Time-series abnormality detection

Abstract

To provide a system and a method for detecting abnormality in time-series data.SOLUTION: In an abnormality detection system 700, an abnormality detection module 410 based on reconfiguration executes short time Fourier transformation (STFT) for a time-series data sample, applies feature jittering to a STFT frequency component matrix, inputs the STFT matrix subjected to the feature jittering to an encoder / decoder neural network 450, applies masking before an encoder, and performs feature embedding for each layer. Output of the encoder / decoder neural network is a reconfigured STFT matrix, and the STFT matrix is subtracted from the input STFT matrix to produce a difference matrix 480, and an abnormality score is calculated from the difference matrix. For achieving the accurate abnormality score with both of a good data sample and a defect data sample, feature weighting for optimizing frequency weighting to be applied to the difference matrix is adopted.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present disclosure generally relates to a reconstruction-based anomaly detection method, and more particularly to a method for anomaly detection in time series data that uses a short-time Fourier transform to transform time series data into a frequency component input matrix, an encoder / decoder neural network to reconstruct an output matrix, and calculates an anomaly score based on the difference between the input matrix and the output matrix, and uses frequency weighting to optimize anomaly detection performance. [Background technology]

[0002] Anomaly detection is broadly defined as computational analysis that analyzes some type of input data sample to determine whether the data sample represents a normal or abnormal condition. The data sample could be an image of a part, in which case the analysis determines whether the part is normal or abnormal, or it could be time-series data from operation, in which case the analysis determines whether the operating condition is normal or abnormal.

[0003] It is known in the art to use neural network systems, including encoder-decoder neural networks, to perform anomaly detection on data samples. To make training a neural network manageable, the dimensionality of the input data stream must be reduced. When the input data are images of parts, feature extraction can be used to reduce the image pixel data into a matrix of features with lower dimensionality. However, other types of input data present different challenges for reducing the dimensionality.

[0004] Another fundamental challenge in anomaly detection is the data imbalance between input data representing "good" and "bad" objects / processes. That is, the number of good objects / processes used to train a neural network system usually far exceeds the number of bad objects / processes. This can make it difficult for the neural network to build a model that accurately distinguishes between the characteristics of good and bad objects / processes.

[0005] Techniques known in the art attempt to improve the effectiveness of anomaly detection systems. These techniques range from simple adjustment of the threshold between good and bad scores, to adapting neural network classifiers, to one-off filter weighting in feature vector calculations. However, none of these existing techniques have proven effective in adapting flexibly and improving anomaly detection results, especially for applications where the input data stream is time-series data. Summary of the Invention [Problem to be solved by the invention]

[0006] Considering the above-mentioned circumstances, improved methods are needed for anomaly detection from time-series input data, where existing techniques may have difficulty detecting a single anomalous data point. [Means for solving the problem]

[0007] The following disclosure describes a method and system for anomaly detection from time-series input data. A reconstruction-based anomaly detection module is constructed, which first performs a short-time Fourier transform (STFT) on the time-series data samples, and then applies random and static feature jittering to the STFT matrix of frequency component magnitudes for each time interval. The feature-jittered STFT matrix is ​​input to an encoder / decoder neural network, where random and dynamic masking is applied before the encoder and layer-wise feature embedding is employed. The output of the encoder / decoder neural network is a reconstructed STFT matrix, which is subtracted from the input STFT matrix to generate a difference matrix, from which anomaly scores are calculated. After training the encoder / decoder neural network with good data samples, a feature weighting technique is employed to optimize the frequency weights applied to the difference matrix to achieve the most accurate anomaly scores for both good and bad data samples. After training the encoder / decoder neural network and optimizing the frequency weighting, the complete anomaly detection system is used in inference mode on production data.

