Joint Metric and Log Autoencoder for Anomaly Detection in Healthcare Decision Making

Abstract

A method and system for anomaly detection includes encoding (206) a time series with a time series encoder and encoding (206) an event sequence with an event sequence encoder. A latent code is generated (208) from the outputs of the time series encoder and the event sequence encoder. The time series is reconstructed (210) from the latent code using a time series decoder. An event sequence is reconstructed (212) from the latent code using an event sequence decoder. An anomaly score (218) is determined based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence. An action is taken (510) responsive to the anomaly score.

Description

[Technical Field]

[0001] Related Application Information This application claims priority to U.S. Patent Application No. 63 / 450,986, filed March 9, 2023, U.S. Patent Application No. 63 / 533,418, filed August 18, 2023, and U.S. Patent Application No. 18 / 599,322, filed March 8, 2024, each of which is incorporated by reference in its entirety. [Background technology]

[0002] The present invention relates to automatic anomaly detection, and more particularly to anomaly detection based on different information modes. 2. Description of Related Art

[0003] Anomaly detection is useful in managing complex systems. Cyber-physical systems contain a variety of sensors that can collect a variety of information about the system, its behavior, and its environment. The collected data may be used to characterize the operating characteristics of the cyber-physical system, for example, to determine when the cyber-physical system may be operating outside of expected normal parameters. Summary of the Invention

[0004] A method for anomaly detection includes encoding a time series using a time series encoder and encoding an event sequence using an event sequence encoder. A latent code is generated from the outputs of the time series encoder and the event sequence encoder. The time series is reconstructed from the latent code using a time series decoder. An event sequence is reconstructed from the latent code using the event sequence decoder. An anomaly score is determined based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence. An action is performed in response to the anomaly score.

[0005] A system for anomaly detection includes a hardware processor and a memory that stores a computer program that, when executed by the hardware processor, causes the hardware processor to encode a time series with a time series encoder, encode an event sequence with an event sequence encoder, generate a latent code from outputs of the time series encoder and the event sequence encoder, reconstruct the time series from the latent code with a time series decoder, reconstruct an event sequence from the latent code with the event sequence decoder, determine an anomaly score based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence, and perform an action responsive to the anomaly score.

[0006] These and other features and advantages will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. [Brief explanation of the drawings]

[0007] The present disclosure provides details in the following description of preferred embodiments with reference to the following figures.

[0008] [Figure 1] FIG. 1 is a block diagram of a cyber-physical system with anomaly detection across metric time series and event sequence logs, according to one embodiment of the present invention.

[0009] [Figure 2] FIG. 1 is a block / flow diagram of a method / system for anomaly detection utilizing a joint variational autoencoder, according to one embodiment of the present invention.

[0010] [Figure 3] FIG. 1 is a block / flow diagram of a method for anomaly detection including training and deployment of a joint variational autoencoder, according to one embodiment of the present invention.

[0011] [Figure 4]FIG. 2 is a block / flow diagram of a method for training a joint variational autoencoder for anomaly detection, according to one embodiment of the present invention.

[0012] [Figure 5] FIG. 2 is a block / flow diagram of a method for joint anomaly detection using metric time series and event sequence logs, according to one embodiment of the present invention.

[0013] [Figure 6] 1 is a block diagram of a healthcare facility in which collaborative anomaly detection is used to guide medical professionals and patient treatment, according to one embodiment of the present invention.

[0014] [Figure 7] FIG. 2 is a block diagram of a computing device for performing anomaly detection, according to one embodiment of the present invention.

[0015] [Figure 8] FIG. 1 is a diagram of an exemplary neural network architecture that may be used as part of a variational autoencoder, according to one embodiment of the present invention.

[0016] [Figure 9] FIG. 1 is a diagram of an exemplary deep neural network architecture that may be used as part of a variational autoencoder, according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0017] A cyber-physical system may contain many sensors that monitor the operational state of the system. Some of the information from the system may be collected as metrics in the form of multivariate time series where measurements from the sensors are taken periodically and can be tracked over time. Examples of metrics include performance and resource counters (such as processor usage, memory usage, and free disk space) and hardware status (such as temperature and power consumption). Other information from the system may be collected as logs in the form of free-form text data with timestamps. Examples of logs include system logs and hardware logs.

