Method for developing an anomaly detection model

Abstract

The computer-implemented process for developing an anomaly detection model includes: - obtaining normal data; - generating abnormal data from the normal data, including introducing implausible values ​​into the normal data; - developing the anomaly detection model using a machine learning algorithm configured to generate an anomaly detection model from the normal and generated abnormal data. Figure for the abstract: Fig 1

Description

Title of the invention: Method for developing an anomaly detection model

[0001] Some embodiments and implementation methods relate to the development of an anomaly detection model.

[0002] Anomaly detection in a physical system is a technique used to identify data that differ significantly from data representative of normal behavior of the physical system. This data is often called "anomalies" or "outliers".

[0003] Anomaly detection is useful in many applications. Some applications use a microcontroller deployed in the physical system to be monitored. Such a microcontroller is then configured to perform anomaly detection.

[0004] Anomaly detection implemented by a microcontroller enables real-time monitoring to detect abnormal behavior in a physical system based on data acquired by at least one sensor of that system. This technique can be used in predictive maintenance applied to a variety of fields such as automotive, aerospace, energy, manufacturing, healthcare monitoring, and many others.

[0005] In the context of anomaly detection, a microcontroller generally uses a model adapted to learn the normal behavior of a system from data collected by at least one sensor of the system. This can be described as incremental learning, particularly if the data is not saved and the learning is based on the flow of collected data.

[0006] If the collected data differs too much from the expected data, this may indicate an anomaly or malfunction in the system. In this case, an alert may be triggered to notify a system operator.

[0007] This type of anomaly detection technique therefore makes it possible to prevent system failures and malfunctions. This improves the reliability and safety of the system.

[0008] The model used to perform anomaly detection is advantageously pre-calibrated (i.e., specifically adapted) for the type of detection in the use case; the pre-calibrated model can be obtained using a machine learning algorithm. A computing device with greater processing power than the microcontroller implementing the model, such as a server or a personal computer, can be used to implement the machine learning algorithm to obtain the model.

[0009] In particular, the machine learning algorithm is configured to generate a model for anomaly detection from training data representative of normal behavior of the system, and ideally also from training data representative of abnormal behavior of the system.

[0010] The anomaly detection model is designed to discriminate between normal and abnormal system behavior. The anomaly detection model can then be used by a microcontroller deployed in the physical system to be monitored.

[0011] However, acquiring training data representative of abnormal behavior can prove difficult, costly, or even impossible in some cases. Indeed, it is often discouraging to break machines in order to intentionally generate anomalies in a system to obtain aberrant data.

[0012] Consequently, in practice single-class models (usually "1-class" in English) are developed without anomaly data, by the machine learning algorithm, so that the "1-class" anomaly detection models thus obtained are efficient and reliable in detecting normal behavior, but may be less efficient and less reliable in the case of abnormal behavior.

[0013] In other words, in the models thus classically obtained, there is a risk of false result in the qualification of the behavior, which is greater in the case of abnormal behavior of the measured system.

[0014] There is therefore a need to improve the performance of anomaly detection models, particularly in the case of abnormal behavior, without benefiting from outlier data from an anomaly in a system (or without benefiting from a larger quantity of outlier data).

[0015] In this regard, some implementation methods propose to generate “simulations” of abnormal data on the basis of normal nominal data, for example by distorting normal signals, the data being used by a machine learning algorithm to generate the anomaly detection model.

[0016] According to one aspect, a computer-implemented method for developing an anomaly detection model is proposed, the method comprising: - obtaining normal data; - the generation of abnormal data from normal data, including the introduction of implausible values ​​into the normal data; - development of the anomaly detection model with a machine learning algorithm configured to generate an anomaly detection model, from normal and abnormal data.

[0017] The machine learning model can be configured to search for the most suitable model for anomaly detection with respect to the data provided, for example from a set comprising elementary models and all possible combinations of elementary models.

