METHOD FOR DETECTING ANOMALIES IN A PHYSICAL SYSTEM

Abstract

According to one aspect, a computer-implemented method for generating an anomaly detection model in a system is proposed. The method comprises: - obtaining (10) a training data matrix corresponding to the normal operation of said system, - decomposing said training data matrix into singular values ​​(11), - calculating (12) a new basis (V'), - defining (16) a maximum Mahalanobis distance threshold representing a limit of the normal operation of said system, - defining an anomaly detection model (MDL) from said new basis (V') and said maximum Mahalanobis distance threshold (MTS). Figure for the abstract: Figure 1

Description

Title of the invention: METHOD FOR DETECTING ANOMALIES IN A PHYSICAL SYSTEM

[0001] Embodiments and implementations relate to anomaly detection.

[0002] Anomaly detection (in English “outlier detection” or “anomaly detection”) is a technique used to identify data that differs significantly from other data. These different data are often called "anomalies" or "outliers."

[0003] Anomaly detection is of interest in many applications. Some applications use microcontrollers that can be configured to perform anomaly detection.

[0004] Anomaly detection implemented by a microcontroller allows real-time monitoring to detect abnormal behaviors in a physical system from data acquired by at least one sensor of this system. This technique can be used in a variety of fields such as automotive, aerospace, energy, manufacturing, health monitoring and many others.

[0005] There are several anomaly detection techniques. Some methods are based on machine learning. These methods use machine learning algorithms to identify data that does not match the learned model.

[0006] In anomaly detection, a microcontroller typically uses a model that represents the normal behavior of a system to analyze data collected by at least one sensor in the system.

[0007] In particular, the model is used to compare the current data collected by said at least one sensor with that of normal behavior. If the current data differs too much from that expected, this may indicate an anomaly or malfunction in the system. In this case, an alert may be triggered to warn an operator of the system.

[0008] The implemented anomaly detection therefore makes it possible to prevent breakdowns and system failures. This improves the reliability and security of the system.

[0009] The model used to perform anomaly detection may be obtained from a machine learning algorithm. A computer server may be used to implement the machine learning algorithm to obtain the model.

[0010] In particular, the machine learning algorithm is configured to generate a model for anomaly detection from data representative of a normal behavior of a system. Using such a machine learning algorithm has the advantage of avoiding providing outlier data to the machine learning algorithm to generate said model. Indeed, it can be difficult and expensive to intentionally generate anomalies in a system to obtain outlier data.

[0011] Known models that can be generated by such machine learning algorithms generally have the disadvantage of comprising numerous parameters which involve relatively complex processing of the data by the microcontroller and a significant occupation of a microcontroller memory.

[0012] There is therefore a need to propose a solution making it possible to obtain a model for the detection of anomalies which is simple to implement by a microcontroller.

[0013] According to one aspect, there is provided a computer-implemented method of generating an anomaly detection model in a physical system, the method comprising: - obtaining a learning data matrix corresponding to normal operation of said system, - a singular value decomposition of said training data matrix, so as to obtain an orthogonal input matrix, a diagonal matrix and an orthogonal output matrix, - a determination of a rank of the training data matrix having an energy greater than a threshold from the diagonal matrix, - a calculation of a new basis formed from columns of the orthogonal input matrix selected according to the determined rank, - a definition of a maximum Mahalanobis distance threshold representative of a limit of the normal functioning of said system, - a definition of an anomaly detection model based on said new base and said maximum Mahalanobis distance threshold.

[0014] Such a method uses a singular value decomposition and a maximum Mahalanobis distance threshold to define the anomaly detection model. The singular value decomposition makes it possible to obtain an anomaly detection model that is robust to noise and disturbances.

[0015] The singular value decomposition also makes it possible to systematically obtain an invertible matrix of the projected training data. It is thus always possible to calculate a Mahalanobis distance from this invertible matrix.

[0016] The model obtained can then be integrated into a microcontroller of said system in order to carry out anomaly detection during the operation of this system. Such a model has the advantage of occupying a relatively small memory space.

[0017] In an advantageous embodiment, the definition of said maximum Mahalanobis distance threshold comprises: - a projection of the learning data onto the new base, - a calculation of a Mahalanobis distance for each of said training data, - a definition of said maximum Mahalanobis distance threshold from the calculated Mahalanobis distances.

