Method and device for detecting anomalies and determining associated explanations in time series data

Abstract

Method and device for detecting anomalies and determining associated explanations in time series of data. The invention relates to a method and device for detecting anomalies and determining associated explanations in time series of data, each time series having an associated duration and comprising a number N of operating values ​​of equipment or a system.The process comprises the following steps: - projection (40), for each time series, of the time series values ​​onto a number M of basis functions and obtaining a descriptive vector of size M, - training (42) a parameterized anomaly determination model, by machine learning, on calculated descriptive vectors, - application (44) of this model to the descriptive vectors and obtaining an anomaly score per time series, - determination (46) of a subset of time series containing an anomaly, and for each time series of said subset, determination (48) of at least some of the values ​​of said descriptive vector that influence the obtaining of the anomaly score of said time series. Figure for the abstract: Figure 2.

Description

Title of the invention: Method and device for detecting anomalies and determining associated explanations in time series data

[0001] The present invention relates to a method for detecting anomalies and determining associated explanations in time series of data, an associated device and an associated computer program.

[0002] The invention lies in the field of determining anomalies from data values, and explaining these anomalies, enabling the exploitation of the results by operators.

[0003] The invention finds particular applications in various technical fields, in particular in the detection and explanation of malfunctions of any type of equipment with a view to the application of effective maintenance or predictive maintenance.

[0004] In this case, time series of data are provided by sensors that collect environmental or operating values ​​of industrial equipment at given time intervals.

[0005] The monitored equipment includes, for example, industrial machines set in motion by electric motors, or GPU graphics processors in a processor farm, or equipment of a smart electrical grid.

[0006] The invention also applies in the field of cybersecurity, to determine anomalies in access requests to a computer system from the same IP address, making it possible to detect a cyber-attack.

[0007] In these various fields, very large volumes of data containing representative values ​​of the operation of the system or equipment observed are collected over time. This data, in its raw form, constitutes a very large volume of data, which is not usable by a human operator for anomaly detection and preventive or maintenance intervention following such anomaly detection.

[0008] In recent years, various computational methods, particularly those based on the application of artificial intelligence, have been implemented to analyze large volumes of data in order to detect potential anomalies. However, artificial intelligence algorithms operate like a "black box," generally incomprehensible to human operators.

[0009] An additional difficulty arises for the processing of time series, the tools known at present being statistical tools which are not adapted for taking into account time series.

[0010] There is therefore a need to provide anomaly detection and associated explanations on time series of data, to enable adequate support, in particular predictive maintenance in the case of equipment operation monitoring.

[0011] To this end, the invention proposes, according to one aspect, a method for detecting anomalies and determining associated explanations in time series of data, each time series having an associated duration and comprising a number N of operating values ​​of a piece of equipment or a system, recorded at regular intervals during said duration. The method comprises steps implemented by a computing processor of: - for each time series, projection of the values ​​of said time series onto a number M of basis functions and obtaining a descriptive vector of said time series of size M, - training a parameterized anomaly determination model, by machine learning on at least a portion of the calculated descriptive vectors, said anomaly determination model allowing the calculation of an anomaly score per descriptive vector, - application of the anomaly determination model to the descriptive vectors of the time series and obtaining an anomaly score per time series, - determination of a subset of time series containing an anomaly by comparing the anomaly score of each time series to a predetermined anomaly threshold; - for each time series of said subset, determination, from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series.

[0012] Advantageously, the proposed anomaly detection and associated explanation determination method relies on descriptive vectors of time series of data, and makes it possible to obtain a subset of time series in anomaly and for each, one or more data values ​​of the time series having an influence on the score obtained.

[0013] The anomaly detection and associated explanation determination method according to the invention may also have one or more of the following characteristics: below, taken independently or according to all technically feasible combinations.

[0014] The determination, from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series involves a calculation of a level of influence in obtaining the influence score for each component of said descriptive vector.

[0015] The calculation of an influence level implements a calculation of Shapley values, said influence level being equal to the Shapley value calculated for each component of said descriptive vector.

[0016] The determination, from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series comprises, for an initial descriptive vector, a calculation of at least one alternative descriptive vector, said alternative descriptive vector having at least one component distinct from the component of the same rank in the initial descriptive vector, having an associated anomaly score, obtained by the application of said parameterized anomaly determination model, lower than the anomaly threshold, and being such that a distance between the initial descriptive vector and the alternative descriptive vector is less than a predetermined distance threshold.

