Anomaly detection using measurement time series and event sequences for medical decision making

Abstract

The method and system for anomaly detection includes encoding (506) multivariate time series and multiple types of event sequences using respective transformers and aggregation networks to generate feature vectors. Anomaly detection is performed (508) using the feature vectors to identify anomalies in the system. Corrective actions are taken (510) in response to the anomalies to correct or mitigate the effects of the anomalies. The detected anomalies can be used in healthcare settings to assist medical professionals in making decisions regarding patient treatment. The encoding can include machine learning models for implementing the transformers and aggregation networks using deep learning.

Description

[Technical Field]

[0001] Related Application Information This application claims priority to U.S. Patent Application No. 63 / 418,999, filed October 25, 2022, and U.S. Patent Application No. 18 / 493,374, filed October 24, 2023, each of which is incorporated by reference in its entirety. [Background technology]

[0002] The present invention relates to event prediction, and more particularly to inferring system states from event history and time series information. 2. Description of Related Art

[0003] Event prediction helps manage complex systems: in cyber-physical systems such as information technology systems, hardware failures can be predicted and preventive maintenance can be planned; in health care systems, predicting adverse events can help doctors adjust treatment early and prevent adverse health outcomes. Summary of the Invention

[0004] A method for anomaly detection includes encoding a multivariate time series and multiple types of event sequences using respective transformers and aggregation networks to generate feature vectors. Anomaly detection is performed using the feature vectors to identify anomalies in the system. Corrective actions corresponding to the anomalies are taken to correct or mitigate the effects of the anomalies.

[0005] A system for anomaly detection includes a hardware processor and a memory that stores a computer program. When executed by the hardware processor, the computer program causes the hardware processor to encode multivariate time series and multiple types of event sequences using respective transformers and aggregation networks to generate feature vectors. Anomaly detection is performed using the feature vectors to identify anomalies in the system. Corrective actions corresponding to the anomalies are performed to correct or mitigate the effects of the anomalies.

[0006] A method for providing treatment includes measuring time series information about a patient. The time series information and a sequence of health events are encoded for the patient using respective transformers and an aggregation network to generate a feature vector. Anomaly detection is performed using the feature vector to identify the health events. Corrective actions are performed in response to the health events to correct or mitigate adverse health effects caused by the health events.

[0007] These and other features and advantages will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. [Brief explanation of the drawings]

[0008] The present disclosure provides details in the following description of preferred embodiments with reference to the following figures.

[0009] [Figure 1] FIG. 1 is a configuration diagram of a cyber-physical system that performs anomaly detection based on time-series information and event log information according to an embodiment of the present invention.

[0010] [Figure 2] 1 is a diagram of a patient in a healthcare situation receiving treatment in response to a detected health condition, according to one embodiment of the present invention;

[0011] [Figure 3]1 is a block diagram of a healthcare facility where information about the functionality of a treatment system and medical records are used to detect anomalies, according to one embodiment of the present invention.

[0012] [Figure 4] FIG. 1 is a block / flow diagram of an anomaly detection method / system according to one embodiment of the present invention.

[0013] [Figure 5] FIG. 1 is a block / flow diagram of a method for training and using a deep learning model for anomaly detection, according to one embodiment of the present invention.

[0014] [Figure 6] FIG. 1 is a block / flow diagram of a method for training a deep learning model for detecting anomalies, according to one embodiment of the present invention.

[0015] [Figure 7] FIG. 1 is a block diagram of a computing device capable of training and using an event prediction model to detect and correct anomalies, according to one embodiment of the present invention.

[0016] [Figure 8] FIG. 1 is a diagram of an exemplary neural network architecture that may be used to implement a portion of an anomaly prediction model, according to one embodiment of the present invention.

[0017] [Figure 9] FIG. 1 is a diagram of an exemplary deep neural network architecture that may be used to implement a portion of an anomaly prediction model, according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0018] Event prediction uses information about past events, but may also use information about the constantly changing system state, which can be inferred from current time series information about system measurements.

