Method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system
Patent Information
- Application Number
- EP2023794080
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-02-22
- Filing Date
- 2023-10-04
- Publication Date
- 2025-08-20
AI Technical Summary
Current anomaly detection methods in monitoring computer systems, such as those using predefined thresholds and confidence intervals, are insufficient in precision, leading to a high number of false positives and negatives, and fail to adapt to changing system behaviors.
A method that involves determining a residual from an observed time series by removing its predictable part, segmenting the residual into homogeneous segments, and performing statistical analysis on the most recent segment to detect anomalies, using a prediction model trained on reference time series and calculating p-values with the Benjamini Hochberg method to set false positive thresholds.
This approach significantly reduces false positives and negatives, enabling earlier detection of anomalies and proactive incident prevention by accurately identifying abnormal patterns in system performance metrics.
Smart Images
Figure 1.1
Abstract
Description
[0001] Description
[0002] Title of the invention: Method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system.
[0003] GENERAL TECHNICAL FIELD
[0004] The present invention relates to the field of monitoring, in particular in computer data. More specifically, it relates to a method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system.
[0005] STATE OF THE ART
[0006] “Monitoring” is an activity of monitoring and measuring IT activity, with the aim of supervision.
[0007] In particular, we can seek to observe the performance of a computer system, in terms of response time for example, its availability, its integrity, etc.
[0008] Generally speaking, the values of various physical quantities (called "metrics") are measured over time, and we seek to identify or even predict anomalies from these values, so as to put in place alerts and correction mechanisms before an incident. The term "time series" refers to the set of successive values of a metric and the corresponding curve.
[0009] For example, Figure 1 is a time series illustrating the CPU usage rate of a computer system (over a period of one week). Each circle represents an observed anomaly, and on July 19, for example, we see cascading anomalies that led to a brief drop in CPU usage to 0% for a few hours, causing a service interruption. We also see other moderate variations in the rate that may or may not be related to anomalies.
[0010] The naive monitoring solution consists of setting thresholds and detecting when they are crossed, which is insufficient in practice: each system is different and has its own behavior.
[0011] And even assuming that we define individual thresholds, the behavior of the metrics can evolve over time without there being an anomaly, and conversely we can have an anomaly while having a metric that is maintained.
[0012] In the example in Figure 1, we can, for example, set a threshold of 80% CPU usage (below which we consider that we are in the presence of an anomaly) which proves to be relevant in the majority of cases. However, during the initial set of anomalies at dawn on July 19 (which will lead to a cascade of other anomalies and the total interruption of the service) the CPU usage is nevertheless at nearly 95%, and therefore well above the detection threshold.
[0013] Therefore, solutions based on the determination of confidence intervals dynamically have been proposed.
[0014] In particular, application EP3672153 proposes to determine a “residue” corresponding to what remains of a metric once a predictable component (corresponding to normal behavior) has been removed, and to calculate confidence intervals (with thresholds) on these residues.
[0015] This method is satisfactory, but it would be desirable to further improve its precision and thus reduce the number of false positives / negatives.
[0016] PRESENTATION OF THE INVENTION
[0017] The present invention therefore relates, according to a first aspect, to a method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system, the method being characterized in that it comprises the implementation by data processing means of a server of steps of: (a) Determination of a residue corresponding to said observed time series from which a predictable part of said observed time series has been removed;
[0018] (b) Segmentation of the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity;
[0019] (c) For at least the most recent segment, statistical analysis of the distribution of the residual values in said segment so as to conclude whether or not there is an anomaly in the segment.
[0020] According to advantageous and non-limiting characteristics:
[0021] Step (a) comprises determining, from the observed time series, said predictable part; and subtracting said predictable part from the time series, so as to obtain said residual.
[0022] Determining the predictable part includes implementing on the observed time series a prediction model trained on a basis of reference time series of the same physical quantity representative of the system's performance.
[0023] The method comprises a step (aO) of acquiring said observed time series of values of the physical quantity representative of the performance of the system, by the system or by means of monitoring the system.