[0018] The development of the most suitable anomaly detection model may include a training phase for the models of the set, using training data including normal data; and an evaluation phase for the models thus trained, using test data including other normal data and the abnormal data.

[0019] In other words, according to one implementation, the machine learning algorithm for developing the anomaly detection model comprises: - a model training phase with training data including a portion of the normal data, and - a phase of evaluating the models with test data including another part of the normal data and the abnormal data.

[0020] The model thus developed is specifically adapted to learn the normal behavior of a system using data collected by at least one sensor of the system. This can be described as incremental learning. This allows the system to learn the specific characteristics of each observed environment.

[0021] The model thus developed can be deployed in a microcontroller to monitor a physical system corresponding to the normal data which was used in its development, the model being consequently specifically adapted to the monitoring of the system.

[0022] The model thus developed is, for example, intended to implement incremental learning with data from system monitoring, on a basis which may or may not benefit from prior knowledge of the training data used for the development of the model.

[0023] For example, the detection model is adapted to classify incoming data as normal or abnormal. This data may originate from an acquisition performed in the physical system being monitored. For example, the data may consist of signals measured by an accelerometer or a microphone in a rotating machine.

[0024] According to one embodiment, said implausible values ​​are calculated as a function of the standard deviations and means of the values ​​of the normal data, over the set of normal data.

[0025] According to one embodiment, each implausible value is calculated so as to have a deviation from the mean greater than a factor of the standard deviation (for example greater than 3 times the standard deviation), at the position of the calculated implausible value.

[0026] According to one embodiment, said introduction of implausible values ​​into the normal data includes an amplification of the normal data values ​​by a value factor randomly centered on 1 according to the uniform law if the power of the signal communicated in the normal data is greater than a threshold, or an addition of Gaussian noise to the normal data values ​​if the power is less than the threshold.

[0027] According to one embodiment, said generation of abnormal data comprises, for each abnormal data item, the introduction of implausible values ​​into a local portion of the content of a normal data item, and an unchanged reproduction of the rest of the content of that normal data item.

[0028] According to one embodiment, the local portion corresponds to a frequency sub-band in the spectrum of the normal data content.

[0029] According to one embodiment, the implausible values ​​are randomly introduced on a fraction (for example one third, or between one half and one quarter) of the values ​​of said local portion of the content of the normal data.

[0030] According to one embodiment, obtaining normal data includes acquiring signals in the time domain, and transforming the signals in the frequency domain (for example by means of a fast Fourier transform).

[0031] For example, the method further includes the development of a computer program product for anomaly detection comprising instructions which, when the program is executed by a computer, cause the computer to implement said detection model.

[0032] According to another aspect, a computer-implemented anomaly detection method is also proposed, comprising an implementation of the anomaly detection model developed by a method as defined above.

[0033] In particular, the anomaly detection process corresponds to an inference phase enabling the implementation of the developed detection model, for example deployed within a microcontroller monitoring a physical system.

[0034] For example, the monitoring model can further be configured to implement incremental learning of the normal behavior of the system, with data collected as the physical system monitoring implementations occur.

[0035] For example, the monitoring model may optionally benefit from prior knowledge derived from the data used during the model's development, particularly the normal training data from the training phase. Alternatively, the model may be blank and designed to refine its functionality solely through incremental learning.

[0036] According to another aspect, a computer program product for developing an anomaly detection model is also proposed, comprising instructions which, when the program is executed by a computer, lead the computer to implement a method for developing an anomaly detection model as defined above.

[0037] According to another aspect, a computer program product for anomaly detection is also proposed, comprising instructions which, when the program is executed by a computer, lead the latter to implement a detection method as defined above.

[0038] According to another aspect, a microcontroller is also proposed comprising: - a memory including a computer program product for anomaly detection as defined above, - a processing unit configured to execute said computer program product.

