Optimization for detecting anomaly data points in time series data

Abstract

In a method for optimizing anomaly detection, the processor receives a set of data, which is partially labeled time-series data; determines the data block size for the set of data; divides the set of data into data blocks based on the data block size; calculates characteristic measures for the characteristics of each data block; assigns a tag to each data block, which is selected from a group consisting of normal tags, abnormal tags, and unknown tags; uses each data block containing either a normal or abnormal tag as training data; updates the training data with artificial anomalies; trains a detection model using the updated training data; and uses the trained detection model to predict whether each data block containing an unknown tag is anomaly-free or not.

Description

BACKGROUND ART

[0001] The present invention relates generally to the field of data processing, and more specifically to a method and system for optimizing detection of anomalous data points in time-series data.

[0002] Time-series data, also referred to as timestamped data, is a sequence of data points indexed in chronological order. These data points typically consist of successive measurements made from the same source over a fixed time interval, and are used to track changes over time. This time-series data can be generated and collected from sensors or other machines, such as Internet of Things (IoT) sensors and devices. SUMMARY OF THE INVENTION

[0003] Aspects of one embodiment of the present invention disclose a method, a computer program product, and a computer system for optimizing the detection of anomalous data points in time-series data. One or more processors receive a set of data, which is partially labeled time-series data. One or more processors determine a data block size for the set of data. One or more processors divide the set of data into data blocks based on the data block size. One or more processors calculate characteristic measurements for the characteristics of each data block. One or more processors assign a tag to each data block, which is selected from the group consisting of normal tags, anomalous tags, and unknown tags. One or more processors use each of the data blocks containing tags indicating anomalous and normal as training data. One or more processors update the training data using artificial anomalous data. One or more processors train a detection model using the updated training data. One or more processors use the trained detection model to predict whether each of the data blocks containing the unknown tag is anomalous or normal.

[0004] In some embodiments of the present invention, one or more processors determine the data block size by observing patterns on a power spectral density plot using a spectral analysis method, identifying peaks, and identifying cutoff points that define the data block size.

[0005] In some embodiments of the present invention, one or more processors store the characteristic measurements for each data block as records in a table, where each row represents one of the data blocks and each column represents one of the characteristics.

[0006] In some embodiments of the present invention, one or more processors add an additional column to the table containing the assigned tag for each data block.

[0007] In some embodiments of the present invention, the tags are assigned based on whether or not a data point in each data block contains a label, and each label indicates an abnormality or normality.

[0008] In some embodiments of the present invention, the abnormal tag indicates that there is an abnormality in each of the data blocks, the normal tag indicates that there is no abnormality in each of the data blocks, and the unknown tag indicates that it is unknown whether or not an abnormality exists in each of the data blocks.

[0009] In some embodiments of the present invention, one or more processors update training data with artificial anomalies by updating one or more of the data blocks containing the normal tags with the abnormal tags, thereby making the number of data blocks containing the normal tags and the number of data blocks containing the abnormal tags in the updated training data more evenly distributed.

[0010] These and other features and advantages of the present invention will be described in the following embodiments for carrying out the invention of exemplary embodiments of the present invention, or will become apparent to those skilled in the art in light of such description. [Brief explanation of the drawing]

[0011] [Figure 1] This is a functional data block diagram showing a computing environment for running an optimized anomaly detection program according to one embodiment of the present invention.

[0012] [Figure 2]This flowchart shows the operational stages of an optimized anomaly detection program for optimizing the detection of anomalous data points in time-series data, which is executed on a computer in the distributed data processing environment shown in Figure 1, according to one embodiment of the present invention. [Modes for carrying out the invention]

[0013] Embodiments of the present invention recognize that normal ranges or patterns in data can be identified by building and training a model (e.g., a semi-supervised anomaly detection model) on time-series data (e.g., sensor data) for anomaly detection. After training, the model can predict future data points one by one and thus identify outliers appearing in the output time-series data. When a new time-series data point is input to the model, the model predicts whether the data point is anomalous or not based on the previous data points. The problem with this conventional methodology is that the model may mistakenly predict normal points as anomalous, i.e., "false positives," requiring manual verification and labeling of the model's predictions, which is inefficient in terms of time and cost, and as a result, only a small portion of the data can be labeled. Therefore, embodiments of the present invention recognize the need for a method to reduce these false positive predictions and enable a more reliable predictive model.