[0024] Step (b) comprises proposing a plurality of candidate segmentations, in particular each defining a number of different segments, and selecting the candidate segmentation exhibiting said lowest score representative of intra-segment inhomogeneity.
[0025] Step (c) comprises constructing a possible statistical model of the residual values in the segments, and for at least said most recent segment, determining a p-value for said statistical model of the distribution of the residual values in said segment.
[0026] An anomaly is concluded at step (c) if said p-value is below a threshold.
[0027] The threshold is predetermined, in particular 5%. Said threshold is calculated for a desired false positive rate, in particular using the Benjamini Hochberg method.
[0028] The desired false positive rate on the segment for which the p-value is determined is calculated based on a desired false positive rate over the entire time series.
[0029] A first threshold calculated for the desired false positive rate over the entire time series, and a second threshold calculated for the said desired false positive rate over the segment, are successively applied.
[0030] Step (c) comprises constructing a plurality of possible statistical models of the residual values in the segments, and selecting for at least said most recent segment a best model of said plurality for which the p-value is determined, said best model being the one best describing the tails of said distribution of residual values in said most recent segment.
[0031] The method comprises a step (d) of implementing an action if an anomaly is detected on at least one segment.
[0032] Step (d) includes triggering an alert and / or requesting system diagnostic and maintenance equipment.
[0033] According to a second aspect, the invention relates to a server for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system, characterized in that it comprises data processing means configured to:
[0034] - Determine a residual corresponding to said observed time series from which a predictable part of said observed time series has been removed;
[0035] - Segment the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity;
[0036] - For at least the most recent segment, implement a statistical analysis of the distribution of the residual values in said segment so as to conclude whether or not there is an anomaly in the segment.
[0037] According to a third aspect, the invention relates to an assembly of the server according to the second aspect, of the system and of diagnostic and maintenance equipment of the system.
[0038] According to a fourth and a fifth aspect, the invention relates to a computer program product comprising code instructions for executing a method according to the first aspect of detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system; and a storage means readable by computer equipment on which is recorded a computer program product comprising code instructions for executing a method according to the first aspect of detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system.
[0039] PRESENTATION OF FIGURES
[0040] Other characteristics and advantages of the present invention will appear on reading the following description of a preferred embodiment. This description will be given with reference to the appended drawings in which:
[0041] [Fig. 1] Figure 1 previously described represents an example of a time series with the observed anomalies;
[0042] [Fig. 2]Figure 2 is a diagram of a system for implementing the method according to the invention;
[0043] [Fig. 3]Figure 3 is a flowchart representing the steps of a preferred embodiment of the invention; [Fig.4]Figure 4 illustrates the determination of the residual from an example of an observed time series;
[0044] [Fig ,5]Figure 5 represents a case of reference segment constructed on the basis of the current segment being analyzed and the segment very similar in terms of mean and variance already analyzed in the near past;
[0045] [Fig.6]Figure 6 illustrates the segmentation of the residue of the example in Figure 4;
[0046] [Fig ,7]Figure 7 represents a case of reference segment constructed on the basis of the current segment being analyzed and the segment very similar in terms of mean and variance already analyzed in the near past;
[0047] [Fig.8]Figure 8 represents an example of probability density on the segment of Figure 7.
[0048] [Fig.9]Figure 9 illustrates the result of implementing the statistical analysis on the current segment of the example in Figures 4, 6 and 7. The current segment in Figure 9 corresponds to that of Figure 7 fed with more data allowing robust anomaly detection.
[0049] [Fig.10]Figure 10 corresponds to Figure 9 using thresholds calculated for desired false positive rates.
[0050] [Fig.11]Figure 11 is a graph illustrating optimal control of the false positive rate.
[0051] DETAILED DESCRIPTION
[0052] Architecture
[0053] The present invention relates to a method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system 2.
[0054] System 2 is typically a computer server providing a service, for example network equipment, a banking server implementing transactions, industrial control equipment, etc. It is assumed that a physical quantity representative of the performance of said system 2 is available.