[0019] There are complex causal relationships between events and time series information. For example, an increasing trend in memory usage in a computer system is likely to eventually cause an out-of-memory event. On the other hand, rising levels of disk queue length may be the result of disk-access-intensive application events. Event prediction that takes into account time series information and event history will yield better results than systems that consider only one or the other.

[0020] Measurements from a system may be correlated with event logs because many actions that cause changes in measurements are recorded in the logs. For example, when a large application is launched, a sudden increase in processor usage is expected, but if no such activity is recorded, it may be an anomaly. On the other hand, a sudden burst of network traffic events is not an anomaly if it correlates with an increase in the number of users, but if traffic measurements are normal, the burst of events may indicate a hardware failure. Furthermore, different measurements may be correlated with each other because they measure the same fundamental performance factors. For example, processor usage and memory usage both reflect the level of system activity.

[0021] Furthermore, interpretation of the system state can take advantage of the context jointly given by the time series of all measurements and the event log. Events reacting to specific anomalies can be pinpointed to make detection results reliable and explainable.

[0022] To this end, machine learning models can be used to predict the type and duration of anomalies given a history of previous events and one or more time-series measurements. Transformers and attention mechanisms are used to explicitly model the interactions between system events and measurements, encapsulating the interactions in hidden states. Support vector data description (SVDD) loss characterizes the encoded state of normal data and can be used to detect whether incoming multivariate sensor data deviates from normal states.

[0023] 1, a maintenance system 106 is shown in the context of a monitored system 102. The monitored system 102 can be any suitable system, such as a physical system, such as a manufacturing line or physical plant operation, an electronic system, such as a computer or other computerized device, a software system, such as an operating system or application, or a cyber-physical system that combines physical systems with electronic and / or software systems. Exemplary systems 102 include a variety of types, such as railroad systems, power plants, vehicle sensors, data centers, transportation systems, etc.

[0024] One or more sensors 104 record information about the state of the monitored 516 system 102. The sensors 104 may be any suitable type of sensor, including, for example, physical sensors such as temperature, humidity, vibration, pressure, voltage, current, magnetic field, electric field, and light sensors, as well as software sensors such as logging utilities installed on a computer system to record information about the state and operation of operating systems and applications running on the computer system. The information generated by the sensors 104 may be in any suitable format and may include sensor log information generated in heterogeneous formats.

[0025] The sensors 104 may transmit the recorded sensor information to the abnormal maintenance system 106 via any suitable communication medium and protocol, including wireless and wired communication. The maintenance system 106 can identify anomalies or abnormal behavior, for example, by monitoring the multivariate time series generated by the sensors 104. When abnormal behavior is detected, the maintenance system 106 communicates with the system control unit to modify one or more parameters of the monitored system 102 to correct the abnormal behavior.

[0026] Exemplary corrective actions include changing security settings of an application or hardware component, changing operating parameters (e.g., operating speed) of an application or hardware component, stopping and / or restarting an application, stopping and / or restarting a hardware component, changing environmental conditions, changing the state or settings of a network interface, etc., thereby allowing the maintenance system 106 to automatically correct or mitigate the abnormal behavior. Identifying the specific sensors 104 associated with an anomaly classification can reduce the time required to isolate the problem.

[0027] Each of the sensors 104 outputs a respective time series that encodes measurements made by the sensor over time. For example, a time series may include pairs of information, each pair including a measurement and a timestamp indicating the time the measurement was made. Each time series may be divided into segments that represent measurements made by the sensor over a particular time range. A time series segment may represent any suitable interval, such as one second, one minute, one hour, or one day. A time series segment may represent a set number of collection points, such as 100 measurements, rather than a fixed period of time.

[0028] The maintenance system 106 may track the occurrence of events related to the state of the monitored system 102. For example, the maintenance system 106 may receive information related to workload, job starts and stops, and failures. This information may be recorded along with appropriate timestamps and other state information related to the state of the monitored system 102 at the time the event occurred, including, for example, information collected by sensors 104. Time series information may be recorded periodically or aperiodically but frequently, while event information may be recorded whenever a discrete event occurs.

