RNN Activation Divergence for Time-Event Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection frameworks struggle with large-scale data center systems due to the intermixing of messages from various software components and the assumption that anomalies have distinct feature-level signatures, which is not always valid, making it difficult to detect system malfunctions effectively.
Innovation Solution
Anomaly detection in neural networks is achieved by extracting on-the-fly node activations from recurrent neural networks (RNNs) and calculating maximum nonparametric divergence from known activations, identifying subsets of nodes contributing to divergence, and determining responsible data sources or sensors using non-parametric scan statistics and priority functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used for complex systems, then system monitoring can be performed, but the complexity of code, dependencies interactions, and sensor data increases the difficulty of detecting anomalies
Solution Approach 1:
The patent segments the complex system into multiple independent data sources and sensors, processing each through separate RNN models. This segmentation allows the system to handle complexity by dividing it into manageable units, where each unit can be analyzed independently before aggregating results for overall anomaly detection.
Solution Approach 2:
The patent introduces RNN models as intermediary components between raw sensor data and anomaly detection. These RNN models act as mediators that process and transform complex sensor data into meaningful representations, making anomaly detection more effective despite the underlying system complexity.
2Reliability
If more data sources and sensors are added to monitor complex systems, then monitoring coverage improves, but the volume and complexity of data to process increases
Solution Approach 1:
The patent segments data processing by assigning separate RNN models to different data sources and sensors. This segmentation enables parallel processing of multiple data streams, managing data volume through distributed computation while maintaining comprehensive monitoring coverage across all data sources.
3Speed
If the system processes data in real-time from multiple data sources, then anomaly detection timeliness improves, but computational resources and processing complexity increase
Solution Approach 1:
The patent segments the processing task across multiple independent RNN models that operate simultaneously on different data sources. This segmentation enables real-time processing by distributing computational workload, improving detection speed while managing processing complexity through parallelization.
Solution Approach 2:
The patent implements continuous anomaly detection by continuously processing data streams through the RNN models without interruption. This continuous processing maintains system responsiveness and detection timeliness while the modular architecture keeps processing complexity manageable through consistent, predictable computation patterns.
Data Source
AI summary
Anomaly detection in neural networks is provided. The method comprises extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors. The method references known node activations of the RNN produced by normal sequences of event data, and for each layer of the RNN, calculates a maximum nonparametric divergence of the on-the-fly node activations from the known node activations. For each layer of the RNN, the method determines a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window and identifies data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.