Method for determining indicators representative of anomalies, device and corresponding program.

Abstract

The invention relates to a method for selecting anomaly detection indicators within time series representing the evolution of values ​​over time, a method implemented within an electronic device comprising a processor and a memory.Such a process includes at least one iteration of the following steps: at least one random anomaly generation step (S01) within initial time series (STi), producing at least one synthetic time series (STs); at least one calculation step (S02), for said at least one synthetic time series (STs), of a plurality of statistical indicators (ISn); a selection step (S03), from among the plurality of calculated statistical indicators (ISn), based on the generated random anomalies, of candidate statistical indicators (ISi) capable of explaining said random anomalies; an identification step (S04), from among the candidate statistical indicators (ISi), of at least one explanatory statistical indicator (ISe) explaining said random anomalies. Fig. 1.

Description

Title of the invention: Method for determining indicators representative of anomalies, device and corresponding program. Domain

[0001] The invention relates to the field of data series analysis. More particularly, the invention relates to the analysis of anomalies within data series. The invention also relates to the determination, for data series, of indicators capable of revealing anomalies within those data series. The invention thus makes it easier to identify anomalies present within large datasets comprising numerous data series, in a multidimensional context. Previous art

[0002] In many industrial contexts, computerized data processing is of crucial importance. Such processing enables, in particular, decisions to be made regarding the implementation of sets of production operations. Among the data processed, some relate to the evolution of specific quantities over time and are called time series. These sequences of random variables can be expressed mathematically in order to analyze their behavior, generally to understand past trends and / or to predict future trends.

[0003] For example, in the field of electricity production, at any given moment, from the short term to the long term, including the medium term (which extends from "+2" weeks to "+5" years), the electricity production industry must ensure the balance between energy production and demand (EOD - supply and demand balance) by controlling its risks.

[0004] However, a physical imbalance on the electrical system can lead to a total collapse of the network.

[0005] To prevent this type of situation, industry makes consumption and production forecasts. These forecasts are drawn in particular from past experience and various factors and parameters that are taken into consideration and used in predictive models. Thus, industry anticipates future EODs and manages the tense situations of seasonal transitions in advance by means of a stochastic optimization universe. In this universe, possible future EOD scenarios are simulated based on defined uncertainties. In total, there are several hundred equally probable scenarios and numerous time series (chronological series) allowing for the optimization of EODs. However, behind this multitude of simulated data, "generation" anomalies are present and are due to the forecasting models. used. The main problem lies in the fact that the presence of such anomalies is unpredictable: since the time series (chronological series) are derived from forecasting models, these series do not actually represent a "past" situation that could be analyzed retrospectively. For a given scenario, several dozen time series are generated. These time series are called variables, in reference to the variables they represent in the scenarios.

[0006] As an example, the variable "targetTelereglage" represents a chronicle of the power required to fulfill teleregulation targets, which correspond to the amount of secondary energy that the energy producer must contractually deliver to the energy carrier; another example, the variable "maximumavailableThermalClassicPower" is the maximum available production power in MW for conventional thermal production; yet another example, the variable "maximumavailableNuclearPower" represents the maximum available production power in MW for nuclear production.

[0007] These series belong to different series typologies, and the detection of anomalies in these series can use indicators that are also different.

[0008] Thus, a significant volume of data circulates within the EOD medium-term optimization tool. Visually analyzing and verifying all the series is a very tedious task, which does not prevent the operator from overlooking anomalous data. Therefore, for an operator, determining the presence of anomalies within time series, whose typologies vary considerably, presents increasing difficulties as the volume of data to be processed grows. However, as explained earlier, the inability to establish the presence of an anomaly in a series, or a diagnostic error related to an anomaly in a series, can pose serious problems in the context of managing a production and / or distribution network for resources, whether energy-related, such as electricity (as presented previously), or natural resources (water resources, for example).It is therefore necessary to provide a device capable of searching through a large amount of data.

[0009] That is why an appropriate anomaly detection methodology is preferred.

