Joint autoencoder of metrics and logs for anomaly detection in health management decision-making

Abstract

A method and system for anomaly detection includes encoding (206) a time series with a time series encoder and encoding (206) an event sequence with an event sequence encoder. A latent code is generated (208) from the outputs of the time series encoder and the event sequence encoder. The time series is reconstructed (210) from the latent code using a time series decoder. An event sequence is reconstructed (212) from the latent code using an event sequence decoder. An anomaly score (218) is determined based on a reconstruction error of the reconstructed time series and a reconstruction error of the reconstructed event sequence. An action is taken (510) responsive to the anomaly score.

Description

[Technical Field]

[0001] Related application information This application claims priority to U.S. Patent Application No. 63 / 450,986 filed on 9 March 2023, U.S. Patent Application No. 63 / 533,418 filed on 18 August 2023, and U.S. Patent Application No. 18 / 599,322 filed on 8 March 2024, which are incorporated herein by reference in their entirety. [Background technology]

[0002] The present invention relates to automatic anomaly detection, and more particularly to anomaly detection based on different information modes. Explanation of related technologies

[0003] Anomaly detection is useful for managing complex systems. Cyber-physical systems include various sensors that can collect a wide range of information about the system, its operation, and its environment. The collected data can be used to characterize the operating characteristics of the cyber-physical system, for example, to determine when the cyber-physical system may be operating outside the expected range of normal parameters. [Overview of the project]

[0004] The method for anomaly detection includes encoding a time series using a time series encoder and encoding an event sequence using an event sequence encoder. A latent code is generated from the outputs of the time series encoder and the event sequence encoder. The time series is reconstructed from the latent code using a time series decoder. The event sequence is reconstructed from the latent code using an event sequence decoder. An anomaly score is determined based on the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence. Actions are taken in response to the anomaly score.

[0005] The system for anomaly detection includes a hardware processor and memory for storing computer programs. When the computer program is executed by the hardware processor, it causes the hardware processor to encode a time series using a time series encoder, encode an event sequence using an event sequence encoder, generate a latent code from the outputs of the time series encoder and the event sequence encoder, reconstruct the time series from the latent code using a time series decoder, reconstruct the event sequence from the latent code using an event sequence decoder, determine an anomaly score based on the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence, and perform an action in response to the anomaly score.

[0006] These and other features and advantages will become apparent from the following detailed description of the exemplary embodiment, which will be read in conjunction with the attached drawings. [Brief explanation of the drawing]

[0007] This disclosure provides further details in the following description of preferred embodiments with reference to the following figures.

[0008] [Figure 1] This is a diagram illustrating the configuration of a cyber-physical system with anomaly detection across metric time-series and event sequence logs, according to one embodiment of the present invention.

[0009] [Figure 2] This is a block / flow diagram of a method / system for anomaly detection using a covariational autoencoder, according to one embodiment of the present invention.

[0010] [Figure 3] This is a block / flow diagram of a method for anomaly detection, including training and deployment of a covariance autoencoder, according to one embodiment of the present invention.

[0011] [Figure 4]FIG. 1 is a block / flow diagram of a method for training a joint variational autoencoder for anomaly detection, in accordance with an embodiment of the present invention.

[0012] [Figure 5] FIG. 2 is a block / flow diagram of a method for joint anomaly detection using metric time series and event sequence logs, in accordance with an embodiment of the present invention.

[0013] [Figure 6] FIG. 3 is a block diagram of a healthcare facility where joint anomaly detection is used to guide medical professionals and patient treatment, in accordance with an embodiment of the present invention.

[0014] [Figure 7] FIG. 4 is a block diagram of a computer apparatus for performing anomaly detection, in accordance with an embodiment of the present invention.

[0015] [Figure 8] FIG. 5 is a diagram of an exemplary neural network architecture that may be used as part of a variational autoencoder, in accordance with an embodiment of the present invention.

[0016] [Figure 9] FIG. 6 is a diagram of an exemplary deep neural network architecture that may be used as part of a variational autoencoder, in accordance with an embodiment of the present invention. [Detailed Description of the Invention]

[0017] Cyber-physical systems may include numerous sensors that monitor the system's operating status. Some of the information from the system may be collected as metrics in the form of multivariate time series, where measurements from sensors are taken periodically and can be tracked over time. Examples of metrics include performance and resource counters (such as processor usage, memory usage, and disk space) and hardware status (such as temperature and power consumption). Other information from the system may be collected as logs in the form of free-form text data with timestamps. Examples of logs include system logs and hardware logs.

