METHOD FOR DETECTING ANOMALIES IN A PHYSICAL SYSTEM

Abstract

According to one aspect, a computer-implemented method for generating an anomaly detection model in a system is proposed. The method comprises: - obtaining (10) a training data matrix corresponding to the normal operation of said system, - decomposing said training data matrix into singular values ​​(11), - calculating (12) a new basis (V'), - defining (16) a maximum Mahalanobis distance threshold representing a limit of the normal operation of said system, - defining an anomaly detection model (MDL) from said new basis (V') and said maximum Mahalanobis distance threshold (MTS). Figure for the abstract: Figure 1

Description

Title of the invention: METHOD FOR DETECTING ANOMALIES IN A PHYSICAL SYSTEM

[0001] Some embodiments and implementation methods relate to the detection of anomalies.

[0002] Anomaly detection (in English, "outlier detection" or "anomaly detection") is a technique used to identify data that differ significantly from other data. This different data is often called "anomalies" or "outliers".

[0003] Anomaly detection is of interest in many applications. Some applications use microcontrollers that can be configured to perform anomaly detection.

[0004] Anomaly detection implemented by a microcontroller enables real-time monitoring to detect abnormal behavior in a physical system based on data acquired by at least one sensor of that system. This technique can be used in a variety of fields such as automotive, aerospace, energy, manufacturing, healthcare monitoring, and many others.

[0005] Several anomaly detection techniques exist. Some methods are based on machine learning. These methods use machine learning algorithms to identify data that do not fit the learned model.

[0006] In the context of anomaly detection, a microcontroller generally uses a model that represents the normal behavior of a system to analyze data collected by at least one sensor of the system.

[0007] In particular, the model is used to compare the current data collected by said at least one sensor with that of normal behavior. If the current data differs too much from the expected data, this may indicate an anomaly or malfunction in the system. In this case, an alert may be triggered to notify a system operator.

[0008] The implemented anomaly detection therefore makes it possible to prevent system failures and malfunctions. This improves the reliability and security of the system.

[0009] The model used to perform anomaly detection can be obtained from a machine learning algorithm. A computer server can be used to implement the machine learning algorithm to obtain the model.

[0010] In particular, the machine learning algorithm is configured to generate a model for anomaly detection from representative data of a normal behavior of a system. Using such a machine learning algorithm has the advantage of avoiding the need to provide aberrant data to the machine learning algorithm to generate said model. Indeed, intentionally generating anomalies in a system to obtain aberrant data can be difficult and costly.

[0011] The known models that can be generated by such machine learning algorithms generally have the disadvantage of having many parameters which involve relatively complex data processing by the microcontroller and a significant use of microcontroller memory.

[0012] There is therefore a need to propose a solution enabling the obtaining of a model for the detection of anomalies which is simple to implement by a microcontroller.

[0013] According to one aspect, a computer-implemented method for generating an anomaly detection model in a physical system is proposed, the method comprising: - obtaining a training data matrix corresponding to the normal operation of said system, - a singular value decomposition of said training data matrix, so as to obtain an orthogonal input matrix, a diagonal matrix and an orthogonal output matrix, - determining a rank of the training data matrix having an energy greater than a threshold from the diagonal matrix, - a calculation of a new basis formed from columns of the input matrix selected orthogonally according to the determined rank, - a definition of a maximum Mahalanobis distance threshold representative of a limit of the normal functioning of said system, - a definition of an anomaly detection model based on said new basis and said maximum Mahalanobis distance threshold.

[0014] Such a method uses singular value decomposition and a maximum Mahalanobis distance threshold to define the anomaly detection model. Singular value decomposition makes it possible to obtain an anomaly detection model that is robust to noise and disturbances.

[0015] Singular value decomposition also systematically yields an invertible matrix of the projected training data. It is thus always possible to calculate a Mahalanobis distance from this invertible matrix.

[0016] The resulting model can then be integrated into a microcontroller of said system in order to perform anomaly detection during the operation of this system. Such a model has the advantage of occupying a relatively small amount of memory.

[0017] In an advantageous embodiment, the definition of said maximum Mahalanobis distance threshold includes: - a projection of the training data onto the new basis, - a calculation of a Mahalanobis distance for each of the aforementioned training data points, - a definition of said maximum Mahalanobis distance threshold based on the calculated Mahalanobis distances.