[0055] The said physical quantity is naturally chosen in accordance with the nature of the system 2 and the service it provides, for example for network equipment we can take the CPU usage (example of figure 1 described previously), but also a memory usage, a bandwidth, a number of connected users, a number of packets passed, etc. For a banking server, this quantity can be the number of transactions completed, the rate of rejected transactions, etc. For industrial control equipment, it can be a quantity involved in the industrial process such as a temperature, a pressure, etc.
[0056] We will not be limited to a type of system or to a physical quantity, it is just important that said physical quantity is representative of the performance of this system 2, i.e. has meaning for the person skilled in the art with regard to the service provided by the system 2.
[0057] A time series of values of the physical quantity is understood to mean a sequence of values over time, each corresponding to an observation of the system 2, for example one value per minute. Said time series can be seen as a vector of values. Here, we speak of an "observed" time series as being the series of values currently examined, as opposed to "reference" time series which correspond to particular past examples constituting a learning base.
[0058] The observed time series can be directly acquired by the system 2, or by means 20 of monitoring the system 2.
[0059] The said method is a method of detecting anomaly in the time series, that is to say that it aims to determine whether the values are normal or not. More precisely, although there is a normal variability of the values that is expected, as explained before, some values may in practice be abnormal and constitute weak signals that a degradation of the system's performance is in progress or imminent, and we speak of an incident when the system 2 is no longer able to perform its service. In the example of figure 1, a network device whose CPU usage collapses is no longer able to correctly manage the network traffic, and users will quickly experience slowdowns or even disconnections. To rephrase, the incident is the consequence of an anomaly.
[0060] The notion of anomaly is in itself statistical, the causes can be very varied, and the objective of this process is not in itself to determine these causes, but simply to alert and launch corrective actions as soon as possible so as to avoid or at least limit the incident (diagnosis, troubleshooting, starting up a backup system, etc.), as well as to identify and evaluate types of anomalies according to selection filters and appropriate criteria.
[0061] In the case of this detection method, we seek to avoid false negatives (cases in which an anomaly is not detected) and false positives (cases in which we believe we have detected an anomaly but in fact there is nothing).
[0062] With reference to Figure 2, the method is implemented by a server 1 comprising data processing means 11 (typically a processor), and generally data storage means 12 (a memory). The server 1 is also provided with an interface 13 for reporting detected anomalies, this may be an HMI but also means of connection to other diagnostic and maintenance equipment 3 and / or a terminal 4 for example of an administrator.
[0063] The connection between the different equipment (servers 1, 3, system 2, means 20 and / or terminal 4) can be via a communication network 10 such as the Internet.
[0064] Process
[0065] With reference to Figure 3, the present method typically begins with a step (aO) of acquiring said observed time series of values of the physical quantity representative of the performance of the system 2, for example by the means 20. Typically, the performance of the system 2 is observed at regular intervals and a new value completing the series is acquired at each observation. It will be understood that system monitoring is well known to those skilled in the art. In network applications, the order of magnitude is typically one observation per second.
[0066] The series can be provided to server 1 all at once, or value by value (especially in real time) in a queue and reconstituted. The method can also be implemented for each new value obtained. It will be understood from this point of view that the present method can be implemented as well:
[0067] - in isolation for an entire time series, and we seek to detect a posteriori whether the series contained anomalies, or
[0068] - in an iterative manner and in particular in real time, and we then seek to proactively detect for each new observation whether we are in the presence of an anomaly (we seek to detect as early as possible or even anticipate an incident).
[0069] In all cases, the time series is advantageously timestamped, i.e. associated with an initial timestamp (of the first value) and / or a final timestamp (last value) corresponding to the observation times
[0070] In a step (a), which is the first step of processing the observed time series implemented by the data processing means 11 of the server 1, a “residue” of the observed time series is determined. The residue corresponds to said observed time series from which a predictable part, i.e. the prediction error, has been removed. The residue and the predictable part are in themselves time series of values.