[0018] Metrics and logs generated by specific systems may correlate. Therefore, a proper interpretation of the system's state may involve a joint analysis of both. Using both information modes can help avoid false alarms and improve the accuracy of anomaly detection.

[0019] For example, if a large application is launched, a period of relatively high processor usage is expected, but no such activity is recorded, this metric may be considered abnormal. In another example, a sudden burst of router events may be considered normal if it correlates with an increase in the number of users shown in network traffic metrics. If traffic metrics are normal, an event burst may suggest a hardware failure and be flagged as abnormal.

[0020] Therefore, time-series metrics are highly unstable and can be sensitive to the system's operating conditions. Machine learning models that utilize both time-series information of metrics and system event sequences can characterize their joint dynamic behavior under normal operating conditions and detect deviations from it. Transducers and attention mechanisms can effectively model the interaction of the two forms of time data, improving the sensitivity and robustness of anomaly detection and allowing for the explicit identification of the events or metrics causing the detected anomalies.

[0021] For this purpose, a co-variational autoencoder (VAE) model can be used, in which the metric time series and log event sequence are co-encoded into latent codes before being reconstructed using their respective decoders. Anomaly scores can be determined based on the decoder outputs, for example, by comparing the reconstructed information with the actual inputs. The encoder outputs can be combined by concatenation or a product-of-expert approach.

[0022] Here, we refer in detail to diagrams where similar numbers represent identical or similar elements, and first to Figure 1, which shows a maintenance system 106 in the context of the monitored system 102. The monitored system 102 can be any suitable system, including physical systems such as manufacturing lines and physical plant operations, electronic systems such as computers and other computerized devices, software systems such as operating systems and applications, and cyber-physical systems that combine physical systems with electronic and / or software systems. Exemplary systems 102 may include a wide variety of types, such as railway systems, power plants, vehicle sensors, data centers, satellites, and transportation systems. Another type of cyber-physical system could be a network of Internet of Things (IoT) devices, which may include a wide variety of different types of devices, each with various functions and sensor types.

[0023] One or more sensors 104 record information about the state of the monitored system 102. Sensors 104 can be any suitable type of sensor, including physical sensors such as temperature, humidity, vibration, pressure, voltage, current, magnetic field, electric field, and light sensors, and software sensors such as logging utilities installed on a computer system to record information about the state and operation of operating systems and applications running on the computer system. Sensor data may include, for example, numerical data, categorical data, and binary data. Sensor data can be stored as log information recording the occurrence of discrete events. The information generated by sensors 104 can be in any suitable format and may include sensor log information generated in heterogeneous formats.

[0024] Sensor 104 can transmit logged sensor information to the abnormal maintenance system 106 via any suitable communication medium and protocol, including wireless and wired communication. The maintenance system 106 can identify abnormalities or abnormal operation by, for example, monitoring the multivariate time series and logged information generated by sensor 104. When abnormal operation is detected, the maintenance system 106 communicates with the system control unit and corrects the abnormal operation by changing one or more parameters of the monitored system 102.

[0025] Exemplary corrective actions include changing the security settings of an application or hardware element, changing the operating parameters (e.g., operating speed) of an application or hardware element, stopping and / or restarting an application, stopping and / or restarting a hardware element, changing environmental conditions, or changing the state or settings of a network interface. This allows the maintenance system 106 to automatically correct or mitigate abnormal behavior. Identifying specific sensors 104 associated with the abnormal classification can reduce the time required to isolate the problem.

[0026] Each of the sensors 104 outputs a time series that encodes the measurements taken by the sensor over time, or the event log. For example, a time series contains pairs of information, each pair containing a measurement and a timestamp representing the time the measurement was taken. Each time series can be divided into segments that represent measurements taken by the sensor over a specific time range. Time series segments can represent any appropriate interval, such as one second, one minute, one hour, or one day. Time series segments may represent a set number of collections, such as 100 measurements, rather than a fixed period. Logs can be segmented over similar periods.

[0027] Therefore, the maintenance system 106 includes a model trained to process time-series data and log event categorical data. In the complex system 106, there are a very large number of sensors 104, and the sensors may report independent streams of time-series data. Therefore, the collaborative anomaly detection 108 combines information from both types of sensor data using a collaborative VAE.

