Unbiased anomaly detection and anomaly location identification system, method, and program

Abstract

The system for fair anomaly detection generates an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, where the mean vector and precision matrix are generated by reducing a function below a threshold, the function including the Gaussian distribution, a first regularization term configured to generate similar anomaly scores for inputs having similar fair characteristics and independent of unfair characteristics, and a second regularization term configured to generate similar anomaly location scores for inputs having similar fair characteristics and independent of unfair characteristics. The system further includes inputting new data into the anomaly detection model and generating an anomaly score and an anomaly location score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

Description

[Technical field]

[0001] The present disclosure relates to anomaly detection, and more particularly, to unbiased anomaly detection and localization. [Background technology]

[0002] Anomaly detection and anomaly localization are important aspects of data analysis. Anomaly detection can identify the occurrence of an anomaly, and anomaly localization can identify the characteristics, cause, or source of the detected anomaly. In other words, anomaly detection indicates that an unusual or unexpected event has occurred, while anomaly localization indicates where and / or why the unusual or unexpected event occurred.

[0003] One challenge in the field of anomaly detection and localization is related to fairness. In other words, anomalies should not be identified based on unfair features in the data. For example, in the case of a vehicle's dash cam, anomaly detection may be used to detect unsafe driving resulting from driver behavior, driver fatigue, vehicle failure, etc. Anomaly localization, on the other hand, can identify the root cause of the detected anomaly. Such data may be utilized by automobile manufacturers, automobile insurance companies, auto parts suppliers, civil engineers, etc. to improve the safety, reliability, and efficiency of vehicles, roads, and drivers. Continuing with the above example, in the case of anomalies detected in a dash cam, anomaly localization may indicate that the pattern of braking by the driver was abnormal compared to the normal pattern of braking. However, some features used in anomaly detection and localization may be unfair. Continuing with the above example of a dashcam, it would be unfair to infer abnormal (e.g., risky) driving behavior from features unrelated to the driver's behavior, such as vertical acceleration (e.g., due to the route's terrain or road surface characteristics), temperature, the likelihood of inclement weather, the driver's age, the model of the car, etc. However, completely ignoring these "unfair" features may degrade the performance of anomaly detection and anomaly localization systems. Thus, a need exists for techniques and systems that can reduce the impact of unfair features on anomaly detection and anomaly localization models while maintaining acceptable accuracy of the anomaly detection and anomaly localization models. Summary of the Invention

[0004] Aspects of the present disclosure are directed to a system including a vehicle, a plurality of sensors that collect observed vehicle data, a drive recorder configured to aggregate and store the observed vehicle data, and an anomaly detection system communicatively coupled to the drive recorder. The anomaly detection system includes a probability distribution of historical vehicle data, and parameters of the probability distribution are adjusted to reduce a function below a threshold. The function is based on the probability distribution conditioned on the historical vehicle data and at least one regularization term configured to generate an output similar to the probability distribution of an input that has similar fair characteristics and is independent of unfair characteristics. The anomaly detection system further includes an anomaly score and an anomaly localization score based on the probability distribution, the parameters, and the observed vehicle data.

[0005] The aforementioned embodiments achieve a number of advantages. First, they achieve improved fairness in anomaly detection insofar as the anomaly scores and anomaly localization scores are based on fair (rather than unfair) features modified using at least one regularization term. Second, the aforementioned improvement in fairness does not lead to a loss in performance. In fact, it is shown that the use of at least one regularization term improves fairness while maintaining or improving performance (see experimental results described with respect to FIG. 6). Third, the additional computational complexity introduced by the at least one regularization term is nonexistent (e.g., for a regularization term related to an anomaly score) or acceptably small (e.g., for a regularization term related to an anomaly localization score).

[0006] A further aspect of the disclosure is directed to a method including training an anomaly detection system configured to generate an anomaly score and an anomaly location score for vehicle data. The anomaly detection system may be trained to generate similar anomaly scores and anomaly location scores for historical vehicle data including similar fair features and dissimilar unfair features using a first regularization term and a second regularization term. The method further includes receiving, at the anomaly detection system, new vehicle data from a drive recorder that collects data from a plurality of sensors on the vehicle, and generating a first anomaly score and a first anomaly location score associated with the new vehicle data. The method further includes performing a mitigation action based on the first anomaly score and the first anomaly location score, the mitigation action modifying the vehicle.

[0007] The aforementioned embodiments achieve a number of advantages. First, they achieve improved fairness in anomaly detection insofar as the anomaly scores and anomaly localization scores are based on fair (rather than unfair) features modified using the first and second regularization terms. Second, the aforementioned improvement in fairness does not lead to a loss in performance. In fact, it is shown that the use of the first and second regularization terms also improves fairness while maintaining or improving performance (see the experimental results described with respect to FIG. 6). Third, there is no additional computational complexity introduced by the first regularization term, while the additional computational complexity introduced by the second regularization term is acceptably small.

[0008] A further aspect of the present disclosure is directed to a method including generating an anomaly detection model based on a Gaussian distribution of past data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, where the mean vector and precision matrix are generated by reducing a function below a threshold, the function including the Gaussian distribution, a first regularization term configured to generate similar anomaly scores for inputs that have similar fair characteristics and are independent of unfair characteristics, and a second regularization term configured to generate similar anomaly location scores for inputs that have similar fair characteristics and are independent of unfair characteristics. The method further includes inputting new data into the anomaly detection model. The method further includes generating an anomaly score and an anomaly location score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

[0009] The aforementioned embodiments achieve a number of advantages. First, they achieve improved fairness in anomaly detection insofar as the anomaly scores and anomaly localization scores are based on fair (rather than unfair) features modified using the first and second regularization terms. Second, the aforementioned improvement in fairness does not lead to a loss in performance. In fact, it is shown that the use of the first and second regularization terms also improves fairness while maintaining or improving performance (see the experimental results described with respect to FIG. 6). Third, there is no additional computational complexity introduced by the first regularization term, while the additional computational complexity introduced by the second regularization term is acceptably small.

[0010] Another aspect of the present disclosure according to the above method further includes that the function is reduced using Stochastic Gradient Descent (SGD) or Block Coordinate Gradient Descent. Using SGD or Block Coordinate Gradient Descent advantageously reduces the computational load associated with reducing the function below the threshold.

[0011] Another aspect of the present disclosure according to the aforementioned method further includes that the anomaly score is the negative log-likelihood of new data according to the Gaussian distribution, mean vector, and precision matrix of the past data. The anomaly score can advantageously be computationally inexpensive when calculated based on the Gaussian distribution and precision matrix, insofar as most of the computational burden resides in the training phase related to learning the precision matrix. In other words, the anomaly score can be calculated quickly with little processing overhead according to these embodiments.