[0014] Embodiments of the present invention provide a system and method for reducing false anomaly predictions for more reliable predictions of anomalies in future time series data. Embodiments of the present invention provide this by dividing a partially labeled set of time series data (e.g., a dataset that could only be partially labeled manually according to conventional methods) into data blocks, converting data block characteristic measurements into new records for each data block to form a new dataset for training an anomaly detection model, balancing the new dataset for training using artificial anomalies, and implementing the trained model for anomaly detection.

[0015] Implementations of the present invention provide a technical solution to the technical problem associated with anomaly detection in time-series data, where conventionally trained detection models predict "false positives" of anomalies. Implementations of the present invention therefore provide improvements in the field of detection models that predict anomalies in time-series data. These improvements are technical in nature because they are closely tied to computing and involve optimizing the set of data used as training data for the detection model by determining the data block size using spectral analysis methods and balancing the training data by adding artificial anomalies.

[0016] Embodiments of the present invention optimize the prediction of anomalous data points in time-series data by a detection model. Therefore, implementations of embodiments of the present invention provide improvements (i.e., technical solutions) to problems arising in the technical field of detection models. In particular, embodiments of the present invention determine the data block size using a spectral analysis method and add artificial anomalies to the data blocks to provide a more balanced training dataset for the detection model; therefore, embodiments of the present invention cannot be performed in the human mind. Furthermore, implementations of the present invention improve computer capabilities by improving the accuracy of the detection model while minimizing the computing resources required for anomaly detection.

[0017] Aspects of one embodiment of the present invention disclose a method, a computer program product, and a computer system for optimizing the detection of anomalous data points in time-series data. One or more processors receive a set of data, which is partially labeled time-series data. One or more processors determine a data block size for the set of data. One or more processors divide the set of data into data blocks based on the data block size. One or more processors calculate characteristic measurements for the characteristics of each data block. One or more processors assign a tag to each data block, which is selected from the group consisting of normal tags, anomalous tags, and unknown tags. One or more processors use each of the data blocks containing tags indicating anomalous and normal as training data. One or more processors update the training data using artificial anomalous data. One or more processors train a detection model using the updated training data. One or more processors use the trained detection model to predict whether each of the data blocks containing the unknown tag is anomalous or normal. This results in the technical benefit of reducing false positives, which are erroneous predictions of anomalies in time-series data, leading to improved accuracy and a reduced need for manual verification of model output.

[0018] In some embodiments of the present invention, one or more processors determine the data block size by observing patterns on a power spectral density plot using a spectral analysis method, identifying peaks, and identifying cutoff points that define the data block size.

[0019] In some embodiments of the present invention, one or more processors store the characteristic measurements for each data block as records in a table, where each row represents one of the data blocks and each column represents one of the characteristics.

[0020] In some embodiments of the present invention, one or more processors add an additional column to the table containing the assigned tag for each data block.

[0021] In some embodiments of the present invention, the tags are assigned based on whether or not a data point in each data block contains a label, and each label indicates an abnormality or normality.

[0022] In some embodiments of the present invention, the abnormal tag indicates that there is an abnormality in each of the data blocks, the normal tag indicates that there is no abnormality in each of the data blocks, and the unknown tag indicates that it is unknown whether or not an abnormality exists in each of the data blocks.

[0023] In some embodiments of the present invention, one or more processors update the training data with artificial anomalies by updating one or more of the data blocks containing the normal tags with the abnormal tags, thereby making the number of data blocks containing the normal tags and the number of data blocks containing the abnormal tags in the updated training data more evenly distributed. This results in the technical effect of improving the quality of the training data when training a detection model to better predict anomalies in time-series data.

