METHOD FOR DEVELOPING AN ANOMALY DETECTION MODEL AND ANOMALY DETECTION METHOD USING SUCH A MODEL

Abstract

According to one aspect, there is provided a computer-implemented method of developing an anomaly detection model, the method comprising: - obtaining (30) a learning data stream, - incrementally calculating (31) the principal components of the learning data stream, - orthonormalizing (32) the principal components of the learning data stream so as to obtain an orthonormal basis representing the learning data stream, - developing (33) an anomaly detection model comprising said orthonormal basis and a user-defined detection threshold. Figure for abstract: Figure 3

Description

Title of the invention: METHOD FOR DEVELOPING AN ANOMALY DETECTION MODEL AND METHOD FOR DETECTING ANOMALY USING SUCH A MODEL

[0001] Embodiments and implementations relate to the detection of anomalies in a data stream.

[0002] Outlier detection in a physical system (or anomaly detection) is a technique used to identify data that differ significantly from data representative of normal behavior of the physical system. These data are often called "anomalies" or "outliers."

[0003] Anomaly detection is of interest in many applications. Some applications use a microcontroller deployed in the physical system to be monitored. Such a microcontroller is then configured to perform anomaly detection.

[0004] Anomaly detection implemented by a microcontroller allows real-time monitoring to detect abnormal behaviors in a physical system from data acquired by at least one sensor of this system. This technique can be used in a variety of fields such as automotive, aerospace, energy, manufacturing, health monitoring and many others.

[0005] In anomaly detection, a microcontroller typically uses a model that represents the normal behavior of a system to analyze data collected by at least one sensor of the system.

[0006] In particular, the model is used to compare the current data collected by said at least one sensor to that of normal behavior. If the current data differs too much from that expected, this may indicate an anomaly or malfunction in the system. In this case, an alert may be triggered to warn an operator of the system.

[0007] The implemented anomaly detection therefore makes it possible to prevent breakdowns and system failures. This improves the reliability and security of the system.

[0008] The model used to perform anomaly detection can be obtained from a machine learning algorithm.

[0009] In particular, the machine learning algorithm is configured to generate a model for anomaly detection from training data representative of normal behavior of the system. The anomaly detection model is developed to define limits on the normal behavior of the system. The anomaly detection model can then be used by a microcontroller deployed in the physical system to be monitored.

[0010] In some applications, it may be difficult to obtain training data before deploying the solution in the system to be monitored. It is then preferable to carry out the training, i.e. the development of the anomaly detection model, within the physical system to be monitored. For example, the training of the anomaly detection model is carried out by a microcontroller deployed in the system to be monitored. Once the anomaly detection model has been developed, this same microcontroller is then configured to use this anomaly detection model.

[0011] In this case, the learning is carried out by the microcontroller for a duration defined by the user from learning data acquired by at least one sensor.

[0012] In order to develop an anomaly detection model from a data stream using a memory of limited capacity, the anomaly detection model may be developed incrementally. In other words, the anomaly detection model is developed as a training data stream is acquired. A fingerprint of each training data item is stored in the memory once these training data items have been used for developing the anomaly detection model. This fingerprint may correspond to information extracted from the acquired training data item or may correspond to the training data item itself.

[0013] There are several solutions for developing an anomaly detection model that is capable of performing incremental anomaly detection.

[0014] It is for example possible to develop such an anomaly detection model using a Gaussian Mixture model or a method based on a Z-score or standard score.

[0015] However, these methods are not sufficiently efficient in certain applications. In addition, they may require significant memory occupation and the execution of complex calculations.

[0016] There is therefore a need to propose another solution making it possible to obtain a model for the detection of anomalies which is simple to implement by a microcontroller.

[0017] According to one aspect, there is provided a computer-implemented method of developing an anomaly detection model, the method comprising: - obtaining a learning data stream, - an incremental calculation of the principal components of the data flow learning, - an orthonormalization of the principal components calculated in order to obtain an orthonormal basis representing the learning data flow, - development of an anomaly detection model comprising said orthonormal basis and a detection threshold defined by the user.

[0018] In particular, the method for developing the anomaly detection model corresponds to a learning phase for developing the detection model. The duration of this learning phase can be defined by the user.

[0019] Such a method makes it possible to obtain an anomaly detection model adapted to carry out incremental anomaly detection. In particular, the detection model is adapted to classify data that it receives as input as normal data or as abnormal data. This data may come from an acquisition carried out in a physical system to be monitored. For example, the data may be data measured by an accelerometer in a rotating machine. The data may also correspond to an electric current consumed by a device, or to a sound signal associated with a given event.