[0010] Generally, unsupervised anomaly detection methods (derived from "deep learning" or "machine learning") take raw data series as input (generated by a model). In order to extract the maximum amount of information from these raw series, it is common practice to calculate complementary statistical indicators, which are then provided to the anomaly detection models. However, it is not easy to use "deep learning" models because they are extremely resource-intensive and computationally time-consuming. "Machine learning" models are of a different type. on the one hand, they are more affordable in terms of infrastructure, but their implementation with undifferentiated statistical indicators poses problems.

[0011] Indeed, the calculated and used indicators are the same regardless of the series. No indicator selection is possible in an unsupervised setting, that is, when no prior knowledge of anomalies is possible. In fact, without labels, it is impossible to determine which statistical indicators are most relevant for each series type. The current solution thus consists of calculating a known set of indicators for each series. However, this solution increases computation time and reduces performance without providing any significant gains.

[0012] It is therefore essential to reduce the number of statistical indicators to be provided as input to these "machine learning" models.

[0013] The invention improves the situation. Summary

[0014] Thus, the invention aims to improve the detection of anomalies within large sets of data series, such as time series, by making the selection of relevant indicators more efficient based on the typology of the data series to which these indicators are applied.

[0015] The generation of synthetic anomalies makes it possible to solve the problem of unsupervised detection. Indeed, once our anomalies are generated, we have a target towards which to strive in order to choose the relevant statistical indicators to provide as input to our models.

[0016] More specifically, a method for selecting anomaly detection indicators from time series representing the evolution of values ​​over time is described. Such a method is implemented within an electronic device comprising a processor and memory. Such a method comprises at least one iteration: - at least one random anomaly generation step within initial time series, delivering at least one synthetic time series; - of at least one calculation step, for said at least one synthetic time series, of a plurality of statistical indicators; - a selection step, from among the plurality of statistical indicators calculated, based on the random anomalies generated, of candidate statistical indicators, likely to explain said random anomalies; - a step of identifying, among the candidate statistical indicators, at least one explanatory statistical indicator explaining said random anomalies.

[0017] Thus, it is possible on the one hand to efficiently process a large dataset, including many time series, which is not possible for a human operator (due to the quantity of data and the errors potentially made by the operator), and on the other hand to give an unsupervised nature to the selection of indicators and the detection of anomalies, which is also not resolved at this stage.

[0018] According to a particular feature, the step of randomly generating anomalies within initial time series comprises: - obtaining initial time series, these initial time series being randomly selected from available time series; - the generation of synthetic anomalies including the artificial and random creation of data points in the initial series to replace existing data points, based on a predetermined value of at least one anomaly insertion parameter.

[0019] Thus, it is possible to create (and maintain) controlled anomalies, which are inserted into the initial time series to facilitate the selection of the most relevant indicators for the detection of these anomalies.

[0020] According to a particular feature, the random anomaly generation step within initial time series further includes a diversity control step for anomaly types according to at least one predefined control criterion.

[0021] According to a particular feature, the step of random generation of anomalies within initial time series further includes a step of verifying the randomness of the anomalies.

[0022] Thus, it is possible to ensure that the inserted anomalies are sufficiently different from each other so that the subsequently selected indicators are effective in detecting them.

[0023] According to a particular feature, the calculation step, for said at least one synthetic time series, of a plurality of statistical indicators includes the selection of a group of indicators to be calculated from a set of possible indicators.

[0024] Thus, it is possible to sample the calculation of indicators according to predetermined selection criteria, these criteria being for example associated with the typologies of initial time series in order to limit unnecessary calculations.

[0025] According to a particular feature, the determination of a group of indicators to be calculated includes the implementation of at least one statistical method for selecting indicators from among a plurality of available methods (for example, tsfresh test, selectKBest, xgboost).

[0026] According to a particular feature, the selection step, among the plurality of calculated statistical indicators, based on the generated random anomalies, of candidate statistical indicators includes a selection step of a candidate statistical indicator, among the plurality of calculated statistical indicators, when the value of the candidate statistical indicator is greater than a predetermined score associated with said candidate statistical indicator.