[0012] Another aspect of the present disclosure according to the aforementioned method further includes that the anomaly localization score is the negative conditional log-likelihood of the features of the new data conditioned on other features of the new data according to the Gaussian distribution, mean vector, and precision matrix of the past data. The anomaly localization score can advantageously be computationally inexpensive to calculate based on the Gaussian distribution and precision matrix insofar as the majority of the computational burden resides in the training phase associated with learning the precision matrix. In other words, the anomaly localization score can be calculated quickly with little processing overhead according to these embodiments.

[0013] Additional aspects of the present disclosure are directed to systems and computer program products configured to perform the aforementioned methods. This Summary is not intended to describe every aspect of every implementation and / or embodiment of the present disclosure.

[0014] The drawings contained in this application are incorporated in and form a part of this specification. The drawings, together with the description, illustrate embodiments of the present disclosure and serve to explain the principles of the present disclosure. The drawings are merely examples of particular embodiments and are not limiting of the disclosure. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram illustrating an example vehicle communicatively coupled to an anomaly detection system, according to some embodiments of the present disclosure. [Diagram 2] FIG. 1 is a block diagram illustrating an example system communicatively coupled to an anomaly detection system, according to some embodiments of the present disclosure. [Diagram 3] FIG. 2 illustrates a flowchart of an example method for utilizing an anomaly detection system, according to some embodiments of the present disclosure. [Figure 4] FIG. 1 illustrates a flowchart of an example method for generating or training an anomaly detection system or model in accordance with some embodiments of the present disclosure. [Diagram 5] FIG. 1 shows a table of experimental results, according to some embodiments of the present disclosure. [Figure 6] FIG. 1 is a block diagram illustrating an example computer according to some embodiments of the present disclosure. [Figure 7] FIG. 1 illustrates a cloud computing environment in accordance with some embodiments of the present disclosure. [Figure 8] FIG. 2 illustrates an abstract model layer according to some embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] While the disclosure is susceptible to various modifications and alternative forms, details thereof have been shown by way of example in the drawings and will be described in detail. It is to be understood, however, that it is not intended to limit the disclosure to the particular embodiments described. On the contrary, it is intended to cover all modifications, equivalents, and alternatives falling within the scope of the disclosure.

[0017] Aspects of the present disclosure are directed to anomaly detection, and more particularly, to unbiased anomaly detection and anomaly localization. Although not limited to such applications, embodiments of the present disclosure may be better understood in light of the foregoing context.

[0018] While various strategies for fairness exist in supervised learning, there are no known strategies to handle fairness in anomaly detection and localization using unsupervised learning with unlabeled training data. There are various definitions of fairness when it relates to anomaly detection. The first definition is that the prediction of anomalies is independent of any unfair features. However, this definition ignores unfair features that can lead to poor performance of anomaly detection and localization models. The second definition of fairness in anomaly detection is that there is no cause-and-effect relationship between unfair features and predicted anomalies. However, causal relationships are difficult to derive explicitly from machine learning models. Therefore, it is impractical to implement this definition in machine learning applications. The third definition of fairness in anomaly detection indicates that the prediction of anomalies is independent of unfair features conditioned on other features. Aspects of the present disclosure utilize the third definition of fairness in anomaly detection and localization. This third definition advantageously enables the use of unfair features to maintain the performance of the anomaly detection and localization model while equalizing (e.g., making more similar) the outputs of data containing similar fair features and dissimilar unfair features using a regularization term.

[0019] Aspects of the present disclosure realize one or more of the following features. First, aspects of the present disclosure utilize a first regularization term to improve the fairness of anomaly detection in an anomaly detection and anomaly localization model. The first regularization term may be defined as a term configured to reduce the difference between two anomaly scores calculated from two samples having dissimilar unfair features and similar fair features. Making the anomaly scores of the two samples approximately equal suggests that there is no effect of the dissimilar unfair features on the anomaly scores (e.g., the output of the model is unrelated to the unfair features). Returning to the dashcam example above, the dissimilar unfair features may be the model of the car (e.g., small truck, convertible, etc.), age, etc., while the similar fair features may relate to speed, acceleration, position, braking patterns, etc.

[0020] A second aspect of the present disclosure uses a second regularization term to improve the fairness of anomaly localization in an anomaly detection and localization model. Similar to the first regularization term, the second regularization term related to anomaly localization may be defined as a term configured to reduce the difference between two anomaly localization scores calculated from two samples with dissimilar unfair features and similar fair features (e.g., such that the output of the model is independent of the unfair features).

[0021] According to a third aspect of the present disclosure, the anomaly score can be the negative likelihood (or negative log-likelihood) of the sample according to an anomaly detection and localization model trained on normal (non-anomalous) data. In some embodiments, the anomaly detection and localization model trained on normal data can be based on a Gaussian probability distribution (e.g., a normal probability distribution), or using maximum likelihood estimation (MLE) techniques, or both.

[0022] According to a fourth aspect of the present disclosure, the anomaly localization score can be based on the negative conditional likelihood (or the negative conditional log-likelihood) of the anomaly detection and localization model trained on normal data. In other words, the anomaly localization score can indicate the features that contributed most to the determination of the anomaly (e.g., the anomaly score).

[0023] To now describe some aspects of the present disclosure in further detail, aspects of the present disclosure can learn parameters of a Gaussian distribution for a model based on a feature vector x. Although Gaussian distributions are primarily described herein, any number of other probability distributions are within the scope of the present disclosure. The anomaly score can then be based on the likelihood of newly observed data x occurring according to a Gaussian distribution. Given a Gaussian distribution (Nx|0, ∧ -1 ) is learned in training. The precision matrix ∧ (sometimes called the cardinality matrix) can be the inverse of the covariance matrix. Zeros in the precision matrix ∧ can advantageously indicate conditional independence between corresponding variables. Thus, the precision matrix ∧ is uniquely suited to identify influences (including the influence of unfairness) between variables (e.g., based on the non-zero elements of the precision matrix ∧), to quantify the degree of influence (e.g., based on how close each element of the precision matrix ∧ is to zero), and to reduce the influence of unfair features on anomaly detection and localization (e.g., by introducing a regularization term that reduces elements in the precision matrix ∧ that reflect dependencies between unfair and fair features).

[0024] Equation 1 determines the value of the precision matrix ∧ that minimizes (e.g., reduces below a threshold or minimizes according to computational parameters) a function of the sum of the Gaussian log-likelihood, the L1 regularization term (e.g., LASSO (Least Absolute Shrinkage and Selection Operator) regression regularization) of the precision matrix ∧, the first regularization term (e.g., anomaly score regularization term), and the second regularization term (e.g., anomaly localization score regularization term).

[0025]

number

[0026] In Equation 1, x represents the input data, and x may be associated with any number of dimensions to represent any number D of different data inputs, features, or sources d. In other words,

number

number

number

[0027] Equation 1 can be simplified to Equation 2, which can eliminate redundant terms, approximate E (e.g., using the sample mean), and utilize the empirical covariance matrix S.