[0020] The method makes it possible to simply define an orthonormal basis corresponding to a normal behavior of the physical system. The anomaly detection model comprises the orthonormal basis and the defined detection threshold. The anomaly detection model is therefore simple, occupies relatively little memory space and can be executed quickly. In this way, such a detection model can be developed and implemented by a microcontroller.

[0021] In an advantageous embodiment, the incremental calculation of the principal components of the data stream comprises an implementation of an incremental principal component analysis method without covariance.

[0022] Such a method makes it possible to obtain the principal components of the training data stream without requiring the calculation of a covariance matrix of the data stream. Such a method thus makes it possible to reduce the memory occupation for obtaining the principal components of the training data stream and is faster to implement.

[0023] Preferably, the orthonormalization of the basis comprises an implementation of a modified Gram-Schmidt algorithm from the principal components of the training data stream.

[0024] Advantageously, the method further comprises developing a computer program product for detecting anomalies comprising instructions which, when the program is executed by a computer, cause the latter to implement said detection model.

[0025] In an advantageous embodiment, said detection threshold is greater than or equal to 70%, for example of the order of 90%. The detection threshold represents a percentage of energy captured by the calculated base.

[0026] According to another aspect, there is provided a computer-implemented method of anomaly detection, the method comprising: - obtaining a data stream to monitor, - a vector projection of the data to be monitored on an orthonormal basis representing a learning data stream provided by an anomaly detection model, - an energy calculation of the data projected onto the orthonormal basis and an energy calculation of the data to be monitored, - a calculation of an energy ratio between the calculated energy of the data to be monitored and the calculated energy of the data projected onto the orthonormal basis, - a comparison of the calculated ratio with a detection threshold provided by the anomaly detection model, - an assessment of the data to be monitored as normal data or abnormal data based on a comparison result.

[0027] In particular, the anomaly detection method corresponds to an inference phase making it possible to implement the developed detection model.

[0028] Such an anomaly detection method has the advantage of using a simple detection model, occupying little memory space. The anomaly detection method also has the advantage of requiring few computing resources. The anomaly detection method can therefore be implemented quickly. Such an anomaly detection method can then be implemented by a microcontroller.

[0029] Preferably, the data are evaluated as normal when the ratio is greater than or equal to said detection threshold and as abnormal when the ratio is less than said detection threshold.

[0030] Advantageously, the method further comprises generating an alert signal if the data to be monitored are evaluated as being abnormal in order to notify an anomaly detection.

[0031] According to another aspect, there is provided a computer-implemented method comprising: - an implementation of a method for developing an anomaly detection model as described previously then, - an implementation of an anomaly detection method as described previously.

[0032] Thus, the process of developing the anomaly detection model (learning phase) is followed by the detection process (inference phase). These two processes are then implemented successively by a microcontroller deployed in a physical system to be monitored for example.

[0033] According to another aspect, there is provided a computer program product for developing an anomaly detection model comprising instructions which, when the program is executed by a computer, cause the latter to implement a method for developing an anomaly detection model as described previously.

[0034] According to another aspect, there is provided an anomaly detection computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement an anomaly detection method as described above.

[0035] According to one aspect, there is provided a microcontroller comprising: - a memory comprising a computer program product for developing an anomaly detection model as described above, - a processing unit configured to execute said computer program product.

[0036] Advantageously, the memory further comprises a computer program product for detecting anomalies as described previously, the processing unit also being configured to execute this computer program product.

[0037] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments, which are in no way limiting, and the appended drawings in which:

[0038] [Fig.l]

[0039] [Fig.2]

[0040] [Fig.3]

[0041] [Fig.4] illustrate embodiments and implementations of the invention.

[0042] [Fig.l] illustrates a microcontroller MCU configured to implement a method for anomaly detection.

[0043] The microcontroller may be integrated into a system for which monitoring of operating anomalies is required. The microcontroller may be configured to receive data acquired by an acquisition device of said system. This acquired data is then representative of the operation of the system. For example, the physical system may be a rotating machine. In this case, the data may be data measured by an accelerometer in a rotating machine.

[0044] The microcontroller MCU comprises a processing unit UT and a memory MEM.

[0045] The memory MEM comprises a computer program PRG1 comprising ins instructions which, when implemented by the processing unit UT of the microcontroller, cause the latter to implement a method for developing an anomaly detection model as described below. This method makes it possible to obtain an anomaly detection model MDL from training data. More particularly, this method makes it possible to generate a computer program PRG2 comprising instructions which, when implemented by the processing unit UT of the microcontroller, cause the latter to implement an anomaly detection method as described below using said developed anomaly detection model MDL.

[0046] Once the computer program has been developed, the MEM memory includes this PRG2 computer program using the developed MDL anomaly detection model.