[0018] Metrics and logs generated by a particular system may be correlated, so a proper interpretation of the system's state may involve a joint analysis of both. Using both modes of information can help avoid false alarms and increase the accuracy of anomaly detection.

[0019] For example, when launching a large application, a period of relatively high processor utilization is expected, but if no such activity is recorded, this metric may be considered an anomaly. In another example, a sudden burst of router events may be considered normal if it correlates with an increase in the number of users indicated by network traffic metrics. If the traffic metrics are normal, the event burst may suggest a hardware failure and be flagged as an anomaly.

[0020] Therefore, time series metrics can be highly unstable and sensitive to system operating conditions. Machine learning models that utilize both metric time series information and system event sequences can characterize their joint dynamic behavior under normal operating conditions and detect deviations from them. Transformers and attention mechanisms can effectively model the interaction of the two forms of time data, improving the sensitivity and robustness of anomaly detection and explicitly identifying the events or metrics responsible for detected anomalies.

[0021] For this purpose, a joint variational autoencoder (VAE) model can be used, in which the metric time series and the log event sequence are jointly encoded into a latent code before being reconstructed using their respective decoders. An anomaly score can be determined based on the decoder output, for example, by comparing the reconstructed information with the actual input. The encoder outputs can be combined by concatenation or a product-of-expert approach.

[0022] Referring now in detail to the figures, where like numerals represent the same or similar elements, and initially to FIG. 1 , a maintenance system 106 is shown in the context of a monitored system 102. The monitored system 102 can be any suitable system, including physical systems such as a manufacturing line or physical plant operation, electronic systems such as computers or other computerized devices, software systems such as operating systems and applications, and cyber-physical systems that combine physical systems with electronic and / or software systems. Exemplary systems 102 can include a wide variety of types, such as railroad systems, power plants, vehicle sensors, data centers, satellites, transportation systems, and the like. Another type of cyber-physical system can be a network of Internet of Things (IoT) devices, which can include a wide variety of different types of devices with various respective functions and sensor types.

[0023] One or more sensors 104 record information about the state of the monitored system 102. The sensors 104 may be any suitable type of sensor, including, for example, physical sensors such as temperature, humidity, vibration, pressure, voltage, current, magnetic field, electric field, and light sensors, and software sensors such as logging utilities installed on a computer system to record information about the state and operation of the operating system and applications running on the computer system. Sensor data may include, for example, numeric data, categorical data, and binary data. Sensor data may be stored as log information that records the occurrence of discrete events. Information generated by the sensors 104 may be in any suitable format and may include sensor log information generated in heterogeneous formats.

[0024] The sensors 104 may transmit logged sensor information to the abnormal maintenance system 106 via any suitable communication medium and protocol, including wireless and wired communication. The maintenance system 106 may identify anomalies or abnormal behavior, for example, by monitoring the multivariate time series and logged information generated by the sensors 104. When abnormal behavior is detected, the maintenance system 106 communicates with the system control unit to modify one or more parameters of the monitored system 102 to correct the abnormal behavior.

[0025] Exemplary corrective actions include changing security settings of an application or hardware element, changing operating parameters (e.g., operating speed) of an application or hardware element, stopping and / or restarting an application, stopping and / or restarting a hardware element, changing environmental conditions, changing the state or settings of a network interface, etc. This allows the maintenance system 106 to automatically correct or mitigate the abnormal behavior. Identifying the particular sensor 104 associated with an anomaly classification can reduce the time required to isolate the problem.

[0026] Each of the sensors 104 outputs a respective time series that encodes a log of measurements, or events, made by the sensor over time. For example, a time series includes pairs of information, each pair including a measurement and a timestamp indicating the time the measurement was made. Each time series can be divided into segments that represent measurements made by the sensor over a particular time range. A time series segment can represent any suitable interval, such as one second, one minute, one hour, or one day. A time series segment may represent a set number of collections, such as 100 measurements, rather than a fixed period of time. A log can be segmented into similar time periods.

[0027] Thus, the maintenance system 106 includes models trained to process time series data and log event categorical data. In a complex system 106, the number of sensors 104 may be large, and the sensors may report independent streams of time series data. Therefore, the joint anomaly detection 108 combines information from both types of sensor data using a joint VAE.