[0039] Other advantages and features of the invention will become apparent upon examination of the detailed description of implementation and embodiments, which are by no means limiting, and the accompanying drawings in which:

[0040] [Fig.1] ;

[0041] [Fig.2] ;

[0042] [Fig.3] ;

[0043] [Fig.4] ;

[0044] [Fig.5] illustrate embodiments and implementations of the invention.

[0045] Fig. 1 illustrates a method for developing an anomaly detection model 100. The method 100 is implemented by computer, for example a desktop computer or a computer provided by an external server.

[0046] The method for developing the anomaly detection model 100 can, for example, be provided in a feature of a computer program product for developing an anomaly detection model comprising instructions which, when the program is executed by a computer, lead the computer to implement a method for developing an anomaly detection model 100 as described below.

[0047] The method for developing the anomaly detection model 100 can, for example, be provided in a feature of a development studio software in this respect.

[0048] The development studio software provides, for example, a simple and pleasant interface for developers, and is designed to generate models, including anomaly detection models, but also outlier detection, classification and regression models.

[0049] These models can be combined and chained together to create a complete artificial intelligence solution: anomaly or outlier detection to detect a problem on the equipment, classification to identify the source of the problem, and regression to extrapolate the information and provide real insight to a maintenance team.

[0050] The input signals can be, for example, signals representing vibrations, pressures, sounds, time of flight, or a combination of several signals.

[0051] The process of developing an anomaly detection model 100 includes obtaining normal data 110, that is, training data representative of the normal behavior of a system, in the manner of single-class classification techniques (usually "1-class classification" in English).

[0052] However, the method 100 advantageously includes a process 200 for generating abnormal data from the normal data obtained for training.

[0053] The abnormal data thus generated makes it possible to "simulate" training data representative of abnormal behavior of the system, in the manner of multi-class classification techniques, without requiring the user to provide abnormal data.

[0054] Indeed, acquiring real data representative of abnormal behavior can prove difficult, costly, or even impossible in some cases, especially if it is necessary to break machines in order to intentionally generate anomalies.

[0055] The anomaly detection model is then advantageously obtained by implementing 300 a machine learning algorithm configured to generate an anomaly detection model, with training and test data comprising normal data 111 and abnormal data 200 thus simulated from the normal data.

[0056] Indeed, the machine learning model 300 can be configured to search for the most suitable model for anomaly detection with respect to the data provided, for example from a set comprising elementary models and all possible combinations of elementary models.

[0057] The development of the most suitable anomaly detection model may include a model training phase, using training data comprising a part of the normal data 111; and an evaluation phase of the models thus trained, using test data comprising another part of the normal data 111 and the abnormal data 200.

[0058] The anomaly detection model thus developed can, for example, be materialized by an anomaly detection computer program product 310 comprising instructions which, when the program is executed by a computer (for example a microcontroller), lead the latter to implement said detection model, such as, for example, a compiled program ready to be deployed in a microcontroller capable of executing it.

[0059] The generation of abnormal data 200 from normal data, summarily includes an introduction of distortion into the content of the normal data obtained, for example by adding implausible values ​​220 into the normal data.

[0060] The implausible values ​​are calculated taking into account statistical and / or physical considerations of normal data, in a non-arbitrary way allowing to approach the fineness and subtlety of the differences between normal and abnormal behaviors of real cases.

[0061] In practice, the generation of the model with anomalous data simulated by the anomalous data generation process 200 is particularly well suited to vibration signals from an accelerometer, measured on rotating machines.

[0062] Advantageously from a practical and analytical point of view, the introduction of distortion is made in the frequency domain.

[0063] Thus, the normal data acquisition step 110 can advantageously include an acquisition of nominal signals in the time domain 111, followed by a transformation of the signals in the frequency domain 112.

[0064] Acquisition 111 can correspond to a reception or reading of data, the content of which expresses the nominal signals, produced externally for example from a database.

