Time series analysis using a shapelet learning method with area under the curve
A time series data analysis method, includes: generating a plurality of first feature vectors including feature amounts of a plurality of feature waveforms, based on distances from a plurality of first time series data sequences to the plurality of feature waveforms, the first time series data sequences belonging to a first class; generating a plurality of second feature vectors including feature amounts of the plurality of feature waveforms, based on distances from a plurality of second time series data sequences to the plurality of feature waveforms, the plurality of second time series data sequences belonging to a second class; and updating the plurality of feature waveforms, based on the plurality of first feature vectors, the plurality of second feature vectors, a performance indicator parameter related to a performance indicator for a classification model and a model parameter including weights on the plurality of feature waveforms.
1. A time series data analysis method, comprising:
outputting a graphical user interface (GUI) to receive input, from a user, a performance indicator parameter being a parameter for specifying a range of false positive rates in pAUC (partial Area Under the Curve), which is an indicator for evaluation of a support vector machine (SVM) model;
setting a value of the performance indicator parameter based on user input information that is input from the GUI;
performing a learning phase to simultaneously learn a model parameter of the SVM model and optimal feature waveforms, by:
performing, by processing circuitry, a first process that calculates, for each of a plurality of first time-series data sequences, which are time series-data sequences belonging to a normal class among a plurality of time-series data sequences detected by a sensor in a target-analysis device, distances to a plurality of feature waveforms given as initial waveforms, the initial waveforms being different from and shorter than the plurality of time-series data sequences, and generates a plurality of first feature vectors each including feature amounts of the plurality of feature waveforms based on the calculated distances, for the plurality of first time-series data sequences;
performing, by the processing circuitry, a second process that calculates, for each of a plurality of second time-series data, which are time series-data belonging to an anomalous class among the plurality of time-series data detected by the sensor, distances to the plurality of feature waveforms and generates a plurality of second feature vectors each including feature amounts of the plurality of feature waveforms based on the calculated distances, for the plurality of second time-series data sequences;
calculating, by the processing circuitry, a first number being a number of second feature vectors to be used in an update process among the generated second feature vectors, based on the value of the performance index parameter and based on a number of the plurality of second-time series data sequences belonging to the anomalous class, wherein the first number of second feature vectors is calculated as a largest integer that does not exceed a multiplied value obtained by multiplying an upper limit of the range of false positive rates specified by the performance indicator parameter and the number of the plurality of second time-series data sequences;
performing, by the processing circuitry, the update process that calculates a plurality of second scores representing values of a magnitude of probability that the target-analysis device belongs to the normal class based on the plurality of second feature vectors and the model parameter of the SVM model, the model parameter including initial values of weights of the plurality of feature waveforms, selects second feature vectors of the determined first number from the plurality of second feature vectors based on the plurality of second feature vectors, and updates the model parameter and the plurality of feature waveforms simultaneously based on the plurality of first feature vectors and the selected second feature vectors; and
iterating, by the processing circuitry, the first process, the second process, and the update process in sequence until a termination condition is satisfied, thereby obtaining the optimal feature waveforms as the finally updated plurality of feature waveforms, and the learned model parameter; and
performing a test phase using the optimal feature waveforms and the learned model parameter, by:
receiving, by communication circuitry, a test targeted time-series data sequence from the target-analysis device via a network, the test target time-series data being output by the sensor;
calculating, by prediction circuitry, distances between the received time-series data sequence and the optimal feature waveforms;
generating, by the prediction circuitry, a third feature vector including feature amounts of the optimal feature waveforms, based on the calculated distances; and
calculating, by the prediction circuitry, a score based on the third feature vector and the learned model parameter, and comparing the calculated score with a threshold value to predict a class of the test targeted time-series data as one of the normal class and the anomalous class, wherein the pAUC is maximized in the specified range of false positive rates specified by the user via the GUI when the threshold value corresponds to the upper limit of the specified range of false positive rates,
the GUI includes a screen that includes
an adjustment bar allowing the user to specify an upper limit of the range of the false positive rates as the range of false positive rates, a lower limit of the range of the false positive being zero or a predetermined value less than the upper limit, and
fields for the user to specify a number K of feature waveforms and a length L of the feature waveforms,
the method further comprises
obtaining, by the processing circuitry, the user input information including the range of false positive rates corresponding to a position of the adjustment bar adjusted by the user in the GUI to set the value of the performance indicator parameter based on the user input information, and
generating, by the processing circuitry, the initial waveforms of the number K specified by the user in the user interface, the initial waveforms having the length L specified by the user in the GUI, and
the method further comprises displaying, on a display, the calculated score, the predicted class, and the optimal feature waveforms in association with the test targeted time-series data sequence.