[0071] In this respect, step (a) preferably includes:
[0072] - the determination, from the observed time series, of said predictable part, and
[0073] - the subtraction of said predictable part from the observed time series, i.e. for each value of the time series we subtract the corresponding value of the predictable part. This step (a) is in particular illustrated by figure 4: we see from left to right the time series, the predictable part and the residue obtained.
[0074] The idea is to consider that the observed time series is the sum of "normal" and "abnormal" behavior of the physical quantity. Normal behavior is expected, and can therefore be predicted, unlike abnormal behavior, which is random.
[0075] In this respect, we know of artificial intelligence models, and in particular artificial neural networks such as N-beats, capable of predicting time series.
[0076] Thus, in a preferred embodiment, the server 1 has a prediction model taking the observed time series as input and generating said predictable part of the observed time series as output.
[0077] This prediction model can be trained in an unsupervised manner from a learning base of reference time series of the same physical quantity representative of the performance of system 2 (i.e. no label is associated with these reference series), advantageously corresponding to past observations under comparable conditions. Indeed, said physical quantity varies for example naturally during the day, and this “normal” trend can be captured by said prediction model.
[0078] For this, the server 1 can store said learning base on its data storage means 12 and the data processing means 11 can implement the learning of the prediction model, even if it is entirely possible that this is done by a separate server, and the learned model directly retrieved by the server 1.
[0079] It will be understood that such a model and its learning are well known to those skilled in the art; it will be possible to use the N-beats model cited above or, for example, other recurrent networks such as LSTM adapted to the prediction of time series. It will also be possible to consult the application EP3672153 cited above. Originally, in a step (b) the data processing means 11 implement a segmentation of the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity. Inhomogeneity, or heterogeneity, here designates the variability of the law which generates the values which are observed, and in practice the variability of the values of the residue, which is translated for example by changes in the variance. A perfectly homogeneous segment will have a constant residue over its entire extent. On the contrary, a very inhomogeneous segment will have a large extent of residue values.Note that we are only looking at intra-segment inhomogeneity (i.e. within segments), and any inter-segment inhomogeneity (i.e. of one segment compared to another) is not considered here. As an example, Figure 5 represents the values of a time series, and we note the existence of a change in the variance that defines a central segment.
[0080] Segmentation means the division of the residue into n successive segments. It will be understood that, in the same way as the values of the physical quantity, the segments are ordered temporally, and therefore the "last" segment is the most recent.
[0081] Segmentation aims more precisely to determine the n-1 breakpoints which constitute the most abrupt points of change (heterogeneities), and where the boundaries between segments are placed.
[0082] The idea is that we can obtain segments that are themselves homogeneous on which we can implement a high-performance statistical analysis.
[0083] The known techniques in fact implemented a global statistical analysis or a sliding window, and we note that working segment by segment allows us to adapt more precisely to variations in the mean and variance.
[0084] For example, if we take Figure 1, the anomalies on the morning of July 19 were certainly at nearly 95% CPU usage, but we already had a drop and therefore a variance that was too abrupt compared to normal behavior (which is close to the sinusoid - whereas the drop before the total incident is almost linear). The segmentation would have highlighted a specific segment corresponding to this morning of July 19.
[0085] To implement step (b) in practice, any known breakpoint detector can be used, including those used in the context of genetic analysis (e.g., to analyze copy number variations in DNA). See also, for example, the so-called "KernSeg" methods described in the document New efficient algorithms for multiple change-point detection with reproducing kernels, A.Celisse, G. Marot, M. Pierre-Jean, GJRigaill.
[0086] Preferably, the processing means 11 propose a plurality of candidate segmentations, preferably at least one candidate segmentation per value of the number n of segments, then calculate for each the value of said score representative of the intra-segment inhomogeneity. The candidate segmentation presenting said score representative of the lowest intra-segment inhomogeneity is then chosen, i.e. the one which minimizes the score among all the candidate segmentations.
[0087] Regarding the score, we can in particular take a score per segment (for example the deviation from the segment mean, but we can use any cost function that tends towards 0 when the segment tends towards a constant value), and sum the segment scores. However, we will prefer scores based on reproducing kernels, allowing the detection of all types of breaks and not only breaks in the mean (for example changes in variance).