[0065] Optionally, the acquisition 111 may correspond to a measurement of said nominal signals, made instantaneously on a real system.

[0066] The transformation in the frequency domain 112 is for example done in a classical and known way by a fast Fourier transform “FFT” (usual abbreviation of the English terms “Fast Fourier Transform”).

[0067] During the FFT transformation in the frequency domain 112, the resulting frequency spectrum can optionally be formally adapted, for example so as to center the data on 0, by removing the mean.

[0068] Furthermore, at this step 112, the magnitudes of the spectral values ​​can be calculated, so as to calculate the power of the nominal signals, or a power spectral density of the nominal signals. Reference is now made to [Fig. 2].

[0069] Fig. 2 illustrates an example of a normal data set, after the transformation step 112. Each normal data is thus represented by a graph tracing the frequency spectrum of the nominal signal.

[0070] Advantageously for the implementation of the distortion introduced into the normal data, and in particular for the quantification of the implausible values ​​220, statistical indicators 120 are calculated on the set of nominal signals thus obtained 112.

[0071] The statistical indicators 120 include, for example, the mean value p and the standard deviation +0, -0 of the amplitudes over the frequencies of the spectrum of all the signals 112 of the set.

[0072] Reference is now made to Figures 3 and 4 to describe an advantageous implementation method of generating abnormal data 200 from normal data, including said introduction of implausible values ​​220 into normal data.

[0073] Fig. 3 illustrates a first step 210 of generation 200 of process 100 (Fig. 1), in which the frequency spectra of the nominal signals are separated into several "N" frequency sub-bands.

[0074] For example, the frequency spectrum of normal data is separated into 4 sub-bands of equal sizes B1, B2, B3, B4.

[0075] Advantageously, the generation of each abnormal data point 200 includes the introduction of implausible values ​​into a local portion B1, B2, B3, B4 of the content of a normal data point. Each abnormal data point also includes an unchanged reproduction of the rest of the content of the normal data point.

[0076] Each local portion therefore corresponds to one of the N (for example N=4) frequency sub-bands Bl, B2, B3, B4 of the spectrum contained in the normal data.

[0077] Thus, it will be noted that with a single normal data 112 (a single nominal signal 111) one can generate N (for example N=4) abnormal data.

[0078] In addition, the implausible values ​​220 can be randomly introduced on a fraction of the values ​​of said local portion of the content of the normal data.

[0079] It should be noted that the data are necessarily sampled since they are measurements recorded in a digital format, and therefore each sub-band comprises a finite number of values ​​at respective positions (in this case, the position being the frequency, the value being the amplitude).

[0080] For example, the fraction is located between one half (1 / 2) and one quarter (1 / 4), for example one third (1 / 3), so that only one value out of three is replaced by an implausible value, while the other values ​​(two out of three, 2 / 3) of the modified frequency sub-band B1-B4 remain unchanged.

[0081] This makes it possible to generate discrete distortions with respect to normal values, which makes it possible to refine the machine learning allowing the detection model to be developed which is also finer and therefore more reliable.

[0082] Indeed, the introduction of distortions that are too "visible" or too discriminatory compared to the normal data could generate a detection model trained to detect marked and unsubtle differences and therefore less efficient.

[0083] In summary, the implementation methods described in relation to [Fig.3], relating to the introduction of implausible values ​​in only a local portion of the normal data, advantageously allow the generation of abnormal data that is relatively similar to the normal data.

[0084] Fig. 4 illustrates examples of abnormal data 221, 222, 223, 224 thus generated from normal data 112.

[0085] Each normal data 112 allows the generation of N (N=4) distinct abnormal data 221, 222, 223, 224, each corresponding to the introduction of the implausible values ​​into one of the N (N=4) frequency sub-bands 210.

[0086] As mentioned previously, the implausible values ​​can be calculated by taking into account statistical indicators of the normal data, for example as a function of the standard deviations o and the means p of the values ​​of the spectrum of the normal data, considered on the set of normal data 112.