[0018] Advantageously, the method further comprises a calculation of a covariance matrix and a precision matrix from the projected training data and a mean of the projected training data, said calculation of the Mahalanobis distance being performed from the projected training data, the calculated precision matrix and mean, and wherein the defined anomaly detection model further comprises said precision matrix and said mean.

[0019] Alternatively, the definition of said maximum Mahalanobis distance threshold includes a definition of said maximum Mahalanobis distance threshold from a chi-square table.

[0020] Alternatively, in an advantageous embodiment, the method further comprises a transformation of said new basis, this transformation being adapted to standardize said projected training data, the anomaly detection model then comprising the new transformed basis and the maximum Mahalanobis distance threshold.

[0021] This transformation avoids storing the precision matrix in the anomaly detection model since the precision matrix then corresponds to the identity matrix. Thus, the anomaly detection model includes only the new transformed basis and the maximum Mahalanobis distance threshold.

[0022] According to another aspect, a computer-implemented method for detecting anomalies in a system comprising: is proposed. - obtaining an anomaly detection model generated from a generation process as described above, using training data corresponding to the normal operation of said system, - obtaining data representative of the operation of said system, - projecting data representative of the operation of said system onto said anomaly detection model, - a calculation of the Mahalanobis distance from the aforementioned projected data, - a comparison of the calculated Mahalanobis distance to the maximum Mahalanobis distance threshold defined in said anomaly detection model, - anomaly detection if the calculated Mahalanobis distance is greater than the maximum Mahalanobis distance threshold.

[0023] Such a process has the advantage of being able to be executed by a microcontroller. Indeed, the latter performs only two operations, which are the projection of the data representing the operation of the system onto said model basis and the calculation of said Mahalanobis distance.

[0024] Advantageously, said calculation of the Mahalanobis distance is performed from the projected data, the accuracy matrix and the average of said anomaly detection model.

[0025] According to another aspect, a computer program product is proposed comprising instructions which, when the program is executed by a computer, lead the latter to implement a method for generating an anomaly detection model as described above.

[0026] According to another aspect, a computer program product is proposed comprising instructions which, when the program is executed by a computer, lead the latter to implement an anomaly detection process as described above.

[0027] According to another aspect, a microcontroller comprising: is proposed - a memory in which a computer program for anomaly detection, as described previously, is stored, - a processing unit configured to run this computer program.

[0028] Other advantages and features of the invention will become apparent upon examination of the detailed description of embodiments, which are by no means limiting, and the accompanying drawings in which:

[0029] [Fig.1]

[0030] [Fig.2]

[0031] [Fig.3]

[0032] [Fig.4] illustrate embodiments and implementations of the invention.

[0033] Figure 1 illustrates the first method of implementing a process for generating an anomaly detection model. This method for generating an anomaly detection model is implemented by computer.

[0034] Such a method is used to define a model determining the limits of a normal behavior of a physical system.

[0035] In particular, such a method can be implemented by a computer server. The server then includes a memory in which a program is stored computer comprising instructions which, when implemented by the server, cause the server to execute said generation process.

[0036] The method includes a step 10 for obtaining training data. In this step 10, training data is provided to the server. The training data is representative of the normal behavior of a physical system. This data can, for example, be acquired by at least one sensor of this system during normal system operation.

[0037] The training data are grouped in a matrix X. The matrix X has, for example, a size mxn.

[0038] The method then includes a step 11 for implementing a singular value decomposition. In this step 11, the server performs a singular value decomposition of the matrix X. This step 11 allows the training data matrix X to be factored into three matrices U, S, and V. In particular, the matrices U, S, and V are defined such that the matrix X corresponds to the matrix product USVT. The matrix U is then an orthogonal matrix of size m x m. The matrix S is a diagonal matrix of size m x n containing the singular values ​​of the matrix X (i.e., the square roots of the eigenvalues ​​of the matrix XTX or XXT), and V is an orthogonal matrix of size n x n.

[0039] The matrix V contains a matrix of orthonormal basis vectors of Kn, called "input" vectors. The matrix V is therefore an orthonormal input matrix.

[0040] The matrix U contains a matrix of orthonormal basis vectors of Km, called "output". The matrix U is therefore an orthonormal output matrix.