[0027] Thus, the obtaining of candidate statistical indicators is carried out according to the potential effectiveness of the current indicator with respect to the detection of anomalies randomly inserted within the synthetic series.

[0028] According to a particular feature, the step of identifying, among the candidate statistical indicators, said at least one explanatory statistical indicator includes the implementation of an isolation forest algorithm so as to discriminate said at least one explanatory statistical indicator from said candidate statistical indicators.

[0029] Thus, among the candidate indicators, only the indicator or indicators that reveal the anomaly in the most reliable way are selected.

[0030] In another aspect, the disclosure also relates to an electronic device for selecting anomaly detection indicators within time series representative of the evolution of values ​​over time. Such an electronic device comprises a processor and memory, and further comprises: - a random anomaly generation component within initial time series, delivering at least one synthetic time series; - a calculation component, for said at least one synthetic time series, of a plurality of statistical indicators; - a selection component, from among the plurality of calculated statistical indicators, based on the generated random anomalies, of candidate statistical indicators, likely to explain said random anomalies; - an identification component, among the candidate statistical indicators, of at least one explanatory statistical indicator that clarifies said random anomalies

[0031] According to another aspect, the invention also relates to a system for implementing a process as previously described.

[0032] According to another aspect, the invention also relates to computer programs capable of implementing the described process(es) and to a data carrier for recording these computer programs.

[0033] The devices have the architecture of a computer. They are equipped with one or more processors capable of executing all types of computer programs, from operating systems to application software, written in Compiled or interpreted languages. The various components of the device are interconnected by a communication bus. The device is equipped with a communication system to communicate via protocols such as Bluetooth, Ethernet, or Wi-Fi with other systems and connect to mobile or fixed telecommunications networks. The device also includes memory components that store the data and programs necessary for its operation. Furthermore, the device is modified to perform management operations on a large number of vehicles and handle several thousand simultaneous operations per second, notably through the parallel implementation of route calculations.

[0034] Data carriers can be any entity or device capable of storing programs. For example, the carriers can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means such as a hard drive, or more commonly, flash memory. Alternatively, the carriers can be transmissible media such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The programs according to the invention can, in particular, be downloaded from a network such as the Internet. Alternatively, the information carrier can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question. Brief description of the figures

[0035] Other features and advantages of the invention will become more apparent upon reading the following description of a particular embodiment, given by way of simple illustrative and non-limiting example, and the accompanying drawings, among which:

[0036] - [Fig.1] illustrates the steps of the selection process according to the invention;

[0037] - [Fig.2] schematically represents an electronic device for putting into work of the invention selection process. Description of a method of implementation

[0038] As explained previously, anomaly detection is crucial in many fields, for example in securing electrical networks, particularly to balance supply and demand. Indeed, abnormal data can lead to erroneous security results, thus causing physical failures on the network. This is why it is essential to develop effective methods for detecting these anomalies. With this in mind, the inventors have developed a method for selecting anomaly detection indicators that is more effective than the detection method previously described.

[0039] Figure 1 illustrates this process. More particularly, the process for selecting anomaly detection indicators within time series representing the evolution of values ​​over time is implemented within an electronic device comprising a processor and a memory, and it comprises at least one iteration: - of at least one random SOI anomaly generation step within initial time series STi, delivering at least one synthetic time series STs; - of at least one calculation step S02, for said at least one synthetic time series STs, of a plurality of statistical indicators ISn; - a selection step S03, among the plurality of statistical indicators calculated ISn, based on the random anomalies generated, of candidate statistical indicators ISI, likely to explain said random anomalies; - an identification step S04, among the candidate statistical indicators ISI, of at least one explanatory statistical indicator ISe explaining said random anomalies.