[0047] This computer program PRG2 can be executed by the processing unit UT to perform anomaly detection from data to be monitored.

[0048] [Fig.2] illustrates a computer-implemented method for anomaly detection. This method may be implemented by a microcontroller MCU as described in connection with [Fig.l].

[0049] The method comprises an implementation 20 of a method for developing an anomaly detection model and then an implementation 21 of an anomaly detection method using the developed anomaly detection model. The method for developing an anomaly detection model is described below in relation to [Fig.3]. The anomaly detection method is described below in relation to [Fig.4].

[0050] [Fig.3] illustrates a computer-implemented method of developing an anomaly detection model. The computer may be the MCU microcontroller.

[0051] Such a method is used to define a model determining limits of normal behavior of a physical system. The method for developing the anomaly detection model therefore corresponds to a learning phase for developing the detection model. In particular, the learning phase makes it possible to adjust parameters of the detection model as a data stream representative of the behavior of the physical system to be monitored is acquired. The duration of the learning phase can be defined by the user. The duration of the learning phase makes it possible to define the quantity of learning data to be used to develop the detection model.

[0052] The method comprises a step 30 of obtaining a learning data stream. In this step 30, the learning data stream is provided to the microcontroller. The learning data is in particular acquired by an acquisition device, such as a sensor.

[0053] Training data are data representative of normal behavior of a system. Each training data is represented by a vector of values.

[0054] The method then comprises a step 31 of incremental calculation of the principal components of the data stream. In particular, the processing unit of the microcontroller executes a covariance-free incremental principal component analysis method. Such an analysis method is well known to those skilled in the art. In particular, the analysis method corresponds to an incremental algorithm for approximating the principal components using a data stream. The number of principal components is fixed in advance. The algorithm applies an update of the principal components to each data acquisition. This update is carried out based on various projection operations.

[0055] The method is performed incrementally, i.e. the training data is used as it is acquired.

[0056] This analysis method makes it possible to obtain a set of vectors of the principal components of the data flow.

[0057] This analysis method has the advantage of avoiding calculating a covariance matrix. This method therefore makes it possible to extract the principal components of a data set iteratively and using fewer resources (computational operations and memory) than traditional methods based on covariance.

[0058] The method then comprises a step 32 of orthonormalization of the set of vectors of the principal components of the data stream. The orthonormalization corresponds to a transformation of this set of vectors towards an orthonormal basis. In particular, the processing unit executes a modified Gram-Schmidt algorithm (in English “modified Gram-Schmidt process”) well known to those skilled in the art.

[0059] In particular, for a set of principal component vectors consisting of vector xj5 j ranging from 1 to n, n corresponding to the number of vectors Xj, the algorithm comprises an initialization of vectors vj5 j ranging from 1 to n. Each vector Vj is initialized to the value of vector Xj. Then, the algorithm comprises a loop for calculating orthonormal vectors q,, j ranging from 1 to n. The loop for calculating orthonormal vectors q, comprises a calculation of vector q,. The calculation of vector q, corresponds to a normalization of vector Vj. Vector q, is therefore equal to the division of vector Vj by its Euclidean norm (qj= Vj / IlVjll2). The loop for calculating vector q, then comprises a loop for updating vectors vk, k being an index ranging from j+1 to n. The loop for updating vectors vk comprises a calculation of vector vk by the formula next:

[0060] vk^vk- (¾¾)¾

[0061] Orthonormalization step 32 makes it possible to obtain an orthonormal basis of vectors qj which corresponds to an orthogonalized set of the initial vectors Xj. The orthonormal basis is used to correct an orthogonality error induced by the approximation of the calculated principal components. The orthonormal basis is also used to calculate the energy of the data carried by this basis.

[0062] The method comprises a development 33 of an anomaly detection model comprising said orthonormal basis and a detection threshold defined by the user. Said detection threshold may be greater than or equal to 70%, for example of the order of 90%.

[0063] The method further comprises a development 34 of a computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement such a detection model.

[0064] Such a method makes it possible to obtain an anomaly detection model suitable for performing incremental anomaly detection. In particular, the detection model is suitable for classifying data that it receives as input as normal data or anomaly data.

[0065] The method makes it possible to simply define an orthonormal basis corresponding to a normal behavior of the physical system. The anomaly detection model comprises the orthonormal basis and the defined detection threshold. The anomaly detection model is therefore simple, occupies relatively little memory space and can be executed quickly. In this way, such a detection model can be developed and implemented by a microcontroller.

[0066] [Fig.4] illustrates a computer-implemented method of detecting anomalies in a physical system to be monitored.

[0067] The method comprises a step 40 of obtaining a data stream to be monitored. In this step 40, the data stream to be monitored is provided to the microcontroller. The data to be monitored are in particular acquired by an acquisition device arranged in the physical system to be monitored. Each data item is represented by a vector of values.