[0028] The sensors 104 may collect information about the state of the system 106, such as information related to system control and operational modes. The sensors 104 may also collect information related to key metrics, such as temperature, humidity, motion, and pressure, to characterize the health of the system. Anomaly monitoring may be performed based on information from time-series sensors, whose values ​​are affected by the system state as indicated by the logs.

[0029] In addition to the cyber-physical system 102, the system may also be associated with a patient in a healthcare environment. In such an example, sensors 104 may monitor the patient's vital signs, and event sequences may record individual health events such as seizures, medical management, or other intermittent occurrences.

[0030] 2, a machine learning model for joint anomaly detection is shown. The model accepts as inputs a multivariate time series 202 reflecting measured metrics from the system 102 and an event sequence 204 representing event log information from the system 102. As described above, the time series includes measurements from one or more sensors 104 over a predetermined period of time, and the event sequence 204 includes time-stamped text entries reflecting events that occurred during the same period. The two inputs may be synchronized and divided into rolling windows, with each contemporaneous window considered as a joint input.

[0031] Both inputs are provided as joint inputs to the encoder 206, which includes a time series encoder and an event sequence encoder. These encoders each have a stack of self-attention and cross-attention layers that fuse information between different timestamps of each sequence. met and E log The shared temporal embedding layer can be trained using a time-to-vector conversion model to convert the timestamps of an event sequence into a vector.

[0032] In the metric encoder, the time series is processed by a one-dimensional convolutional layer, and the result for each timestamp is concatenated with the corresponding time embedding vector before being input to the transformer. In the event sequence encoder, the event sequence is first parsed by a log parser, and every event message is decomposed into two parts: a template and parameters. For example, the message "ESMCommonService has transitioned to the stopped state" is converted into the template "[*] has transitioned to the stopped state" with the parameter "ESMCommonService". A template embedding layer and a parameter embedding layer may be trained to convert the template and parameters into vectors, respectively.

[0033] The hidden state of the encoder at the most recent time step is

number

number

number

number

[0034] The values ​​of μ and Σ are determined by either the consolidation or the Product-of-Expert approach.

number

number

number

number

number

number

number

[0035] A latent code z 208 is sampled from the distribution q(z|x,y) and represents the combined input in latent space. The latent code 208 is then decoded by the time series decoder 210 and the event sequence decoder 212 and used as a condition for the time series decoder p(x|z) and the event sequence decoder p(y|z).

[0036] The time series decoder 210 attempts to generate an output that reconstructs the time series 202, with a metric reconstruction error 214 identifying the difference between the two. The event sequence decoder 212 similarly attempts to generate an output that reconstructs the event sequence 204, with a log reconstruction error 216 identifying the difference between the two. The time series decoder 210 can be implemented as a transform model that outputs a multivariate time series, and the event sequence decoder 212 can be implemented as a transform model that outputs a sequence of logit vectors. The softmax of each logit vector gives the probability of the type of event at that position.

[0037] metric reconstruction error L met is the input metric time series x and the reconstructed time series

number

number

number

number

[0038] The regularized error between the posterior and prior distribution p(z) can also be calculated as follows: L reg (x,y)=max(b,D KL (q(z|x,y),N(0,1))) where b is a user-specified hyperparameter that controls the deviation of the posterior distribution q from the Gaussian prior N(0,1), and D KL is the Kullback-Leibler divergence.

[0039] An anomaly score 218 is determined for the period of the time series 202 and the event sequence 204 based on the metric reconstruction error 214 and the log reconstruction error 216. The anomaly score may be calculated as follows: Score(x,y)=L met (x,G met (μ))+αL log (y,G log (μ) where μ = μ(x,y). G met is the time series decoder 210, and G log is an event sequence decoder. The hyperparameter α can be selected by the user using cross-validation to control the balance between the log reconstruction objective and the metrics reconstruction objective. The value τ represents the 99th percentile of these scores and can be used as a detection threshold. If the anomaly score is greater than τ, an anomaly has been detected.

[0040] The encoder 206, time series decoder 210, and event sequence decoder 212 may be trained on a set of training data that reflects the normal operation of the system 102. The model is trained to optimize a weighted sum of the reconstruction errors. If the anomaly score is higher than a threshold, an anomaly is detected and a ranked list of metrics and events that are potential causes of the anomaly is generated.