[0040] Thus, this process relies on the (supervised) selection of statistical indicators from synthetically generated anomalies. In other words, anomaly detection is performed using synthetic time series STs, also called "featured series," obtained via randomly introduced anomalies. This approach makes it possible to address a subsequent problem of unsupervised anomaly detection. The initial series STi belong, in at least one embodiment, to different typologies: in other words, the series can be grouped according to their type, for example, according to the quantity to which the time series relates.

[0041] Since each data series is unique, it is important to exploit the information contained in each one by calculating multiple statistical indicators (STs). These statistical indicators, calculated over a predetermined period (e.g., a week, a month, a year), capture the specific characteristics of the series. However, these statistical indicators do not all apply in the same way to every series. This is why it is relevant to select the ISe indicators according to the series, and more specifically the series types: the ISe indicators selected for one series type will not necessarily be identical to those selected for another series type.

[0042] The introduction of various synthetic series into an anomaly detector provides a gain in information to the model (of the anomaly detector) and strengthens the robustness of its results. Thus, various indicators are calculated STs, then some of these ST indicators are selected using methods (supervised or unsupervised, but in any case informed) to provide the explanatory indicators ISe (which allow for the selection of time series). To fit within this indicator selection framework, random anomalies are synthetically generated in the initial STi series, also called raw series (the location and nature of these anomalies are stored in memory for each synthetic series).

[0043] Thus, synthetic anomaly generation is an important step in this process. It allows the creation of controlled abnormal data, which serve as the basis for selecting the most relevant statistical indicators. This approach has the advantage of allowing the performance of an anomaly detection model to be tested and evaluated under controlled conditions.

[0044] Once the explanatory indicators ISe have been selected, they are used to train an anomaly detection model. This model is capable of detecting abnormal data in real-world data series, based on features learned from synthetic series STs. Anomaly detection is thus performed automatically and in real time, allowing for a rapid response when an anomaly is detected in a series.

[0045] This methodology offers numerous advantages. First, it allows for unsupervised anomaly detection, which is particularly useful when abnormal data are scarce, difficult to obtain, or when dealing with large data volumes. Second, the supervised selection of statistical indicators allows adaptation to the specific characteristics of each data series type, thereby improving the performance of the anomaly detection model. Finally, the synthetic generation of anomalies allows for testing and evaluating the model's performance under controlled conditions.

[0046] Thus, the process based on the informed (supervised or unsupervised) selection of statistical indicators from synthetically generated anomalies offers an effective approach to addressing the challenges of determining relevant statistical indicators for anomaly detection. By leveraging the information contained in each data set and selecting the most relevant indicators, this method improves the performance of the anomaly detection model and enhances security, particularly for electricity generation and supply networks.

[0047] In what follows, the different steps of the process described above are detailed for one or more embodiment examples. Generation of anomalies

[0048] As explained previously, the first step to be implemented in the selection of indicators is to generate anomalies in time series "Raw." Lacking prior knowledge of anomalies in the studied series, synthetic anomalies are generated, enabling a supervised indicator selection problem. Thus, the random SOI generation step of anomalies within the initial STi time series includes, for example, the following steps: - obtaining initial time series, these initial time series ideally being randomly selected from available time series; when several typologies of time series are used, care is taken to ensure that the selection makes it possible to obtain representative samples of all time series in all typologies; - synthetic anomaly generation, which involves using anomaly generation techniques to artificially create unusual data points in the initial series; a predetermined value of an anomaly insertion parameter is used, allowing the quantity of anomalies to be randomly inserted into the series to be fixed, and this anomaly insertion parameter can take the form of a percentage of anomalies; this percentage can be adjusted according to the specific needs of the analysis; - the generation of synthetic anomalies, to obtain synthetic series, can be preceded or followed by a diversity check of the types of anomalies according to predefined criteria: it is thus possible to ensure that the generated anomalies cover a variety of types to capture different scenarios of potential anomalies: the types of anomalies can include patterns such as homothety (constant scale), missing values, areas of missing values, outliers, unprecedented values ​​compared to the history, and other types relevant to the context; Therefore, in this situation (if this control step is implemented a posteriori), only the synthetic series that meet these control criteria are retained; - In addition, depending on the operational implementation conditions, a check of the randomness of the anomalies can also be carried out, in order to guarantee the absence of bias in the insertion of the anomalies: this ensures that the synthetic anomalies represent a diversity of possible cases.