[0029] The maintenance system 106 may use event prediction 108 to predict when future events will occur. Event prediction utilizes both event history information and time series information to determine when an event is likely to occur. The maintenance system 106 can further determine which sources of information contribute most to the prediction, thereby enabling corrective actions taken by the maintenance system 106 to be tailored to the root cause of the problem.

[0030] Referring now to FIG. 2, a patient 20 is shown in the context of a health care system. For example, a patient 202 may be undergoing hemodialysis (also referred to simply as "dialysis"). During dialysis, a dialysis machine 204 automatically draws the patient's blood, processes and cleanses the blood, and reintroduces the cleansed blood into the patient's body. Dialysis may take four hours and may occur every three days, although other durations and time periods are contemplated. While dialysis is specifically envisioned, it should be understood that any suitable medical procedure, monitoring, or system may be used instead.

[0031] Before, during, and after a dialysis session, the patient 202 may experience treatment-related health events. Such health events, which may be dangerous to the patient 202, can be predicted based on knowledge of previous health events and the patient's current health measurements. Before the patient 202 undergoes a medical procedure or treatment, such as dialysis, the medical professional 206 reviews a recommendation 208 that includes a prediction score. The prediction score indicates the likelihood of a health event occurring during the dialysis session. The recommendation 208 may further include information related to the type of predicted event and measurements of the patient's condition. It is specifically contemplated that the recommendation may be made before the dialysis session begins, and treatment may be adjusted.

[0032] Recommendations may be based on various input information. Part of the information may include a patient's static profile, including information such as age, gender, when dialysis was initiated, and previous health events. The information may also include dialysis measurement records, which may be taken for each dialysis session, as well as dynamic data such as blood pressure, weight, venous pressure, blood test measurements, and cardiothoracic ratio (CTR). Blood test measurements may be taken periodically, such as twice a month, to measure factors such as albumin, glucose, and platelet count. CTR may also be measured periodically, such as monthly. Dynamic information may also be recorded during a dialysis session, for example, using sensors on the dialysis machine 204. The dynamic information may be modeled as a time series over each frequency.

[0033] Additionally, the system itself may be monitored within a healthcare environment. For example, the operating parameters of a dialysis machine 204 or other system within a hospital or other healthcare facility, along with the history of past events in the system, are often monitored to detect anomalies, as described below. When an anomaly is detected, corrective action may be taken and / or a system administrator may be notified.

[0034] Referring now to FIG. 3, there is a diagram of anomaly detection in the context of a healthcare facility 300. Rather than, or in addition to, detecting anomalies in the context of treating a single patient, the present principles may be applied to all systems within the facility. This may be useful for monitoring and treating multiple patients, for example, in response to changing environmental conditions or material shortages. Such facilities may also be vulnerable to cyber-attacks, and detecting anomalies in such situations can help identify and thwart attacks, preserving the facility's ability to treat patients.

[0035] The healthcare facility may include one or more medical professionals 302 that provide anomaly information and system status measurements to the anomaly detection system 308. The treatment system 304 may further be designed to monitor the patient's condition, generate a medical record 306, and automatically administer and adjust treatment as needed.

[0036] Based on information drawn from at least the medical professionals 302, the treatment system 304, and the medical records 306, the anomaly detection system 308 can detect anomalies and can automatically respond to correct or mitigate the detected anomalies. For example, corrective action may be taken and / or facility administrators may be notified. If administrators are notified, the anomaly detection can be used to assist in decision-making by hospital administrators.

[0037] The different elements of the healthcare facility 300 can communicate with each other over a network 310, for example, using any suitable wired or wireless communication protocol and medium. Thus, the output of the anomaly detection system 308 can access remotely stored medical records 306, communicate with the treatment system 304, receive instructions for the medical professional 302, and send reports.

[0038] 4, anomaly detection using time series information and event sequence information is illustrated. The input may include a multivariate time series 402, for example, combining multiple time series from different sensors. The input may further include a multi-event sequence 404, which may indicate the type of event, the time the event occurred, and other suitable information related to the event. The multi-event sequence may include multiple different types of events.