[0088] Figure 6 represents the candidate segmentations obtained for the residue of Figure 4 respectively for n=2, 3 and 4, as well as the corresponding inhomogeneity score. We see that this score has its minimum for n=3, because at n=2 the second segment is too inhomogeneous, and at n=4+ we have too many segments.
[0089] Note that in real-time operation, we generally already know the previous completed segments (due to the iterated implementation of the process) and we have a "current" segment (the most recent). With each new observation, breakpoint detection determines whether we continue the current segment, or whether, on the contrary, a new segment has started (retroactively, the algorithm can fragment the current segment by placing a breakpoint a posteriori several observations before).
[0090] Preferably, at the end of step (b) it is verified that each segment (in particular the current segment) has a size above a predetermined significance score. To rephrase, a segment that is too short may not include enough value to allow a relevant statistical analysis, and this generally happens in real-time operation when a new segment begins.
[0091] If this is the case, we can add to a segment that is too short the values of a similar previous segment for the next step. Of course, as soon as the current segment is long enough due to new observations, we can stop using these previous values.
[0092] For example, in the case of Figure 7, the segmentation obtained again includes three segments but the last one is too short: we only have 12 seconds of observations. If the significance threshold is, for example, 30 seconds, it is necessary to add this third segment to the most similar previous segment, in this case the first. It is then this set of segments that serves as a reference to define normality.
[0093] In step (c), for at least the current segment (and possibly for each segment if the entire series is processed a posteriori), the distribution of the values of the residual in said segment is statically analyzed so as to conclude whether or not there is an anomaly. If the method is implemented in real time, step (c) only concerns the current segment (because it is assumed that the previous segments have already been analyzed as they were), but alternatively, if the entire series is processed a posteriori, step (c) is implemented for each segment identified in step (b).
[0094] Classically, the residual should have a Gaussian distribution of values, i.e. in accordance with a centered normal law (around 0), and we check whether the observed distribution is compatible with such a law in probabilistic terms. In more realistic cases, the distribution obtained is not always Gaussian, the statistical analysis of the residuals and the detection of anomalies is then more difficult with classical methods.
[0095] The statistical analysis thus aims to determine whether the observed distribution is "explainable" by statistical fluctuations, or on the contrary that it is not and therefore that we are in the presence of an anomaly. Any known method may be used, and in particular those cited in application EP3672153, but advantageously, at least one possible statistical model of the values of the residue in the segments is constructed.
[0096] We can have several candidate models corresponding to several possible distributions, and progressively update these models as we receive observations.
[0097] Preferably, the model(s) are evaluated by their ability to describe the extreme parts of the distribution, called "tails". It is more common to select models by their ability to accurately describe the entire distribution, but such models are biased in favor of the central part and against the tail of the distribution. However, it is precisely in the tail of the distribution that any anomalies are observed that we wish to capture.
[0098] The model or a “best model” if there are several, is chosen and used to determine alert thresholds on the residual values.
[0099] For example, we can use the "p-value", which designates the probability for the chosen statistical model to obtain an error as large as the observed error (i.e. the value of the residual). Thus, a low p-value corresponds to an abnormally high prediction error, and therefore that we are in the presence of an anomaly. Traditionally, a p-value threshold of 5% is used.
[0100] Estimating the p-value typically involves Kernel Density Estimation (KDE) applied to the tail of the distribution, which estimates the probability density of the residual by smoothing the estimate more or less, and the Grimshaw procedure (Computing Maximum Likelihood Estimates for the Generalized Pareto Distribution, Scott D. Grimshaw).
[0101] Figure 8 represents for a segment the probability density estimated by KDE with the corresponding p-value thresholds.
[0102] Visually, the corresponding value thresholds can be plotted on the residual: if a threshold is exceeded, an anomaly is observed, see Figure 9. However, it should be understood that the p-value can simply be determined and compared to the threshold, without recalculating the residual value thresholds.