[0087] It is recalled that the implausible values ​​are positioned randomly on, for example, one third of the values ​​of the respective sub-band B1-B4.

[0088] In this regard, for example each implausible value is calculated so as to have a deviation from the mean p greater than a factor of the standard deviation o, at the position in the frequency spectrum that the implausible value thus calculated takes.

[0089] In other words, an implausible value is constructed at a given frequency (position), by assigning an amplitude greater than the mean value p at this frequency of at least k times the standard deviation of the values ​​at this frequency over the set of normal data (with for example k=3).

[0090] Alternatively, and as mentioned previously, the implausible values ​​can be calculated by taking into account physical considerations on the normal data 112, such as the consideration of the power of the signal contained in normal data, for example the power spectral density at the corresponding frequency.

[0091] In this regard, for example, the introduction of implausible values ​​220 into the normal data includes an amplification of the nominal signal (i.e. an amplification of the values ​​of the normal data), by a factor randomly centered on 1, for example between 0.5 and 1.5, according to the uniform law, in respectively one of the N (N=4) frequency sub-bands.

[0092] Advantageously, this random amplification operation of the nominal signal can be performed if the signal power is greater than a threshold in the modified band. Otherwise, if the signal power is strictly less than the threshold in the modified band, the introduction of implausible values ​​into the normal data may involve the addition of Gaussian noise to the normal data belonging to said sub-band.

[0093] The positioning of the threshold may, for example, depend on each practical case, according to the nominal powers and the disparity or homogeneity of the powers of the measured signals, and / or other practical considerations.

[0094] The random amplification operation centered around 1 makes it possible to construct implausible values ​​which nevertheless exhibit contained and measured differences on high power nominal signals, but may have too weak an effect for low power nominal signals (below the threshold).

[0095] Conversely, the addition of Gaussian noise makes it possible to introduce a random character into low power signals, but can have too strong and too distinctive an effect in nominal high power signals (above the threshold).

[0096] In summary, the implementation methods described in relation to [Fig.4], relating to the quantification of implausible values ​​introduced discreetly into the normal data, advantageously allow the generation of data sufficiently different from the normal data to bring about an improvement in the generation of the model.

[0097] Fig. 5 illustrates a microcontroller MCU in which the anomaly detection model thus developed has been deployed; it is a microcontroller MCU configured to implement the method for anomaly detection.

[0098] The microcontroller can be integrated into a system for which monitoring of malfunctions is required. The microcontroller can be configured to receive data acquired by a sensor of said system, for example, a microphone or an accelerometer. This acquired data is then representative of the system's operation. For example, the physical system could be a rotating machine.

[0099] The MCU microcontroller includes a processing unit UT and a memory MEM.

[0100] The MEM memory includes a computer program 310 ([Fig.1]) comprising instructions which, when implemented by the microcontroller's processing unit UT, lead it to implement an anomaly detection model 310 as obtained at the end of the process 100 for developing the model 310 described previously in relation to [Fig.1] and Figures 2 to 4.

[0101] This computer program 310, thus deployed in the microcontroller MCU, can be executed by the processing unit UT to perform anomaly detection from data to be monitored.

[0102] This can, for example, be applied to the field of predictive maintenance of rotating machines by controlling vibrations using the MCU microcontroller and an accelerometer.

[0103] In this regard, for example: - collect nominal data with the microcontroller; - generate "simulated" abnormal data from the set of nominal data collected; - train an anomaly detection model in a development studio, based on collected and generated data; - deploy the model on the MCU microcontroller.

[0104] Optionally, it may be possible to update the model deployed on the MCU microcontroller, by training carried out directly on the MCU microcontroller with the data collected during the "practical" implementations of the detection model.

[0105] Indeed, the monitoring model can be configured to implement incremental learning of the normal behavior of the system, with the flow of data collected as the physical system monitoring implementations occur.