[0039] The encoder 406 embeds the inputs into a latent space, generating a set of features that represent the combined inputs 402 and 404. Each input generates a respective feature vector, which may be aggregated in 408 to create a context vector. The encoder 406 may include a transformer with a stack of self-attention and cross-attention layers that combine information across different time steps from each sequence. The hidden states from each time step of each sequence are then concatenated and passed to the aggregation network 408. The aggregation network 408 may include a self-attention layer that combines information from all time steps of both streams and outputs a context vector.

[0040] The context vector may be used as input to an SVDD loss function 410. The feature vectors from all training data may be used to calculate the SVDD loss 410, which is interpreted as the radius of the smallest hypersphere that encompasses all training data in the latent feature space. The output of the SVDD loss function 410 may be used to detect anomalies 414.

[0041] 5, a method for detecting and responding to anomalies is shown. Block 502 obtains a set of training data, which may include system measurement time series and time-stamped event sequences, and trains a machine learning model to detect anomalies, as described in more detail below. The training process 502 may use multivariate time series and event logs collected during the system's normal operating conditions, and this information may be used to optimize according to SVDD loss 410. The trained model is then deployed 504 to an installation, such as a cyber-physical system management system 106 or a health care analytics system.

[0042] In block 506, new data may be collected from the devices, including event information and multivariate time series information. This new data represents the operating state of the system and its specific event history. The trained model is used in block 508 to generate an anomaly score associated with the system's operation; for example, an anomaly score above a threshold is interpreted as an abnormal operating state. If the anomaly score is higher than the threshold, block 508 may further generate a ranked list of system events that are potential causes of the anomaly. For example, this event prediction may relate to an expected system malfunction or an adverse health event.

[0043] Block 510 then executes actions to prevent or mitigate harm from the predicted event. In the context of a cyber-physical system 102, actions may include executing an automated response to address one or more subsystems expected to be associated with the predicted event. For example, actions may include changing environmental parameters to prevent overheating or shutting down a subsystem to prevent damage.

[0044] In the context of patient 202, if the detected anomaly is an adverse health event, the action may include automatic adjustments to therapy, such as adjusting the operation of dialysis machine 204, adjusting the dosage of an intravenously administered medication, or stopping a procedure deemed unsafe.

[0045] 6, details of training 502 are shown. Block 602 acquires a training data set including synchronized system measurement time series and time-stamped system event sequences. Block 604 analyzes the event messages in the system event sequences to identify the event type from each message, for example, by representing each different type of event as a different integer value.

[0046] The training data can be divided into context windows, for example, using overlapping windows of fixed length. Each training sample corresponds to a time series segment x within the window. i , the event subsequence in the window v i , the event immediately following the window (time t i Type u in i ) are obtained from each time window.

[0047] Training can be performed in two phases. In the first phase, autoencoder training 606 can be performed, as described in more detail below. Autoencoder training 606 trains an encoder to determine hidden states of an input time series and uses a decoder to reconstruct the input time series. The autoencoder loss is used to update the parameters of the autoencoder, for example, using stochastic gradient descent. The encoder portion of the autoencoder can be used in encoder 406.

[0048] In the second phase, the entire model is trained using the SVDD loss, as described in more detail below. The encoder 406 and the aggregation network 408 are used to generate feature vectors for training examples, and the SVDD loss is calculated. Based on the SVDD loss, the parameters of the encoder 406 and the aggregation network 408 may be adjusted, for example, according to stochastic gradient descent.

[0049] The multivariate time series is first processed by a one-dimensional convolutional layer, and the result for each timestamp is concatenated with the corresponding time embedding vector before being input to the encoder 406. The event sequence may first be parsed by a log parser to decompose each event message into a template and parameters. For example, the message "ESMCommonService has transitioned to the stopped state" may be converted into a template "[*]has transitioned to the stopped state" and a parameter "ESMCommonService". A template embedding layer and a parameter embedding layer are trained to convert the template and parameters into vectors, respectively. For each event in the sequence, the template embedding vector, parameter embedding vector, and time embedding vector are concatenated and used as the input of the transform encoder.