[0028]

number

[0029] The terms in Equation 2 can be grouped together to better understand the components of Equation 2. For example, the part -ln det(∧) + tr(S∧) represents the negative log-likelihood of the Gaussian distribution, the part ρ|∧| remains the L1 regularization term,

number

number

[0030] In some embodiments, the anomaly detection model learns the precision matrix ∧ by determining a precision matrix ∧ that minimizes Equation 2 (e.g., reduces it below a threshold or minimizes it according to a computational parameter) using Stochastic Gradient Descent (SGD). In other embodiments, the anomaly detection model learns the precision matrix ∧ by minimizing Equation 2 using Block Coordinate Gradient Descent or another method, such as, but not limited to, Cyclic Block Coordinate Descent, Randomly Permuted Cyclic Block Coordinate Descent, Randomized Block Coordinate Descent, etc. Additionally, although aspects of the present disclosure describe minimizing a function of Equation 1 or 2 by manipulating the precision matrix ∧, the term minimize refers to any amount of reduction in the function and not necessarily an absolute minimum. For example, in some embodiments, the function is reduced below a threshold amount, or in other embodiments, the function is reduced for a predefined number of computational iterations or approximations.

[0031] Some embodiments utilizing Glasso (e.g., graphical LASSO) together with block coordinate gradient descent are advantageous insofar as the gradients for each matrix element are calculated separately (even considering the first and second regularization terms as described in Equations 1 and 2). Furthermore, before performing block coordinate gradient descent (or any other gradient descent), the sum over all training samples x (N*N iterations) of the first and second regularization terms described in Equations 1 and 2 may be calculated. This is done by using the precision matrix ∧ d,i This means that there is no summation over all N samples or D features at each gradient step of N. Thus, by introducing the first regularization term, the order of computational complexity at each gradient step does not change as long as the order for computing these terms is O(1).

[0032] In contrast, the order of magnitude of the computational complexity of the preprocessing step is increased (N times larger) from O(D^2*N), the cost for computing the empirical covariance matrix S, to O(D^2*N^2), the cost for preprocessing the second regularization term. However, it should be noted that this computation is only required before the operation of Stochastic Gradient Descent (SGD), and the number of SGD steps can be several times larger than the number of training samples N. Thus, the additional computational complexity introduced by the second regularization term is relatively insignificant.

[0033] In summary, the anomaly score is the negative log-likelihood of the Gaussian probability and precision matrix of the training dataset (e.g., -lnN(x|0, ∧ -1 ) while the anomaly localization score can be based on the complementary features x -d Input features x conditioned on d The negative conditional log-likelihood of the Gaussian probability and precision matrix for the training dataset (e.g., -lnN(x d |x -d ,0,∧ -1 Equations 1 and 2 can be simplified so that they can be based on

[0034] Turning now to the figures, FIG. 1 illustrates a block diagram of an example vehicle 100 including a drive recorder 102 communicatively coupled to an anomaly detection system 112 (also referred to as an anomaly detection model) via a network 130, in accordance with some embodiments of the present disclosure. While the network 130 is illustrated for ease of explanation, in other embodiments, one or more permanent or intermittent networks of similar or dissimilar types may be used to connect multiple vehicles 100 to the anomaly detection system 112. Non-limiting examples of the network 130 include a wide-area network (WAN), a local area network (LAN), an intranet, the Internet, a cellular network (e.g., 3G, 4G, 5G), a personal-area network (PAN), and the like.In some embodiments, the network 130 is a short-range network connection (e.g., networks utilizing the Institute of Electrical and Electronics Engineers (IEEE) 802.15 standard, the IEEE 1902.1 standard, a personal area network (PAN), a Bluetooth™ network, a Near Field Communication (NFC) network, an Infrared Data Association (IrDA) network, Internet Protocol version 6 (IPv6) over Low-Power Wireless Personal-Area Networks (6LoWAPN), a DASH7 Alliance Protocol (D7A) network, a RuBee network, an Ultra-wideband (UWB) network, a Frequency Modulation (FM)-UWB network, a Wireless Ad Hoc Network (WANET), a Z-Wave network, a ZigBee™ network, and other short-range networks) or another connection that enables communication between the vehicle 100 and the anomaly detection system 112.

[0035] The vehicle 100 can be any non-autonomous, semi-autonomous, or autonomous vehicle. The vehicle 100 can include a drive recorder 102 adapted to aggregate, store, and transmit data associated with the performance of the vehicle and / or the capabilities of the driver of the vehicle 100. The drive recorder 102 can collect data from a variety of sensors, such as, but not limited to, an accelerometer 104 (e.g., collecting linear or angular acceleration data), a speedometer 106 (e.g., collecting speed data), a global positioning system (GPS) 108 (e.g., collecting latitude, longitude, country, region, state, city, or other location data, or combinations thereof), or other sensors 110 (e.g., temperature sensors, pressure sensors, location sensors, etc.), or combinations thereof. Other sensors 110 may collect various other types of data associated with the vehicle 100, such as, for example, throttle position, engine temperature, engine revolutions per minute (RPM), steering wheel position, brake pressure, driving mode (e.g., cruise control, adaptive cruise control, semi-autonomous, etc.), engine vehicle code, and / or other data.

[0036] The drive recorder 102 may transmit data collected by the drive recorder 102 to the anomaly detection system 112 over the network 130. In various embodiments, the data may be transmitted continuously, semi-continuously, or in batches.

[0037] The anomaly detection system 112 may be trained using historical data 114 (also referred to as training data). In some embodiments, the historical data 114 is historical drive recorder data representing normal (e.g., non-anomalous) driving behavior. The anomaly detection system 112 may be trained by (i) standardizing the historical data 114 (e.g., to make the mean feature vector equal to zero), (ii) learning a Gaussian probability distribution 120 of the standardized historical data 114, and (iii) reducing the function 122 below a threshold by manipulating (e.g., changing, adjusting, etc.) the precision matrix ∧ 124 of the Gaussian probability distribution 120 while utilizing a first regularization term 126 related to the fairness of anomaly detection or a second regularization term 128 related to the fairness of anomaly localization, or both. As previously described, the function 122 may be a function as shown in Equation 1 or Equation 2 or both. Additionally, the first regularization term 126 may be a function as shown in Equation 1 (as shown in Equation 1)

number

number

number

number

[0038] After training the anomaly detection system 112 (e.g., by learning an accuracy matrix ∧ 124 that reduces the function 122 below a threshold), the anomaly detection system 112 may receive data from the drive recorder 102 and output an anomaly score 116 and an anomaly localization score 118. In some embodiments, the data received from the drive recorder 102 is pre-processed to standardize it in a manner consistent with the standardization of the historical data 114. In some embodiments, the anomaly score 116 is calculated by multiplying the negative log-likelihood of new data x (e.g., −lnN(x|0, ∧) according to a Gaussian probability distribution 120 and the learned accuracy matrix ∧ 124. -1 )). The anomaly score 116 can help indicate whether an anomaly has occurred. Furthermore, in some embodiments, the anomaly localization score 118 can be a function of complementary features x -d Considering x d The negative conditional log-likelihood of the new data x (e.g., -lnN(x d |x -d ,0,∧ -1 ) The anomaly localization score 118 can help indicate the source or cause of the detected anomaly.