[0024] The embodiments of the present invention can be implemented in various forms, and details of exemplary implementations will be described later with reference to the drawings.

[0025] Various aspects of the present disclosure are described by way of description text, flowcharts, data block diagrams of computer systems, and / or data block diagrams of machine logic included in embodiments of computer program products (CPP). With respect to any flowchart, operations may be executed in an order different from that shown in a given flowchart, depending on the involved technology. For example, again depending on the involved technology, two operations shown in consecutive data blocks of a flowchart may be performed in reverse order, as a single integrated step, simultaneously, or in a manner where their timings at least partially overlap.

[0026] Embodiments of a computer program product ("CPP Embodiment" or "CPP") are terms used in this disclosure to describe any set of one or more storage media (also called "mediums") that are collectively comprised of a set of one or more storage devices that collectively contain machine-readable code corresponding to instructions and / or data for performing computer operations specified in a given CPP claim. A "storage device" is any tangible device capable of holding and storing instructions for use by a computer processor. Computer-readable storage media may, but are not limited to, electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, mechanical storage media, or any preferred combination thereof. Some known types of storage devices, including these media, include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices (such as pits / lands formed on the main surface of a punch card or disk), or any suitable combination of those described above. When the term "computer-readable storage medium" is used in this disclosure, it shall not be interpreted as storage in the form of a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, optical pulses passing through optical fiber cables, electrical signals communicated through wires, and / or other transmission media.As will be understood by those skilled in the art, data is typically moved at several intermittent points during the normal operation of a storage device, such as during access, defragmentation, or garbage collection; however, since data is not transient while it is stored, this does not mean that a storage device is transient.

[0027] In Figure 1, the computing environment 100 includes an example of an environment for executing at least a portion of the computer code involved in performing the method of the present invention, such as an optimized anomaly detection program 126. In addition to the data block 126, the computing environment 100 includes, for example, a computer 101, a wide area network (WAN) 102, an end user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this embodiment, the computer 101 has a processor set 110 (including processing circuits 120 and a cache 121), a communication fabric 111, volatile memory 112, persistent storage 113 (including the operating system 122 and data block 126 identified above), a peripheral device set 114 (including a user interface (UI) device set 123, storage 124, and an Internet of Things (IoT) sensor set 125), and a network module 115. The remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140, a cloud orchestration module 141, a host physical machine set 142, a virtual machine set 143, and a container set 144.

[0028] The computer 101 may take the form of a desktop computer, a laptop computer, a tablet computer, a smartphone, a smartwatch, or other wearable computer, a mainframe computer, a quantum computer, or any other currently known or future-developed computer or mobile device capable of executing programs, accessing a network, or querying a database such as the remote database 130. As is well understood in the field of computer technology, and depending on the technology, the execution of the computer-implemented method may be distributed across multiple computers and / or multiple locations. On the other hand, in the present presentation of the computing environment 100, to keep the presentation as simple as possible, the detailed discussion focuses on a single computer, specifically the computer 101. Although the computer 101 is not shown in the cloud of Figure 1, it may be located in the cloud. On the other hand, the computer 101 is not required to reside in the cloud, except to the extent that it may be affirmatively indicated.

[0029] The processor set 110 includes one or more computer processors of any type that are currently known or will be developed in the future. The processing circuitry 120 may be distributed across multiple packages, for example multiple coordinated integrated circuit chips. The processing circuitry 120 may implement multiple processor threads and / or multiple processor cores. The cache 121 is memory located within the processor chip package, and is typically used for data or code that should be available for high-speed access by threads or cores executing on the processor set 110. Cache memory is typically organized into multiple levels according to its relative proximity to the processing circuitry. Alternatively, some or all of the caches for the processor set may be located "off-chip". In some computing environments, the processor set 110 may be designed to operate using qubits and perform quantum computing.