[0050] The aggregation network 408 is a stack of self-attention layers. The hidden state of the time-series transform encoder at the last time step is the latent vector

number

number

[0051] In the second training phase 608, the feature vectors from the aggregation network 408 are

number

number

number

number

number

number

[0052] After the model is trained and deployed, at time t, events and time series within a fixed-size context window preceding t may be input to the model. The model outputs an anomaly score, for example, by computing an SVDD loss. System events with the highest attention weights (e.g., selecting the top k weights) may be output as potential causes of events whose anomaly scores exceed a threshold.

[0053] 7, an exemplary computing device 700 is shown, in accordance with an embodiment of the present invention. The computing device 700 is configured to perform anomaly detection.

[0054] Computing device 700 may be embodied as any type of computational or computing device capable of performing the functions described herein, such as, but not limited to, a computer, a server, a rack-based server, a blade server, a workstation, a desktop computer, a laptop computer, a notebook computer, a tablet computer, a mobile computing device, a wearable computing device, a network appliance, a web appliance, a distributed computing system, a processor-based system, and / or a user electronic device. Additionally or alternatively, computing device 700 may be embodied as one or more compute sleds, memory sleds, or other racks, sleds, computing chassis, or other components of a physically separated computing device.

[0055] 7, computing device 700 illustratively includes a processor 710, an input / output subsystem 720, a memory 730, a data storage device 740, and a communications subsystem 750, and / or other components and devices typically found in a server or similar computing device. In other embodiments, computing device 700 may include other or additional components (e.g., various input / output devices) such as those typically found in a server computer. Furthermore, in some embodiments, one or more of the illustrative components may be incorporated into or otherwise form part of another component. For example, memory 730, or portions thereof, may be incorporated into processor 710 in some embodiments.

[0056] The processor 710 may be embodied as any type of processor capable of performing the functions described herein, and may be embodied as a single processor, multiple processors, a central processing unit (CPU), a graphics processing unit (GPU), a single or multi-core processor, a digital signal processor, a microcontroller, or other processor or processing / control circuitry.

[0057] Memory 730 may be embodied as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. During operation, memory 730 may store various data and software used during operation of computing device 700, such as an operating system, applications, programs, libraries, and drivers. Memory 730 is communicatively coupled to processor 710 via I / O subsystem 720 and may be embodied as circuits and / or components for facilitating input / output operations with processor 710, memory 730, and other components of computing device 700. For example, I / O subsystem 720 may be embodied as or otherwise include a memory controller hub, an input / output control hub, a platform controller hub, integrated control circuitry, firmware devices, communication links (e.g., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.), and / or other components and subsystems for facilitating input / output operations. In some embodiments, I / O subsystem 720 may form part of a system-on-chip (SOC) and be integrated with processor 710, memory 730, and other components of computing device 700 on a single integrated circuit chip.

[0058] The data storage device 740 may be embodied as any type of device or device configured for short-term or long-term storage of data, such as, for example, a memory device and circuitry, a memory card, a hard disk drive, a solid-state drive, or other data storage device. The data storage device 740 may store program code 740A for training a model, program code 740B for detecting anomalies, and / or program code 740C for executing corrective actions in response to detected anomalies. The communications subsystem 750 of the computing device 700 may be embodied as any network interface controller or other communications circuitry, device, or collection thereof that can enable communications between the computing device 700 and other remote devices over a network. The communications subsystem 750 may be configured to achieve such communications using any one or more communications technologies (e.g., wired or wireless communications) and associated protocols (e.g., Ethernet, InfiniBand, Bluetooth, Wi-Fi, WiMAX, etc.).

[0059] As shown, computing device 700 may also include one or more peripheral devices 760. Peripheral devices 760 may include any number of additional input / output devices, interface devices, and / or other peripheral devices. For example, in some embodiments, peripheral devices 760 may include a display, a touch screen, graphics circuitry, a keyboard, a mouse, a speaker system, a microphone, a network interface, and / or other input / output devices, interface devices, and / or peripheral devices.

[0060] Of course, computing device 700 may include other elements (not shown) or omit certain elements, as would readily occur to one skilled in the art. For example, various other sensors, input devices, and / or output devices may be included in computing device 700, depending on the particular implementation of the same, as would be readily understood by one skilled in the art. For example, various types of wireless and / or wired input and / or output devices may be used. Furthermore, additional processors, controllers, memory, etc. may be utilized in a variety of configurations. These and other variations of processing system 700 will be readily contemplated by one skilled in the art in view of the teachings of the present invention provided herein.