[0106] On the other hand, the monitoring model may initially, upon deployment, either benefit from prior knowledge or be blank. The prior knowledge may, for example, be derived from the data used during the development of the model, in particular the normal training data from the training phase.

[0107] Finally, in summary, the generation of "simulated" abnormal data based on normal data comprises the following steps: - Transform nominal data into the frequency domain using an FFT; - Divide each signal into a specific number of equal sub-bands; and, in a first alternative: — Calculate the standard deviation and the mean at all frequencies; — Distort a specific proportion of each band by assigning it implausible values ​​calculated on the basis of the mean and standard deviation, while leaving the other sub-bands unchanged; or, alternatively: — Calculate the power (the magnitude) of the frequency signal; — If the signal strength is greater than a threshold, amplify normal data values ​​by a random factor centered on 1 according to a uniform law; — If the signal strength is below the threshold, add Gaussian noise to the normal data values.

[0108] The abnormal data thus generated are then advantageously used, in addition to normal data, to train the model generation algorithm, for example within a development studio.

Claims

Demands

1. A computer-implemented method for developing an anomaly detection model, the method (100) comprising: - obtaining normal data (110); - generating abnormal data (200) from the normal data, including introducing implausible values ​​(220) into the normal data; - developing the anomaly detection model (300) with a machine learning algorithm configured to generate an anomaly detection model, from the normal data (111) and the abnormal data (220).

2. A method according to claim 1, wherein the machine learning algorithm for developing the anomaly detection model comprises: - a model training phase with training data including a portion of the normal data (111), and - a model evaluation phase with test data including another portion of the normal data (111) and the abnormal data (200).

3. A method according to any one of claims 1 or 2, wherein said implausible values ​​are calculated as a function of the standard deviations (o) and means (p) of the values ​​of the normal data (120), over the set of normal data (112).

4. A method according to claim 3, wherein each implausible value is calculated so as to have a deviation from the mean (p) greater than a factor of the standard deviation (o), at the position of the calculated implausible value.

5. A method according to any one of claims 1 or 2, wherein said introduction of implausible values ​​(220) into the normal data comprises an amplification of the normal data values ​​by a value factor randomly centered on 1 according to the uniform law if the signal power is above a threshold, or an addition of Gaussian noise to the normal data values ​​if the signal power is below the threshold.

6. A method according to any one of claims 1 to 5, wherein said generation of abnormal data (200) comprises, for each abnormal data, the introduction of implausible values ​​into a local portion (B1, B2, B3, B4) of the content of normal data, and an unchanged reproduction of the rest of the content of that normal data.

7. A method according to claim 6, wherein the local portion (Bl-B4) corresponds to a frequency sub-band in the spectrum of the normal data content.

8. A method according to any one of claims 6 or 7, wherein the implausible values ​​(220) are randomly introduced on a fraction of the values ​​of said local portion of the content of the normal data.

9. A method according to any one of claims 1 to 8, wherein the normal data acquisition includes an acquisition of signals in the time domain (111), and a transformation of the signals in the frequency domain (112).

10. A method according to any one of claims 1 to 9, further comprising the development of an anomaly detection computer program product (310) comprising instructions which, when the program is executed by a computer, cause the computer to implement said detection model.

11. Computer-implemented anomaly detection method, comprising an implementation of the anomaly detection model (310) developed by a method according to any one of claims 1 to 10.

12. Product computer program for developing an anomaly detection model comprising instructions which, when the program is executed by a computer, cause the computer to implement a method for developing an anomaly detection model (100) according to any one of claims 1 to 10.

13. Product anomaly detection computer program comprising instructions which, when the program is executed by a computer, cause the computer to implement an anomaly detection method (310) according to claim 11.

14. Microcontroller (MCU) comprising: - a memory (MEM) comprising a computer program product for anomaly detection according to claim 13, - a processing unit (TU) configured to execute said computer program product.

Images