[0030] Computer-readable program instructions are typically loaded onto computer 101, causing the processor set 110 of computer 101 to execute a series of operational steps, thereby enabling the computer implementation method. As a result, the instructions thus executed instantiate the method specified in the flowcharts and / or descriptions of the computer implementation method contained herein (collectively referred to as the "Method of the Invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 121 and other storage media discussed below. The program instructions and associated data are accessed by the processor set 110 to control and direct the execution of the Method of the Invention. In computing environment 100, at least some of the instructions for executing the Method of the Invention may be stored in data block 116 of persistent storage 113.

[0031] The communication fabric 111 is a signal conduction path that enables various components of the computer 101 to communicate with one another. Typically, this fabric is made up of switches and conductive paths, such as buses, bridges, physical input / output ports, and similar components. Other types of signal communication paths, such as optical fiber communication paths and / or wireless communication paths, may be used.

[0032] The volatile memory 112 is any type of volatile memory currently known or to be developed in the future. Examples include dynamic random access memory (RAM) or static RAM. Typically, the volatile memory 112 is characterized by random access, but this is not required unless explicitly stated. In computer 101, the volatile memory 112 is located in a single package and resides inside computer 101, but alternatively or additionally, the volatile memory may be distributed across multiple packages and / or located externally to computer 101.

[0033] The persistent storage 113 is any form of non-volatile storage for a computer, currently known or to be developed in the future. The non-volatility of this storage means that the stored data is maintained regardless of whether the computer 101 and / or the persistent storage 113 are directly powered. The persistent storage 113 may be read-only memory (ROM), but typically at least a portion of the persistent storage allows for writing, deleting, and rewriting of data. Some well-known forms of persistent storage include magnetic disks and solid-state storage devices. The operating system 122 can take multiple forms, such as various known proprietary operating systems or open-source portable operating system interface type operating systems employing a kernel. The code contained in the data block 116 typically includes at least a portion of computer code involved in performing the method of the present invention.

[0034] The peripheral device set 114 includes a set of peripheral devices for the computer 101. Data communication connections between the computer 101's peripheral devices and other components can be implemented in various ways, including Bluetooth connections, Near-Field Communication (NFC) connections, connections made by cables (such as universal serial bus (USB) type cables), insert-type connections (e.g., secure digital (SD) cards), connections made through local area communication networks, and even connections made through wide area networks such as the internet. In various embodiments, the UI device set 123 may include components such as a display screen, speaker, microphone, wearable devices (such as goggles and smartwatches), keyboard, mouse, printer, touchpad, game controller, and haptic devices. Storage 124 is external storage such as an external hard drive, or insertable storage such as an SD card. Storage 124 may be persistent and / or volatile. In some embodiments, storage 124 may take the form of a quantum computing storage device for storing data in the form of qubits. In embodiments where computer 101 is required to have a large amount of storage (for example, when computer 101 locally stores and manages a large database), this storage may be provided by peripheral storage devices designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. The IoT sensor set 125 consists of sensors that can be used in Internet of Things applications. For example, one sensor may be a thermometer and another may be a motion detector.

[0035] The network module 115 is a collection of computer software, hardware, and firmware that enables computer 101 to communicate with other computers via the WAN 102. The network module 115 may include hardware such as a modem or Wi-Fi signal transceiver, software for packetizing and / or depacketizing data for communication network transmission, and / or web browser software for communicating data over the Internet. In some embodiments, the network control and network forwarding functions of the network module 115 are performed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing software-defined networking (SDN)), the control and forwarding functions of the network module 115 are performed on physically separate devices, such that the control function manages multiple different network hardware devices. Computer-readable program instructions for performing the method of the present invention can typically be downloaded from an external computer or external storage device to computer 101 via a network adapter card or network interface included in the network module 115.

[0036] WAN102 is any wide area network (e.g., the Internet) capable of communicating computer data over non-local distances by any currently known or future-developed technology for communicating computer data. In some embodiments, WAN102 may be replaced and / or complemented by a local area network (LAN), such as a Wi-Fi network, designed to communicate data between devices located in a local area. WANs and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and edge servers.