[0041] 3, a method for training and using a joint VAE model for anomaly detection is shown. Block 302 trains the model using training data representative of the normal operation of the system 102. This training data includes both event sequence data and time series data collected simultaneously from the system 102. The trained model is then deployed 304 and implemented in the maintenance system 106. As new data is collected from the sensors 104, the trained model is used to identify anomalies in the operation of the system 102.

[0042] Referring now to Figure 4, further details of training 302 the anomaly detection model are shown. Given a training dataset of synchronized metric time series and event logs, each input can be divided into segments using overlapping rolling windows of fixed time length. Block 402 samples event messages from the event sequence input and identifies the event type from each log message as an integer value. For each event in the sequence, the template type embedding vector, parameter embedding vector, and time embedding vector can be concatenated for use as input to the encoder.

[0043] Block 404 samples a batch from the input stream, e.g., identifies a time window, and obtains events and time series measurements occurring within that time window. The encoder 206 encodes the different inputs in block 406, generates respective latent codes, and can combine them. Block 408 then reconstructs each input using the time series decoder 210 and the event sequence decoder 212.

[0044] Block 410 calculates the reconstruction error L met and L log , and block 412 determines the regularization error L reg Block 414 adjusts the autoencoder parameters according to these errors. Block 414 may calculate the total error as a weighted average of the two reconstruction errors and the regularization error.

number

[0045] This process can be repeated until a termination condition is reached, such as exhaustion of available training data, a predetermined number of iterations, or parameter convergence (e.g., the magnitude of successive changes falls below a threshold). A score is determined for each window of training data.

[0046] 5, further details of the collaborative anomaly detection 306 are shown. Block 502 obtains new measurements from sensors 104 and logs, e.g., collecting all such measurements and events that occur within a given window of time. Block 504 uses the trained encoder 206 and decoder 210 / 212 to generate an anomaly score 218 for the new measurements, e.g., using the model of FIG. 2.

[0047] Block 506 compares the anomaly score to a threshold τ, or other suitable threshold. If block 508 determines that the anomaly score is below the threshold, processing returns to block 502 to obtain a new set of measurements. If the anomaly score is above the threshold, block 510 begins taking action in response to the detected anomaly, at which point processing again returns to block 502.

[0048] The response action can operate to correct or mitigate the effects of the anomaly. For example, in a system 102 representing a factory, the response might be to stop production to prevent damage or a dangerous condition. In a system 102 representing a computer system, the response might be to shut down a process or reduce the computational load to prevent overheating.

[0049] In a system 102 implemented at a healthcare site, the sensors 104 may relate to monitoring a patient's health status. Accordingly, the responsive action may relate to automatically adjusting the patient's treatment. For example, if an anomaly is detected during the administration of the treatment, the responsive action may be to stop the treatment or otherwise intervene.

[0050] Anomaly detection can include identifying a ranked list of metrics and events that are potential causes of a detected anomaly. To rank the metrics, the reconstruction error for each metric can be averaged over time, and the metrics can be ranked in descending order of this averaged error. For an event sequence, the probability of each ground truth event can be calculated according to the predicted logit, and the events can be ranked from low to high probability. In any given list, candidates near the top of the list are more likely to be the cause of the anomaly. Therefore, responsive actions can focus on actions associated with the highly ranked metrics and events. For example, if an anomaly is detected and the system temperature is ranked high, an automated response could be to adjust environmental conditions or adjust the computational load.

[0051] 6, an illustration of anomaly detection in the context of a healthcare facility 600 is shown. Anomaly detection can be used to determine when a patient's healthcare needs have changed, for example, in response to an adverse health event or a negative reaction to treatment. A change in therapy can be automatically initiated or administered to assist the patient.

[0052] The healthcare facility may include one or more medical professionals 602 that provide information related to events and system state measurements to anomaly detection 608. Treatment system 604 may further be designed to monitor the patient's condition, generate medical records 606, and automatically manage and adjust treatment as needed. In some cases, medical records 606 may include multivariate time series related to the patient's condition (e.g., heart rate, blood oxygen level, blood pressure, etc.). Medical records 606 may also include event sequences related to healthcare events, such as the administration of a therapy or intermittent healthcare events.

[0053] Based on information drawn from at least the medical professional 602, the treatment system 604, and the medical record 606, the anomaly detection 608 identifies an abnormal health condition of the patient and identifies metrics and / or events that contribute to the abnormality. Information regarding the detected anomaly can be forwarded to the medical professional 602 to diagnose and treat the patient's condition.