[0039] The anomaly scores 116 and anomaly location scores 118 may be utilized in any number of ways. For example, the scores may be utilized by automobile manufacturers to improve warranties, improve vehicle safety, or understand customer usage, or a combination thereof. The scores may be utilized by automobile parts suppliers to improve reliability or safety or both. The scores may be utilized by automobile insurance companies to adjust insurance rates based on driving behavior. The scores may be utilized by civil engineers and urban planners to modify road designs to improve safety. Additionally, the scores may be utilized by the vehicle 100 itself. For example, the vehicle 100 may present a notification or warning to the driver of the vehicle based on the score. As another example, the vehicle 100 may send a notification or warning, for example, to an emergency service, based on the score. As yet another example, the vehicle 100 may modify or change a function of the vehicle 100, such as, but not limited to, accelerating, decelerating, turning, braking, etc., based on the score.

[0040] While FIG. 1 illustrates the vehicle 100 communicatively coupled to the anomaly detection system 112 via the network 130, in other embodiments, the vehicle 100 may include the anomaly detection system 112 stored therein. For example, the anomaly detection system 112 may be co-located with the drive recorder 102 within the vehicle 100. In such embodiments, the anomaly detection system 112 may be trained on a remote data processing system and downloaded to the vehicle 100. In other embodiments, a partially trained or untrained anomaly detection system 112 may be downloaded to the vehicle 100 from the remote data processing system, and the anomaly detection system 112 may train itself in real-time or while the vehicle 100 is in operation, for embodiments in which vehicle-specific and / or driver-specific training are desired.

[0041] 2, an example system 200 is shown that generates data 202 for transmission to and analysis by the anomaly detection system 112 shown in FIG. 1 in accordance with some embodiments of the present disclosure. Although FIG. 1 illustrates a drive recorder 102 in a vehicle 100, aspects of the present disclosure are applicable to any number of industries and applications. For example, the system 200 can be a device or application in which data 202 originates in a medical environment (e.g., patient monitoring, patient billing, etc.), a device or application in an industrial environment (e.g., parts quality control data in a manufacturing plant, process control data in a refinery, rig data for onshore or offshore drilling rigs, etc.), a financial application (e.g., loan origination, credit reports, etc.), a travel application (e.g., insight into flight delays, cancellations, etc.), etc. Additionally, in contrast to FIG. 1, where the drive recorder 102 collected data from sensors, as shown in FIG. 2, the data 202 does not necessarily come from sensors, but could also come from purely electronic data (e.g., text messages, internet search terms, applications, resumes, etc.) (although it could come from sensors).

[0042] The anomaly detection system 112 may function in Figure 2 in a similar manner as previously described in Figure 1, except that whereas the data in Figure 1 was received from the drive recorder 102, the data 202 in Figure 2 is received from the system 200. The data 202 may include more features, fewer features, or similar features than the data described with respect to Figure 1.

[0043] 2 illustrates system 200 communicatively coupled to anomaly detection system 112 by network 130, in other embodiments, system 200 may include anomaly detection system 112 stored therein. For example, anomaly detection system 112 may be co-located with data 202 in system 200. In such embodiments, anomaly detection system 112 may be trained on a remote data processing system and downloaded to system 200. In other embodiments, a partially trained or untrained anomaly detection system 112 may be downloaded to system 200 from a remote data processing system, and for embodiments in which system-specific and / or driver-specific training are desired, anomaly detection system 112 may train itself in real-time or while system 200 is operating.

[0044] Figure 3 illustrates a flowchart of an example method 300 for utilizing the anomaly detection system 112 shown in Figures 1 and 2, according to some embodiments of the present disclosure. The method 300 may be implemented by the anomaly detection system 112, a computer, a processor, or another configuration of hardware and / or software.

[0045] Operation 302 includes training (or generating) an anomaly detection system 112 using a first regularization term for fairness of anomaly scores and a second regularization term for fairness of anomaly localization scores. In some embodiments, the anomaly detection system 112 is trained by learning a precision matrix ∧ 124 that reduces a function 122 below a threshold, the function including at least one of a negative log-likelihood of a Gaussian probability distribution 120 of the training data 114, an L1 regularization term, a first regularization term for fairness of anomaly scores 126, and a second regularization term for fairness of anomaly localization scores 128. In some embodiments, the first regularization term for fairness of anomaly scores 126 causes the anomaly scores 116 to be similar for inputs that include similar fair features and dissimilar unfair features, thereby reducing or eliminating the influence of the unfair features. Similarly, in some embodiments, a second regularization term for fairness of the anomaly localization score 128 makes the anomaly localization score 118 similar for inputs that include similar fair features and dissimilar unfair features, thereby reducing or eliminating the influence of the unfair features. In some embodiments, operation 302 includes downloading the anomaly detection system 112 from a remote data processing system to a device, such as a computer, a server, the vehicle 100, the system 200, or another device.

[0046] Operation 304 includes inputting new data (e.g., data from the drive recorder 102 or data 202) into the anomaly detection system 112. Operation 306 includes generating an anomaly score 116 or an anomaly localization score 118, or both, by the anomaly detection system 112 based on the new data. In some embodiments, the anomaly score 116 is calculated as a negative log-likelihood (e.g., -lnN(x|0, ∧) of the Gaussian probability distribution 120, precision matrix ∧ 124, or mean vector, or a combination thereof, of the past data 114 with respect to the new data. -1) while the anomaly localization score 118 can be based on the negative conditional log-likelihood (e.g., −lnN(x d |x -d ,0,∧ -1 )) can be based on.

[0047] Operation 308 includes transmitting the anomaly scores 116 and / or the anomaly localization scores 118 to another device, system, subsystem, or computer. In some embodiments, the anomaly scores 116 and / or the anomaly localization scores 118 are transmitted over the network 130 to a remote data processing system.

[0048] Operation 310 includes performing a mitigating action based on the anomaly score 116 and / or the anomaly location score 118. The mitigating action may relate to a notification, alert, report, or warning presented to a user, such as a notification, alert, report, or warning sent to emergency services, or a change to one or more devices or systems associated with the anomaly score 116 and / or the anomaly location score 118, or a combination thereof. In an embodiment where the device associated with the anomaly score 116 and / or the anomaly location score 118 is a vehicle 100, the mitigating action may relate to accelerating, decelerating, turning, braking, etc.