[0008] Additional features of the present disclosure will become apparent from the following description and appended claims, considered in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the basic structure of an anomaly detection system known in the art. [Figure 2] FIG. 2 is a block diagram of a reconstruction-based anomaly detection system according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a schematic diagram of a processing system in which vibration data is recorded that can be analyzed using time series anomaly detection techniques, in accordance with one embodiment of the present disclosure. [Figure 4]FIG. 4 is a block diagram of an anomaly detection system configured for offline learning, in which a reconstruction-based anomaly detection module with an encoder-decoder neural network is trained with good time-series data samples, in one embodiment of the present disclosure. [Figure 5] FIG. 5 is a diagram of the results of a short-time Fourier transform (STFT) performed on time series data samples, as known in the art. [Figure 6] FIG. 6 is a diagram illustrating a technique for calculating an anomaly score from the difference between an input STFT matrix and a reconstructed STFT matrix in accordance with one embodiment of the present disclosure. [Figure 7] FIG. 7 is a block diagram of an anomaly detection system configured for feature weighting in one embodiment of the present disclosure, where the reconstruction-based anomaly detection module of FIG. 4 is provided with both good and bad data samples to determine feature weights that optimize the resulting anomaly score. [Figure 8] FIG. 8 includes a graph of frequency weights of the X, Y, and Z time series data signals determined by the feature weighting approach depicted in FIG. 7, in accordance with one embodiment of the present disclosure. [Figure 9] FIG. 9 is a block diagram of an anomaly detection system configured for online testing in inference mode, in which operational data samples are provided to the trained anomaly detection module of FIG. 4 and optimized frequency weights are used to determine an anomaly score and classification, in one embodiment of the present disclosure. [Figure 10] FIG. 10 is a flowchart diagram of a method for reconstruction-based time series anomaly detection that includes training an encoder / decoder neural network and optimizing frequency weights used to calculate anomaly scores, in accordance with an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010] The following discussion of embodiments of the present disclosure directed to reconstruction-based methods for time series anomaly detection is merely exemplary in nature and is in no way intended to limit the disclosed approach or its application or uses.

[0011] 1 is a block diagram illustrating the basic structure of an anomaly detection system 100 known in the art. In block 110, input is provided. The input in block 110 can be visual input, such as an image of a part or workpiece. Depending on the application, the input may be a drawing, or it may be data input, such as data from an accelerometer or other sensor that characterizes the operation of the equipment. In either case, the input in block 110 is used to determine whether the item being analyzed (part / workpiece or machine / equipment) is normal (i.e., "good," "OK," "nominal") or abnormal ("bad," "defective").

[0012] The input from block 110 is provided to an algorithm 120 that determines an anomaly score 130. Based on the anomaly score 130, the analyzed item is classified as either normal / good or abnormal / bad in box 140. The algorithm 120 may be any suitable computational algorithm or other type of analyzer, such as a machine learning system.

[0013] Figure 1 is intended merely to illustrate the basic concepts and building blocks of an anomaly detection system to provide a background for further discussion below. While the anomaly detection performed by system 100 of Figure 1 is effective for some types of input, it may have difficulty identifying anomalies or may incorrectly identify anomalies when processing other types of input.

[0014] 2 is a block diagram illustrating a reconstruction-based anomaly detection system 200 according to an embodiment of the present disclosure. The system 200 uses an encoder / decoder neural network 220 to convert an input signal χ at block 210 into a reconstruction signal χ at block 230.

number

number

[0015] The basic concept of reconstruction-based time series anomaly detection is shown at a high level in Figure 2. The following figure and accompanying discussion provide details of a specific time series anomaly detection technique developed to detect anomalies in time series data, such as data collected from machine tool operation.

[0016] 3 is a schematic diagram of a machining system 300 in which vibration data that can be analyzed using a time series anomaly detection technique is recorded, according to one embodiment of the present disclosure. The machine tool 302 is generally designated 302. The machine tool 302 includes a machine frame 310 and a motor 320 that drives a spindle 330. The spindle 330 is mounted by bearings that allow the spindle to rotate within a spindle housing 340 to which the motor 320 is coupled. Attached to the end of the spindle 330 opposite the motor 320 is a tool 350. The tool 350 performs a machining operation on a workpiece 360 ​​that is mounted in a fixture 370.

[0017] A sensor 380, such as a three-axis accelerometer, is attached to the spindle housing 340 to measure vibrations. A computing device 390 (typically a machine controller) controls the operation of the machine tool 302, such as positioning the tool 350 and controlling the speed of the motor 320. The computing device 390 also receives signals from the motor 320 and the sensor 380. For example, the computing device 390 may record a time series of motor speed data, a time series of motor torque command data, or other time series data indicative of the motor's operational performance. This time series data from the motor may include fluctuations or variations that indicate an abnormal condition in the machine tool 302. The computing device 390 also records time series acceleration data from the sensor 380 (e.g., independent acceleration signals in each of the local X, Y, and Z directions), and the sensor data may also include information indicative of an abnormality in the machine tool.

[0018] The time series data recorded by computing device 390 is exemplary of the type of data that can be analyzed using techniques described below to provide an indication of whether machine tool 302 is operating normally or whether an abnormal condition exists. By analyzing the time series data using the techniques disclosed herein, abnormal conditions can be detected when other signs of a problem (such as increased noise or vibration, visible damage, etc.) are not outwardly apparent.

[0019] The time series anomaly detection techniques described below (including the training of the neural network system and the operation of the neural network system in inference mode) are, of course, performed on a computing device. The computing device performing the time series anomaly detection calculations may be computing device 390 (i.e., the machine's controller) or another computer that receives the time series data from computing device 390.