[0103] As explained the threshold can be predetermined, for example 5%, but alternatively it is calculated for a desired false positive rate on the segment considered (in particular the most recent segment), so as to be more adequate to decide on the existence of anomalies.
[0104] For this, we can use the Benjamini-Hochberg method, which defines the threshold 0 a for a desired false positive rate, using the following formula:
[0105] P(k): 1a k-th smallest p-value of the analyzed series m: Size of the analyzed series
[0106] The skilled person will be able to find alternative methods.
[0107] Preferably, one can even use a modified version of the Benjamini-Hochberg method:
[0108] - the desired false positive rate on the segment considered (called local rate) can be predetermined, but alternatively what can be predetermined is a desired false positive rate over the entire time series (called global rate). Indeed, if we use the threshold 0 athen we can guarantee that the false positive rate will be lower than a on the segment but this is insufficient to guarantee control over the false positive rate in the complete series, this is why we can apply to the segment a second threshold 0a' calculated for a value a' corresponding to a slight variation of the global rate a so as to guarantee said desired false positive rate over the entire time series (i.e. said desired false positive rate on the segment for which the value p is determined is calculated as a function of the desired false positive rate over the entire time series), as illustrated in Figure 10, in order to control the false positive rate of the overall time series analyzed by controlling the false positive rate of its sub-series.
[0109] In particular, we can start by calculating and applying the first threshold 0 to the segment considered afor the desired rate a over the entire time series (with the standard Benjamini-Hochberg method), calculate a proportion li of anomalies, and apply the where m' is the size of the local sub-series (i.e. the number of values of the physical quantity in the segment). The second threshold 0 a ' is then calculated for the segment by applying the Benjamini-Hochberg method again but taking the rate a'.
[0110] In summary, in the preferred embodiment: o a first threshold 0 a is calculated for a desired false positive rate a over the entire time series (predetermined), and applied to the segment considered; o a desired false positive rate a' over the segment considered is calculated as a function of the desired false positive rate a over the entire time series (and the result of the application of the first threshold 0 ato the segment); o a second threshold 0a' is calculated for said desired false positive rate a' on the segment considered, and applied to the segment considered.
[0111] - the reference size can be modified so as to ensure that the error made on the estimation of the p-value does not prevent control of the false positive rate, both locally and globally. Indeed, the number of points in the reference set must be chosen judiciously to best control false positives. We can see in Figure 11 that the control is in particular optimal for a reference size Ni chosen in the following way: N, = l — 1, a where the index I is a hyperparameter chosen by the user. It is a positive integer (usually 1 or 2) that controls the size of the reference set. Choosing a larger reference set reduces the number of false negatives but increases the computation time.
[0112] In all cases, the method advantageously comprises a step (d) of implementing an action if an anomaly is detected on at least one segment:
[0113] - at least one alert to be triggered on an interface 13 of server 1 or a connected terminal 4
[0114] - preferably, the possible diagnostic and maintenance equipment 3 of the system 2 is requested, i.e. a request is sent to it, so that the latter implements tests to determine the nature of the anomaly, or even resolve it, if possible even before an incident occurs.
[0115] Results
[0116] This method has been tested for proactive detection of anomalies on a system 2 of network equipment type such as a denial of service (DDoS) attack.
[0117] We see that server 1 manages to detect the anomaly 15 minutes earlier than using known methods with predefined thresholds.
[0118] Server, system
[0119] According to a second aspect, the invention relates to the server 1 for implementing the method according to the invention. This server for detecting anomaly in an observed time series of values of a physical quantity representative of the performance of a system 2 comprises data processing means 11, and generally data storage means 12, for example storing a base of observed time series of values of said physical quantity representative of the performance of the system 2, and an interface 13.
[0120] The means 11 are configured to:
[0121] - Determine a residual corresponding to said observed time series from which a predictable part of said observed time series has been removed;
[0122] - Segment the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity;
[0123] - For at least the most recent segment, implement a statistical analysis of the distribution of the residual values in said segment so as to conclude whether or not there is an anomaly in the segment.