[0017] The method further comprises determining at least one alternative time series from the alternative descriptive vector, the projection onto said basis of chosen functions of said alternative time series allowing to obtain said alternative descriptive vector.

[0018] The basic functions are functions of a wavelet transformation basis or B-Spline functions.

[0019] The method is implemented on time series, comprising at least a first time series and at least a second time series of operating values ​​of equipment or a system, collected over successive time periods comprising at least a first time period and a second time period, following the first time period, and the method comprises:

[0020] - obtaining a first anomaly score for a descriptive vector determined for a time series over the first time period, by implementing an anomaly determination model parameterized by parameters calculated for said first time period,

[0021] - obtaining a second anomaly score of a descriptive vector determined for a time series of a time series over the second time period by implementing the anomaly determination model parameterized by parameters calculated for said first time period, and

[0022] -a determination of the evolution of the anomaly score for said equipment or system, consisting of calculating a difference between the second calculated anomaly score and the first calculated anomaly score.

[0023] The method further includes an update of the parameters of the anomaly determination model parameterized on said second time period.

[0024] According to another aspect, the invention relates to a device and method for detecting anomalies and determining associated explanations in time series of data, each time series having an associated duration and comprising a number N of operating values ​​of equipment or a system, recorded at regular intervals during said duration, the device comprising a computing processor configured to implement: - a projection module, for each time series, of the values ​​of said time series onto a number M of basis functions and obtaining a descriptive vector of said time series of size M, - a training module for a parameterized anomaly determination model, using machine learning on at least a portion of the calculated descriptive vectors, said anomaly determination model allowing the calculation of an anomaly score per descriptive vector, - a module applying the anomaly determination model to the descriptive vectors of time series and obtaining an anomaly score per time series, - a module for determining a subset of time series containing an anomaly by comparing the anomaly score of each time series to a predetermined anomaly threshold; - a determination module, for each time series of said subset, from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series.

[0025] According to another aspect, the invention relates to an information storage medium, on which software instructions are stored for the execution of an anomaly detection and associated explanation determination method as briefly described above, when these instructions are executed by a programmable electronic device.

[0026] According to another aspect, the invention relates to a computer program comprising software instructions which, when implemented by a programmable electronic device, implement a method for determining an anomaly and providing an associated explanation as briefly described above.

[0027] Other features and advantages of the invention will become apparent from the description given below, by way of example and not limitation, with reference to the accompanying figures, among which:

[0028] [Fig-1] [Fig.1] illustrates an operating monitoring system equipment implementing the invention according to a first embodiment;

[0029] [Fig.2] [Fig.2] is a synoptic diagram of the main steps of a first mode of implementation of a process for determining anomalies and providing associated explanations;

[0030] [Fig.3] [Fig.3] is a synoptic diagram of the main steps of a second mode of implementation of a process for determining anomalies and providing associated explanations.

[0031] The invention will be described below in its application in the field of detecting malfunctions of equipment from data series which include values ​​taken by sensors.

[0032] It is understood that the invention is not limited to this application, and can also be applied, in an analogous manner, for the detection of anomalies and the determination of associated explanations in time series representative of the operation of a system, for example network accesses or disk accesses in a computer system.

[0033] Fig. 1 schematically illustrates a system 2 for monitoring the operation of equipment 4i to 4P, this equipment being, in an example application, electric motors of the same type and operating in parallel under similar conditions.

[0034] The number P is any integer, for example P=100.

[0035] The operational monitoring system 2 performs the detection of operational anomalies, for example for predictive maintenance of equipment.

[0036] Each piece of equipment 4; is associated with sensors 6i, 8i, configured to measure operating data of the equipment 4; at regular time intervals.

[0037] By way of non-limiting example, the sensors 6; are temperature sensors, adapted to measure the temperature in or near each engine 4;, and the sensors 8; are piston speed sensors of each engine 4;.

[0038] For example, each sensor provides a measurement value every minute, and values ​​are grouped into respective time series of temperature and piston speed, each time series being associated with a given time duration D, for example equal to 24 hours (24h), or in other words, one day.

[0039] In this example, each time series comprises N=1440 values, which are operating values ​​of the associated equipment.