[0020] 3 is merely a high-level schematic diagram of a physical system to which the disclosed time series anomaly detection techniques may be applied. The techniques disclosed herein may also be applied to various types of machining systems, such as multi-axis machine tools, robotically operated mills and drills, etc. Furthermore, machine tools are merely one non-limiting example of a system in which time series data may be generated and used for anomaly detection in accordance with the disclosed techniques. Many other types of systems (mechanical or otherwise) are envisioned in which the disclosed techniques are similarly applicable to time series data.

[0021] 4 is a block diagram of an anomaly detection system 400 configured for offline learning, according to one embodiment of the present disclosure, in which a reconstruction-based anomaly detection module having an encoder / decoder neural network is trained with known good time-series data samples. The time-series data samples are provided in box 402. In a preferred embodiment, the samples provided in box 402 are known good data samples, i.e., time-series data from normal operating conditions of the machine tool or other system represented by the time-series data.

[0022] The reconstruction-based anomaly detection module 410 receives data samples from box 402. To reduce the dimensionality of the time series data samples, a short-time Fourier transform (STFT) is first performed on each time series data sample in box 420. The STFT is a technique that divides a time series data signal into multiple consecutive time intervals and performs a Fourier transform of each time interval to determine the frequency component content of each time interval.

[0023] 5 illustrates the results of a short-time Fourier transform (STFT) performed on time-series data samples, as known in the art. An individual time-series data sample is provided in box 510, which corresponds to one of the known good training samples from box 402 of FIG. 4. An STFT operation is performed on the data sample from box 510, as indicated by arrow 520. The result of the STFT operation is an STFT matrix 530, which contains magnitude data for multiple frequency components (on the vertical axis) for each time interval of multiple time intervals (on the horizontal axis).

[0024] In one exemplary embodiment, the time series data samples have a duration of approximately 10 seconds or more, with a sampling rate of 2000 Hertz (Hz), and the duration of the STFT time interval is defined as 112 milliseconds (ms). The STFT generates frequency components ranging from 0 to 500 Hz, divided into 128 frequency components. Thus, as an example, the STFT matrix 530 may have a size of approximately 50 time intervals (horizontal axis) by 128 frequency components (vertical axis). The number of frequency components and the duration of the time interval can be selected to suit the requirements of the application.

[0025] Ellipse 532 defines a portion of STFT matrix 530, which is expanded in inset 540. As can be seen from inset 540, the horizontal axis is divided into a series of time intervals (TS1, TS2, etc.), and the vertical axis is divided into a series of frequency components (F1, F2, F3, etc.). Each cell of matrix 530 contains a magnitude value corresponding to a particular frequency component at a particular time interval. For example, the bottom left cell shown in inset 540 (cell 542) contains the magnitude (Mag) for time interval 1 at frequency component 1. 1,1 The next cell in inset 540 (cell 544) contains the magnitude (Mag) of time interval 1 at frequency component 2. 1,2 The cell to the right of cell 542 in inset 540 (cell 546) contains the magnitude (Mag) of frequency component 1 for time interval 2. 2,1 ), and so on.

[0026] Using the techniques of the present disclosure, described in detail below, the frequency component magnitude data depicted in STFT matrix 530 and inset 540 are processed in a manner that produces anomaly scores with greater accuracy and repeatability than can be provided by existing anomaly detection techniques.

[0027] Returning to Figure 4, in box 420, an STFT operation is performed on each time series data sample to produce an STFT matrix of the type described in connection with Figure 5. In box 430, feature jittering is performed on the STFT matrix. The feature jittering in box 430 applies random variations to each cell of the STFT matrix. In a preferred embodiment, the feature jittering in box 430 is static, i.e., the same random variations are applied to each time series data sample used for training. Feature jittering is a technique that helps solve "identical shortcuts" in reconstruction-based neural network systems.

[0028] The STFT matrix after feature jittering is defined as input STFT matrix 440. Encoder / decoder neural network 450 processes input STFT matrix 440 and provides reconstructed output STFT matrix 460. Encoder / decoder neural network 450 includes encoder 452 and decoder 454; an encoder / decoder pair is sometimes called a transformer. An encoder / decoder is a type of neural network structure used for sequence-to-sequence learning. Encoder 452 processes an input sequence to generate a set of context vectors, which decoder 454 uses to generate an output sequence. This structure can be applied to a variety of tasks, including, in the current application, reconstructing an input to facilitate comparison between the input and the reconstructed output.