[0018] Advantageously, the method further comprises a calculation of a covariance matrix and a precision matrix from the projected training data and an average of the projected training data, said calculation of the Mahalanobis distance being carried out from the projected training data, the calculated precision matrix and average, and wherein the defined anomaly detection model further comprises said precision matrix and said average.

[0019] Alternatively, defining said maximum Mahalanobis distance threshold comprises defining said maximum Mahalanobis distance threshold from a chi-square table.

[0020] Alternatively, in an advantageous embodiment, the method further comprises a transformation of said new base, this transformation being adapted to standardize said projected learning data, the anomaly detection model then comprising the new transformed base and the maximum Mahalanobis distance threshold.

[0021] This transformation makes it possible to avoid storing the precision matrix in the anomaly detection model since the precision matrix then corresponds to the identity matrix. Thus, the anomaly detection model only includes the new transformed basis and the maximum Mahalanobis distance threshold.

[0022] According to another aspect, there is provided a computer-implemented method of anomaly detection in a system comprising: - obtaining an anomaly detection model generated from a generation method as described previously from learning data corresponding to normal operation of said system, - obtaining data representative of the operation of said system, - a projection of data representative of the operation of said system on the basis of said anomaly detection model, - a calculation of a Mahalanobis distance from said projected data, - a comparison of the calculated Mahalanobis distance with the maximum Mahalanobis distance threshold defined in said anomaly detection model, - anomaly detection if the calculated Mahalanobis distance is greater than the maximum Mahalanobis distance threshold.

[0023] Such a method has the advantage of being able to be executed by a microcontroller. Indeed, the latter only executes two operations which are the projection of the data representative of the operation of the system on said model base and the calculation of said Mahalanobis distance.

[0024] Advantageously, said calculation of the Mahalanobis distance is carried out from the projected data, the precision matrix and the average of said anomaly detection model.

[0025] According to another aspect, there is provided a computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement a method for generating an anomaly detection model as described above.

[0026] According to another aspect, there is provided a computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement an anomaly detection method as described above.

[0027] According to another aspect, there is provided a microcontroller comprising: - a memory in which is recorded a computer program for the detection of anomalies as described above, - a processing unit configured to execute this computer program.

[0028] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments, which are in no way limiting, and the appended drawings in which:

[0029] [Fig.l]

[0030] [Fig.2]

[0031] [Fig.3]

[0032] [Fig.4] illustrate embodiments and implementations of the invention.

[0033] [Fig.l] illustrates a first mode of implementation of a method for generating an anomaly detection model. This method for generating an anomaly detection model is implemented by computer.

[0034] Such a method is used to define a model determining the limits of normal behavior of a physical system.

[0035] In particular, such a method can be implemented by a computer server. The server then comprises a memory in which is stored a computer program comprising instructions, which when implemented by the server lead the latter to execute said generation method.

[0036] The method comprises a step 10 of obtaining training data. In this step 10, training data is provided to the server. The data Learning data are data representative of normal behavior of a physical system. These data can, for example, be acquired by at least one sensor of this system during normal operation of the system.

[0037] The training data are grouped in a matrix X. The matrix X has for example a size mxn.

[0038] The method then comprises a step 11 of implementing a singular value decomposition. In this step 11, the server performs a singular value decomposition of the matrix X. This step 11 makes it possible to factorize the training data matrix X into three matrices U, S and V. In particular, the matrices U, S and V are defined so that the matrix X corresponds to the matrix product USVT. The matrix U is then an orthogonal matrix of size mx m. The matrix S is a diagonal matrix of size mxn containing the singular values ​​of the matrix X (i.e. the square roots of the eigenvalues ​​of the matrix XTX or XXT), and V is an orthogonal matrix of size nx n.

[0039] The matrix V contains a matrix of orthonormal basis vectors of Kn, called "input". The matrix V is therefore an orthonormal input matrix.

[0040] The matrix U contains a matrix of orthonormal basis vectors of Km, called “output”. The matrix U is therefore an orthonormal output matrix.

[0041] This singular value decomposition makes it possible to reduce the dimensionality of the training data matrix X while preserving the important properties of the matrix X. The singular value decomposition therefore makes it possible to compress the matrix X and reduce its memory occupation by keeping only the vectors which correspond to the most important singular values.

[0042] The method then comprises a step 12 of calculating a new basis. In this step 12, the server calculates a new basis V' from the matrix S obtained by means of the singular value decomposition.