[0037] An end-user device (EUD) 103 is any computer system used and controlled by an end-user (e.g., an enterprise customer operating computer 101) and can take any of the forms described above in relation to computer 101. EUD 103 typically receives useful and valuable data from the operation of computer 101. For example, in a hypothetical case where computer 101 is designed to provide recommendations to an end-user, these recommendations would typically be transmitted from computer 101's network module 115 to EUD 103 via WAN 102. In this way, EUD 103 can display or otherwise present the recommendations to the end-user. In some embodiments, EUD 103 may be a client device such as a thin client, heavy client, mainframe computer, desktop computer, and similar.

[0038] The remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. The remote server 104 may be controlled and used by the same entity that operates computer 101. The remote server 104 represents a machine that collects and stores useful and valuable data for use by other computers, such as computer 101. For example, in a hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, this historical data may be provided to computer 101 from the remote database 130 of the remote server 104.

[0039] The public cloud 105 is any computer system available for use by multiple entities, providing on-demand availability of computer system resources and / or other computing capabilities, particularly data storage (cloud storage) and computing power, without direct active management by the user. Cloud computing typically leverages resource sharing to achieve coherence and economies of scale. Direct active management of the computing resources of the public cloud 105 is performed by the computer hardware and / or software of the cloud orchestration module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments running on various computers that make up the host physical machine set 142, which is the universe of physical computers available in and / or to the public cloud 105. The virtual computing environment (VCE) typically takes the form of virtual machines from the virtual machine set 143 and / or containers from the container set 144. These VCEs may be stored as images and are understood to be transferable either as images or after instantiation of the VCE, among and between various physical machine hosts. The cloud orchestration module 141 manages the transfer and storage of images, deploys new VCE instances, and manages active instances of the VCE deployment. The gateway 140 is a collection of computer software, hardware, and firmware that enables the public cloud 105 to communicate over the WAN 102.

[0040] Here, some further explanation of virtualized computing environments (VCEs) is provided. A VCE can be stored as an "image." A new active instance of a VCE can be instantiated from an image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system-level virtualization. This refers to an operating system feature where the kernel allows for the existence of multiple isolated user-space instances called containers. These isolated user-space instances typically behave as actual computers from the perspective of the programs running in them. Computer programs running on a normal operating system can utilize all the resources of that computer, including connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, programs running inside a container can only use the contents of the container and the devices allocated to the container; this feature is known as containerization.

[0041] The private cloud 106 is similar to the public cloud 105, except that its computing resources are available only for use by a single enterprise. While the private cloud 106 is shown as communicating with the WAN 102, in other embodiments, the private cloud may be completely isolated from the internet and accessible only through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private, community, or public cloud types), often implemented by different vendors. Each of the multiple clouds remains an independent entity, but the larger hybrid cloud architecture is coupled together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the multiple configuration clouds. In this embodiment, both the public cloud 105 and the private cloud 106 are part of a larger hybrid cloud.

[0042] The optimized anomaly detection program 126 operates to optimize the anomaly detection model by reducing the occurrence of false positive predictions of anomalies in time-series data by the model. In the shown embodiment, the optimized anomaly detection program 126 is a standalone program. In another embodiment, the optimized anomaly detection program 126 may be integrated into another software product, such as a machine learning product or package. In one embodiment, detailed steps of the optimized anomaly detection program 126 are shown and described in more detail with respect to Figure 2.

[0043] Figure 2 is a flowchart, generally designated as 200, showing the operational stages of an optimized anomaly detection program 126 running on computer 101 of the computing environment 100 of Figure 1, according to one embodiment of the present invention. In one embodiment, the optimized anomaly detection program 126 operates to optimize the detection of anomaly data points in time-series data. It should be understood that the process shown in Figure 2 represents one possible iteration of the process flow.