[0029] The encoder / decoder neural network in box 450 includes a masking mechanism 456. The masking mechanism 456 applies a random, dynamic mask to a portion of the cells of the input STFT matrix 440, blanking those cells so that they are invisible to the encoder 452, which operates only on a set of visible cells or patches. The decoder 454 then processes the full set of encoded patches and mask tokens to reconstruct the input. The masking ratio is selected to suit the application requirements and can be in the range of 50-80%, or more or less depending on the requirements. Random masking is a technique that helps overcome overfitting and information redundancy in the encoder / decoder pair. The masking mechanism 456 is shown within the encoder / decoder neural network 450 box because the mask is dynamic; that is, the mask is randomly generated for each iteration when training the encoder / decoder network pair.

[0030] The encoder / decoder neural network 450 also includes a layer-by-layer query embedding. The encoder / decoder pair has a structure that includes various types of layers (e.g., fully connected layers, convolutional layers, and attention layers). A common problem in reconstruction-based anomaly detection is known as the "identity shortcut," in which neural network layers connect nodes in a way that allows accurate reconstruction of both normal and abnormal samples. Accurate reconstruction of abnormal samples reduces the difference between the neural network's input and output, thus resulting in a low anomaly score (discussed below), which is undesirable. Therefore, measures must be taken to minimize the possibility of identity shortcuts. Because query embedding can hinder accurate reconstruction of anomalies, we employ a layer-by-layer query decoder by adding a query embedding to each decoder layer.

[0031] Taking together the STFT in box 420, feature jittering in box 430, the encoder / decoder pair with layer-wise query embedding (452 / 454), and the masking mechanism 456, the reconstruction-based anomaly detection module 410 is able to process time series data for anomaly detection while overcoming known obstacles, including identity shortcuts (leading to low scores for anomalous samples) and overfitting.

[0032] The input STFT matrix 440 and the reconstructed output STFT matrix 460 are fed to a differencing junction 470, where the reconstructed output STFT matrix 460 is subtracted from the input STFT matrix 440. A differencing matrix 480 (D) is output from the differencing junction 470. In box 490, an anomaly score is calculated from the differencing matrix 480 in a manner described below.

[0033] FIG. 6 is a diagram of a technique for calculating an anomaly score from the difference between an input STFT matrix and a reconstructed STFT matrix, according to one embodiment of the present disclosure. The difference matrix 480 (D) of FIG. 4 is shown in step (1) in the upper left of FIG. 6. The difference matrix 480 is D=(STFT in -STFT recon ) / scale, and STFT in is the input STFT matrix 440, and the STFT recon where D(480) is the reconstructed output STFT matrix 460, and scale is a scale factor that can have any appropriate value based on the desired range of anomaly scores calculated in a later step. As previously mentioned, the input STFT matrix 440 contains the STFT data (the magnitude of each frequency component at each time interval) as input to the encoder / decoder neural network 450, and the reconstructed output STFT matrix 460 contains the reconstructed STFT data as output from the encoder / decoder neural network 450. Thus, the difference matrix D(480) reflects how well the output of the encoder / decoder neural network 450 matches the input.

[0034] In step (2), indicated by arrow 610, the norm of the difference matrix D(480) is calculated. The result of the norm(D) operation is depicted as vector 620, which contains the maximum frequency component values ​​in each time interval. In step (3), identified by arrow 630, the top "k" values ​​are selected from norm vector 620. For example, if k is 3, then the top three values ​​are selected from norm vector 620. This is depicted graphically in FIG. 6 by the check marks above the three highest magnitude values ​​in norm vector 620.

[0035] In step (4) in box 640, the anomaly score is calculated as the average of the top "k" values ​​selected above (e.g., the average of the top 3 values). That is, the score is calculated by score=mean(topk). Thus, starting from the difference matrix D in step (1), and combining the operations of steps (2)-(4), the anomaly score can be defined as follows:

number

[0036] Returning again to FIG. 4 , the encoder / decoder neural network 450 of the reconstruction-based anomaly detection module 410 is trained using multiple good data samples to produce low anomaly scores, i.e., to produce a reconstructed output STFT matrix 460 that closely resembles the input STFT matrix 440 of the good data samples. This training is achieved by providing the anomaly scores calculated for each data sample as feedback to the encoder / decoder neural network 450, and over a large number of training samples, the neural network 450 learns the node connectivity that results in low anomaly scores for the good data samples. The reconstruction-based anomaly detection module 410 with the trained encoder / decoder neural network 450 is then used for the second stage of system configuration and finally for online time series data evaluation in inference mode, both of which are described below.