[0054] The different elements of the healthcare facility 600 may communicate with each other via a network 610, for example, using any suitable wired or wireless communication protocol and medium. This enables the anomaly detection 608 to access remotely stored medical records 606, communicate with the treatment system 604, and receive instructions and send reports to the healthcare professional 602. In particular, the anomaly detection 608 can automatically initiate changes in the patient's treatment in response to new information obtained from the medical records 606 by sending instructions to the treatment system 604. For example, the treatment system can automatically administer medication or discontinue treatment in response to a negative health event.

[0055] In some cases, anomaly detection 608 can initiate treatment for the patient in response to a particular event or metric that is ranked as likely contributing to the anomaly. For example, if the anomaly is related to the patient's blood pressure measurement, treatment system 604 may automatically adjust the administered blood pressure medication. Thus, the output of anomaly detection 608 may include one or a combination of the above-described automated treatments and notifications to medical professional 602. In some cases, the treatment plan may be used by the medical professional to assist in patient management decisions. For example, upon being notified of a change in the patient's condition, medical professional 602 can visit the patient to check in.

[0056] 7, an exemplary computing device 700 is shown, in accordance with an embodiment of the present invention. The computing device 700 is configured to perform anomaly detection.

[0057] Computing device 700 may be embodied as any type of computational or computing device capable of performing the functions described herein, including, but not limited to, a computer, a server, a rack-based server, a blade server, a workstation, a desktop computer, a laptop computer, a notebook computer, a tablet computer, a mobile computing device, a wearable computing device, a network appliance, a web appliance, a distributed computing system, a processor-based system, and / or a consumer electronic device. Additionally or alternatively, computing device 700 may be embodied as one or more compute sleds, memory sleds, or other racks, sleds, computing chassis, or other components of a physically separate computing device.

[0058] 7, computing device 700 illustratively includes a processor 710, an input / output subsystem 720, a memory 730, a data storage device 740, and a communications subsystem 750, and / or other components and devices typically found in a server or similar computing device. In other embodiments, computing device 700 may include other or additional components (e.g., various input / output devices) such as those typically found in a server computer. Furthermore, in some embodiments, one or more of the illustrative components may be incorporated into or otherwise form part of another component. For example, memory 730, or portions thereof, may be incorporated into processor 710 in some embodiments.

[0059] The processor 710 may be embodied as any type of processor capable of performing the functions described herein, and may be embodied as a single processor, multiple processors, a central processing unit (CPU), a graphics processing unit (GPU), a single or multi-core processor, a digital signal processor, a microcontroller, or other processor or processing / control circuitry.

[0060] Memory 730 may be embodied as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. During operation, memory 730 may store various data and software used during operation of computing device 700, such as an operating system, applications, programs, libraries, and drivers. Memory 730 is communicatively coupled to processor 710 via I / O subsystem 720 and may be embodied as circuits and / or components for facilitating input / output operations with processor 710, memory 730, and other components of computing device 700. For example, I / O subsystem 720 may be embodied as or otherwise include a memory controller hub, an input / output control hub, a platform controller hub, integrated control circuitry, firmware devices, communication links (e.g., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.), and / or other components and subsystems for facilitating input / output operations. In some embodiments, I / O subsystem 720 may form part of a system-on-chip (SOC) and be integrated with processor 710, memory 730, and other components of computing device 700 on a single integrated circuit chip.

[0061] The data storage device 740 may be embodied as any type of device or device configured for short-term or long-term storage of data, such as, for example, a memory device and circuitry, a memory card, a hard disk drive, a solid-state drive, or other data storage device. The data storage device 740 may store program code 740A for model training, program code 740B for anomaly detection, and / or program code 740C for executing corrective response actions to detected anomalies. The communications subsystem 750 of the computing device 700 may be embodied as any network interface controller or other communications circuitry, device, or collection thereof that can enable communications between the computing device 700 and other remote devices over a network. The communications subsystem 750 may be configured to achieve such communications using any one or more communications technologies (e.g., wired or wireless communications) and associated protocols (e.g., Ethernet, InfiniBand, Bluetooth, Wi-Fi, WiMAX, etc.).