[0028] Sensor 104 can collect information about the state of system 106, including information related to system control and operating modes. Sensor 104 may also collect information related to key metrics such as temperature, humidity, motion, and pressure to characterize the health of the system. Anomaly monitoring may be performed based on information from time-series sensors, but the values ​​of time-series sensors are affected by the system state indicated by the logs.

[0029] In addition to the cyber-physical system 102, the system may be related to patients in a healthcare environment. In such cases, the sensor 104 may monitor the patient's vital signs, and the event sequence may record individual health events such as seizures, treatment management, or other intermittent occurrences.

[0030] Referring to Figure 2, a machine learning model for collaborative anomaly detection is shown. This model accepts a multivariate time series 202 reflecting measured metrics from system 102 and an event sequence 204 representing event log information from system 102 as input. As described above, the time series includes measurements from one or more sensors 104 over a given period, and the event sequence 204 includes timestamped text entries reflecting events that occurred during the same period. The two inputs may be synchronized and divided into rolling windows, with each corresponding window being considered as a collaborative input.

[0031] Both inputs are provided as joint inputs to encoder 206, which includes a time-series encoder and an event-sequence encoder. These encoders have a stack of self-attention layers and mutual-attention layers that merge information between different timestamps of each sequence, and each transducer E met and E log It is sometimes implemented as follows: The shared time embedding layer can be trained using a time-to-vector conversion model to convert the timestamps of the event sequence into vectors.

[0032] In a metric encoder, the time series is processed by a one-dimensional convolutional layer, and the result of each timestamp is concatenated with the corresponding time embedding vector before being input to the converter. In an event sequence encoder, the event sequence is first parsed by a log parser, and all event messages are broken down into two parts: a template and parameters. For example, the message "ESMCommonService has transitioned to the stopped state" is transformed into the template "[*] has transitioned to the stopped state" with the parameter "ESMCommonService". Template type embedding layers and parameter embedding layers may be trained to transform template types and parameters into vectors, respectively.

[0033] The hidden state of the encoder in the most recent time step

number

number

number

number

[0034] The values ​​of μ and Σ are determined by concatenation or Product-of-Expert.

number

number

number

number

number

number

number

[0035] The latent code z208 is sampled from the distribution q(z|x,y) and represents the combined input in the latent space. This latent code 208 is then decoded by the time series decoder 210 and the event sequence decoder 212 and used as a condition for the time series decoder p(x|z) and the event sequence decoder p(y|z).

[0036] The time series decoder 210 attempts to generate an output that reconstructs the time series 202, and the metric reconstruction error 214 identifies the difference between the two. Similarly, the event sequence decoder 212 attempts to generate an output that reconstructs the event sequence 204, and the log reconstruction error 216 identifies the difference between the two. The time series decoder 210 can be implemented as a transformation model that outputs a multivariate time series, and the event sequence decoder 212 can be implemented as a transformation model that outputs a sequence of logit vectors. The softmax of each logit vector gives the probability of the type of event at that location.

[0037] Metric reconstruction error L met This is the input metric time series x and the reconstructed time series

number

number

number

[0038] The regularization error between the posterior distribution and the prior distribution p(z) can also be calculated as follows. L reg (x,y)=max(b,D KL (q(z|x,y),N(0,1))) Here, b is a user-specified hyperparameter that controls the deviation between the posterior distribution q and the prior Gaussian distribution N(0,1), and D KL is the Kullback-Leibler divergence.

[0039] The anomaly score 218 is determined for the period of the time series 202 and the event sequence 204 based on the metric reconstruction error 214 and the log reconstruction error 216. The anomaly score may be calculated as follows. Score(x,y)=L met (x,G met (μ))+αL log (y,G log (μ)) Here, μ=μ(x,y). G met is the time series decoder 210, and G log is the event sequence decoder. The hyperparameter α can be selected by the user using cross-validation to control the balance between the log reconstruction objective and the metrics reconstruction objective. The value τ represents the 99th percentile of these scores and can be used as a detection threshold. If the anomaly score is greater than τ, an anomaly is detected.

[0040] The encoder 206, time series decoder 210, and event sequence decoder 212 may be trained with a set of training data that reflects the normal operation of system 102. The models are trained to optimize the sum of weighted reconstruction errors. If the anomaly score is higher than a threshold, an anomaly is detected, and a ranked list of metrics and events that are potential causes of the anomaly is generated.