[0041] This singular value decomposition makes it possible to reduce the dimensionality of the training data matrix X while preserving the important properties of the matrix X. The singular value decomposition therefore makes it possible to compress the matrix X and reduce its memory usage by keeping only the vectors that correspond to the most important singular values.

[0042] The process then includes a step 12 of calculating a new basis. In this step 12, the server calculates a new basis V' from the matrix S obtained by singular value decomposition.

[0043] In particular, step 12 of calculating the new basis V' includes determining a rank of the training data matrix that has an energy corresponding to a predefined energy threshold. More specifically, the total energy of the training data matrix corresponds to the sum of the squares of the singular values ​​of this matrix, the singular values ​​being contained in the diagonal matrix S obtained by singular value decomposition. The rank determined in this step 12 corresponds to the rank of the data matrix training data that includes an energy reaching the predefined energy threshold (i.e., the number of singular values ​​required to reach this energy threshold). The energy threshold can correspond to a predefined percentage relative to the total energy of the training data matrix.

[0044] Step 12 of calculating the new basis includes selecting the columns of matrix V that correspond to the determined rank of the training data matrix. The columns of matrix V then form a new basis V'. This new basis V' allows only the columns of basis V corresponding to the most significant singular values ​​(i.e., those that contribute most to the total energy of the matrix) to be retained.

[0045] The process then includes a projection step 13. In this step 13, the server projects the training data onto the new basis V'. The projection corresponds to a matrix product between the training data and the new basis V'.

[0046] The server thus obtains a matrix of said projection. This matrix of said projection is systematically an invertible matrix.

[0047] The process then includes a transformation step 14. In this transformation step 14, the server implements an algorithm to standardize the data of the matrix of said projection. This step 14 calculates a transformed basis V”. In particular, the transformed basis V” can be obtained according to the following expression:

[0048] y " = 1 XS' X V'' represents the number of rows in the matrix of learning, V' is the new basis and S' is a truncated diagonal matrix of the singular value decomposition.

[0049] This step 14 makes it possible to obtain a centered matrix with unit variance from the matrix of said projection. The resulting matrix is ​​centered around zero. This transformation makes it possible to obtain a precision matrix corresponding to an identity matrix.

[0050] The method then includes a step 15 for calculating Mahalanobis distances. In this step 15, the server calculates a Mahalanobis distance for each of the training data. Each Mahalanobis distance can be calculated because the covariance matrix corresponding to said projection is systematically invertible, due to the singular value decomposition and the consideration of only those components with a significant singular value.

[0051] In particular, the distance to Mahalanobis is calculated using the formula:

[0052] n / \ r Zvï / ? D M lxl = J(xp) Zlx-p

[0053] where x is a vector that corresponds to a projected data point, P is a vector that corresponds to an average of the projected training data, and 571 corresponds to the precision matrix (i.e., the inverse of the covariance matrix).

[0054] By applying step 14, the Mahalanobis distance reduces to the Euclidean distance. It can be expressed as follows: _ , . R ~t / \ D m (x) = ÿ(x-jl) (xp)

[0055] where x is a vector that corresponds to a projected and standardized data, R is a vector that corresponds to an average of the projected and standardized training data.

[0056] The method then includes a step 16 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum Mahalanobis distance threshold. This maximum Mahalanobis distance threshold represents a limit to the normal behavior of the system. For example, the maximum threshold is defined as a distance that is greater than the Mahalanobis distance associated with 98% of the normal data projected onto the V' basis and standardized.

[0057] An anomaly detection model is then defined. This anomaly detection model includes the basis V', the precision matrix, and the maximum Mahalanobis distance threshold. Alternatively, the detection model includes only the transformed basis V'' and the maximum Mahalanobis distance threshold using step 14, since the precision matrix is ​​then the identity matrix, which is known and therefore does not need to be stored.

[0058] This anomaly detection model is then integrated into a microcontroller of the system. In particular, the anomaly detection model is stored in the microcontroller's memory. Such a detection model has the advantage of occupying relatively little space in the microcontroller's memory.

[0059] Figure [Fig. 2] illustrates a second method of implementing a method for generating an anomaly detection model.

[0060] Such a method is used to define a model determining the limits of a normal behavior of a physical system.

[0061] In particular, such a process can be implemented by a computer server. The server then includes a memory in which is stored a computer program comprising instructions which, when implemented by the server, cause it to execute said generation process.