[0037] 7 is a block diagram illustrating an anomaly detection system 700 configured for feature weighting, in which both good and bad data samples are provided to the reconstruction-based anomaly detection module 410 of FIG. 4 to determine feature weights that optimize the resulting anomaly score, according to an embodiment of the present disclosure. Feature weighting is the second stage of system configuration, performed after the encoder / decoder neural network 450 is trained and before the complete system with the reconstruction-based anomaly detection module 410 and optimized frequency weights is used for online time series data evaluation.

[0038] In box 702, classified data is provided, including both known good data samples and known bad (anomalous) data samples. In a preferred embodiment, a large number of good data samples and a small number of anomalous data samples are provided. The reconstruction-based anomaly detection module 410, including the encoder / decoder neural network 450 described in detail with respect to Figure 4, is now shown in a reduced form in Figure 7. The encoder / decoder neural network 450 is trained as described above and is not further trained in the feature / frequency weighting step of Figure 7.

[0039] The reconstruction-based anomaly detection module 410 provides the difference matrix 480, as previously described. However, rather than directly calculating the anomaly scores from the difference matrix 480, the weighted difference matrix 720 (D w ) is created and this matrix is ​​used to calculate the anomaly scores. The weight values ​​in the frequency weight database 710 are optimized in the setting step shown in FIG.

[0040] Continuing with the previous example, consider the case where the STFT input matrix 440 and the reconstructed output matrix 460 each have 50 time intervals (horizontal axis) and 128 frequency components (vertical axis) for a particular time series sample. These matrices and the difference matrix 480 therefore have a size of 128 rows by 50 columns. When data from the X-, Y-, and Z-axis accelerometers is processed, each with its own STFT matrix at its own time series sample, three difference matrices 480 are generated, each with dimensions 128×50. The STFT frequency components can be concatenated into an overall difference matrix D with dimensions 384×50, where the X-, Y-, and Z-frequency components are stacked on top of each other for each time interval column.

[0041] In this example, the frequency weights contained in database 710 are represented as a vector w having dimensions 384 x 1. That is, the vector w (initially filled with all ones) is multiplied by each frequency component value in difference matrix D (480) to produce a weighted difference matrix D w Generate (720).

[0042] Using the technique shown in FIG. 6 and described above, in box 730, a weighted difference matrix D is generated, rather than from the original difference matrix D (480). w The anomaly score is calculated from (720). This calculation is done by dividing D by D w This is done using equation (1) where

[0043] Box 740 contains the frequency weight database 710, the weighted difference matrix D w (720) and anomaly score calculation box 730 together represent a gradient ascent optimizer operating in a loop. The gradient ascent optimizer operates as follows: For each iteration (processing the anomaly scores of multiple good and bad time series data samples), the gradient ascent algorithm finds a gradient in the weight vector space that increases the difference between the anomaly scores of the good and bad samples.

[0044] According to the disclosed approach, a weight is assigned to each frequency component of the difference matrix being evaluated, and the weighted differences are used. Each of the 384 frequency components is assigned an initial weight value of 1.0, and an iterative optimization process is employed in which the anomaly scores are recalculated using the weighted difference matrix, and a gradient ascent calculation is used to adjust the frequency weights to maximize the gap between the anomaly scores of good and bad time series samples.

[0045] As explained above, at each iteration step, multiple time series data samples (including both known good samples and known bad samples) need to be processed. The anomaly scores for the good samples and the anomaly scores for the bad samples are then stored in box 740 and used in the gradient ascent calculation.

[0046] A gradient ascent calculation is performed to update the individual frequency weight values ​​in the weight vector w. As known in the art, gradient ascent is an iterative technique that can be used to evaluate the influence of a set of input variables on the value of a function and follow a gradient to maximize the function. In this case, the gradient ascent calculation is defined as follows:

number

[0047] The iterations continue until the gradient converges to a predefined convergence criterion or a predefined maximum number of iterations is reached, which can be defined as appropriate for a given application.

[0048] 8 includes graphs of frequency weights for X, Y, and Z time series data signals determined by the feature weighting approach depicted in FIG. 7 in accordance with an embodiment of the present disclosure. Graph 810 plots the frequency weights for each of the 128 frequency components of the X-axis accelerometer time series data set. Graph 820 plots the frequency weights for each of the 128 frequency components of the Y-axis accelerometer time series data set. Graph 830 plots the frequency weights for each of the 128 frequency components of the Z-axis accelerometer time series data set.