[0049] In an example embodiment, the value of the anomaly insertion parameter is set to 3% anomalies: the type of anomaly (homothety, missing value, missing value area, outlier, new value compared to the history, ...) is not chosen.

[0050] It should be noted that, according to the invention, it is not necessary to ensure that there are no anomalies in the initial "raw" series. Indeed, since the aim is to ensure that indicators will effectively detect anomalies later on, the presence of pre-existing anomalies in the initial series does not affect the selection of the indicators in question. Finally, the initial time series and synthetic versions of these initial time series are retained to allow for the identification of inserted anomalies and the comparison of the initial series with the corresponding synthetic series. Calculation of statistical indicators

[0051] Equipped with synthetic time series, the next step consists of calculating statistical indicators on these synthetic series. According to the invention, a calculation module is implemented to obtain a significant number of different statistical indicators for the same synthetic time series. Depending on the operational implementation conditions, predefined calculation libraries can be used to facilitate the implementation of this step. In a purely illustrative example, a "TsFresh" type library (from the English "Time Series Features extraction based on scalable hypothesis tests") can be implemented to calculate a very large number of indicators (800 in one example). These calculations are performed for all synthetic series, without differentiation.For each synthetic series, the indicators are then stored (after being calculated) with the initial series (and the inserted anomalies). Selection of candidate statistical indicators

[0052] Since each synthetic time series is derived from an initial series and has been randomly modified, and each series potentially belongs to a different series typology (as explained previously) from another, it is necessary to pre-select the indicators that are most likely to explain (or show) the anomalies that have been introduced into the synthetic series.

[0053] To achieve this, according to the invention, different, so-called informed, techniques are used, and then the results of these techniques are combined. In one embodiment, a predetermined number of candidate indicators are selected for each of the informed selection techniques used. For example, for each candidate indicator selection technique, the ten best indicators are retained.

[0054] The indicator selection techniques used are, in an example of implementation, statistical methods (e.g., tsfresh test, selectKBest, xgboost) that deliver groups of potentially relevant indicators (indicators candidates) from among all the calculated indicators. In addition, new groups of potentially relevant indicators (i.e., candidate indicators) can be obtained by performing set operations on the groups of potentially relevant indicators obtained by statistical methods.

[0055] Thus, for example, a "new" group of potentially relevant indicators can be obtained by performing an intersection of the group of potentially relevant indicators resulting from the implementation of Tsfresh and the group of potentially relevant indicators resulting from the implementation of selectKBest. This intersection (if it is not "empty", i.e., if there are indicators in common between the two groups) can be used to form a new group of indicators.

[0056] Similarly, a "new" group of potentially relevant indicators can be obtained by merging the group of potentially relevant indicators resulting from the implementation of Tsfresh and the group of potentially relevant indicators resulting from the implementation of xgboost, for example. This union can be used to form a new group of indicators.

[0057] In other words, following the selection of indicators as such (i.e., following the implementation of the statistical methods for selecting indicators), one or more derivation steps (set-based) of new groups of indicators can be implemented to obtain complementary groups of indicators that can be used to perform the selection of the latter, and this derivation step of a new group of indicators comprises: - the selection of two different groups of indicators, from among the groups resulting from the execution of statistical methods; - the selection of a set operation (Intersection of groups, Union of groups, Difference between groups, Complement between groups) to be applied to the two groups of indicators; - the implementation of the selected set operation on the two selected groups of indicators.

[0058] Several derivation steps can be implemented depending on the needs.