[0062] The method includes a step 20 for obtaining training data. In this step 20, training data is provided to the server. The training data is representative of the normal behavior of a system. This data can, for example, be acquired by at least one sensor of this system during normal system operation.

[0063] The training data are grouped in a matrix X. The matrix X has, for example, a size mxn.

[0064] The method then includes a step 21 for implementing a singular value decomposition. In this step 21, the server performs a singular value decomposition of the matrix X. This step 21 makes it possible to factor the training data matrix X into three matrices U, S, and V. In particular, the matrices U, S, and V are defined such that the matrix X corresponds to the matrix product USVT. The matrix U is then an orthogonal matrix of size m x m. The matrix S is a diagonal matrix of size m x n containing the singular values ​​of the matrix X (that is, the square roots of the eigenvalues ​​of the matrix XTX or XXT), and V is an orthogonal matrix of size n x n.

[0065] The matrix V contains a matrix of orthonormal basis vectors of Kn, called "input" vectors. The matrix V is therefore an orthonormal input matrix.

[0066] The matrix U contains a matrix of orthonormal basis vectors of Km, called "output". The matrix U is therefore an orthonormal output matrix.

[0067] This singular value decomposition reduces the dimensionality of the training data matrix X while preserving the important properties of the matrix X. The singular value decomposition therefore compresses the matrix X and reduces its memory usage by keeping only the vectors that correspond to the most important singular values.

[0068] The process then includes a step 22 of calculating a new basis V'. In this step 22, the server calculates a new basis V' from the matrix S obtained by singular value decomposition.

[0069] In particular, step 22 of calculating the new basis V' includes determining a rank of the learning data matrix which has an energy corresponding to a predefined energy threshold.

[0070] Step 22 of calculating the new basis includes selecting the columns of matrix V that correspond to the determined rank of the training data matrix. The columns of matrix V then form a new basis V'.

[0071] The process then includes a transformation step 23. This step 23 allows the calculation of a transformed basis V”. In particular, the transformed basis V” corresponds to the following expression:

[0072] y " = .....- XS ' X y °where n represents the number of rows in the matrix of learning, V' is the new basis and S' is a truncated diagonal matrix of the singular value decomposition.

[0073] The method then includes a step 24 of defining a maximum Mahalanobis distance threshold. In this step, the server defines a maximum threshold of Mahalanobis distance. This maximum Mahalanobis distance threshold represents a limit to the normal behavior of the system. In this embodiment, the maximum Mahalanobis distance threshold is defined using a chi-squared table. Indeed, the Mahalanobis distance follows the chi-squared distribution. It is therefore possible to define the maximum Mahalanobis distance threshold using such a table.

[0074] An anomaly detection model is then defined. This anomaly detection model includes the basis V', the precision matrix, and the maximum Mahalanobis distance threshold. Alternatively, the detection model includes only the transformed basis V'' and the maximum Mahalanobis distance threshold using step 14, since the precision matrix is ​​then the identity matrix, which is known and therefore does not need to be stored.

[0075] This anomaly detection model is finally integrated into a microcontroller of the system. In particular, the anomaly detection model is stored in the microcontroller's memory. Such a detection model has the advantage of occupying relatively little space in the microcontroller's memory.

[0076] Figure 3 illustrates a microcontroller (MCU) configured to implement a method for detecting anomalies in a data matrix. Such a method is described below in relation to Figure 4.

[0077] The microcontroller MCU comprises a processing unit UT and a memory MEM. The memory MEM comprises a computer program PRG including instructions which, when implemented by the processing unit UT of the microcontroller, cause the latter to implement said anomaly detection method.

[0078] The PRG computer program includes said MDL model defined by the model generation method described above. In particular, the MDL model includes said new transformed basis V” and said maximum Mahalanobis distance threshold MTS of the anomaly detection model. Alternatively, the MDL model may include the new basis V', the accuracy matrix, and the maximum Mahalanobis distance threshold.

[0079] The microcontroller can be integrated into a system for which monitoring of malfunctions is required. The microcontroller can be configured to receive data acquired by a sensor of said system. This acquired data is then representative of the system's operation.

[0080] Fig. 4 illustrates a method implemented by said microcontroller to perform anomaly detection in a data matrix representative of the operation of a system.

[0081] The method includes a step 30 of obtaining a data matrix to be analyzed. In this step 30, the microcontroller obtains a data vector to be analyzed. This data to be analyzed can be obtained from a sensor of said system.

