Series Anomaly Detection Using Reference Probability Distributions

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing anomaly detection methods fail to accurately identify anomalies in series data from generation mechanisms with changing states, as they often misinterpret normal state changes as outliers or change points.

Innovation Solution

An anomaly detection device and method that extract series feature amounts, calculate probability distributions, and determine state feature amounts relative to a reference probability distribution to accurately detect anomalies in series data from generation mechanisms with changing states.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If simple threshold-processing of dissimilarity is used for anomaly detection, then the detection process is simple and fast, but normal state changes are misidentified as anomalies reducing detection accuracy

Engineering Contradiction:
Improvedetection process simplicityVSAvoidanomaly detection accuracy
Core Design Contradiction:
Ease of operationVSMeasurement precision

Solution Approach 1:

The patent introduces a reference probability distribution as an intermediary between the input series data and the anomaly detection decision. This reference distribution, built from normal operation data, serves as a mediator that contextualizes the current state, allowing the system to distinguish between normal variations and true anomalies while maintaining a relatively simple detection process.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the detection approach by changing from direct threshold comparison of raw dissimilarity to comparing probability distributions. This parameter transformation allows the system to account for normal state changes by modeling their probabilistic nature, thereby improving detection accuracy without substantially increasing operational complexity.

Inventive Principle:
Principle #35Parameter changes

2Measurement precision

If statistical outlier detection is applied to series data from changing generation mechanisms, then change points can be detected, but normal state changes are falsely identified as anomalies

Engineering Contradiction:
Improvechange point detection capabilityVSAvoidanomaly detection reliability
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent performs preliminary action by constructing a reference probability distribution from normal operation data before conducting anomaly detection. This pre-established reference model captures the characteristics of normal state changes, enabling the detection system to reliably distinguish between normal variations and true anomalies when analyzing series data from changing generation mechanisms.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If the generation mechanism state constantly changes during normal operation, then the system adapts to varying conditions, but accurate anomaly detection becomes difficult

Engineering Contradiction:
Improvesystem adaptability to state changesVSAvoidanomaly detection precision
Core Design Contradiction:
Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent applies dynamics by using probability distributions to model the varying normal operation states. Instead of assuming a static normal state, the reference probability distribution captures the dynamic nature of normal operations, allowing the system to adapt to state changes while maintaining precise anomaly detection through probabilistic comparison.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentUS11397792B2Anomaly detecting device, anomaly detecting method, and recording medium
Publication Date: 2022.07.26 NEC CORP
  • US11397792B2 patent drawing
  • US11397792B2 patent drawing
  • US11397792B2 patent drawing

AI summary

An anomaly detecting device according to the present invention includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations includes: when first series data are input, extracting a series feature amount being a feature amount of a signal included in the first series data; calculating a series probability distribution being a probability distribution which the series feature amount follows; storing a reference probability distribution being a probability distribution designated as a reference for the series feature amount in the first series data; calculating a state feature amount representing a fluctuation condition of the series probability distribution with respect to the reference probability distribution; and detecting an anomaly of the first series data, based on a plurality of the state feature amounts calculated from the first series data.