Adaptive Anomaly Detection Using Dynamic Consecutive Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems face a tradeoff between early detection of anomalies and preventing erroneous detection, as uniform threshold settings lead to either missed anomalies or increased false alarms, especially in large or complex systems.
Innovation Solution
An anomaly detection apparatus that adjusts the second threshold based on feature quantities representing changes in measured values over time, using a second function that dynamically sets the threshold according to the frequency distribution of these quantities, thereby minimizing mis-detection while ensuring timely anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If uniform small thresholds are set for the number of consecutive times, then anomalies can be detected early, but erroneous detection increases in number
Solution Approach 1:
The patent applies dynamics by making the threshold value changeable over time based on the operational state of the monitored system. Instead of using a fixed uniform threshold, the system dynamically adjusts the threshold for the number of consecutive times according to the current operational context, allowing early anomaly detection when appropriate while reducing erroneous detections during normal operational variations.
Solution Approach 2:
The patent implements parameter changes by modifying the threshold parameter based on the operational state of the system. The threshold for consecutive deviations is adjusted according to different operational conditions, enabling the system to maintain high sensitivity for anomaly detection while adapting to normal variations in system behavior under different states.
2Reliability
If uniform large thresholds are set for the number of consecutive times, then erroneous detection can be decreased in number, but anomalies cannot be detected early
Solution Approach 1:
The system dynamically adjusts the threshold based on operational state, using higher thresholds during states where normal variations are expected and lower thresholds during states where anomalies should be detected immediately. This resolves the contradiction by making the threshold adaptive rather than uniformly large.
Solution Approach 2:
The patent applies local quality by setting different threshold values for different operational states or different monitoring points. Instead of a single uniform large threshold, the system implements localized threshold values tailored to specific operational contexts, allowing early detection where needed while maintaining reliability where normal variations occur.
3Productivity
If a limited number of people monitor sensors in large or complex systems, then monitoring cost is reduced, but it becomes difficult to monitor all sensors simultaneously
Solution Approach 1:
The patent implements self-service by enabling the monitoring system to automatically detect and identify anomalies without requiring continuous human intervention. The system autonomously analyzes sensor data, applies threshold-based detection, and generates alerts, allowing limited personnel to effectively monitor large numbers of sensors by focusing only on flagged anomalies rather than manually reviewing all sensor readings.
Solution Approach 2:
The patent introduces an automated anomaly detection system as an intermediary between the sensors and human operators. This intermediary automatically processes sensor data, applies detection algorithms, and filters information before presenting it to monitors, enabling a small number of people to effectively oversee large complex systems by receiving only relevant anomaly information.
Data Source
AI summary
According to one embodiment, an anomaly detection apparatus includes a processing circuit. The processing circuit is configured to: acquire measured values from sensors installed in a system, a first function, a first threshold, and a second function to output a second threshold; generate the predicted values based on the measured value and the first function; detect that a deviation between the measured values and the predicted values exceeds the first threshold; calculate the feature quantities based on the measured values; and determine whether a number of consecutive times is equal to or larger than the second threshold to detect an anomaly or a sign of the anomaly.