[0082] The method then includes a projection step 31. In this step 31, the data to be analyzed are projected onto the transformed basis V” of the anomaly detection model stored in the microcontroller's memory. The projection corresponds to a matrix product between the data to be analyzed and the transformed basis V”.

[0083] This projection of the data to be analyzed makes it possible to obtain a vector of projected data.

[0084] The method then includes a step 32 for calculating the Mahalanobis distance. In this step 32, the microcontroller calculates a Mahalanobis distance from the projected and standardized data.

[0085] The method then includes a step 33 for determining the presence of anomalies in the data matrix. In this step 34, the microcontroller compares the calculated Mahalanobis distance value to the maximum threshold stored in the microcontroller's memory.

[0086] If the calculated Mahalanobis distance value is less than the maximum threshold, then the microcontroller considers that the data vector is representative of normal system behavior (NRML state on [Fig.3]).

[0087] If the calculated Mahalanobis distance value exceeds the maximum threshold, then the microcontroller considers the data vector to be representative of anomalies in the system's behavior (OTLR state in [Fig. 3]). In this case, the microcontroller can generate an alert signal to inform the system user of a system malfunction.

[0088] Of course, the present invention is susceptible to various variations and modifications that will become apparent to those skilled in the art. For example, instead of performing a transformation to standardize the projection of the training data onto the basis, the anomaly detection model generation method may include calculating a covariance matrix, a precision matrix (i.e., the inverse of the covariance matrix), and a mean from the projection of the training data onto the new basis V'. The Mahalanobis distance calculated in this generation method is then obtained using this precision matrix and the calculated mean. The generated detection model then also includes this precision matrix and the calculated mean. In this case, the anomaly detection method includes calculating the Mahalanobis distance using this precision matrix and the stored mean.

[0089] However, projecting the data onto the transformed basis makes it unnecessary to calculate the precision matrix because the latter corresponds to the identity matrix in In this case, this transformation also avoids storing the precision matrix in the microcontroller.

Claims

Demands

1. A computer-implemented method for generating an anomaly detection model in a physical system, the method comprising: - obtaining (10, 20) a training data matrix corresponding to normal operation of said system, said training data being acquired by at least one sensor of said system, - decomposing said training data matrix into singular values ​​(11, 21) so as to obtain an orthogonal input matrix, a diagonal matrix and an orthogonal output matrix, - determining a rank of the training data matrix having an energy greater than a threshold from the diagonal matrix, - calculating (12, 22) a new basis (V') formed of columns of the orthogonal input matrix selected according to the determined rank, - defining (16,24) of a maximum Mahalanobis distance threshold representing a limit of the normal operation of said system, the definition of said maximum Mahalanobis distance threshold includes: - a projection (13) of the training data onto the new basis, - a calculation (15) of a Mahalanobis distance for each of said training data, - a definition of said maximum Mahalanobis distance threshold from the calculated Mahalanobis distances, - a transformation (14, 23) of said new basis, this transformation being adapted to standardize said projected training data, and - a definition of an anomaly detection model (MDL) comprising the transformed new basis and the maximum Mahalanobis distance threshold.

2. A method according to claim 1, wherein the definition (24) of said maximum Mahalanobis distance threshold comprises a definition said maximum Mahalanobis distance threshold from a chi-square table.

3. A computer-implemented method for anomaly detection in a system comprising: - obtaining an anomaly detection model generated from a generation method according to claim 1 or 2 from training data corresponding to normal operation of said system, said training data being acquired by at least one sensor of said system, - obtaining (30) data representative of the operation of said system, this training data being acquired by said at least one sensor of said system, - projecting (31) the data representative of the operation of said system onto the basis of said anomaly detection model, - calculating (33) a Mahalanobis distance from said projected data, - comparing (34) the calculated Mahalanobis distance to the maximum Mahalanobis distance threshold defined in said anomaly detection model,- Anomaly detection if the calculated Mahalanobis distance exceeds the maximum Mahalanobis distance threshold.

4. Product computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out a process according to claim 1 or 2.

5. Product computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out a process according to claim 3.

6. Microcontroller comprising: - a memory (MEM) in which a computer program (PRG) according to claim 5 is stored, - a processing unit (TU) configured to execute this computer program (PRG).