[0061] 8 and 9, exemplary neural network architectures are shown that can be used to implement portions of the present model, such as encoder 406. Neural networks are generalized systems whose functionality and accuracy improves with exposure to additional empirical data. Neural networks learn by exposure to empirical data. During training, the neural network stores and adjusts weights that are applied to input empirical data. Applying the adjusted weights to the data can identify that data belongs to a specific predefined class from a set of classes and output the probability that the input data belongs to each class.

[0062] Empirical data (also called training data) from a set of examples is formatted as a string of values ​​and fed to the input of a neural network. Each example is associated with a known outcome or output. Each column is represented as an (x,y) pair, where x represents the input data and y represents the known output. The input data can be of various data types and contain multiple different values. The network can have one input node for each value that makes up the example input data, and a separate weight can be applied to each input value. The input data can be formatted, for example, as a vector, array, or string, depending on the architecture of the neural network being built and trained.

[0063] Neural networks "learn" by comparing neural network outputs generated from input data with known values ​​from examples and adjusting stored weights to minimize the difference between the output value and the known value. Adjustments can be made to the stored weights through backpropagation, where the weight's influence on the output value is determined by calculating a mathematical gradient and adjusting the weight in a way that shifts the output toward the minimum difference. This optimization, called gradient descent, is a non-limiting example of how training occurs. A subset of examples with known values ​​that were not used in training can be used to test and validate the accuracy of the neural network.

[0064] During operation, a trained neural network can be used on new data not previously used for training or validation through generalization. The adjusted neural network weights can be applied to the new data, and the weights estimate the function developed from the training examples. The parameters of the estimated function, captured by the weights, are based on statistical inference.

[0065] In a layered neural network, nodes are arranged in layers. An exemplary simple neural network has an input layer 820 of source nodes 822 and a single computational layer 830 with one or more computational nodes 832 that also function as output nodes, with a single computational node 832 for each possible category into which an input example may be classified. The input layer 820 may have a number of source nodes 822 equal to the number of data values ​​812 in the input data 810. The data values ​​812 in the input data 810 may be represented as a column vector. Each computational node 832 in the computational layer 830 generates a weighted linear combination of values ​​from the input data 810 provided to the input node 820 and applies a differentiable nonlinear activation function to the sum. An exemplary simple neural network can perform classification on linearly separable examples (e.g., patterns).

[0066] A deep neural network, such as a multilayer perceptron, may have an input layer 820 of source nodes 822, one or more computational layers 830 with one or more computational nodes 832, and an output layer 840 with one output node 842 for each possible category into which an input example may fall. The input layer 820 may have a number of source nodes 822 equal to the number of data values ​​812 in the input data 810. The computational nodes 832 in the computational layer 830 are also referred to as hidden layers because they are located between the source nodes 822 and the output nodes 842 and are not directly observed. Each node 832, 842 in the computational layer generates a weighted linear combination of values ​​from the values ​​output by the nodes in the previous layer and applies a nonlinear activation function that is differentiable over the range of the linear combination. The weights applied to the values ​​from each previous node may be, for example, w1, w2, ... w n-i ,w n The output layer provides the network's overall response to the input data. Deep neural networks can be fully connected, where each node in a computational layer is connected to every node in the previous layer, or the connections between layers can have other configurations. If links between nodes are missing, the network is said to be partially connected.

[0067] Training a deep neural network involves two phases: a forward phase, in which the weights of each node are fixed and inputs are propagated through the network, and a backward phase, in which error values ​​are propagated back through the network and the weight values ​​are updated.

[0068] Computational nodes 832 in one or more computational (hidden) layers 830 perform nonlinear transformations on the input data 812 to generate a feature space. Classes or categories may be more easily separated in the feature space than in the original data space.