[0049] As described above with respect to FIG. 7 , a gradient ascent optimization technique was used to adjust each of the 384 frequency weights in the weight vector w to maximize the separation between good and bad anomaly scores. Each graph 810, 820, and 830 has a general trend line at a weight value of 1.0, with some weights being higher and some weights being lower. Weight values ​​set higher than 1.0 in the gradient ascent optimization represent frequency components that are important for distinguishing between good and bad (anomalous) time series data. Weight values ​​set lower than 1.0 in the gradient ascent optimization represent noisy frequency components that are detrimental to accurate anomaly detection.

[0050] The feature / frequency weightings depicted in Figures 7 and 8 have proven highly effective in tuning the disclosed time series anomaly detection system. The frequency weightings used in anomaly score calculations are an effective means of separating good from bad time series data, even when anomalies present in the bad time series samples cannot be detected visually or by other analytical techniques. Furthermore, the gradient ascent technique described above allows for automatic and efficient optimization of frequency weights. Figure 8 clearly demonstrates that any manual technique is not capable of effectively selecting individual frequency weight values. Selecting frequency weights one by one computationally is also ineffective due to the interdependence of hundreds of frequency weights in calculating the anomaly score.

[0051] The frequency weights can be optimized as described above for a particular type of time series data (e.g., a particular machine tool operating with a particular type of part), and the trained encoder / decoder neural network and optimized frequency weights are then used to analyze online production data. If time series data of a different type of operation is to be analyzed, the training of the encoder / decoder neural network and frequency optimization must be performed using time series data samples of that particular type of operation.

[0052] FIG. 9 is a block diagram of an anomaly detection system 900 configured for online testing in inference mode, in which operational data samples are provided to the trained anomaly detection module of FIG. 4 and optimized frequency weights are used to determine anomaly scores and classifications, according to an embodiment of the present disclosure.

[0053] Time series data samples from "production" operations are provided in box 902. That is, the time series data samples provided in box 902 are of unknown classification and may represent normal or abnormal operation. Each data sample (or set of three X / Y / Z data samples) is evaluated using system 900 in online test (inference) mode to determine whether the operation is normal or abnormal.

[0054] The reconstruction-based anomaly detection module 410, including the encoder / decoder neural network 450, described in detail with respect to Figure 4, is now shown in a reduced form in Figure 9. The encoder / decoder neural network 450 has been trained as described above and is not further trained. In Figure 9, a frequency weight database 710 is used, which has the final values ​​of the weight vector w after gradient ascent optimization.

[0055] The reconstruction-based anomaly detection module 410 provides the difference matrix 480, as previously described. The frequency weight database 710 stores the weighted difference matrix 720 (D w), which is used to calculate the anomaly scores for the time series data samples of unknown quality in box 910. The calculation of the anomaly scores in box 910 is the same as that described above with respect to FIG. 6, where the weighted differences D w The new numbering in box 910 in Figure 9 is simply for the purpose of calculating anomaly scores for unlabeled time series data.

[0056] In box 920, the time series data samples are classified as either good or anomalous based on the anomaly score from box 910. Typically, a threshold for the anomaly score is predefined, and time series data samples that result in an anomaly score above the threshold are classified as anomalous. Data samples with scores below the threshold are classified as good. As shown in box 920, anomaly detection systems may use a classification value of 1 for anomaly and -1 for good.

[0057] FIG. 10 is a flowchart diagram 1000 of a method for reconstruction-based time series anomaly detection, including training an encoder / decoder neural network and optimizing frequency weights used to calculate anomaly scores, according to an embodiment of the present disclosure.

[0058] In box 1002, labeled time-series data samples are provided, including both good and bad samples that are selectively used as described. In box 1004, a reconstruction-based anomaly detection module is provided. This is the reconstruction-based anomaly detection module 410 of FIG. 4, which includes a short-time Fourier transform (STFT) algorithm and feature jittering function that results in an input STFT matrix 440, and an encoder / decoder neural network 450 that processes the input STFT matrix 440 to provide a reconstructed output STFT matrix 460. The encoder / decoder neural network 450 includes a random masking mechanism 456 and a layer-by-layer query embedding function, as previously described. The reconstruction-based anomaly detection module 410 generates a difference matrix between the input STFT matrix and the reconstructed STFT matrix, as also previously described, from which an anomaly score is calculated.

[0059] In box 1006, the encoder / decoder neural network 450 is trained to produce low anomaly scores for good time series data samples. As previously mentioned, this is a supervised learning operation, where the anomaly scores calculated from the difference matrix are provided as learning feedback to effectively train the desired encoder / decoder neural network.

[0060] In box 1008, a frequency weight vector w is provided and initialized to have all values ​​equal to 1. In box 1010, the frequency weight vector w is optimized using gradient ascent using both good and bad time series data samples, as shown in FIG. 7 and described above. That is, the weight vector w is used to generate a weighted difference matrix D w This matrix is ​​then used to calculate the anomaly scores, and the anomaly scores for multiple samples (both good and bad) are used in an iterative gradient ascent optimization to find the value of the weight vector w that maximizes the difference between the anomaly scores for the good samples and the anomaly scores for the bad samples.