[0041] Next, referring to Figure 3, a method for training and using a joint VAE model for anomaly detection is shown. Block 302 trains the model using training data that represents the normal operation of system 102. This training data includes both event sequence data and time series data collected simultaneously from system 102. The trained model is then deployed (304) and implemented in the maintenance system 106. When new data is collected from sensor 104, the trained model is used to identify anomalies in the operation of system 102.

[0042] Next, referring to Figure 4, further details of training the anomaly detection model 302 are shown. Given a training dataset of synchronized metric time series and event logs, each input can be segmented using overlapping rolling windows of a fixed time length. Block 402 samples event messages from the event sequence input and identifies the event type as an integer value from each log message. For each event in the sequence, a template type embedding vector, a parameter embedding vector, and a time embedding vector can be concatenated for use as input to the encoder.

[0043] Block 404 samples batches from the input stream, for example, to identify a time window and obtain events and time-series measurements occurring within that time window. Encoder 206 can encode different inputs in block 406, generate their respective latent codes, and combine them. Block 408 then uses the time-series decoder 210 and the event-sequence decoder 212 to reconstruct each input.

[0044] Block 410 is reconstruction error L met and L log The block 412 determines the regularization error L as described above. reg This is determined. Block 414 adjusts the autoencoder parameters according to these errors. Block 414 may also calculate the total error as a weighted average of the two reconstruction errors and the regularization error.

number

[0045] This process can be repeated until a termination condition is reached. For example, termination conditions may include exhaustion of available training data, a predetermined number of iterations, or convergence of parameters (e.g., the magnitude of continuous change falls below a threshold). A score is determined for each window of training data.

[0046] Next, referring to Figure 5, further details of the collaborative anomaly detection 306 are shown. Block 502 acquires new measurements from sensor 104 and logs, and collects, for example, all such measurements and events that occur within a given window time. Block 504 uses the trained encoder 206 and decoder 210 / 212 to generate anomaly scores 218 for the new measurements, for example using the model in Figure 2.

[0047] Block 506 compares the anomaly score to a threshold τ or another appropriate threshold. If Block 508 determines that the anomaly score is below the threshold, processing returns to Block 502 to obtain a new set of measurements. If the anomaly score is above the threshold, Block 510 begins executing actions in response to the detected anomaly, and at this point processing returns to Block 502 again.

[0048] A response action can be performed to correct or mitigate the effects of an anomaly. For example, in system 102 representing a factory, the response might be to stop production to prevent damage or a dangerous condition. In system 102 representing a computer system, the response might be to shut down a process or reduce the computational load to prevent overheating.

[0049] In a system 102 implemented in a healthcare setting, the sensor 104 may be related to monitoring the patient's health status. Therefore, the response action may relate to the automatic adjustment of the patient's treatment. For example, if an abnormality is detected during treatment, the response action may be to stop the treatment or intervene in another way.

[0050] Anomaly detection can involve identifying a ranked list of metrics and events that are potential causes of the detected anomaly. To rank metrics, the reconstruction error of each metric can be averaged over time, and the metrics can be ranked in descending order of this averaged error. For event sequences, the probability of each ground truth event can be calculated according to a predicted logit, and events may be ranked from low probability to high probability. In any list, candidates closer to the top of the list are more likely to be the cause of the anomaly. Therefore, the response action can focus on actions related to the higher-ranked metrics and events. For example, if an anomaly is detected and the system temperature is ranked high, the automated response might be to adjust environmental conditions or the computational load.

[0051] Next, referring to Figure 6, a diagram of anomaly detection in the context of a healthcare facility 600 is shown. Anomaly detection can be used to determine when a patient's healthcare needs have changed, for example, in response to adverse health events or negative responses to treatment. Changes in treatment may be automatically initiated or administered to support the patient.

[0052] A healthcare facility may include one or more healthcare professionals 602 who provide information related to event and system status measurements for anomaly detection 608. The treatment system 604 may further be designed to monitor the patient's condition, generate a medical record 606, and automatically manage and adjust treatment as needed. In some cases, the medical record 606 may include a multivariate time series related to the patient's condition (e.g., heart rate, blood oxygen saturation, blood pressure). The medical record 606 may further include an event sequence relating to healthcare events, such as the administration of treatment or intermittently occurring healthcare events.

[0053] Based on information extracted from at least medical professionals 602, treatment systems 604, and medical records 606, the anomaly detection 608 identifies an abnormal health condition in the patient and identifies the metrics and / or events contributing to that anomaly. Information regarding the detected anomaly may be forwarded to medical professionals 602 to diagnose and treat the patient's condition.