[0044] In step 210, the optimized anomaly detection program 126 receives a set of partially labeled time-series data. In one embodiment, the optimized anomaly detection program 126 receives a set of partially labeled time-series data in which a small portion of the data points have been manually labeled by the user as normal or abnormal. The set of partially labeled time-series data may be univariate time-series data (i.e., a single observation over a period of time for one variable, e.g., a sensor measuring temperature every second) or multivariate time-series data (i.e., more than one observation collected over time for multiple variables, e.g., a triaxial accelerometer measuring three accelerations over time). In one embodiment, the optimized anomaly detection program 126 receives data from a database storing the output of an anomaly detection algorithm, which may be inaccurate and generate many false positives for anomalous data points, and the output has been manually partially labeled. Thus, embodiments of the present invention optimize this set of data by reducing the number of false positives for anomaly or anomalous detection in the data.

[0045] In step 220, the optimized anomaly detection program 126 determines the data block size for the set of data. In one embodiment, the optimized anomaly detection program 126 determines the data block size (i.e., segment length, e.g., 5 seconds) for a set of partially labeled time-series data. In some embodiments, the optimized anomaly detection program 126 determines the data block size for a set of data by calculating the power spectral density or autocorrelation function using a spectral analysis method (e.g., a spectral analysis model). Based on observations of patterns in the power spectral density or autocorrelation function, for example through the identification of major peaks on a power spectral density plot or graph, the optimized anomaly detection program 126 identifies frequency or delay cutoff points in the set of data, thereby determining the data segment length and thus the data block size. In other embodiments, the optimized anomaly detection program 126 determines the data block size for a set of data based on a user-predefined size set.

[0046] In step 230, the optimized anomaly detection program 126 divides the data set into data blocks and calculates characteristic measurements. In one embodiment, the optimized anomaly detection program 126 divides the data set into data blocks based on the determined data block size. In one embodiment, the optimized anomaly detection program 126 divides the data set into data blocks B1, B2…B nThe data is divided into data block columns, where each data block contains a column of data points in chronological order. In one embodiment, once the set of data is divided into data blocks, the optimized anomaly detection program 126 analyzes the characteristics of each data block (i.e., the characteristics of the data in a particular data block) based on the values ​​of the data points in each data block, and calculates a measurement (i.e., a value) for each characteristic in each data block. The characteristics of a data block may include, but are not limited to, the mean, variance, autocorrelation function, partial correlation function, skewness, and trend. In one embodiment, the optimized anomaly detection program 126 stores the characteristic values ​​of each data block as records in a table where each row represents a data block and each column represents a characteristic.

[0047] In step 240, the optimized anomaly detection program 126 adds a tag to each data block of the data. In one embodiment, the optimized anomaly detection program 126 adds a tag value to each data block of the data based on whether the data points within the data block are labeled or unlabeled. The tag value indicates whether the data block of the data contains an anomaly, what type of anomaly may exist, or whether it is unknown whether an anomaly exists because none of the data points within the data block are labeled. In an exemplary embodiment, the tag value is selected from the group consisting of N for normal (i.e., no anomalies or anomalies), E for extreme outlier anomalies, V for variance change anomalies, L for level shift anomalies, and NA for unlabeled (i.e., unknown) data points. In one embodiment, the optimized anomaly detection program 126 adds a column to the record table that will represent the tag values ​​assigned to each data block. In one embodiment, the optimized anomaly detection program 126 uses data blocks with tag values ​​of N, E, V, and L as training data for a detection model in a later stage of the process. In one embodiment, the optimized anomaly detection program 126 uses a trained detection model to predict whether an anomaly exists in a data block with the tag NA.