[0061] In box 1012, the optimized frequency weight vector and the trained encoder / decoder neural network are used to calculate anomaly scores for the unlabeled time series data samples. This is the inference mode of the system depicted in Figure 9, where unlabeled (unknown good or bad) data from an operation is processed through the reconstruction-based anomaly detection module 410 to generate a difference matrix, and the optimized weight vector is applied to generate the weighted difference matrix D w provides the difference matrix D w An anomaly score is calculated from the data sample and the data sample is classified.

[0062] Testing of a reconstruction-based anomaly detection system trained as described above, including both training an encoder-decoder neural network and frequency weighting for anomaly score calculation, has shown superior anomaly detection results in terms of recall (fewer missed anomaly detections) and precision (fewer incorrect anomaly classifications) compared to existing anomaly detection techniques. As disclosed, applying reconstruction-based anomaly detection, including short-time Fourier transforms and corresponding difference matrix score calculations, to time series data provides anomaly detection capabilities that fulfill a previously unmet need.

[0063] Various computers have been described or implied throughout the preceding discussion. It should be understood that these computer software applications and modules execute on one or more computing devices having a processor and memory modules. In particular, this includes a computer having a processor configured with algorithms that perform the functions of the blocks in Figures 4-7 and 9, which can communicate with, for example, controller 390 of Figure 3, as needed to implement a fully automated anomaly detection system.

[0064] The foregoing discussion discloses and describes merely exemplary embodiments of the present disclosure. Those skilled in the art will readily recognize from such discussion, and the accompanying drawings and claims, that various changes, modifications, and variations can be made without departing from the spirit and scope of the present disclosure, as defined in the following claims.

Claims

1. A method for reconstruction-based time series anomaly detection, comprising: performing a short-time Fourier transform (STFT) on the time series data samples to provide an input STFT matrix; providing the input STFT matrix to an encoder / decoder neural network, which computes a reconstructed output STFT matrix; multiplying a frequency weight vector by the difference between the input STFT matrix and the output STFT matrix to generate a weighted difference matrix; and calculating an anomaly score for the time series data sample from the weighted difference matrix.

2. The method of claim 1 , wherein the input STFT matrix, the output STFT matrix, and the weighted difference matrix each include magnitudes of multiple frequency components for each of multiple time intervals.

3. The method of claim 1 , wherein a feature jittering operation is performed on the input STFT matrix before the input STFT matrix is ​​provided to the encoder / decoder neural network.

4. 10. The method of claim 1, wherein the encoder / decoder neural network includes a random masking mechanism applied before an encoder module and includes layer-by-layer query embedding.

5. 2. The method of claim 1, wherein the encoder-decoder neural network is trained using supervised learning by calculating the anomaly scores for a plurality of pre-classified good time series data samples and providing the anomaly scores as feedback for training a neural network.

6. The method of claim 5 , wherein the supervised learning includes a penalty or reinforcement that causes the encoder / decoder neural network to produce low anomaly scores for the good time series data samples.

7. 6. The method of claim 5, wherein the frequency weight vector is set to all values ​​equal to 1 during the supervised training of the encoder / decoder neural network.

8. 2. The method of claim 1 , wherein values ​​of the frequency weight vector are determined by performing a gradient ascent optimization that includes calculating anomaly scores for a plurality of pre-sorted time series data samples that include both good and bad samples, and iteratively adjusting values ​​of the frequency weight vector and recalculating the anomaly scores to maximize the difference between the anomaly scores of the good and bad samples.

9. 9. The method of claim 8, wherein the gradient ascent optimization of the frequency weight vector is performed after the encoder / decoder neural network is trained to produce low anomaly scores for good time series data samples.

10. 2. The method of claim 1 , wherein the anomaly score is calculated by taking the norm of the weighted difference matrix to obtain a vector with a maximum frequency content in each time interval, selecting a number of elements of the vector that have the maximum values, and calculating the anomaly score as an average of the number of elements with the maximum values.

11. 2. The method of claim 1 , wherein the encoder / decoder neural network is trained to produce low anomaly scores for good time series data samples, and an anomaly score is calculated for unlabeled time series data samples after the values ​​of the frequency weight vector are optimized to maximize the difference between the anomaly scores of good and bad samples, and the unlabeled time series data sample is classified as anomalous if its anomaly score is above a predefined threshold.