[0062] As shown, computing device 700 may also include one or more peripheral devices 760. Peripheral devices 760 may include any number of additional input / output devices, interface devices, and / or other peripheral devices. For example, in some embodiments, peripheral devices 760 may include a display, a touch screen, graphics circuitry, a keyboard, a mouse, a speaker system, a microphone, a network interface, and / or other input / output devices, interface devices, and / or peripheral devices.

[0063] Of course, computing device 700 may include other elements (not shown) or omit certain elements, as would readily occur to one skilled in the art. For example, various other sensors, input devices, and / or output devices may be included in computing device 700, depending on the particular implementation of the same, as would be readily understood by one skilled in the art. For example, various types of wireless and / or wired input and / or output devices may be used. Furthermore, additional processors, controllers, memory, etc. may be utilized in a variety of configurations. These and other variations of processing system 700 will be readily contemplated by one skilled in the art in view of the teachings of the present invention provided herein.

[0064] Referring now to Figures 8 and 9, exemplary neural network architectures are shown, such as joint VAEs 800 and 900, which can be used to implement portions of the present model. Neural networks are generalized systems whose functionality and accuracy improve with exposure to additional empirical data. Neural networks learn by being exposed to empirical data. During training, the neural network stores and adjusts multiple weights that are applied to input empirical data. By applying the adjusted weights to the data, the neural network can identify that data belongs to a specific predefined class from a set of classes and output the probability that the input data belongs to each class.

[0065] Empirical data (also called training data) from a set of examples is formatted as a string of values ​​and fed to the input of a neural network. Each example is associated with a known outcome or output. Each column is represented as an (x,y) pair, where x represents the input data and y represents the known output. The input data can be of various data types and contain multiple different values. The network can have one input node for each value that makes up the example input data, and a separate weight can be applied to each input value. The input data can be formatted, for example, as a vector, array, or string, depending on the architecture of the neural network being built and trained.

[0066] Neural networks "learn" by comparing neural network outputs generated from input data with known values ​​from examples and adjusting stored weights to minimize the difference between the output value and the known value. Adjustments can be made to the stored weights through backpropagation, where the weight's influence on the output value is determined by calculating a mathematical gradient and adjusting the weight in a way that shifts the output toward the minimum difference. This optimization, called gradient descent, is a non-limiting example of how training occurs. A subset of examples with known values ​​that were not used in training can be used to test and validate the accuracy of the neural network.

[0067] During operation, a trained neural network can be used on new data not previously used for training or validation through generalization. The adjusted neural network weights can be applied to the new data, and the weights estimate the function developed from the training examples. The parameters of the estimated function, captured by the weights, are based on statistical inference.

[0068] In a layered neural network, nodes are arranged in layers. An exemplary simple neural network has an input layer 820 of source nodes 822 and a single computational layer 830 with one or more computational nodes 832 that also function as output nodes, with a single computational node 832 for each possible category into which an input example may be classified. The input layer 820 may have a number of source nodes 822 equal to the number of data values ​​812 in the input data 810. The data values ​​812 in the input data 810 may be represented as a column vector. Each computational node 832 in the computational layer 830 generates a weighted linear combination of values ​​from the input data 810 provided to the input node 820 and applies a differentiable nonlinear activation function to the sum. An exemplary simple neural network can perform classification on linearly separable examples (e.g., patterns).

[0069] A deep neural network, such as a multilayer perceptron, may have an input layer 820 of source nodes 822, one or more computational layers 830 with one or more computational nodes 832, and an output layer 840 with one output node 842 for each possible category into which an input example may fall. The input layer 820 may have a number of source nodes 822 equal to the number of data values ​​812 in the input data 810. The computational nodes 832 in the computational layer 830 are also referred to as hidden layers because they are located between the source nodes 822 and the output nodes 842 and are not directly observed. Each node 832, 842 in the computational layer generates a weighted linear combination of values ​​from the values ​​output by the nodes in the previous layer and applies a nonlinear activation function that is differentiable over the range of the linear combination. The weights applied to the values ​​from each previous node may be, for example, w1, w2, ... w n-1 ,w n The output layer provides the network's overall response to the input data. Deep neural networks can be fully connected, where each node in a computational layer is connected to every node in the previous layer, or the connections between layers can have other configurations. If links between nodes are missing, the network is said to be partially connected.

[0070] Training a deep neural network involves two phases: a forward phase, in which the weights of each node are fixed and inputs are propagated through the network, and a backward phase, in which error values ​​are propagated back through the network and the weight values ​​are updated.

