Anomaly Detection System with Dynamic Threshold Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection methods struggle to accurately set thresholds due to deviations in prediction results during normal operation, leading to false information and increased operator load, especially when monitoring multiple targets.
Innovation Solution
An anomaly detection system that learns a predictive model and a window size estimation model to calculate an anomaly score based on cumulative error and likelihood, adjusting the window size to maintain consistent anomaly scores during normal operation, and determines anomalies by exceeding a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a threshold is set for anomaly detection based on prediction deviation, then anomaly detection capability is improved, but false detections increase due to normal operation deviations
Solution Approach 1:
The system performs preliminary learning of normal operation patterns before actual anomaly detection. By pre-training the predictive model with normal operational data and determining appropriate thresholds during this learning phase, the system establishes a baseline that distinguishes normal variations from actual anomalies, thereby reducing false detections while maintaining detection capability
Solution Approach 2:
The system uses feedback from the difference between predicted and actual values to continuously refine anomaly detection. The threshold is dynamically adjusted based on the distribution of prediction errors during normal operation, allowing the system to adapt to normal variations while still detecting true anomalies accurately
2Adaptability or versatility
If monitoring is performed on multiple target devices, then system coverage is improved, but operator load increases due to information overload
Solution Approach 1:
The system introduces an automated anomaly detection mechanism as an intermediary between multiple monitored devices and the operator. This intermediary automatically processes data from numerous devices, applies the predictive model, and only presents confirmed anomalies to the operator, thereby maintaining comprehensive monitoring coverage while significantly reducing operator information load
Solution Approach 2:
The system enables self-service anomaly detection where the automated model independently monitors multiple devices, identifies anomalies, and generates alerts without requiring continuous operator attention. The system serves itself by automatically managing the monitoring process across multiple targets, freeing operators from the burden of manually reviewing data from each device
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
An objective is to set an anomaly detection threshold easily and accurately. An anomaly detection system 1 includes an arithmetic device 1H101 that executes processing of learning a predictive model that predicts a behavior of a monitoring target device based on operational data on the device, processing of adjusting an anomaly score such that the anomaly score for operational data under normal operation falls within a predetermined range, the anomaly score being based on a deviation of the operational data acquired from the monitoring target device from a prediction result obtained by the predictive model, processing of detecting an anomaly or a sign of an anomaly based on the adjusted anomaly score, and processing of displaying information on at least one of the anomaly score and a result of the detection on an output device.