[0040] Of course, the time duration D is chosen, and can be any, e.g. a few minutes, an hour, a few hours, several days etc.

[0041]

[0042]

[0043]

[0044]

[0045]

[0046]

[0047]

[0048]

[0049]

[0050]

[0051]

[0052]

[0053]

[0054]

[0055] Thus, for equipment 4; with index i, we obtain the following for time series: Temp^ {fij, .... 4 A ,} Pistori^p^, ...,¾N} Where k represents the 24-hour period considered. For example, for each piece of equipment, we obtain several time series that follow one another in time, for example k=1 for a first period of 24h, k=2 for the following 24h period and so on. Of course, the number of sensors used is variable, for example ranging from 1 to any number of sensors. When only one sensor is used per device, only one time series is obtained per device and per measurement period. In this case, the time series are said to be univariate. When multiple sensors are used, multiple time series are obtained per device and per period. In this case, the time series are called multivariate. System 2 further includes an anomaly detection and associated explanation determination device 14, which is a programmable electronic device, for example a computer. The device 14 comprises an electronic memory unit 16, at least one processing unit 18, and a communication interface 20 with remote devices, using a chosen communication protocol, for example, a wired and / or radio communication protocol. The elements of the device 14 are adapted to communicate via a communication bus 15. The 6i, 8i sensors are suitable for transmitting measurement data to device 14, for example via a radio or wired communication link. The respective time series and received PistOïi^ data are stored, in appropriate form 10ijk, 12i>k, in an electronic memory 16 of the device 14. Each stored time series with index i contains N values ​​representing the operation of the equipment 4; during a period of duration D. The computing processor 18 is configured to implement a projection module 22, configured to project the values ​​of a time series onto a number M of basis functions in order to obtain a descriptive vector, of size M, of the time series. The number M is configurable and is less than or equal to the number N of values ​​in a time series. The processor 18 is further configured to implement a training module 24 for an algorithm, implementing a parameterized model, of Anomaly detection is performed using machine learning on at least a portion of the calculated descriptive vectors. The anomaly detection algorithm calculates an anomaly score for each descriptive vector.

[0056] For example, module 24 implements the training of the parameters of an anomaly determination model known as an isolation forest (from the English "isolation forest"), known in the field of machine learning algorithms.

[0057] The training implemented is unsupervised, in other words it is carried out solely from the data collected without the use of examples previously labeled by experts.

[0058] Furthermore, the processor 18 implements a module 26 for applying the anomaly determination model, with parameters determined by learning, to the descriptive vectors of the time series to calculate an anomaly score for each time series. The anomaly score is a value representative of the presence of an anomaly in the processed data. In one embodiment, the higher the anomaly score for a given piece of equipment, the more abnormal the observed operation is considered to be.

[0059] The processor 18 also implements a module 28 for determining a subset of time series with an anomaly, implementing a comparison of the anomaly score of each time series to a predetermined anomaly threshold to determine a subset of time series with an anomaly, and a module 30 for determining, for each time series with an anomaly, from its descriptive vector, at least a part of the values ​​of the descriptive vector having an influence in obtaining the anomaly score of said time series.

[0060] In particular, module 30 makes it possible to provide an explanation, more easily understood and usable by a human operator, of the source of the observed anomaly. This notably allows for predictive maintenance, for example by determining a cause of equipment malfunction that results in an observed anomaly in the observed time series data.

[0061] Module 30 implements, in one embodiment, an algorithm for calculating, for a given time series, an influence level for each component of the descriptive vector and / or for calculating one or more alternative time series, the alternative time series being calculated from said given time series and respecting predetermined rules, the alternative time series having an anomaly score in the "normal" operating range, in particular an anomaly score lower than the predetermined anomaly threshold. Such an alternative time series is also called counter-example or counterfactual time series (in English "counterfactual series").

[0062] Several embodiments of modules 22, 24, 26, 28 and 30 will be described below.

[0063] In one embodiment, modules 22, 24, 26, 28 and 30 are implemented in the form of software instructions forming a computer program, which, when executed by a programmable electronic device, implements an anomaly detection and explanation determination method according to the invention.

[0064] In an alternative not shown, modules 22, 24, 26, 28 and 30 are each implemented as programmable logic components, such as FPGAs (Field Programmable Gate Arrays), microprocessors, GPGPUs (General-purpose processing on graphics processing), or dedicated integrated circuits, such as ASICs (Application-Specific Integrated Circuits).