[0059] At the end of this step of selecting the candidate statistical indicators, we have, For each type of synthetic series, at least one group of candidate indicators (but more likely several groups) are used to identify anomalies "synthetically" inserted into the raw series. However, assuming that ten candidate indicators have been identified and that "only" three "pre-selection" techniques for these candidate indicators have been implemented, this step yields thirty candidate indicators for each series type, which remains a large number that needs to be reduced to simplify the implementation. subsequent work of the detection model on "real" (i.e., not randomly altered) series.

[0060] Segregation of candidate statistical indicators

[0061] Thus, in order to have a limited number of statistical indicators to use, a segregation of these indicators is implemented. This segregation is carried out using an anomaly detector. This anomaly detector is, in a way, repurposed from its function of anomaly detection, in the usual sense of the term, to identify which indicators are the most relevant. This makes it possible to assess the quality of the selected indicators relative to one another.

[0062] In one embodiment, the anomaly detector used is the "isolation forest." Generally (and traditionally), the isolation forest is an unsupervised algorithm that returns an anomaly score for each observation (in a set of observations), indicating the likelihood that the observation is anomalous. The algorithm iterates through random partitions and counts the number of partitions required to isolate an observation (from the set). The number of partitions needed to isolate an observation is equivalent to the length of the path between the initial and final nodes. The shorter the paths (the fewer partitions), the more likely it is that the isolated observation is an anomaly. Thus, the anomaly score is fundamentally higher than those of observations whose paths from initial to final nodes are longer.

[0063] The inventors had the idea of ​​"repurposing" the use of this algorithm to determine to what extent one or more indicators from a group of candidate indicators is or are most likely to identify anomalies in a series belonging to a given typology.

[0064] To do this, anomaly scores are used for the indicators in the indicator groups that are selected using the statistical approach. The forest isolation algorithm is then implemented on all the previously obtained indicator groups.

[0065] The candidate indicator groups are evaluated by the forest isolation algorithm in such a way as to retain only the indicator group that obtained the best score (fl-score) on the synthetically generated anomalies. Other features and benefits

[0066] The method described above is implemented through several means and / or calculation components that allow the iterative operations described above to be performed. All of these means can be parameterized and / or controlled by means of a computer program running within the anomaly detection indicator selection device. The device The anomaly detection indicator selection device may include a processing circuit comprising a processor and memory for storing the device's configuration parameters. Additionally, or alternatively, the raw (initial) data series may also be processed and stored within this anomaly detection indicator selection device. The memory stores at least the instructions of a computer program compliant with this disclosure.By performing this type of processing, and in particular by implementing data structures in accordance with the disclosure method for the selection of relevant indicators, the module's processor has proven capable of performing indicator selections in a much more precise, efficient and relevant manner, and this on very large volumes of data, which would not be possible by performing such selections manually, because the volumes of data to be processed are too large.

[0067] A simplified architecture of an electronic selection device capable of performing all or part of the processing described above is presented in relation to [Fig. 2]. An electronic selection device comprises a first electronic module including a memory 41, a processing unit 42 equipped, for example, with a microprocessor, and controlled by a computer program 43. In at least one embodiment, the present technique is implemented in the form of a set of programs installed partly or entirely on the electronic selection device. In at least one other embodiment, the present technique is implemented in the form of a dedicated component (CpX) capable of processing data from the processing units and installed partly or entirely on the selection device.Furthermore, the device also includes communication means (CIE), such as network components (Wi-Fi, 3G / 4G / 5G, wired, RFID / NFC, Bluetooth, BLE, LPWAN, VLC, etc.), which enable the device to receive data (I) from entities connected to one or more communication networks and to transmit processed data (T) to such entities. Such a selection device also includes parallelizable computing means (MCP), which are used to perform indicator calculations, as described above, to calculate and select, from synthetic series, indicators or groups of indicators best suited to detect anomalies.