[0071] Computational nodes 832 in one or more computational (hidden) layers 830 perform nonlinear transformations on the input data 812 to generate a feature space. Classes or categories may be more easily separated in the feature space than in the original data space.

[0072] The embodiments described herein may be entirely hardware, entirely software, or contain both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

[0073] Embodiments may include a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. A computer-usable or computer-readable medium may include any apparatus that stores, communicates, propagates, or transports a program for use by or in connection with an instruction execution system, apparatus, or device. The medium may be a magnetic, optical, electronic, electromagnetic, infrared, or semiconductor system (or apparatus or device) or propagation medium. The medium may include computer-readable storage media such as semiconductor or solid-state memory, magnetic tape, removable computer diskettes, random access memory (RAM), read-only memory (ROM), rigid magnetic disks, and optical disks.

[0074] Each computer program can be tangibly stored on a machine-readable storage medium or device (e.g., program memory or magnetic disk) readable by a general-purpose or special-purpose programmable computer to configure and control the operation of the computer when the storage medium or device is read by the computer to perform the procedures described herein. The system of the present invention can also be considered to be embodied in a computer-readable storage medium configured with a computer program, where the configured storage medium causes the computer to operate in a particular, predetermined manner to perform the functions described herein.

[0075] A data processing system suitable for storing and / or executing program code may include at least one processor coupled directly or indirectly to memory elements via a system bus. The memory elements may include local memory employed during the actual execution of the program code, bulk storage, and cache memory that provides temporary storage of at least some program code to reduce the number of times the code is retrieved from bulk storage during execution. Input / output or I / O devices (including but not limited to keyboards, displays, pointing devices, etc.) may be coupled to the system either directly or through intervening I / O controllers.

[0076] Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the types of network adapters currently available.

[0077] As employed herein, the terms “hardware processor subsystem” or “hardware processor” can refer to a processor, memory, software, or combination thereof that cooperate to perform one or more specific tasks. In useful embodiments, a hardware processor subsystem may include one or more data processing elements (e.g., logic circuits, processing circuits, instruction execution devices, etc.). The data processing elements may be included in a central processing unit, a graphics processing unit, and / or a separate processor- or computing element-based controller (e.g., logic gates, etc.). A hardware processor subsystem may include one or more on-board memories (e.g., cache, dedicated memory array, read-only memory, etc.). In some embodiments, a hardware processor subsystem may include one or more memories (e.g., ROM, RAM, basic input / output system (BIOS), etc.) that may be on-board or off-board or dedicated for use by the hardware processor subsystem.

[0078] In some embodiments, the hardware processor subsystem may include and execute one or more software elements, which may include an operating system and / or one or more applications and / or specific code for achieving a specified result.

[0079] In other embodiments, the hardware processor subsystem may include dedicated, specialized circuitry that performs one or more electronic processing functions to achieve a specified result. Such circuitry may include one or more application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and / or programmable logic arrays (PLAs).

[0080] These and other variations of the hardware processor subsystem are also contemplated in accordance with embodiments of the present invention.

[0081] References herein to "one embodiment" or "one embodiment" of the present invention, as well as other variations thereof, mean that a particular feature, structure, characteristic, etc. described in connection with an embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrase "in one embodiment" or "in one embodiment," as well as any other variations thereof, in various places throughout this specification do not necessarily all refer to the same embodiment. However, it should be understood that features of one or more embodiments may be combined given the teachings of the present invention provided herein.

[0082] For example, in the case of "A / B," the use of any of the following " / ," "and / or," "at least one," such as "A and / or B" or "at least one of A and B" will be understood to be intended to encompass the selection of only the first listed alternative (A), or the selection of only the second listed alternative (B), or the selection of both alternatives (A and B). As a further example, in the case of "A, B, and / or C" and "at least one of A, B, and C," such language is intended to encompass the selection of only the first listed alternative (A), or the selection of only the second listed alternative (B), or the selection of only the third listed alternative (C), or the selection of only the first and second listed alternatives (A and B), the selection of only the first and third listed alternatives (A and C), the selection of only the second and third listed alternatives (B and C), or the selection of all three alternatives (A, B, and C). This can be expanded as many times as there are listed items.