[0048] In step 250, the optimized anomaly detection program 126 balances the training data with artificial anomalies. In one embodiment, the optimized anomaly detection program 126 balances the training data, which includes data blocks with tag values ​​N, E, V, and L, by adding an artificial anomaly to one or more of the normal data blocks (i.e., data blocks with tag N). This is necessary because typically the majority of data blocks are normal, and only a few contain anomalies, and therefore the training data is highly unbalanced at this point. In one embodiment, the optimized anomaly detection program 126 creates an updated, balanced set of training data by updating a certain number of data blocks with tag value N to have tag values ​​E, V, or L, for example, by updating a certain number of N data blocks to reach a threshold number of training data containing anomaly tags (i.e., E, V, or L), where the threshold is a pre-configured and adjustable model training parameter. In some embodiments, the optimized anomaly detection program 126 updates a sufficient number of data blocks having tag values ​​of N to tag values ​​of E, V, or L so that the number of tag values ​​of N, E, V, and L becomes similar (i.e., more evenly distributed).

[0049] In step 260, the optimized anomaly detection program 126 trains a detection model using the updated training data set. In one embodiment, the optimized anomaly detection program 126 trains a detection model, such as extreme gradient boosting (XGBoost), a neural network (NN), a C5 decision tree classifier, or chi-squared automatic interaction detection (CHAID), using the updated balanced training data set. In one embodiment, by training with the updated balanced training data set, the optimized anomaly detection program 126 creates a semi-supervised trained detection model that more accurately identifies anomalies and anomalies in time-series data, thereby reducing the number of false positives.

[0050] In step 270, the optimized anomaly detection program 126 uses a trained detection model to make predictions for data blocks with NA tag values. In one embodiment, the optimized anomaly detection program 126 inputs each data block with an NA tag value into the trained detection model and receives the model's prediction output regarding whether or not an anomaly exists in that data block. These predictions can be compared with what a conventional detection algorithm would or would have predicted for the same data point in order to identify false positives.

[0051] Accordingly, embodiments of the present invention provide an optimized anomaly detection program that generates balanced training data from an initial set of partially labeled time-series data, which is tagged as either normal, abnormal, or unknown and divided into balanced data blocks using artificial anomalies; trains a detection model using the balanced training data; and implements the trained detection model to make predictions on data blocks tagged as unknown, thereby improving the accuracy of anomaly detection.

[0052] The descriptions of the various embodiments of the present invention presented above are for illustrative purposes only and are not intended to be exhaustive or limitful to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terms used herein have been selected to best describe the principles, practical applications, or technical improvements to the technologies found in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. One or more processors receive a set of data, which is partially labeled time-series data; The step in which one or more processors determine the data block size for the set of data; The step in which one or more processors divide the set of data into data blocks based on the data block size; The step in which one or more processors calculate characteristic measurements for the characteristics of each data block; In the step where one or more processors assign a tag to each data block, the tag is selected from a group consisting of normal tags, abnormal tags, and unknown tags; The step in which one or more processors use each of the data blocks, which include either the normal tag or the abnormal tag, as training data; The step in which one or more of the aforementioned processors update the training data using artificial anomalies; The step of one or more processors training a detection model using the updated training data; and The step in which one or more processors use the trained detection model to predict whether each of the data blocks containing the unknown tag is abnormal or not. A computer implementation method comprising the following:

2. The computer implementation method according to claim 1, wherein the step of determining the data block size is performed by observing a pattern on a power spectral density plot using a spectral analysis method, identifying peaks, and identifying a cutoff point for determining the data block size.

3. The step in which one or more processors store the characteristic measurements for each data block as records in a table, where each row represents one of the data blocks and each column represents one of the characteristics. The computer implementation method according to claim 1, further comprising:

4. The step in which one or more processors add an additional column to the table containing the assigned tag for each data block. The computer implementation method according to claim 3, further comprising:

5. The computer implementation method according to claim 1, wherein the tags are assigned based on whether or not a data point in each data block contains a label, and each label indicates an abnormality or no abnormality.

6. The computer implementation method according to claim 1, wherein the abnormal tag indicates that there is an abnormality in each of the data blocks, the normal tag indicates that there is no abnormality in each of the data blocks, and the unknown tag indicates that it is unknown whether or not there is an abnormality in each of the data blocks.