[0068] The method then comprises a vector projection step 41. In this step 41, the processing unit projects the data to be monitored onto the orthonormal basis. The vector projection corresponds to a scalar product between the data to be monitored and each vector of the orthonormal basis.

[0069] The method then comprises a step 42 of energy calculation. In this step 42, the processing unit calculates the energy of the data projected onto the orthonormal basis. The processing unit also calculates the energy of the data to be monitored. The energy of a vector corresponds to the sum of the squares of all the elements of this vector.

[0070] The method then comprises a step 43 of calculating an energy ratio. In this step 43, the processing unit calculates a ratio between the energy of the data to be monitored and the energy of the data projected onto the orthonormal basis.

[0071] The method then comprises a comparison step 44. In this step, the processing unit compares the calculated ratio with the detection threshold provided by the detection model. This comparison makes it possible to determine whether the data to be monitored corresponds to normal data, such as that used for training the detection model, or to data which corresponds to abnormal data.

[0072] In particular, the method comprises an evaluation step 45. In this step, the processing unit evaluates the data to be monitored based on the result of the comparison.

[0073] More particularly, if the calculated ratio is greater than or equal to the detection threshold, then the processing unit evaluates the data to be monitored as being normal data.

[0074] If the calculated ratio is lower than the detection threshold, then the processing unit evaluates the data to be monitored as abnormal data.

[0075] If the processing unit evaluates the data to be monitored as being abnormal data, then the method may comprise an alert step. In this step, the processing unit generates an alert signal making it possible to notify an anomaly detection.

[0076] Such an anomaly detection method has the advantage of using a simple detection model, occupying little memory space. The anomaly detection method also has the advantage of requiring few computing resources. The anomaly detection method can therefore be implemented quickly. Such an anomaly detection method can therefore be implemented by a microcontroller deployed in a physical system to be monitored.

Claims

Claims

1. A computer-implemented method for developing an anomaly detection model, the method comprising: - obtaining (30) a learning data stream, - incremental calculation (31) of the principal components of the learning data stream, - orthonormalization (32) of the principal components calculated so as to obtain an orthonormal basis representing the learning data stream, - developing (33) an anomaly detection model comprising said orthonormal basis and a user-defined detection threshold.

2. The method of claim 1, wherein the incremental calculation (31) of the principal components of the data stream comprises an implementation of a covariance-free incremental principal component analysis method.

3. A method according to any one of claims 1 or 2, wherein the orthonormalization (32) of the basis comprises an implementation of a modified Gram-Schmidt algorithm from the principal components of the training data stream.

4. Method according to one of claims 1 to 3, further comprising a development (34) of a computer program product for detecting anomalies comprising instructions which, when the program is executed by a computer, cause the latter to implement said detection model.

5. Method according to one of claims 1 to 4, wherein said detection threshold is greater than or equal to 70%.

6. A computer-implemented method for detecting anomalies, the method comprising: - obtaining (40) a data stream to be monitored, - a vector projection (41) of the data to be monitored onto an orthonormal basis representing a learning data stream provided by an anomaly detection model, - calculating (42) the energy of the data projected onto the orthonormal basis and calculating the energy of the data to be monitored, - calculating (43) an energy ratio between the calculated energy of the data to be monitored and the calculated energy of the data projected onto the orthonormal basis, - a comparison (44) of the calculated ratio with a detection threshold provided by the anomaly detection model, - an evaluation (45) of the data to be monitored as being normal data or abnormal data depending on the result of the comparison.

7. The method of claim 6, wherein the data is evaluated as normal when the ratio is greater than or equal to said detection threshold and as abnormal when the ratio is less than said detection threshold.

8. A method according to one of claims 6 or 7, further comprising generating an alert signal if the data to be monitored is assessed as being abnormal in order to notify an anomaly detection.

9. Computer-implemented method comprising: - an implementation (20) of a method for developing an anomaly detection model according to one of claims 1 to 5 then, - an implementation (21) of an anomaly detection method according to one of claims 6 to 8.

10. Computer program product for developing an anomaly detection model comprising instructions which, when the program is executed by a computer, cause the latter to implement a method for developing an anomaly detection model according to one of claims 1 to 5.

11. Anomaly detection computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement an anomaly detection method according to one of claims 6 to 8.

12. Microcontroller comprising: - a memory (MEM) comprising a computer program product for developing an anomaly detection model according to claim 10, - a processing unit (UT) configured to execute said computer program product.

13. Microcontroller according to claim 12, wherein the memory further comprises an anomaly detection computer program product according to claim 11, the processing unit (UT) also being configured to execute this computer program product.

Images