[0065] The computer program comprising software instructions is further capable of being stored on a non-transient, computer-readable information storage medium. This computer-readable medium is, for example, a medium capable of storing electronic instructions and being connected to a bus of a computer system. By way of example, this medium is an optical disc, a magneto-optical disc, a ROM, a RAM, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), a magnetic card, or an optical card.

[0066] More detailed embodiments of modules 22, 24, 26, 28 and 30 will be described below.

[0067] The anomaly detection and associated explanation determination device 14 is further connected to a human-machine interface 32, enabling data to be displayed in a form interpretable by an operator. For example, the human-machine interface 32 includes a display screen.

[0068] According to one embodiment, the human-machine interface 32 is part of the device 14.

[0069] According to one variant, the human-machine interface is remote from device 14.

[0070] In particular, this allows the display of data relating to anomalies in the monitored equipment, and explanations relating to the anomalies detected, in particular information obtained by module 30. For example, the display of alternative time series makes it easier for an operator to understand which values ​​of the observed time series induce an anomaly score higher than the anomaly threshold, and consequently which maintenance actions need to be undertaken.

[0071] Fig. 2 is a synoptic diagram of the main steps of a first embodiment of the anomaly detection and associated explanation determination process.

[0072] In this first embodiment, the detection is applied to time series of stored data; in other words, it is an anomaly detection and an associated explanation determination that is carried out a posteriori.

[0073] The results obtained relating to the detection of anomalies and their explanations are applicable, for example, for the calibration of equipment.

[0074] The method is applied in this embodiment to previously stored time series, for example on P observed equipment, over K successive observation time periods, each time series comprising N operating values ​​of one of the equipment over an observation time period.

[0075] By way of non-limiting example, P=100, K=1 and the duration of a time period is 24h, a time series comprising values ​​taken every minute, N=1440.

[0076] Alternatively, the method also applies with time series comprising measured values ​​for a piece of equipment, over a number K, for example K=100, of successive time series.

[0077] By way of non-limiting example, it is assumed that each piece of equipment is equipped with a temperature sensor, and the operating values ​​taken are temperature values.

[0078] In this first embodiment, the process includes a step 40 of applying, for each of the stored time series, a projection onto a basis of M chosen functions.

[0079] The number M is a parameter whose value indicates a depth of projection.

[0080] Preferably, M is strictly less than N.

[0081] For example M is less than half of N.

[0082] For example, M is fixed at a predetermined value, for example between 5 and 10, and for example equal to 8, for any N greater than this predetermined value.

[0083] In one embodiment, the chosen function basis is a wavelet transformation basis, for example the Haar wavelet basis, well known in the field of signal processing.

[0084] A subset of M functions of the Haar wavelet basis of size N is chosen to apply the projection, for example the first M functions of the basis. For example M=8.

[0085] According to one variant, the function base used is a B-Spline function base.

[0086] Let X be a time series of N values: x ) and let H be a matrix formed from M basis functions forming a projection basis. The matrix H is of size MxN, where M is the number of rows and N is the number of columns.

[0087] The projection of X onto H is carried out by calculating the scalar product between H and X, and the result is a vector d, called the descriptive vector of the time series X, of size M.

[0088] In general terms:

[0089] d = H*X

[0090] With = c^a9ue comPosante d; of the descriptive vector d is a descriptive variable of the associated time series X.

[0091] By way of a simplified numerical example, the matrix H is as follows, for example dimensions N=8 and M=5:

[0092] 11111111' 11110000 H= 00001111 11 00 00 00 >00 1 10000.

[0093] Projection step 40 is applied to each time series to obtain a descriptive vector of the time series.

[0094] The descriptive vectors obtained are temporarily stored in an electronic memory of the programmable electronic device implementing the process.

[0095] The method also includes a step 42 of unsupervised learning of the parameters of an anomaly determination model, for the implementation of an anomaly determination algorithm, on at least a part of the calculated descriptive vectors.

[0096] Preferably, all descriptive vectors calculated in the projection step 40 are used.

[0097] Preferably, an isolation forest type machine learning algorithm is implemented.

[0098] Alternatively, another unsupervised anomaly detection method, producing an anomaly score, is used, for example the method known as "local factor outlier".