[0043] In particular, step 12 of calculating the new base V' comprises a determination of a rank of the training data matrix which comprises an energy corresponding to a predefined energy threshold. More particularly, the total energy of the training data matrix corresponds to the sum of the squares of the singular values ​​of this matrix, the singular values ​​being contained in the diagonal matrix S obtained by the singular value decomposition. The rank determined in this step 12 corresponds to the rank of the training data matrix which comprises an energy reaching the predefined energy threshold (i.e. the number of singular values ​​making it possible to reach this energy threshold). The energy threshold may correspond to a predefined percentage relative to the total energy of the training data matrix.

[0044] Step 12 of calculating the new base includes a selection of the columns of the

[0045]

[0046]

[0047]

[0048]

[0049]

[0050]

[0051]

[0052]

[0053]

[0054] matrix V that correspond to the determined rank of the training data matrix. The columns of the matrix V then form a new basis V'. This new basis V' makes it possible to keep only the columns of the basis V corresponding to the most important singular values ​​(i.e. those which contribute the most to the total energy of the matrix). The method then comprises a projection step 13. In this step 13, the server projects the training data onto the new base V'. The projection corresponds to a matrix product between the training data and the new base V'. The server thus obtains a matrix of said projection. This matrix of said projection is systematically an invertible matrix. The method then comprises a transformation step 14. In this transformation step 14, the server implements an algorithm for standardizing the data of the matrix of said projection. This step 14 makes it possible to calculate a transformed basis V”. In particular, the transformed basis V” can be obtained according to the following expression: y ” — —L_ x 5" XV"' °where n represents the number of rows in the matrix learning, V' is the new basis and S' is a truncated diagonal matrix of the singular value decomposition. This step 14 makes it possible to obtain a centered matrix with unit variance from the matrix of said projection. The matrix obtained is centered around zero. This transformation makes it possible to obtain a precision matrix corresponding to an identity matrix. The method then comprises a step 15 of calculating Mahalanobis distances. In this step 15, the server calculates a Mahalanobis distance for each of said training data. Each Mahalanobis distance can be calculated because the covariance matrix which corresponds to said projection is systematically invertible, due to the decomposition into singular values ​​and the consideration of only components having a significant singular value. In particular, the Mahalanobis distance is calculated using the formula: where x is a vector that corresponds to a projected data, is a vector that corresponds to a mean of the projected training data, and E1 corresponds to the precision matrix (i.e., the inverse of the covariance matrix). By applying step 14, the Mahalanobis distance reduces to the Euclidean distance. It can be expressed as follows • , x E ~\T( \

[0055] where A is a vector that corresponds to a projected and standardized data, is a vector that corresponds to an average of the projected and standardized training data.

[0056] The method then comprises a step 16 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum Mahalanobis distance threshold. This maximum Mahalanobis distance threshold represents a limit of normal behavior of the system. For example, the maximum threshold is defined as a distance that is greater than the Mahalanobis distance associated with 98% of the normal data projected onto the V' base and standardized.

[0057] An anomaly detection model is then defined. This anomaly detection model comprises the base V', the precision matrix and the maximum Mahalanobis distance threshold. Alternatively, the detection model comprises only the transformed base V” and the maximum Mahalanobis distance threshold using step 14 because the precision matrix is ​​then the identity matrix which is known and therefore does not need to be stored.

[0058] This anomaly detection model is then integrated into a microcontroller of the system. In particular, the anomaly detection model is stored in a memory of the microcontroller. Such a detection model has the advantage of occupying relatively little space in the memory of the microcontroller.

[0059] [Fig.2] illustrates a second mode of implementation of a method for generating an anomaly detection model.

[0060] Such a method is used to define a model determining the limits of normal behavior of a physical system.

[0061] In particular, such a method can be implemented by a computer server. The server then comprises a memory in which is stored a computer program comprising instructions, which when implemented by the server lead the latter to execute said generation method.

[0062] The method comprises a step 20 of obtaining learning data. In this step 20, learning data is provided to the server. The learning data is data representative of normal behavior of a system. This data may for example be acquired by at least one sensor of this system during normal operation of the system.

[0063] The training data are grouped in a matrix X. The matrix X has for example a size mxn.

[0064] The method then comprises a step 21 of implementing a singular value decomposition. In this step 21, the server performs a singular value decomposition of the matrix X. This step 21 makes it possible to factorize the training data matrix X into three matrices U, S and V. In particular, the matrices U, S and V are defined so that the matrix X corresponds to the matrix product USVT. The matrix U is then an orthogonal matrix of size mx m. The matrix S is a diagonal matrix of size mxn containing the singular values ​​of the matrix X (i.e., the square roots of the eigenvalues ​​of the matrix XTX or XXT), and V is an orthogonal matrix of size nx n.