[0069] The embodiments described herein may be entirely hardware, entirely software, or contain both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

[0070] Embodiments may include a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. A computer-usable or computer-readable medium may include any apparatus that stores, communicates, propagates, or transports a program for use by or in connection with an instruction execution system, apparatus, or device. The medium may be a magnetic, optical, electronic, electromagnetic, infrared, or semiconductor system (or apparatus or device) or propagation medium. The medium may include computer-readable storage media such as semiconductor or solid-state memory, magnetic tape, removable computer diskettes, random access memory (RAM), read-only memory (ROM), rigid magnetic disks, and optical disks.

[0071] Each computer program can be tangibly stored on a machine-readable storage medium or device (e.g., program memory or magnetic disk) readable by a general-purpose or special-purpose programmable computer to configure and control the operation of the computer when the storage medium or device is read by the computer to perform the procedures described herein. The system of the present invention can also be considered to be embodied in a computer-readable storage medium configured with a computer program, where the configured storage medium causes the computer to operate in a particular, predetermined manner to perform the functions described herein.

[0072] A data processing system suitable for storing and / or executing program code may include at least one processor coupled directly or indirectly to memory elements via a system bus. The memory elements may include local memory employed during the actual execution of the program code, bulk storage, and cache memory that provides temporary storage of at least some program code to reduce the number of times the code is retrieved from bulk storage during execution. Input / output or I / O devices (including but not limited to keyboards, displays, pointing devices, etc.) may be coupled to the system either directly or through intervening I / O controllers.

[0073] Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the types of network adapters currently available.

[0074] As employed herein, the terms “hardware processor subsystem” or “hardware processor” can refer to a processor, memory, software, or combination thereof that cooperate to perform one or more specific tasks. In useful embodiments, a hardware processor subsystem may include one or more data processing elements (e.g., logic circuits, processing circuits, instruction execution devices, etc.). The data processing elements may be included in a central processing unit, a graphics processing unit, and / or a separate processor- or computing element-based controller (e.g., logic gates, etc.). A hardware processor subsystem may include one or more on-board memories (e.g., cache, dedicated memory array, read-only memory, etc.). In some embodiments, a hardware processor subsystem may include one or more memories (e.g., ROM, RAM, basic input / output system (BIOS), etc.) that may be on-board or off-board or dedicated for use by the hardware processor subsystem.

[0075] In some embodiments, the hardware processor subsystem may include and execute one or more software elements, which may include an operating system and / or one or more applications and / or specific code for achieving a specified result.

[0076] In other embodiments, the hardware processor subsystem may include dedicated, specialized circuitry that performs one or more electronic processing functions to achieve a specified result. Such circuitry may include one or more application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and / or programmable logic arrays (PLAs).

[0077] These and other variations of the hardware processor subsystem are also contemplated in accordance with embodiments of the present invention.

[0078] References herein to "one embodiment" or "one embodiment" of the present invention, as well as other variations thereof, mean that a particular feature, structure, characteristic, etc. described in connection with an embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrase "in one embodiment" or "in one embodiment," as well as any other variations thereof, in various places throughout this specification do not necessarily all refer to the same embodiment. However, it should be understood that features of one or more embodiments may be combined given the teachings of the present invention provided herein.

[0079] For example, in the case of "A / B," the use of any of the following " / ," "and / or," "at least one," such as "A and / or B" or "at least one of A and B" will be understood to be intended to encompass the selection of only the first listed alternative (A), or the selection of only the second listed alternative (B), or the selection of both alternatives (A and B). As a further example, in the case of "A, B, and / or C" and "at least one of A, B, and C," such language is intended to encompass the selection of only the first listed alternative (A), or the selection of only the second listed alternative (B), or the selection of only the third listed alternative (C), or the selection of only the first and second listed alternatives (A and B), the selection of only the first and third listed alternatives (A and C), the selection of only the second and third listed alternatives (B and C), or the selection of all three alternatives (A, B, and C). This can be expanded as many times as there are listed items.

[0080] The foregoing is understood in all respects to be illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is to be determined not from the detailed description, but from the claims which are interpreted in accordance with the full breadth permitted by the patent laws. It will be understood that the embodiments shown and described herein are merely exemplary of the invention, and that those skilled in the art could make various modifications without departing from the scope and spirit of the invention. Various other feature combinations could be implemented by those skilled in the art without departing from the scope and spirit of the invention. Having thus described aspects of the invention with the detail and particularity required by the patent laws, what is desired to be claimed and protected by Letters Patent is set forth in the appended claims.