[0099] The anomaly determination algorithm takes as input a descriptive vector of size M and provides as output an anomaly score, allowing the potential presence of anomalies to be inferred in the time series data associated with the descriptive vector.

[0100] For example, the anomaly scores obtained at output are normalized between a minimum and a maximum value. The closer the anomaly score is to the maximum value, the higher the value. The closer the anomaly score is to the maximum value, the more likely the presence of an anomaly is, and conversely, the closer the anomaly score is to the minimum value, the more it is considered to be a "normal" functioning.

[0101] The learning step 42 is followed by a step 44 of application of the algorithm implementing the anomaly determination model parameterized to each descriptive vector to calculate the associated anomaly score.

[0102] Thus, for each time series processed, an associated anomaly score is obtained, using the descriptive vector of the time series.

[0103] In one embodiment, an anomaly score is thus obtained for each piece of equipment observed.

[0104] The process then includes a step 46 of comparing each calculated anomaly score to a predetermined or dynamically calculated anomaly threshold.

[0105] The predetermined anomaly threshold is between the minimum and maximum values ​​of the anomaly score. For example, if the score is between 0 and 1, the anomaly threshold is set at 0.5.

[0106] According to one variant, a percentage P is fixed, for example P=10%, and the abnormal scores are considered to be the P highest scores. An anomaly threshold value is derived from this.

[0107] According to another variant, the calculated anomaly scores are ranked from smallest to largest (or vice versa), and deviations between anomaly scores are calculated. For example, the abnormal scores are those with the largest deviation. For example, if the scores are respectively {0.1; 0.2; 0.3; 0.7; 0.8}, the abnormal scores are 0.7 and 0.8, with the largest deviation being between 0.3 and 0.7.

[0108] If the anomaly score is greater than the predetermined or dynamically calculated anomaly threshold, the corresponding time series is labeled as having an anomaly.

[0109] A subset of anomaly time series (i.e. containing an anomaly) relative to the predetermined anomaly threshold is thus obtained, if necessary.

[0110] In the case where an anomaly score is obtained per observed equipment, similarly a subset of equipment in anomaly relative to the predetermined anomaly threshold is thus obtained.

[0111] The process then includes a step 48 for explaining the detected anomalies. For each time series in the subset of time series with anomalies, step 48 implements a determination, from the descriptive vector of said time series, of at least a part of the values ​​of the time series having an influence in obtaining the anomaly score.

[0112] In the embodiment of [Fig.2], step 48 comprises two substeps, a first substep 50 of calculating the level of influence of each component of the a descriptive vector of the time series under consideration and a step 52 of calculating one or more alternative time series, each alternative time series being a counterexample or counterfactual time series. Each alternative time series is a series that the anomaly detection algorithm would have classified as normal, and each alternative series is close to the original series.

[0113] Substep 50 implements a calculation of Shapley values ​​for each component of the descriptive vector, each Shapley value providing a level of influence of that component.

[0114] From the level of influence of each component of the descriptive vector it is possible to calculate a level of influence associated with each value of the time series associated with the descriptive vector.

[0115] Shapley values ​​are initially used for payoff distribution in the field of cooperative games in game theory, and their application in the field of machine learning is known.

[0116] The formula for calculating the Shapley values ​​for each element of a set of elements is known.

[0117] In its application here, the element set is the set of components of a descriptive vector, and the associated function is the anomaly determination model (i.e. the anomaly score obtained).

[0118] In the present case, a gain value is calculated for each component of the descriptive vector in the anomaly determination model.

[0119] Thus, a level of influence is obtained per component of the descriptive vector.

[0120] Substep 52 implements an alternative time series calculation.

[0121] In one embodiment, substep 52 applies to a given descriptive vector, called here the initial descriptive vector, a calculation of at least one alternative (or counterexample) descriptive vector.

[0122] The initial descriptive vector has an associated anomaly score greater than the anomaly threshold.

[0123] An alternative descriptive vector has an associated anomaly score lower than the anomaly threshold. Thus, the alternative descriptive vector has at least one component distinct from the component of the same rank in the initial descriptive vector.

[0124] Moreover, the initial descriptive vector and the alternative descriptive vector are close in the sense of a distance, for example the Euclidean distance, in other words the distance between the initial descriptive vector and the alternative descriptive vector is less than a predetermined distance threshold.