[0065] The matrix V contains a matrix of orthonormal basis vectors of Kn, called "input". The matrix V is therefore an orthonormal input matrix.

[0066] The matrix U contains a matrix of orthonormal basis vectors of Km, called “output”. The matrix U is therefore an orthonormal output matrix.

[0067] This singular value decomposition makes it possible to reduce the dimensionality of the training data matrix X while preserving the important properties of the matrix X. The singular value decomposition therefore makes it possible to compress the matrix X and reduce its memory occupation by keeping only the vectors which correspond to the most important singular values.

[0068] The method then comprises a step 22 of calculating a new base V'. In this step 22, the server calculates a new base V' from the matrix S obtained by means of the singular value decomposition.

[0069] In particular, step 22 of calculating the new base V' comprises a determination of a rank of the learning data matrix which comprises an energy corresponding to a predefined energy threshold.

[0070] Step 22 of calculating the new base comprises a selection of the columns of the matrix V which correspond to the determined rank of the training data matrix. The columns of the matrix V then form a new base V'.

[0071] The method then comprises a transformation step 23. This step 23 makes it possible to calculate a transformed base V”. In particular, the transformed base V” corresponds to the following expression:

[0072] y" — _L. x S" X V', °where n represents the number of rows in the matrix ^jT learning, V' is the new basis and S' is a truncated diagonal matrix of the singular value decomposition.

[0073] The method then comprises a step 24 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum Mahalanobis distance threshold. This maximum Mahalanobis distance threshold represents a limit of normal behavior of the system. In this embodiment, the maximum Mahalanobis distance threshold is defined from a chi-square table. Indeed, the Mahalanobis distance follows the chi-square law. It is thus possible to define the maximum Mahalanobis distance threshold from such a table.

[0074] An anomaly detection model is then defined. This detection model of anomalies comprises the basis V', the precision matrix and the maximum Mahalanobis distance threshold. Alternatively, the detection model comprises only the transformed basis V” and the maximum Mahalanobis distance threshold using step 14 because the precision matrix is ​​then the identity matrix which is known and therefore does not need to be stored.

[0075] This anomaly detection model is finally integrated into a microcontroller of the system. In particular, the anomaly detection model is stored in a memory of the microcontroller. Such a detection model has the advantage of occupying relatively little space in the memory of the microcontroller.

[0076] [Fig.3] illustrates a microcontroller MCU configured to implement a method for detecting anomalies in a data matrix. Such a method is described below in relation to [Fig.4].

[0077] The microcontroller MCU comprises a processing unit UT and a memory MEM. The memory MEM comprises a computer program PRG comprising instructions which, when implemented by the processing unit UT of the microcontroller, cause the latter to implement said anomaly detection method.

[0078] The PRG computer program comprises said MDL model defined by the model generation method described above. In particular, the MDL model comprises said new transformed basis V” and said maximum Mahalanobis distance threshold MTS of the anomaly detection model. Alternatively, the MDL model may comprise the new basis V', the precision matrix and the maximum Mahalanobis distance threshold.

[0079] The microcontroller may be integrated into a system for which monitoring of operating anomalies is required. The microcontroller may be configured to receive data acquired by a sensor of said system. This acquired data is then representative of the operation of the system.

[0080] [Fig.4] illustrates a method implemented by said microcontroller to perform anomaly detection in a data matrix representative of an operation of a system.

[0081] The method comprises a step 30 of obtaining a data matrix to be analyzed. In this step 30, the microcontroller obtains a data vector to be analyzed. This data to be analyzed can be obtained from a sensor of said system.

[0082] The method then comprises a projection step 31. In this step 31, the data to be analyzed are projected onto the transformed base V” of the anomaly detection model stored in the memory of the microcontroller. The projection corresponds to a matrix product between the data to be analyzed and the transformed base V”.

[0083] This projection of the data to be analyzed makes it possible to obtain a data vector projected.

[0084] The method then comprises a step 32 of calculating the Mahalanobis distance. In this step 32, the microcontroller calculates a Mahalanobis distance from the projected and standardized data.