[0083] The foregoing is understood in all respects to be illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is to be determined not from the detailed description, but from the claims which are interpreted in accordance with the full breadth permitted by the patent laws. It will be understood that the embodiments shown and described herein are merely exemplary of the invention, and that those skilled in the art could make various modifications without departing from the scope and spirit of the invention. Various other feature combinations could be implemented by those skilled in the art without departing from the scope and spirit of the invention. Having thus described aspects of the invention with the detail and particularity required by the patent laws, what is desired to be claimed and protected by Letters Patent is set forth in the appended claims.

Claims

1. 1. A computer-implemented method for anomaly detection, comprising: encoding 206 the time series using a time series encoder; encoding 206 the event sequence using an event sequence encoder; generating 208 a latent code from the outputs of the time series encoder and the event sequence encoder; reconstructing 210 the time series from the latent code using a time series decoder; reconstructing 212 the event sequence from the latent code using an event sequence decoder; determining 218 an anomaly score based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence; and performing (510) an action responsive to the anomaly score.

2. 10. The method of claim 1, The method further includes determining a ranked list of metrics and a ranked list of events.

3. 3. The method of claim 2, The method, wherein determining the ranked list of metrics includes averaging the reconstruction errors of the reconstructed time series for each of a plurality of metrics represented in the time series, and ranking the metrics in descending order.

4. 3. The method of claim 2, The method, wherein determining the ranked list of events includes calculating ground truth event probabilities according to predicted logits and ranking the events from low probability to high probability.

5. 3. The method of claim 2, A method in which the behavior is directed towards one or more highly ranked metrics or events.

6. 10. The method of claim 1, The method, wherein determining the anomaly score comprises a weighted sum of the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence.

7. 10. The method of claim 1, The method further comprising determining that the abnormality score exceeds a threshold that indicates an abnormality in the patient's health status in a healthcare setting.

8. 8. The method of claim 7, The method, wherein the action includes a therapeutic intervention responsive to the patient's health condition, including instructions to a therapeutic system to automatically administer a therapy to the patient.

9. 10. The method of claim 1, The method comprises: a time series encoder, an event sequence encoder, a time series decoder, and an event sequence decoder comprising a joint variational autoencoder comprising a machine learning model trained to reconstruct an input after transformation to a latent space.

10. 10. The method of claim 1, The method wherein generating the latent code includes combining the outputs as a Product-of-Expert.

11. 1. A system for anomaly detection, comprising: a hardware processor (710); When executed by the hardware processor, it causes the hardware processor to: encoding 206 the time series using a time series encoder; encoding (206) the event sequence using an event sequence encoder; generating 208 a latent code from the outputs of the time series encoder and the event sequence encoder; using a time series decoder to reconstruct 210 the time series from the latent code; reconstructing 212 the event sequence from the latent code using an event sequence decoder; determining (218) an anomaly score based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence; and a memory (740) storing a computer program that causes an action to be taken (510) in response to the anomaly score.

12. 12. The system of claim 11, The computer program further causes the hardware processor to: A system for determining a ranked list of metrics and a ranked list of events.

13. 13. The system of claim 12, The computer program further causes the hardware processor to: The system averages the reconstruction errors of the reconstructed time series for each of a plurality of metrics represented by the time series and ranks the metrics in descending order.

14. 13. The system of claim 12, The computer program further causes the hardware processor to: A system for calculating the probability of ground truth events according to the predicted logits and ranking the events from low probability to high probability.

15. 13. The system of claim 12, A system in which the actions are directed towards one or more highly ranked metrics or events.

16. 12. The system of claim 11, The computer program further causes the hardware processor to: A system for determining a weighted sum of the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence.

17. 12. The system of claim 11, The computer program further causes the hardware processor to: A system for determining whether the abnormality score exceeds a threshold that indicates an abnormality in a patient's health status in a healthcare environment.

18. 18. The system of claim 17, The system includes a therapeutic action according to the patient's health condition, wherein the action includes instructions to a therapeutic system to automatically administer therapy to the patient.

19. 12. The system of claim 11, The system, wherein the time series encoder, the event sequence encoder, the time series decoder, and the event sequence decoder constitute a joint variational autoencoder that includes a machine learning model trained to reconstruct an input after transformation to a latent space.

20. 12. The system of claim 11, The computer program further causes the hardware processor to: A system that combines the outputs as a Product-of-Expert of the latent code.

Images