[0125] In addition, a likelihood condition of the alternative descriptive vector is applied, for example as a function of the anomaly score calculated by the anomaly determination algorithm.

[0126] The calculation of an alternative descriptive vector (or counterexample) is carried out using a known method, for example using the method described in the article "Model-agnostic and Scalable Counterfactual Explanations via Reinforcement Learning" by RF Samoilescu et al, published in June 2021.

[0127] Alternatively, any other alternative descriptive vector calculation method may be applied.

[0128] From an alternative descriptive vector, one or more alternative time series are calculated, i.e., the projection onto the basis of chosen functions allows us to obtain the alternative descriptive vector, by applying an inverse transformation.

[0129] The alternative time series(s) contain different values ​​from the initial time series. These different values ​​are highlighted and indicated to the operator.

[0130] This allows us to better understand the anomaly observed and to remedy it.

[0131] Fig. 3 is a synoptic diagram of the main steps of a second embodiment of the anomaly detection and associated explanation determination process.

[0132] In this second embodiment, detection is applied to time series of data collected as they are collected, almost in real time, and takes into account the evolution of the anomaly scores calculated for each monitored piece of equipment.

[0133] The results obtained relating to the detection of anomalies and their explanations are applicable, for example, to predictive maintenance and failure avoidance.

[0134] The method is applied to time series collected over successive PER_k time periods, for each monitored equipment.

[0135] For example, in the univariate case, during each time period, a time series of data collected by a sensor associated with a piece of equipment is processed.

[0136] In this embodiment, each time period has an associated duration, which is for example on the order of one to several hours.

[0137] For example, the duration of the time period is less than the duration of the time period chosen in the first embodiment.

[0138] The time series of values ​​measured during a first time period Per_l are obtained.

[0139] In a first processing step 60, these first time series are processed as in the first embodiment. In other words, the first processing step 60 implements steps analogous to steps 40 to 48 described previously.

[0140] The parameters of the anomaly determination model, implemented by the anomaly determination algorithm, learned during the learning step 42 are stored.

[0141] Next, an index k of the following time period is set to the value k=2 at step 62.

[0142] Time series containing values ​​measured during the period Per_k are processed in a second processing step 64.

[0143] The second processing step 64 implements a projection 66 of the time series onto the M chosen basis functions allowing to obtain a descriptive vector per time series of the period Per_k.

[0144] Step 66 is followed by step 68, which applies the anomaly determination model, this model being parameterized by the previously learned parameters. For each descriptive vector associated with a piece of equipment, an anomaly score is calculated for the period Per_k.

[0145] The method also includes a step 70 for determining the evolution of the anomaly score for each observed piece of equipment. For example, for a piece of equipment with index i, step 70 performs a calculation of the difference between the anomaly score calculated for the period Per_k-1 and the anomaly score calculated for the period Per_k.

[0146] This difference calculation makes it possible to detect variations in the anomaly score for the same equipment, and consequently to detect drifts or a rate of equipment degradation, even before the anomaly threshold is reached. Advantageously, this makes it possible to anticipate potential degradations, and therefore to optimize predictive maintenance.

[0147] The process further comprises a third processing step 72, implemented on the time series obtained for the period Per_k, which is analogous to the first processing step.

[0148] In other words, the third processing step 72 implements steps analogous to steps 40 to 48 described previously.

[0149] In particular, during the third processing step 72, the parameters of the anomaly determination model are updated by the learning step (analogous to step 42).

[0150] The parameters of the anomaly determination model learned during the learning step on the descriptive vectors of the time series of period Per_k are stored.

[0151] The third processing step is followed by a repetition of steps 64 to 72 for a subsequent time period, with the index k being incremented.

[0152] Thus, advantageously, the method makes it possible to obtain, over successive time periods, a calculation of anomaly scores and a determination of explanation associated, a detection of equipment in anomaly, as well as a detection of the evolution of anomaly scores, for the same equipment, over several successive time periods.