[0085] The method then comprises a step 33 of determining the presence of anomalies in the data matrix. In this step 34, the microcontroller compares the value of the calculated Mahalanobis distance with the maximum threshold stored in the memory of the microcontroller.

[0086] If the calculated Mahalanobis distance value is lower than the maximum threshold, then the microcontroller considers that the data vector is representative of normal system behavior (NRML state in [Fig.3]).

[0087] If the calculated Mahalanobis distance value is greater than the maximum threshold, then the microcontroller considers that the data vector is representative of the presence of anomalies in the behavior of the system (OTLR state in [Fig.3]). In this case, the microcontroller can generate an alert signal to inform the user of the system of a system malfunction.

[0088] Of course, the present invention is susceptible to various variants and modifications which will appear to those skilled in the art. For example, instead of carrying out a transformation to standardize the projection of the training data onto the base, the method for generating an anomaly detection model may comprise a calculation of a covariance matrix, a precision matrix (i.e. the inverse of the covariance matrix) and an average from the projection of the training data onto the new base V'. The Mahalanobis distance calculated in this generation method is then obtained using this precision matrix and the calculated average. The generated detection model then also comprises this precision matrix and the calculated average. In this case, the anomaly detection method comprises a calculation of the Mahalanobis distance using this precision matrix and the stored average.

[0089] However, the projection of data onto the transformed basis makes it possible not to calculate the precision matrix because the latter corresponds to the identity matrix in this case. This transformation then also makes it possible to avoid storing the precision matrix in the microcontroller.

Claims

Claims

1. A computer-implemented method for generating an anomaly detection model in a physical system, the method comprising: - obtaining (10, 20) a training data matrix corresponding to a normal operation of said system, said training data being acquired by at least one sensor of said system, - decomposing (11, 21) said training data matrix into singular values, so as to obtain an input orthogonal matrix, a diagonal matrix and an output orthogonal matrix, - determining a rank of the training data matrix having an energy greater than a threshold from the diagonal matrix, - calculating (12, 22) a new base (V') formed of columns of the input orthogonal matrix selected as a function of the determined rank, - defining (16,24) of a maximum Mahalanobis distance threshold representative of a limit of the normal operation of said system, - a definition of a model (MDL) for detecting anomalies from said new base (V') and said maximum Mahalanobis distance threshold (MTS).,

2. Method according to claim 1, wherein the definition of said maximum Mahalanobis distance threshold comprises: - a projection (13) of the training data onto the new basis, - a calculation (15) of a Mahalanobis distance for each of said training data, - a definition of said maximum Mahalanobis distance threshold from the calculated Mahalanobis distances.

3. The method of claim 2, further comprising calculating a covariance matrix and an accuracy matrix from the projected training data and an average of the projected training data, said calculating the Mahalanobis distance being performed from the projected training data, the calculated accuracy matrix and average, and wherein the defined anomaly detection model further comprises said accuracy matrix and said average.

4. The method of claim 1, wherein the definition (24) of said maximum Mahalanobis distance threshold comprises a definition said maximum Mahalanobis distance threshold from a chi-square table.

5. Method according to one of claims 2 to 4 taken in combination with claim 2, further comprising a transformation (14, 23) of said new base, this transformation being adapted to standardize said projected learning data, the anomaly detection model then comprising the new transformed base and the maximum Mahalanobis distance threshold.

6. A computer-implemented method for detecting anomaly in a system comprising: - obtaining an anomaly detection model generated from a generation method according to one of claims 1 to 5 from learning data corresponding to a normal operation of said system, said learning data being acquired by at least one sensor of said system, - obtaining (30) data representative of the operation of said system, these learning data being acquired by said at least one sensor of said system, - projecting (31) the data representative of the operation of said system on the basis of said anomaly detection model, - calculating (33) a Mahalanobis distance from said projected data, - comparing (34) the calculated Mahalanobis distance with the maximum Mahalanobis distance threshold defined in said anomaly detection model,- anomaly detection if the calculated Mahalanobis distance is greater than the maximum Mahalanobis distance threshold.,

7. The method of claim 6, wherein said calculation of the Mahalanobis distance is performed from the projected data, the accuracy matrix and the average of said anomaly detection model.

8. Computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement a method according to one of claims 1 to 5.

9. Computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement a method according to one of claims 6 and 7.

10. Microcontroller comprising: - a memory (MEM) in which a program is recorded computer (PRG) according to claim 9, - a processing unit (UT) configured to execute this computer program (PRG).

Images