7. The step of updating the training data using artificial anomalies is: The step in which one or more processors update one or more of the data blocks containing the normal tags with the abnormal tags so that the number of data blocks containing the normal tags and the number of data blocks containing the abnormal tags in the updated training data become more evenly distributed. A computer implementation method according to claim 1, comprising:

8. One or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media. The program instructions are: A program instruction for receiving a set of data, where the set of data is partially labeled time-series data; Program instructions for determining the data block size for the aforementioned set of data; Program instructions for dividing the set of data into data blocks based on the data block size; Program instructions for calculating characteristic measurements for the characteristics of each data block; A program instruction for assigning a tag to each data block, wherein the tag is selected from the group consisting of normal tags, abnormal tags, and unknown tags; Program instructions for using each of the data blocks containing either the normal tag or the abnormal tag as training data; Program instructions for updating the training data using artificial anomalies; Program instructions for training a detection model using the updated training data; and Program instructions for predicting whether each of the data blocks containing the unknown tag is abnormal or not, using the aforementioned trained detection model. A computer program product that has [certain characteristics].

9. The computer program product according to claim 8, wherein the program instruction for determining the data block size is performed by observing a pattern on a power spectral density plot using a spectral analysis method, identifying peaks, and identifying a cutoff point for determining the data block size.

10. A program instruction to store the characteristic measurements for each data block as records in a table, where each row represents one of the data blocks and each column represents one of the characteristics. The computer program product according to claim 8, further comprising:

11. Program instructions for adding an additional column to the table containing the assigned tag for each data block. The computer program product according to claim 10, further comprising the above.

12. The computer program product according to claim 8, wherein the tags are assigned based on whether or not a data point in each data block contains a label, and each label indicates an abnormality or no abnormality.

13. The computer program product according to claim 8, wherein the abnormal tag indicates that there is an abnormality in each of the data blocks, the normal tag indicates that there is no abnormality in each of the data blocks, and the unknown tag indicates that it is unknown whether or not there is an abnormality in each of the data blocks.

14. The program instructions for updating the training data using artificial anomalies are: A program instruction to update one or more of the data blocks containing the normal tags with the abnormal tags in the updated training data, thereby making the number of data blocks containing the normal tags and the number of data blocks containing the abnormal tags more evenly distributed. A computer program product according to claim 8, including the above.

15. One or more computer processors; One or more computer-readable storage media; Program instructions for execution by at least one of the one or more computer processors, which are collectively stored on the one or more computer-readable storage media. The stored program instructions are: A program instruction for receiving a set of data, where the set of data is partially labeled time-series data; Program instructions for determining the data block size for the aforementioned set of data; Program instructions for dividing the set of data into data blocks based on the data block size; Program instructions for calculating characteristic measurements for the characteristics of each data block; A program instruction for assigning a tag to each data block, wherein the tag is selected from the group consisting of normal tags, abnormal tags, and unknown tags; Program instructions for using each of the data blocks containing either the normal tag or the abnormal tag as training data; Program instructions for updating the training data using artificial anomalies; Program instructions for training a detection model using the updated training data; and Program instructions for predicting whether each of the data blocks containing the unknown tag is abnormal or not, using the aforementioned trained detection model. A computer system having the following features.

16. The computer system according to claim 15, wherein the program instructions for determining the data block size are performed by observing a pattern on a power spectral density plot using a spectral analysis method, identifying peaks, and identifying a cutoff point for determining the data block size.

17. A program instruction to store the characteristic measurements for each data block as records in a table, where each row represents one of the data blocks and each column represents one of the characteristics. The computer system according to claim 15, further comprising:

18. Program instructions for adding an additional column to the table containing the assigned tag for each data block. The computer system according to claim 17, further comprising:

19. The computer system according to claim 15, wherein the tags are assigned based on whether or not a data point in each data block contains a label, and each label indicates an abnormality or normal condition.

20. The computer system according to claim 15, wherein the abnormal tag indicates that there is an abnormality in each of the data blocks, the normal tag indicates that there is no abnormality in each of the data blocks, and the unknown tag indicates that it is unknown whether or not there is an abnormality in each of the data blocks.

Images