[0054] Different elements of the healthcare facility 600 may communicate with each other via the network 610, for example, using any suitable wired or wireless communication protocol and medium. This allows the anomaly detection system 608 to access medical records 606 stored remotely, communicate with the treatment system 604, receive instructions, and send reports to healthcare professionals 602. In particular, the anomaly detection system 608 can automatically initiate changes to the patient's treatment in response to new information obtained from the medical records 606 by sending instructions to the treatment system 604. For example, the treatment system can automatically administer medication or stop treatment in response to a negative health event.

[0055] In some cases, the anomaly detection system 608 may initiate treatment for a patient in response to a specific event or metric ranked as likely to be a contributing factor to the anomaly. For example, if the anomaly is related to a patient's blood pressure measurement, the treatment system 604 may automatically adjust the blood pressure medication dosage. Thus, the output of the anomaly detection system 608 may include one or a combination of the above-described automated treatment and notification to the healthcare professional 602. In some cases, the treatment plan may be used by the healthcare professional to assist in decision-making for patient management. For example, upon being notified of a change in the patient's condition, the healthcare professional 602 may go to the patient's location to check on them.

[0056] Next, referring to Figure 7, an exemplary arithmetic unit 700 according to an embodiment of the present invention is shown. The arithmetic unit 700 is configured to perform anomaly detection.

[0057] The computing unit 700 may be embodied as any type of computing or computer device capable of performing the functions described herein, including but not limited to computers, servers, rack-based servers, blade servers, workstations, desktop computers, laptop computers, notebook computers, tablet computers, mobile computing units, wearable computing units, network appliances, web appliances, distributed computing systems, processor-based systems, and / or consumer electronic devices. Furthermore, or alternatively, the computing unit 700 may be embodied as one or more compute reads, memory reads, or other racks, reads, computing chassis, or other components of a physically isolated computing unit.

[0058] As shown in Figure 7, the arithmetic unit 700 exemplary includes a processor 710, an input / output subsystem 720, memory 730, a data storage device 740, and a communication subsystem 750, and / or other components and devices commonly found in a server or similar arithmetic unit. In other embodiments, the arithmetic unit 700 may include other or additional components (e.g., various input / output devices) commonly found in a server computer. Furthermore, in some embodiments, one or more exemplary components may be incorporated into another component or form part of another component. For example, memory 730, or part thereof, may be incorporated into the processor 710 in some embodiments.

[0059] The processor 710 can be embodied as any type of processor capable of performing the functions described herein. The processor 710 may be embodied as a single processor, a multiprocessor, a central processing unit (CPU), a graphics processing unit (GPU), a single or multicore processor, a digital signal processor, a microcontroller, or other processor or processing / control circuit.

[0060] Memory 730 may be embodied as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. During operation, memory 730 may store various data and software used during the operation of the arithmetic unit 700, such as operating systems, applications, programs, libraries, and drivers. Memory 730 may be communicatively coupled to the processor 710 via the I / O subsystem 720 and may be embodied as circuits and / or components to facilitate input / output operations with the processor 710, memory 730, and other components of the arithmetic unit 700. For example, the I / O subsystem 720 may be embodied as, or otherwise include, a memory controller hub, an input / output control hub, a platform controller hub, an integrated control circuit, a firmware device, communication links (e.g., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.) and / or other components and subsystems to facilitate input / output operations. In some embodiments, the I / O subsystem 720 may form part of a system-on-a-chip (SOC) and be integrated into a single integrated circuit chip together with other components of the processor 710, memory 730, and arithmetic unit 700.

[0061] The data storage device 740 can be embodied as any type of device or apparatus configured for short-term or long-term storage of data, such as a memory device and circuit, a memory card, a hard disk drive, a solid-state drive, or other data storage device. The data storage device 740 can store program code 740A for model training, program code 740B for anomaly detection, and / or program code 740C for performing corrective response actions to detected anomalies. The communication subsystem 750 of the arithmetic unit 700 can be embodied as any network interface controller or other communication circuit, apparatus, or assembly thereof that can enable communication between the arithmetic unit 700 and other remote devices over a network. The communication subsystem 750 can be configured to achieve such communication using any one or more communication technologies (e.g., wired or wireless) and associated protocols (e.g., Ethernet, InfiniBand®, Bluetooth®, Wi-Fi®, WiMAX®, etc.).