[0049] 4 illustrates a flowchart of an example method 400 for training the anomaly detection system 112 in accordance with some embodiments of the present disclosure. The method 400 may be implemented by the anomaly detection system 112, a computer, a processor, or another configuration of hardware and / or software. In some embodiments, the method 400 is a sub-method of operation 302 of FIG. 3.

[0050] Operation 402 includes extracting a feature vector from the historical data 114. In some embodiments, operation 402 includes standardizing the feature vector such that the mean vector is equal to zero.

[0051] Operation 404 includes determining a Gaussian probability distribution 120 of the feature vectors of the historical data 114. Operation 406 includes calculating a pre-computable portion of the function 122 (e.g., a pre-computable portion of Equation 1 or 2). For example, in Equation 2, operation 406 may include calculating an empirical covariance matrix S of the regularization term and / or other pre-computable portions.

[0052] Operation 408 includes learning the precision matrix ∧ 124 by manipulating the precision matrix ∧ 124 to reduce or minimize the function 122. In some embodiments, operation 406 includes using stochastic gradient descent (SGD). In other embodiments, the anomaly detection model learns the precision matrix ∧ 124 by using block coordinate gradient descent or another method, such as, but not limited to, cyclic block coordinate descent, randomly permuted cyclic block coordinate descent, randomized block coordinate descent, etc. Operation 406 may include reducing the function 122 below a predefined threshold, reducing the function 122 until successive iterations result in a change below a predefined threshold, reducing the function 122 for a predefined number of iterations, reducing the function 122 until an absolute minimum is found, or another method for reducing the function 122 by an acceptable amount.

[0053] FIG. 5 shows a table 500 of experimental results for some embodiments of the present disclosure. Experimental validation of embodiments of the present disclosure was performed on a synthetic dataset containing N=1000 data points for training and testing and a number of features D=10. The covariance matrix Σ was randomly generated with the positive semidefinite constraint. Then, D-dimensional data was generated from the distribution N(x|0,Σ). If the unfair feature is x u while the abnormal features are set as x a Set as (xa x u (It should not be equal to x for half of the test data.) a The variances and covariances associated with were corrupted.

[0054] Two types of Area Under the Curve (AUC) data were used to evaluate the results. AUC-Anomaly Detection (AUC AD) was used to detect whether the anomaly classification of each input was correct, and AUC-Anomaly Localization (AUC AL) was used to determine whether the root cause of the detected anomaly was correct. Additionally, fairness was evaluated by determining whether the anomaly scores 116 and anomaly localization scores 118 for data containing similar fair features and dissimilar unfair features were in fact similar. The Equalized Odds for Anomaly Detection (EO AD) measure of fairness constitutes the squared difference between the two anomaly scores 116 calculated from the two samples, while the Equalized Odds for Anomaly Localization (EO AL) measure of fairness (e.g.,

number

number

[0055] As shown in table 500, for the AUC measure, larger is better, while for the EO measure, smaller is better. As shown in table 500, the AUC AD and AUC AL of the three experimental models are equal to or greater than the AUC AD and AUC AL of the baseline model. Similarly, the EO AD and EO AL of each of the three experimental models are equal to or less than the EO AD and EO AL of the baseline model. Taken together, these experimental results show that (i) performance was improved (or at least maintained) compared to the baseline model, (ii) fairness was improved in all cases compared to the baseline model, and (iii) improved performance and fairness were achieved when either of the regularization terms were used in isolation and when both regularization terms were used together. FIG. 5 illustrates that aspects of the present disclosure successfully achieved an anomaly detection system 112 improved fairness without loss of performance.

[0056] FIG. 6 illustrates a block diagram of an exemplary computer 600 according to some embodiments of the present disclosure. In various embodiments, the computer 600 can perform any or all of the methods described in FIGS. 3-4, implement the functions described in FIGS. 1-2, or realize the experimental results described in FIG. 5, or a combination thereof. In some embodiments, the computer 600 receives instructions related to the aforementioned methods and functions by downloading processor-executable instructions from a remote data processing system over the network 650. In other embodiments, the computer 600 provides instructions for the aforementioned methods and / or functions to a client machine such that the client machine performs the method or part of the method based on the instructions provided by the computer 600. In some embodiments, the computer 600 is incorporated into (or virtually provisioned with functionality similar to the computer 600) the anomaly detection system 112, the vehicle 100, the dash cam 102, the system 200, or other aspects of the present disclosure, or a combination thereof.

[0057] The computer 600 includes memory 625, storage 630, an interconnect 620 (e.g., a bus), one or more CPUs 605 (also referred to herein as processors), an I / O device interface 610, I / O devices 612, and a network interface 615.

[0058] Each CPU 605 retrieves and executes programming instructions stored in memory 625 or storage 630. Interconnect 620 is used to move data, such as programming instructions, between CPU 605, I / O device interface 610, storage 630, network interface 615, and memory 625. Interconnect 620 may be implemented using one or more buses. In various embodiments, CPU 605 may be a single CPU, multiple CPUs, or a single CPU including multiple processing cores. In some embodiments, CPU 605 may be a digital signal processor (DSP). In some embodiments, CPU 605 includes one or more 3D integrated circuits (3DICs) (e.g., 3D wafer-level packaging (3DWLP), 3D interposer-based integration, 3D stacked ICs (3D-SICs), monolithic 3D ICs, 3D heterogeneous integration, 3D system in package (3DSiP), and / or package on package (PoP) CPU configurations). Memory 625 is included generally to represent random access memory (e.g., static random-access memory (SRAM), dynamic random access memory (DRAM), or flash). Storage 630 is included generally to represent non-volatile memory, such as a hard disk drive, solid state device (SSD), removable memory card, optical storage, or flash memory device.In alternative embodiments, storage 630 may be replaced by a storage area-network (SAN) device, cloud, or other device connected to computer 600 via I / O device interface 610 or to network 650 via network interface 615.

[0059] In some embodiments, memory 625 stores instructions 660. However, in various embodiments, instructions 660 are stored partially in memory 625 and storage 630, respectively, or stored entirely in memory 625 or storage 630, or accessed over network 650 via network interface 615.

[0060] The instructions 660 may be computer readable and computer executable instructions for performing any part or all of the methods of Figures 3-4, implementing the functionality described in any part of Figures 1-2, or achieving the experimental results described in Figure 5, or combinations thereof. Although the instructions 660 are shown in memory 625, the instructions 660 may include program instructions executable by one or more CPUs 605 collectively stored across a number of computer readable storage media.

[0061] In various embodiments, the I / O device 612 includes an interface that can present information and receive input. For example, the I / O device 612 can present information to and receive input from a user interacting with the computer 600.