[0124] - Advantageously, implement an action if an anomaly is detected on at least one segment
[0125] According to a third aspect, a set of the server 1 and the system 2 is proposed. The set may possibly comprise means 20 for monitoring the system 2, equipment 3 for diagnosing and maintaining the system 2 and / or a terminal 4. All of these elements 1, 2, 20, 3, 4 may be connected via a network 10.
[0126] Computer program product
[0127] According to a fourth and a fifth aspect, the invention relates to a computer program product comprising code instructions for the execution (in particular on the data processing means 11) of a method according to the first aspect of the invention for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system, as well as storage means readable by computer equipment (a memory 12 of the server 1) on which this computer program product is found.
Claims
CLAIMS
1. Method for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system (2), the method being characterized in that it comprises the implementation by data processing means (11) of a server (1) of steps of: (a) Determination of a residual corresponding to said observed time series from which a predictable part of said observed time series has been removed; (b) Segmentation of the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity; (c) For at least the most recent segment, statistical analysis of the distribution of the residual values in said segment so as to conclude whether or not there is an anomaly in the segment.
2. The method of claim 1, wherein step (a) comprises determining, from the observed time series, said predictable portion; and subtracting said predictable portion from the time series, so as to obtain said residual.
3. Method according to claim 2, in which the determination of the predictable part comprises the implementation on the observed time series of a prediction model trained on a basis of reference time series of the same physical quantity representative of the performances of the system (2).
4. Method according to one of claims 1 to 3, comprising a step (aO) of acquiring said observed time series of values of the physical quantity representative of the performance of the system (2), by the system (2) or by means (20) of monitoring the system (2).
5. Method according to one of claims 1 to 4, in which step (b) comprises the proposal of a plurality of candidate segmentations, in particular each defining a number of different segments, and the selection of the candidate segmentation having said score representative of the lowest intra-segment inhomogeneity.
6. A method according to one of claims 1 to 5, wherein step (c) comprises constructing a possible statistical model of the residual values in the segments, and for at least said most recent segment, determining a p-value for said statistical model of the distribution of the residual values in said segment.
7. A method according to claim 6, wherein an anomaly is concluded in step (c) if said value p is below at least one threshold.
8. A method according to claim 7, wherein said threshold is either predetermined, in particular 5%, or calculated for a desired false positive rate on the segment for which the p-value is determined, in particular using the Benjamini Hochberg method.
9. The method of claim 8, wherein said desired false positive rate over the segment for which the p-value is determined is calculated based on a desired false positive rate over the entire time series.
10. A method according to any one of claims 6 to 9, wherein step (c) comprises constructing a plurality of possible statistical models of the residual values in the segments, and selecting for at least said most recent segment a best model of said plurality for which the p-value is determined, said best model being the one best describing the tails of said distribution of residual values in said most recent segment.
11. Method according to one of claims 1 to 10, comprising a step (d) of implementing an action if an anomaly is detected on at least one segment.
12. Method according to claim 11, in which step (d) comprises triggering an alert and / or requesting equipment (3) for diagnosis and maintenance of the system (2).
13. Server (1) for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system (2), characterized in that it comprises data processing means (11) configured to: - Determine a residual corresponding to said observed time series from which a predictable part of said observed time series has been removed; - Segment the residue into a plurality of successive segments minimizing a score representative of the intra-segment inhomogeneity; - For at least the most recent segment, implement a statistical analysis of the distribution of the residual values in said segment so as to conclude whether or not there is an anomaly in the segment.
14. Assembly of the server (1) according to claim 13, of the system (2) and of equipment (3) for diagnosis and maintenance of the system (2).
15. Computer program product comprising code instructions for executing a method according to one of claims 1 to 12 of detection of anomaly in an observed time series of values of a physical quantity representative of the performance of a system (2), when said program is executed on a computer.
16. Storage means readable by computer equipment on which is recorded a computer program product comprising code instructions for the execution of a method according to one of claims 1 to 12 for detecting an anomaly in an observed time series of values of a physical quantity representative of the performance of a system (2).