[0062] As shown in the figure, the arithmetic unit 700 may also include one or more peripheral devices 760. The peripheral devices 760 may include any number of additional input / output devices, interface devices, and / or other peripheral devices. For example, in some embodiments, the peripheral devices 760 may include a display, a touchscreen, a graphics circuit, a keyboard, a mouse, a speaker system, a microphone, a network interface, and / or other input / output devices, interface devices, and / or peripheral devices.

[0063] Of course, the arithmetic unit 700 may include other elements (not shown) and may omit certain elements, as can be easily conceived by those skilled in the art. For example, various other sensors, input devices, and / or output devices may be included in the arithmetic unit 700, depending on specific implementations of the same, as can be easily understood by those skilled in the art. For example, various types of wireless and / or wired input and / or output devices may be used. Furthermore, processors, controllers, memory, etc., may be added to make it available in various configurations. These and other variations of the processing system 700 can be easily conceived by those skilled in the art, given the teachings of the invention provided herein.

[0064] Next, refer to Figures 8 and 9. Figures 8 and 9 show exemplary neural network architectures, such as the joint VAE800 and 900, which can be used to implement parts of this model. A neural network is a generalized system whose functionality and accuracy improve with exposure to additional empirical data. Neural networks are learned by exposure to empirical data. During training, the neural network remembers and adjusts multiple weights applied to the input empirical data. By applying the adjusted weights to the data, it can identify whether the data belongs to a specific predefined class from a set of classes, or output the probability that the input data belongs to each class.

[0065] The empirical data obtained from a series of examples (also called training data) is formatted as a string of values ​​and fed into the neural network. Each example is associated with a known result or output. Each column is represented as a pair (x,y), where x is the input data and y is the known output. The input data can be of various data types and may contain multiple different values. The network can have one input node for each value that makes up the example's input data, and each input value can be assigned a separate weight. The input data can be formatted as a vector, array, or string, for example, depending on the architecture of the neural network being built and trained.

[0066] A neural network "learns" by comparing the neural network output generated from input data with known values ​​from examples, and adjusting the stored weights to minimize the difference between the output and the known values. This adjustment can be performed on the stored weights through backpropagation, and the effect of the weights on the output is determined by calculating a mathematical gradient and adjusting the weights in a way that shifts the output to the minimum difference. This optimization, called gradient descent, is a non-restrictive example of how training takes place. A subset of examples with known values ​​not used in training can be used to test and validate the accuracy of the neural network.

[0067] During operation, the trained neural network can be used on new data that has not been previously used for training or validation through generalization. The weights of the tuned neural network can be applied to the new data, and the weights estimate the function developed from the training examples. The parameters of the estimated function captured by the weights are based on statistical inference.

[0068] In a layered neural network, nodes are arranged in layers. An exemplary simple neural network has an input layer 820 with source nodes 822 and a single computation layer 830 with one or more computation nodes 832 that also function as output nodes, with one computation node 832 for each possible category into which the input example can be classified. The input layer 820 can have a number of source nodes 822 equal to the number of data values ​​812 of the input data 810. The data values ​​812 of the input data 810 can be represented as a column vector. Each computation node 832 in the computation layer 830 generates a linear combination of weighted values ​​from the input data 810 supplied to the input nodes 820 and applies a differentiable nonlinear activation function to the sum. The exemplary simple neural network can perform classification on linearly separable examples (e.g., patterns).

[0069] Deep neural networks, such as multilayer perceptrons, can have an input layer 820 with source nodes 822, one or more computation layers 830 with one or more computation nodes 832, and an output layer 840 with one output node 842 for each category into which the input example may be classified. The input layer 820 can have a number of source nodes 822 equal to the number of data values ​​812 of the input data 810. The computation nodes 832 of the computation layer 830 are located between the source nodes 822 and the output nodes 842 and are not directly observed, and are therefore also called hidden layers. Each node 832,842 of the computation layer generates a linear combination of weighted values ​​from the output values ​​of the nodes of the previous layer and applies a differentiable nonlinear activation function over the range of the linear combination. The weights applied to the values ​​from each previous node are, for example, w1, w2, ... w n-1 ,w n It can be represented as follows: The output layer provides the network's overall response to the input data. Deep neural networks can be fully connected, where each node in the computational layer is connected to all nodes in the previous layer, or the connections between layers can be in other configurations. If there are missing links between nodes, the network is said to be partially connected.

[0070] Training a deep neural network involves two phases: a forward phase in which the weights of each node are fixed and the input is propagated through the network, and a backward phase in which error values ​​are propagated back through the network and the weight values ​​are updated.