[0062] The computer 600 is connected to a network 650 via a network interface 615. The network 650 may include a physical network, a wireless network, a cellular network, or a different network.

[0063] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the subject matter presented herein is not limited to a cloud computing environment. Rather, embodiments of the invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0064] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computational resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) and for rapidly provisioning and releasing these resources with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0065] The features are as follows:

[0066] On-Demand Self-Service: Cloud customers can automatically provision server time, network storage, and other computing power as they need it, without any unilateral, human interaction with the service provider.

[0067] Broad network access: Capabilities are available over the network and can be accessed using standard mechanisms, facilitating use by heterogeneous thin-client or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0068] Resource Pool: The provider's computing resources are pooled and offered to multiple consumers using a multi-tenant model. Different physical and virtual resources are dynamically allocated and reallocated according to demand. There is a sense of location independence, consumers usually have no control or knowledge regarding the exact location of the resources offered, although at a higher level of abstraction they may be able to specify a location (e.g. country, state, or data center).

[0069] Rapid Elasticity: Capacity is provisioned quickly and elastically, in some cases automatically, so it can be quickly scaled out and quickly released to quickly scale in. Capacity available for provisioning often appears to the consumer as unlimited, available for purchase in any quantity at any time.

[0070] Metered Services: Cloud systems leverage metering to automatically control and optimize resource usage at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services utilized.

[0071] The service model is as follows:

[0072] SaaS (Software as a Service): The capability provided to the consumer is the use of the provider's applications running on a cloud infrastructure. Those applications can be accessed from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application functionality, except for the possibility of limited user-specific application configuration settings.

[0073] PaaS (Platform as a Service): The capability provided to a consumer is to deploy applications that the consumer creates or acquires, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of the application hosting environment.

[0074] Infrastructure as a Service (IaaS): The capability provided to a consumer is the provisioning of processing, storage, network, and other basic computing resources over which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, and deployed applications, and in some cases has limited control over selected network components (e.g., host firewalls).

[0075] The deployment model is as follows:

[0076] Private Cloud: This cloud infrastructure is operated solely for one organization. It can be managed by this organization or a third party and can exist on-premise or off-premise.

[0077] Community Cloud: This cloud infrastructure is shared by multiple organizations to support a specific community with shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It can be managed by these organizations or a third party and can reside on-premise or off-premise.

[0078] Public Cloud: This cloud infrastructure is available for use by general users or large industry organizations and is owned by an organization that sells cloud services.

[0079] Hybrid cloud: This cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique but are bound together by standardized or proprietary technologies that allow for the portability of data and applications (e.g., cloud bursting to balance the load between clouds).

[0080] A cloud computing environment is a service-oriented environment with an emphasis on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that contains a network of interconnected nodes.

[0081] 7, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers (e.g., a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N) can communicate. The nodes 10 may communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks (not shown), such as in a private cloud, community cloud, public cloud, or hybrid cloud, or combination thereof, as previously described herein. This allows the cloud computing environment 50 to provide an infrastructure, platform, and / or SaaS that does not require the cloud consumer to maintain resources on a local computing device. The types of computing devices 54A-N illustrated in FIG. 7 are intended as examples only, and it will be understood that the computing node 10 and cloud computing environment 50 may communicate with any type of computer-controlled device via any type of network and / or network-addressable connection (e.g., a connection using a web browser).

[0082] Referring now to Figure 8, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 7) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 8 are intended to be illustrative only and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0083] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, Reduced Instruction Set Computer (RISC) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and network components 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0084] The virtualization layer 70 provides an abstraction layer that can provide virtual entities such as virtual servers 71 , virtual storage 72 , virtual networks including virtual private networks 73 , virtual applications and operating systems 74 , and virtual clients 75 .

[0085] As an example, the management layer 80 may provide the following functions: Resource provisioning 81 provides dynamic procurement of computational and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking and billing or invoicing for the utilization of resources within the cloud computing environment. As an example, the resources may include application software licenses. Security provides identity verification of cloud users and tasks, as well as protection of data and other resources. User portal 83 provides access to the cloud computing environment to users and system administrators. Service level management 84 provides allocation and management of cloud computational resources to meet required service levels. Service level agreement (SLA) planning and execution 85 provides pre-provisioning and procurement of cloud computational resources in anticipation of upcoming demands and in accordance with SLAs.

[0086] The Workload Layer 90 shows examples of functions available in a cloud computing environment. Examples of workloads and functions provided by this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom education delivery 93, data analytics processing 94, transaction processing 95, and unbiased anomaly detection and localization 96.

[0087] The embodiments of the present invention may be a system, a method, or a computer program product, or a combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium including computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0088] A computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridges in a groove on which instructions are recorded, and any suitable combinations of these. As used herein, computer-readable storage media should not itself be construed as being ephemeral signals such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0089] The computer readable program instructions described herein can be downloaded from a computer readable storage medium to each computing device / processing device or to an external computer or storage device over a network (e.g., the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof) that can include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing device / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage on a computer readable storage medium within each computing device / processing device.

[0090] The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the invention, electronic circuitry including, for example, a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), can execute computer readable program instructions to customize the electronic circuitry by utilizing state information of the computer readable program instructions.

[0091] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks included in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0092] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / operations specified in the blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium and capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions for performing aspects of the functions / operations specified in the blocks of the flowcharts and / or block diagrams.

[0093] Computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in the blocks of the flowcharts and / or block diagrams, thereby causing a series of operable steps to be performed on the computer, other programmable apparatus, or other device to generate a computer-implemented process.

[0094] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or subset of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions shown in the blocks may occur in a different order than that shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously or in reverse order, depending on the functionality involved. It is also noted that each block in the block diagrams and / or flowchart illustrations, as well as combinations of blocks included in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0095] Although it will be appreciated that the process software (e.g., any of the instructions stored in instructions 660 of FIG. 6 and / or any software configured to perform any portion of the method described with respect to FIGS. 3-4 or implement any portion of the functionality described in FIGS. 1-2) can be deployed by manually loading it directly into the client, server, and proxy computers via loading a storage medium such as a CD, DVD, or the like, the process software can also be automatically or semi-automatically deployed to the computer systems by sending the process software to a central server or group of central servers. The process software is then downloaded to the client computers that will execute the process software. Alternatively, the process software is sent directly to the client systems via email. The process software is then isolated into a directory or loaded into the directory by executing a set of program instructions that isolates the process software into a directory. Another alternative is to send the process software directly into a directory on the hard drive of the client computer. If a proxy server is present, the process selects the proxy server code, determines the computer on which to place the proxy server code, transmits the proxy server code, and then installs the proxy server code on the proxy computer. The process software is transmitted to the proxy server and then stored on the proxy server.