12. 2. The method of claim 1 , wherein the time series data samples include one or more of torque data from a spindle motor of a machine tool, velocity data from the spindle motor, and / or data from one or more axial accelerometers mounted to the machine tool.

13. A method for reconstruction-based time series anomaly detection, comprising: performing a short-time Fourier transform (STFT) on the time series data samples to provide an input STFT matrix; providing the input STFT matrix to an encoder / decoder neural network that computes a reconstructed output STFT matrix; multiplying the difference between the input STFT matrix and the output STFT matrix by a frequency weighting vector to generate a weighted difference matrix, wherein each of the input STFT matrix, the output STFT matrix, and the weighted difference matrix includes magnitudes of a plurality of frequency components for a plurality of time intervals; calculating an anomaly score for the time series data sample from the weighted difference matrix; the encoder-decoder neural network is trained using supervised learning by calculating anomaly scores for a plurality of pre-classified good time series data samples and providing the anomaly scores as feedback for training the neural network; The values ​​of the frequency weight vector are determined by performing a gradient ascent optimization, including calculating anomaly scores for a plurality of pre-sorted time series data samples, including both good and bad samples, and iteratively adjusting the values ​​of the frequency weight vector and recalculating the anomaly scores to maximize the difference between the anomaly scores of the good and bad samples; The method, wherein an anomaly score is calculated for unlabeled time series data samples after the encoder / decoder neural network is trained and the values ​​of the frequency weight vector are optimized.

14. 1. A reconstruction-based time series anomaly detection system, comprising: a computer having a processor and a memory, the computer comprising: a reconstruction-based anomaly detection module that performs a short-time Fourier transform (STFT) on the time-series data samples and provides an input STFT matrix to an encoder / decoder neural network that computes a reconstructed output STFT matrix; a frequency weight database containing frequency weight vectors that are multiplied by the difference between the input STFT matrix and the output STFT matrix to produce a weighted difference matrix; an anomaly score calculation algorithm that calculates an anomaly score for the time series data sample from the weighted difference matrix.

15. 15. The system of claim 14, wherein the input STFT matrix, the output STFT matrix, and the weighted difference matrix each include magnitudes of multiple frequency components for each of multiple time intervals.

16. 15. The system of claim 14, wherein a feature jittering operation is performed on the input STFT matrix before the input STFT matrix is ​​provided to the encoder / decoder neural network, the encoder / decoder neural network including a random masking mechanism applied before an encoder module and including layer-by-layer query embedding.

17. 15. The system of claim 14, wherein the encoder / decoder neural network is trained using supervised learning by calculating anomaly scores for a plurality of pre-classified good time series data samples and providing the anomaly scores as feedback for training a neural network, the supervised learning including a penalty or reinforcement that causes the encoder / decoder neural network to produce low anomaly scores for the good time series data samples.

18. 18. The system of claim 17, wherein the frequency weight vector is set to all values ​​equal to 1 during supervised training of the encoder / decoder neural network.

19. 15. The system of claim 14, wherein the values ​​of the frequency weight vector are determined by performing a gradient ascent optimization that includes calculating anomaly scores for a plurality of pre-sorted time series data samples that include both good and bad samples, and iteratively adjusting values ​​of the frequency weight vector and recalculating the anomaly scores to maximize the difference between the anomaly scores of the good and bad samples.

20. 20. The system of claim 19, wherein the gradient ascent optimization of the frequency weight vector is performed after the encoder / decoder neural network is trained to produce low anomaly scores for good time series data samples.

21. 15. The system of claim 14, wherein the anomaly score is calculated by taking the norm of the weighted difference matrix to obtain a vector with a maximum frequency content in each time interval, selecting a number of elements of the vector with a maximum value, and calculating the anomaly score as an average of the number of elements with the maximum value.

22. 15. The system of claim 14, wherein the encoder / decoder neural network is trained to produce low anomaly scores for good time series data samples, and an anomaly score is calculated for unlabeled time series data samples after the values ​​of the frequency weight vector are optimized to maximize the difference between the anomaly scores of the good and bad samples, and the unlabeled time series data sample is classified as anomalous if its anomaly score is above a predefined threshold.

23. 15. The system of claim 14, wherein the time series data samples include one or more of torque data from a spindle motor of a machine tool, velocity data from the spindle motor, and / or data from one or more axial accelerometers mounted to the machine tool.

24. 24. The system of claim 23, wherein data for concurrent time series data samples comprising acceleration data measured in three primary directions of the machine tool are processed simultaneously, comprising concatenating frequency component data from all of the concurrent time series data samples into a combined weighted difference matrix, and calculating the anomaly score from the combined weighted difference matrix.

Images