[0071] One or more computational (hidden) layers 830 compute nodes 832 perform a nonlinear transformation on the input data 812 that generates the feature space. Classes and categories may be easier to separate in the feature space than in the original data space.

[0072] The embodiments described herein may be entirely hardware, entirely software, or may include both hardware and software elements. In preferred embodiments, the present invention is implemented in software including, but not limited to, firmware, resident software, and microcode.

[0073] Embodiments may include computer program products accessible from computer-enabled or computer-readable media that provide program code for use by or in connection with a computer or any instruction execution system. Computer-enabled or computer-readable media may include any device that stores, communicates, propagates, or transports programs for use by or in connection with an instruction execution system, apparatus, or device. The medium may be magnetic, optical, electronic, electromagnetic, infrared, or semiconductor systems (or apparatus or devices), or propagation media. The medium may include computer-readable storage media such as semiconductor or solid-state memory, magnetic tape, removable computer diskettes, random-access memory (RAM), read-only memory (ROM), rigid magnetic disks, and optical disks.

[0074] Each computer program can be substantially stored in a machine-readable storage medium or device (e.g., program memory or magnetic disk) that is readable by a general-purpose or special-purpose programmable computer, in order to configure and control the operation of the computer when the storage medium or device is read by the computer in order to perform the procedures described herein. The system of the present invention can also be considered to be implemented on a computer-readable storage medium configured with a computer program, in which case the configured storage medium causes the computer to operate in a specific predetermined manner to perform the functions described herein.

[0075] A data processing system suitable for storing and / or executing program code may include at least one processor directly or indirectly coupled to a memory element via a system bus. The memory element may include local memory, bulk storage, and cache memory that provides at least some temporary storage for the program code to reduce the number of times the code is retrieved from bulk storage during execution. Input / output or I / O devices (including, but not limited to, keyboards, displays, pointing devices, etc.) may be coupled to the system directly or via an intermediary I / O controller.

[0076] Network adapters can also be integrated into a system to enable a data processing system to connect to other data processing systems or remote printers or storage devices via an intervening private or public network. Modems, cable modems, and Ethernet cards are just a few of the types of network adapters currently available.

[0077] As used herein, the terms “hardware processor subsystem” or “hardware processor” may refer to a processor, memory, software, or combination thereof that works together to perform one or more specific tasks. In useful embodiments, a hardware processor subsystem may include one or more data processing elements (e.g., logic circuits, processing circuits, instruction execution devices, etc.). One or more data processing elements may be included in a central processing unit, a graphics processing unit, and / or a separate processor- or arithmetic element-based controller (e.g., logic gates, etc.). A hardware processor subsystem may include one or more onboard memories (e.g., caches, dedicated memory arrays, read-only memory, etc.). In some embodiments, a hardware processor subsystem may include one or more memories (e.g., ROM, RAM, Basic Input / Output System (BIOS), etc.) that may be onboard or offboard, or that may be dedicated for use by the hardware processor subsystem.

[0078] In some embodiments, a hardware processor subsystem may include and execute one or more software elements. These software elements may include an operating system and / or one or more applications and / or specific code to achieve a specified result.

[0079] In other embodiments, the hardware processor subsystem may include dedicated circuits that perform one or more electronic processing functions to achieve a specified result. Such circuits may include one or more application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and / or programmable logic arrays (PLAs).

[0080] These and other variations of the hardware processor subsystem are also intended in accordance with embodiments of the present invention.

[0081] In this specification, any reference to “one embodiment” or “one embodiment” of the present invention, and to other modifications, means that certain features, structures, properties, etc., described in relation to the embodiments are included in at least one embodiment of the present invention. Therefore, expressions such as “in one embodiment” or “in one embodiment” appearing elsewhere in this specification, and any other modifications, do not necessarily all refer to the same embodiment. However, it should be understood that, considering the teachings of the present invention provided herein, features of one or more embodiments can be combined.

[0082] For example, in the case of "A / B," the use of any of the following " / ," "and / or," or "at least one," such as "A and / or B" or "at least one of A and B," will be understood as intended to include the selection of only the first listed option (A), only the second listed option (B), or both options (A and B). As further examples, in the case of "A, B, and / or C" and "at least one of A, B, and C," such expressions are intended to include the selection of only the first listed option (A), only the second listed option (B), only the third listed option (C), only the first and second listed options (A and B), only the first and third listed options (A and C), only the second and third listed options (B and C), or all three options (A, B, and C). This can be extended as many times as there are listed items.