[0096] Embodiments of the invention may also be delivered as part of a service agreement with a client company, non-profit organization, government agency, internal organizational structure, etc. These embodiments may include configuring a computer system to execute software, hardware, and web services that implement some or all of the methods described herein, and deploying such software, hardware, and web services. These embodiments may also include analyzing client behavior, making recommendations in response to the analysis, building a system that implements a subset of the recommendations, integrating the system into existing processes and infrastructure, metering usage of the system, allocating costs to users of the system, and billing, invoicing (e.g., generating invoices), or otherwise receiving payment for use of the system.

[0097] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the various embodiments. As used herein, the singular forms "a", "an" and "the" are intended to include the plural unless the context expressly indicates otherwise. It will be further understood that the terms "comprise" and / or "comprising", when used herein, indicate the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof. In the preceding detailed description of exemplary embodiments of the various embodiments, reference is made to the accompanying drawings, which form a part hereof (where like numbers represent like elements), in which specific example embodiments are shown by way of example and in which the various embodiments may be practiced. These embodiments have been described in sufficient detail to enable one skilled in the art to practice the embodiments, but other embodiments may be used and logical, mechanical, electrical and other changes may be made without departing from the scope of the various embodiments. In the preceding description, many specific details have been set forth to enable a thorough understanding of the various embodiments. However, various embodiments may be practiced without these specific details. In other instances, well-known circuits, structures and techniques have not been shown in detail so as not to obscure the embodiments.

[0098] Different instances of the term "embodiment" as used within this specification do not necessarily refer to the same embodiment, but may refer to the same embodiment. All data and data structures shown or described herein are merely examples, and in other embodiments, different amounts of data, types of data, fields, numbers and types of fields, field names, numbers and types of rows, records, entries, or organization of data may be used. In addition, any data may be combined with logic such that separate data structures may not be necessary. Thus, the preceding detailed description should not be taken in a limiting sense.

[0099] The description of various embodiments of the present disclosure is presented for illustrative purposes, but is not intended to be exhaustive and is not limited to the disclosed embodiments. Many changes and modifications that do not depart from the scope of the described embodiments will be apparent to those skilled in the art. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements beyond the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

[0100] While the present disclosure has been described with respect to specific embodiments, it is anticipated that alterations and modifications thereto will become apparent to those skilled in the art, and it is therefore intended that the following claims be interpreted to cover all such alterations and modifications as falling within the true scope of the present disclosure.

[0101] All advantages described in this disclosure are exemplary advantages, and there may be embodiments of the disclosure that achieve all, some, or none of the described advantages while remaining within the scope of the disclosure.

[0102] In the following, a non-limiting list of examples is provided to illustrate some aspects of the disclosure. Example 1 is a system. The system includes a vehicle, a plurality of sensors that collect observed vehicle data, a drive recorder configured to aggregate and store the observed vehicle data, and an anomaly detection system communicatively coupled to the drive recorder, the anomaly detection system includes a probability distribution of past vehicle data, parameters of the probability distribution are adjusted to reduce a function below a threshold, the function is based on the probability distribution conditioned on the past vehicle data and at least one regularization term configured to generate an output similar to the probability distribution of an input having similar fair characteristics and independent of unfair characteristics, and the anomaly detection system further includes an anomaly score and an anomaly location score based on the probability distribution, the parameters, and the observed vehicle data.

[0103] Example 2 includes the system of example 1, including or excluding optional features, in which the at least one regularization term includes a first regularization term configured to generate similar anomaly scores for inputs including similar fair features and dissimilar unfair features, and a second regularization term configured to generate similar anomaly localization scores for inputs including similar fair features and dissimilar unfair features.

[0104] Example 3 includes the system of any one of examples 1-2, including or excluding optional features, in which the probability distribution is a Gaussian distribution and the parameters include a mean vector and a precision matrix.

[0105] Example 4 includes the system of any one of examples 1-3, including or excluding optional features, in which reducing the function below the threshold is performed using stochastic gradient descent (SGD).

[0106] Example 5 includes the system of any one of examples 1-4, including or excluding optional features. In this example, the anomaly detection system is configured to perform a method including performing a mitigation action based on the anomaly score and the anomaly localization score.

[0107] Example 6 is a computer-implemented method. The method includes training an anomaly detection system configured to generate an anomaly score and an anomaly location score for vehicle data, where the anomaly detection system is trained using a first regularization term and a second regularization term to generate similar anomaly scores and anomaly location scores for past vehicle data that have similar fair characteristics and are independent of unfair characteristics, receiving, at the anomaly detection system, new vehicle data from a drive recorder that collects data from a plurality of sensors on the vehicle, generating a first anomaly score and a first anomaly location score associated with the new vehicle data, and performing a mitigation action based on the first anomaly score and the first anomaly location score, where the mitigation action modifies the vehicle.

[0108] Example 7 includes the method of example 6, including or excluding optional features. In this example, training the anomaly detection system further includes generating a Gaussian probability distribution of the historical vehicle data and learning a mean vector and a precision matrix that reduce a function below a threshold, the function being based on a negative log-likelihood of the Gaussian probability distribution given the historical vehicle data, an L1 regularization term of the precision matrix, a first regularization term, and a second regularization term. Optionally, the first anomaly score and the first anomaly localization score are based on the new vehicle data, the Gaussian probability distribution, the mean vector, and the precision matrix.

[0109] Example 8 is a computer-implemented method. The method includes generating an anomaly detection model based on a Gaussian distribution of past data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, where the mean vector and precision matrix are generated by reducing a function below a threshold, the function including the Gaussian distribution, a first regularization term configured to generate similar anomaly scores for inputs having similar fair characteristics and independent of unfair characteristics, and a second regularization term configured to generate similar anomaly location scores for inputs having similar fair characteristics and independent of unfair characteristics, inputting new data into the anomaly detection model, and generating anomaly scores and anomaly location scores associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

[0110] Example 9 includes the method of example 8, including or excluding optional features, in which the anomaly score indicates the presence of an anomaly and the anomaly localization score indicates a source of the anomaly.

[0111] Example 10 includes the method of any one of examples 8-9, including or excluding optional features. In this example, the function is reduced using stochastic gradient descent (SGD).

[0112] Example 11 includes the method of any one of examples 8-10, including or excluding the optional feature, in which the anomaly score is the negative log-likelihood of new data according to a Gaussian distribution of the historical data, a mean vector, and a precision matrix.

[0113] Example 12 includes the method of any one of examples 8-11, including or excluding optional features, in which the anomaly localization score is the negative conditional log-likelihood of a feature of the new data conditioned on other features of the new data according to a Gaussian distribution of the historical data, a mean vector, and a precision matrix.

[0114] Example 13 includes the method of any one of examples 8-12, including or excluding optional features. In this example, the anomaly detection model is generated using unsupervised learning, and the historical data is unlabeled training data.

