. A computer-readable data carrier having program code of a computer program for carrying out at least a portion of the method according to any one of claims 1 to 7 when the computer program is executed on a computer.

10. An apparatus (1000) for interpreting anomalies (100) in a time series (102) of a production process at least within a time window (104), wherein the anomalies (100) are detectable by means of a detection model, wherein the apparatus (1000) has an evaluation and calculation device configured to perform the following steps: - Provide (S1) the anomaly-free model time series (106) of the production process, and the time series to be explained (102). - Using the nearest neighbor algorithm, determine (S2) the nearest neighbor (108) of the non-anomaly model time series (106) relative to the time series to be explained (102). - By means of linear interpolation, determine (S3) the linear function component (110) between the function value (113) of the time series to be explained (102) at the start point (112) of the time window of the time window (104) and the function value (115) of the time series to be explained (102) at the end point (114) of the time window of the predetermined time window (104). - Determine (S4) the residual component function (116) between the start point (112) and the end point (114) of the time window relative to the nearest neighbor (108). - When using the linear function component (110) and the residual component function (116), replace (S5) the function segment (118) of the time series to be explained (102) within the time window (104) to generate a replacement time series (120) within the time window (104). - Determine (S6) the anomaly score for the replacement time series (120) within the time window (104) using the detection model; - Compare the anomaly score of the replacement time series (120) within the time window (104) with the anomaly score of the time series to be explained (102) within the time window (104) that can be determined by the detection model (S7) to generate an interpretability curve (122) for the anomaly (100) within the time window (104); and - Optionally, the (S8) action is performed within the production process when the interpretability curve (122) is used.

Images