[0083] The foregoing is to be understood in all respects to be illustrative and not restrictive, and the scope of the invention disclosed herein is to be determined not from the detailed description but from the claims as interpreted in accordance with the full width permitted by patent law. The embodiments shown and described herein are merely illustrative of the invention, and those skilled in the art should understand that various modifications can be implemented without departing from the scope and spirit of the invention. Those skilled in the art can implement various other combinations of features without departing from the scope and spirit of the invention. Thus, while aspects of the invention have been described with the detail and specificity required by patent law, what is claimed and intended to be protected by the patent is as stated in the appended claims.

Claims

1. A computer-implemented method for anomaly detection, Encoding the time series using a time series encoder (206), Encoding the event sequence using an event sequence encoder (206), (208) generating a latent code from the outputs of the time-series encoder and the event-sequence encoder, Using a time series decoder, the time series is reconstructed from the latent code (210), Reconstructing the event sequence from the latent code using an event sequence decoder (212), An anomaly score is determined based on the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence (218), Performing an action in response to the aforementioned abnormal score (510), A method that includes determining a ranked list of metrics and a ranked list of events.

2. In the method according to claim 1, A method for determining the ranked list of metrics includes averaging the reconstruction error of the reconstructed time series for each of the multiple metrics represented in the time series, and ranking the metrics in descending order.

3. In the method according to claim 1, A method for determining the aforementioned ranked list of events, comprising calculating the probability of a ground truth event according to a predicted logit and ranking the events from low probability to high probability.

4. In the method according to claim 1, A method by which the aforementioned action is directed towards one or more highly ranked metrics or events.

5. In the method according to claim 1, Determining the anomaly score is a method that includes a weighted sum of the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence.

6. In the method according to claim 1, A method further comprising determining whether the abnormality score exceeds a threshold indicating an abnormality in the patient's health status within a healthcare environment.

7. In the method according to claim 6, A method comprising a therapeutic action in accordance with the patient's health condition, wherein the action includes instructing a treatment system to automatically administer treatment to the patient.

8. In the method according to claim 1, A method for configuring a co-variational autoencoder comprising a time-series encoder, an event-sequence encoder, a time-series decoder, and an event-sequence decoder, including a machine learning model trained to reconstruct the input after transformation to a latent space.

9. In the method according to claim 1, A method for generating the latent code, comprising combining the outputs as a Product-of-Expert.

10. A system for detecting anomalies, Hardware processor (710), When executed by the aforementioned hardware processor, the hardware processor will The time series is encoded using a time series encoder (206), The event sequence is encoded using an event sequence encoder (206), A latent code is generated from the outputs of the time-series encoder and the event-sequence encoder (208), A time series decoder is used to reconstruct the time series from the latent code (210), Using an event sequence decoder, the event sequence is reconstructed from the latent code (212), Based on the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence, an anomaly score is determined (218). The system will perform an action in response to the abnormal score (510), A system comprising: memory (740) for storing a computer program that determines a ranked list of metrics and a ranked list of events.

11. In the system according to claim 10, The computer program further provides the hardware processor with: A system that averages the reconstruction error of the reconstructed time series for each of the multiple metrics represented by the aforementioned time series, and ranks the metrics in descending order.

12. In the system according to claim 10, The computer program further provides the hardware processor with: A system that calculates the probability of a ground truth event according to a predicted logit and ranks the event from low probability to high probability.

13. In the system according to claim 10, A system in which the aforementioned actions are directed towards one or more highly ranked metrics or events.

14. In the system according to claim 10, The computer program further provides the hardware processor with: A system for determining the weighted sum of the reconstruction error of the reconstructed time series and the reconstruction error of the reconstructed event sequence.

15. In the system according to claim 10, The computer program further provides the hardware processor with: A system that determines whether the aforementioned abnormality score exceeds a threshold indicating an abnormality in the patient's health condition within a health management environment.

16. In the system described in claim 15, A system that includes a treatment action in accordance with the patient's health condition, wherein the action includes an instruction to a treatment system for automatically administering treatment to the patient.

17. In the system according to claim 10, The time-series encoder, the event-sequence encoder, the time-series decoder, and the event-sequence decoder constitute a system of co-variational autoencoders including a machine learning model trained to reconstruct the input after transformation to latent space.

18. In the system according to claim 10, The computer program further provides the hardware processor with: A system that combines the aforementioned output as a Product-of-Expert of the latent code.

Images