Claims

1. 1. A computer-implemented method for detecting anomalies, comprising: encoding 506 the multivariate time series and the multiple types of event sequences using respective transformers and aggregation networks to generate feature vectors; performing anomaly detection using the feature vector (508) to identify anomalies in the system; and performing (510) a corrective action corresponding to the anomaly to correct or mitigate an effect of the anomaly.

2. 10. The method of claim 1, A method for using a support vector data description that includes a hypersphere radius term and a network parameter regularization term when performing anomaly detection.

3. 3. The method of claim 2, The hypersphere radius term represents the radius of a hypersphere that encompasses the input multivariate time series data in the feature space.

4. 10. The method of claim 1, A method of performing anomaly detection by determining an anomaly score and comparing the anomaly score to a threshold, with an anomaly score above the threshold indicating an anomaly.

5. 10. The method of claim 1, The aggregation network includes a stack of self-attention layers that transform the output of each of the transformers into the feature vector.

6. 10. The method of claim 1, The method further includes determining a ranked list of historical events and time series measurements that most contribute to the anomaly.

7. 7. The method of claim 6, The method wherein determining the ranked list is performed according to attention weights from the aggregation network.

8. 10. The method of claim 1, The transformer and the aggregation network are trained using deep learning with a training data set including synchronized time series information and time-stamped event sequences.

9. 10. The method of claim 1, The method further comprising reporting the detected abnormalities to a medical professional to assist in medical decision making.

10. 10. The method of claim 1, The method wherein performing the corrective action includes an action selected from the group consisting of changing security settings of an application or hardware component, changing operating parameters of an application or hardware component, stopping and / or restarting an application, stopping and / or restarting a hardware component, changing environmental conditions, and changing the state or settings of a network interface.

11. 1. A system for detecting anomalies, comprising: a hardware processor (710); a memory (740) for storing a computer program, the computer program, when executed by the hardware processor, causing the hardware processor to: encoding 506 the multivariate time series and the multiple types of event sequences using respective transformers and aggregation networks to generate feature vectors; performing anomaly detection using the feature vector (508) to identify anomalies in the system; and performing (510) a corrective action corresponding to the anomaly to correct or mitigate an effect of the anomaly.

12. 12. The system of claim 11, The computer program causes the hardware processor to support a vector data description including a hypersphere radius term and a network parameter regularization term for anomaly detection.

13. 13. The system of claim 12, The hypersphere radius term represents the radius of a hypersphere that encompasses the input multivariate time series data in the feature space.

14. 12. The system of claim 11, The computer program further causes the hardware processor to determine an anomaly score, compare the anomaly score to a threshold, and an anomaly score exceeding the threshold indicates an anomaly.

15. 12. The system of claim 11, The aggregation network includes a stack of self-attention layers that transform the output of each of the transformers into the feature vector.

16. 12. The system of claim 11, The computer program further causes the hardware processor to determine a ranked list of historical events and time series measurements that most contribute to the anomaly.

17. 17. The system of claim 16, The system wherein the determination of the ranked list is performed according to attention weights from the aggregation network.

18. 12. The system of claim 11, The corrective action includes an action selected from the group consisting of changing security settings of an application or hardware component, changing operating parameters of an application or hardware component, stopping and / or restarting an application, stopping and / or restarting a hardware component, changing environmental conditions, and changing the state or settings of a network interface.

19. 1. A method for administering a treatment, comprising: measuring 506 time series information about the patient; encoding 506 the time series information and health event sequence for the patient using respective transformers and aggregation networks to generate a feature vector; performing anomaly detection using the feature vector (508) to identify a health event; and implementing (510) a corrective action in response to the health event to correct or mitigate an adverse health effect caused by the health event.

20. 20. The method of claim 19, The method, wherein taking corrective action includes an action selected from the group consisting of adjusting the operation of the dialysis machine, adjusting the dosage of an intravenous medication, and ceasing treatment.

Images