[0115] Example 14 includes the method of any one of examples 8-13, including or excluding optional features. In this example, the method includes performing mitigation actions based on the anomaly score and the anomaly localization score. Optionally, the mitigation actions include changes to a device associated with the new data.

[0116] Example 15 includes the method of any one of examples 8-14, including or excluding optional features. In this example, the method is performed by one or more computers in accordance with software downloaded to the one or more computers from a remote data processing system. Optionally, the method further includes metering usage of the software and generating an invoice based on the metering of usage.

[0117] Example 16 is a system. The system includes one or more processors and one or more computer-readable storage media storing program instructions, the program instructions being configured to, when executed by the one or more processors, cause the one or more processors to perform a method according to any one of Examples 6 to 15.

[0118] Example 17 is a computer program product. The computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including instructions configured to cause one or more processors to perform a method according to any one of Examples 6 to 15.

Claims

1. vehicle, A plurality of sensors for collecting observed vehicle data; a drive recorder configured to aggregate and store the observed vehicle data; and 11. The system comprising: an anomaly detection system communicatively coupled to the drive recorder, the anomaly detection system comprising a probability distribution of historical vehicle data, parameters of the probability distribution being adjusted to reduce a function below a threshold, the function being based on the probability distribution conditional on the historical vehicle data and at least one regularization term configured to produce similar outputs of the probability distribution for inputs including fair features that are similar to the historical vehicle data and inputs including unfair features that are dissimilar, the anomaly detection system further comprising an anomaly score and an anomaly location score based on the probability distribution, the parameters, and the observed vehicle data.

2. 2. The system of claim 1 , wherein the at least one regularization term comprises: a first regularization term configured to generate similar anomaly scores for the inputs including the unfair features that are dissimilar to inputs including fair features that are similar to the historical vehicle data; and a second regularization term configured to generate similar anomaly localization scores for the inputs including the unfair features that are dissimilar to inputs including fair features that are similar to the historical vehicle data.

3. The system of claim 1 or claim 2, wherein the probability distribution is a Gaussian distribution and the parameters include a mean vector and a precision matrix.

4. The system of claim 1 , wherein reducing the function below the threshold is performed using Stochastic Gradient Descent (SGD).

5. The system of claim 1 , wherein the anomaly detection system is configured to perform mitigation actions based on the anomaly score and the anomaly localization score.

6. training an anomaly detection system configured to generate anomaly scores and anomaly location scores for vehicle data, the anomaly detection system being trained using a first regularization term and a second regularization term to generate similar anomaly scores and anomaly location scores for inputs that include fair features similar to the historical vehicle data and historical vehicle data that include unfair features that are dissimilar to the historical vehicle data; receiving new vehicle data from a drive recorder that collects data from a plurality of sensors on a vehicle, in the anomaly detection system; generating a first anomaly score and a first anomaly location score associated with the new vehicle data; and performing a mitigation action based on the first anomaly score and the first anomaly location score, the mitigation action modifying a device or system of the vehicle.

7. training the anomaly detection system, generating a Gaussian probability distribution of the historical vehicle data; and learning a mean vector and a precision matrix that reduces a function below a threshold, the function being based on a negative log-likelihood of the Gaussian probability distribution given the historical vehicle data, an L1 regularization term of the precision matrix, the first regularization term, and the second regularization term.

8. 8. The computer-implemented method of claim 7, wherein the first anomaly score and the first anomaly location score are based on the new vehicle data, the Gaussian probability distribution, the mean vector, and the precision matrix.

9. generating an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, the mean vector and the precision matrix being generated by reducing a function below a threshold, the function including the Gaussian distribution of the historical data, a first regularization term configured to generate similar anomaly scores for inputs including unfair features that are dissimilar to inputs including fair features that are similar to the historical data, and a second regularization term configured to generate similar anomaly localization scores for the inputs including the unfair features that are dissimilar to inputs including the similar fair features; inputting new data into the anomaly detection model; generating an anomaly score and an anomaly localization score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

10. 10. The computer-implemented method of claim 9, wherein the anomaly score indicates a presence of an anomaly and the anomaly localization score indicates a source of the anomaly.

11. 11. The computer-implemented method of claim 9 or claim 10, wherein the function is reduced using Stochastic Gradient Descent (SGD).

12. 12. The computer-implemented method of claim 9, wherein the anomaly score is the negative log-likelihood of the new data according to the Gaussian distribution of the past data, the mean vector, and the precision matrix.

13. 10. The computer-implemented method of claim 9, wherein the anomaly localization score is the negative conditional log-likelihood of features of the new data according to the Gaussian distribution of the past data, the mean vector, and the precision matrix.

14. 10. The computer-implemented method of claim 9, wherein the anomaly detection model is generated using unsupervised learning, and the historical data comprises unlabeled training data.

15. The computer-implemented method of claim 9 , further comprising performing mitigation actions based on the anomaly score and the anomaly localization score.

16. The computer-implemented method of claim 15 , wherein the mitigating action comprises a change to a device associated with the new data.

17. 10. The computer-implemented method of claim 9, wherein the method is performed by one or more computers in accordance with software downloaded to the one or more computers from a remote data processing system.

18. The method further comprising: Measuring usage of said software; 20. The computer-implemented method of claim 17, further comprising: generating an invoice based on the measurement of usage.

19. one or more processors; and one or more computer-readable storage media storing program instructions, the program instructions, when executed by the one or more processors, causing the one or more processors to: generating an anomaly detection model based on a Gaussian distribution of historical data, a mean vector of the Gaussian distribution, and a precision matrix of the Gaussian distribution, the mean vector and the precision matrix being generated by reducing a function below a threshold, the function including the Gaussian distribution of the historical data, a first regularization term configured to generate similar anomaly scores for inputs including unfair features that are dissimilar to inputs including fair features that are similar to the historical data, and a second regularization term configured to generate similar anomaly localization scores for the inputs including the unfair features that are dissimilar to inputs including the similar fair features; inputting new data into the anomaly detection model; generating an anomaly score and an anomaly localization score associated with the new data based on the Gaussian distribution, the mean vector, and the precision matrix.

20. 20. The system of claim 19, wherein the function is reduced using stochastic gradient descent (SGD).

21. 20. The system of claim 19, wherein the anomaly score is the negative log-likelihood of the new data according to the Gaussian distribution of the past data, the mean vector, and the precision matrix.

22. 20. The system of claim 19, wherein the anomaly localization score is the negative conditional log-likelihood of features of the new data according to the Gaussian distribution of the historical data, the mean vector, and the precision matrix.

23. A computer program product causing a computer to carry out a method according to any one of claims 6 to 18.

24. 24. A computer readable storage medium having the computer program of claim 23 stored thereon.

Images