Claims

1. Demands A method for detecting anomalies and determining associated explanations in time series of data, each time series having an associated duration and comprising N operating values ​​of equipment or a system, recorded at regular intervals during said duration, the method being characterized in that it comprises steps implemented by a computing processor: for each time series, projection (40) of the values ​​of said time series onto a number M of basis functions and obtaining a descriptive vector of said time series of size M, said basis functions being functions of a wavelet transformation basis or B-Spline functions, training (42) of a parameterized anomaly determination model, by machine learning on at least a part of the calculated descriptive vectors, said anomaly determination model allowing the calculation of an anomaly score per descriptive vector, application (44) of the anomaly determination model to the descriptive vectors of the time series and obtaining an anomaly score per time series, determination (46) of a subset of time series containing an anomaly by comparing the anomaly score of each time series to a predetermined anomaly threshold;for each time series of said subset, determination (48), from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series, the determination comprising, for an initial descriptive vector,; • a calculation of at least one alternative descriptive vector, said alternative descriptive vector comprising at least one component distinct from the component of the same rank in the initial descriptive vector, having an associated anomaly score, obtained by applying said parameterized anomaly determination model, lower than the anomaly threshold, and being such that a distance between the initial descriptive vector and the alternative descriptive vector is less than a predetermined distance threshold, and

2.

3.

4. • a determination of at least one alternative time series from the alternative descriptive vector, the projection onto said basis of chosen functions of said alternative time series allowing to obtain said alternative descriptive vector, the alternative time series or series having different values ​​from the values ​​of the initial time series, these different values ​​being highlighted and indicated to an operator. Method according to claim 1, wherein the determination (48), from the descriptive vector of said time series, of at least a part of the values ​​of said descriptive vector having an influence in obtaining the anomaly score of said time series comprises a calculation (50) of a level of influence in obtaining the influence score for each component of said descriptive vector. A method according to claim 2, wherein the calculation of an influence level implements a calculation of Shapley values, said influence level being equal to the Shapley value calculated for each component of said descriptive vector. A method according to any one of claims 1 to 3, implemented on time series comprising at least a first time series and at least a second time series of operating values ​​of equipment or a system, collected over successive time periods comprising at least a first time period and a second time period following the first time period, the method comprising: - obtaining a first anomaly score of a descriptive vector determined for a time series over the first time period, by implementing an anomaly determination model parameterized by parameters calculated for said first time period,- obtaining a second anomaly score for a descriptive vector determined for a time series over the second time period by implementing the anomaly determination model parameterized by parameters calculated for said first time period, and, -a determination of the evolution of the anomaly score for said equipment or system, consisting of calculating a difference between the second calculated anomaly score and the first calculated anomaly score.

5. A method according to claim 4, further comprising an update of the parameters of the anomaly determination model parameterized on said second time period.

6. A computer program comprising software instructions which, when executed by a programmable electronic device, implement a method for detecting an anomaly and determining an associated explanation in accordance with claims 1 to 5.

7. Anomaly detection and explanation determination device for time series of data, each time series having an associated duration and comprising N operating values ​​of equipment or a system, recorded at regular intervals during said duration, the device being characterized in that it comprises a computing processor configured to implement: a projection module (22), for each time series, of the values ​​of said time series onto a number M of basis functions and obtaining a descriptive vector of said time series of size M, said basis functions being functions of a wavelet transformation basis or B-Spline functions, a training module (24) of a parameterized anomaly determination model, by machine learning on at least a part of the calculated descriptive vectors, said anomaly determination model allowing the calculation of an anomaly score per descriptive vector, a module (26) application of the anomaly determination model to the descriptive vectors of the time series and obtaining an anomaly score per time series, a module (28) for determining a subset of time series containing an anomaly by comparing the anomaly score of each time series to a predetermined anomaly threshold; a module (30) for determining, for each time series of said subset, from the descriptive vector of said time series, at least a portion of the values ​​of said descriptive vector that influence the anomaly score of said time series, the determination comprising, for an initial descriptive vector, • a calculation of at least one alternative descriptive vector, said alternative descriptive vector comprising at least one component distinct from the component of the same rank in the initial descriptive vector, having an associated anomaly score, obtained by applying said parameterized anomaly determination model, lower than the anomaly threshold, and being such that a distance between the initial descriptive vector and the alternative descriptive vector is less than a predetermined distance threshold and a determination of at least one alternative time series from the alternative descriptive vector, the projection onto said basis of chosen functions of said alternative time series allowing to obtain said alternative descriptive vector, the alternative time series or series having different values ​​from the values ​​of the initial time series, these different values ​​being highlighted and indicated to an operator.

Images