[0068] In preferred embodiments, the computer system or device comprises one or more processors (which may belong to the same computer or to different computers) and one or more memories (magnetic hard drive, optical disc, electronic memory, or any computer-readable storage medium) in which a computer program product is stored, in the form of a set of program code instructions to be executed in order to put implements all or part of the steps of the control method. Alternatively, or in combination, the system, device, or computer module may include one or more programmable logic circuits (FPGA, PLD, etc.), and / or one or more specialized integrated circuits (ASIC), etc., adapted to implement all or part of said steps of the control method. In other words, the computer system comprises a set of means configured by software (specific computer program product) and / or by hardware (processor, FPGA, PLD, ASIC, etc.) to implement the steps of the selection method.

Claims

Demands

1. A method for selecting anomaly detection indicators within time series representative of the evolution of values ​​over time, implemented within an electronic device comprising a processor and a memory, the method comprising at least one iteration of: - at least one random anomaly generation step (SOI) within initial time series (STi), delivering at least one synthetic time series (STs); - at least one calculation step (S02), for said at least one synthetic time series (STs), of a plurality of statistical indicators (ISn); - a selection step (S03), from among the plurality of calculated statistical indicators (ISn), based on the generated random anomalies, of candidate statistical indicators (ISi), capable of explaining said random anomalies;- an identification step (S04), among the candidate statistical indicators (ISi), of at least one explanatory statistical indicator (ISe) explaining said random anomalies.;

2. A method for selecting anomaly detection indicators according to claim 1, characterized in that the random anomaly generation step (SOI) within initial time series (STi) comprises: - obtaining initial time series (STi), these initial time series (STi) being randomly selected from available time series; - generating synthetic anomalies comprising the artificial and random creation of data points in the initial series (STi) in place of existing data points, according to a predetermined value of at least one anomaly insertion parameter.

3. Method for selecting anomaly detection indicators according to claim 1, characterized in that the random anomaly generation step (SOI) within initial time series (STi) It also includes a step to check the diversity of anomaly types according to at least one predefined control criterion.

4. Method for selecting anomaly detection indicators according to claim 1, characterized in that the random anomaly generation step (SOI) within initial time series (STi) further includes a step for verifying the randomness of the anomalies.

5. Method for selecting anomaly detection indicators according to claim 1, characterized in that the calculation step (S02), for said at least one synthetic time series (STs), of a plurality of statistical indicators (ISn) comprises the determination of a group of indicators to be calculated from among a set of possible indicators.

6. Method for selecting anomaly detection indicators according to claim 5, characterized in that the determination of a group of indicators to be calculated includes the implementation of at least one statistical method for selecting indicators from among a plurality of available methods.

7. Method for selecting anomaly detection indicators according to claim 1, characterized in that the selection step (S03), among the plurality of calculated statistical indicators (ISn), based on the generated random anomalies, of candidate statistical indicators (ISi) comprises a step of selecting a candidate statistical indicator, among the plurality of calculated statistical indicators (ISn), when the value of the candidate statistical indicator is greater than a predetermined score associated with said candidate statistical indicator.

8. Method for selecting anomaly detection indicators according to claim 1, characterized in that the identification step (S04), among the candidate statistical indicators (ISi), of said at least one explanatory statistical indicator (ISe) comprises the implementation of an isolation forest algorithm so as to discriminate said at least one explanatory statistical indicator (ISe) from said candidate statistical indicators (ISi).

9. An electronic device for selecting anomaly detection indicators within time series representative of the evolution of values ​​over time, an electronic device comprising a processor and a memory, and further comprising: - a component for the random generation of anomalies within initial time series (STi), delivering at least one synthetic time series (STs); - a component for calculating, for said at least one synthetic time series (STs), a plurality of statistical indicators (ISn); - a component for selecting, from among the plurality of calculated statistical indicators (ISn), based on the generated random anomalies, candidate statistical indicators (ISi), capable of explaining said random anomalies; - a component for identifying, among the candidate statistical indicators (ISi), at least one explanatory statistical indicator (ISe) explaining said random anomalies.

10. Computer program comprising instructions for carrying out a method according to any one of claims 1 to 8, when said instructions are executed by a processor of a computer processing circuit.

Images