2. The method according to claim 1 , wherein
the updating process further comprises
calculating, for the plurality of first time-series data, a plurality of first scores relating to the magnitude of the probability of belonging to the normal class based on the plurality of first feature vectors and the model parameter,
calculating, for the plurality of second time-series data, a plurality of second scores relating to the magnitude of the probability of belonging to the normal class based on the plurality of second feature vectors and the model parameter,
identifying the determined first number of second feature vectors from among the plurality of second feature vectors in a descending order of the second scores,
generating an ordering matrix that one of rows or columns of a matrix is assigned to the determined first number of second feature vectors and the other of the row or columns is assigned to the first feature vectors, elements of the matrix are stored with 0 or 1 depending on a relationship between the second score of the second feature vector and the first score of the first feature vector, and a number of the columns or the rows to which the determined first number of second feature vectors is assigned is equal to the determined first number,
updating the model parameter based on the identified second feature vectors and the ordering matrix using a stochastic gradient method,
selecting a class from the normal class and the anomalous class at random or alternately or with equal probability,
in response to the normal class being selected, randomly selecting one first feature vector as a first target feature vector from the plurality of first feature vectors, and updating the plurality of feature waveforms based on the first target feature vector, the identified second feature vectors, and the ordering matrix, using the stochastic gradient method, and
in response to the anomalous class being selected, randomly selecting one second feature vector from the identified second feature vectors as a second target feature vector, and updating the plurality of feature waveforms based on the second target feature vector, the identified second feature vectors, and the ordering matrix, using the stochastic gradient method.
3. The method according to claim 2 , wherein the update process further comprises determining the ordering matrix by assigning the determined first number of second feature vectors to one of the columns or rows of the matrix so as to obtain a maximum value of an objective function, the objective function including the ordering matrix, the identified second feature vectors, and the model parameter, as input variables, and by calculating a value of each element of the matrix based on the assigned second feature vectors and the first feature vectors assigned the other of the columns or rows.
4. The method according to claim 1 , wherein the plurality of feature waveforms minimizes an objective function with L1 norm regularization related to the model parameter, the objective function including variables representing the weights representing the plurality of feature waveforms, to thereby update the weights, and
the method further comprises obtaining feature waveforms with a non-zero weight among the plurality of feature waveforms as the finally updated feature waveforms.
5. The method according to claim 1 , wherein the method further comprises:
extracting, by the processing circuitry, a plurality of partial waveforms of the length L from each of the plurality of time-series data sequences detected by the sensor,
generating K clusters by clustering the extracted partial waveforms, and
calculating K centroids of respective K clusters, wherein the calculated K centroids are the initial waveforms.
6. A time series data analysis apparatus, comprising:
a display configured to output a graphical user interface (GUI) to receive input, from a user, of a performance indicator parameter being a parameter for specifying a range of false positive rates in pAUC (partial Area Under the Curve), which is an indicator for evaluation of a support vector machine (SVM) model;
processing circuitry configured to
set a value of the performance indicator parameter based on user input information that is input from the GUI;
perform a learning place to simultaneously learn a model parameter of the SVM model and optimal feature waveforms, by:
performing a first process that calculates, for each of a plurality of first time-series data sequences, which are time series-data sequences belonging to a normal class among a plurality of time-series data sequences detected by a sensor in an target-analysis device, distances to a plurality of feature waveforms given as initial waveforms, the initial waveforms being different from and shorter than the plurality of time-series data sequences, and generates a plurality of first feature vectors each including feature amounts of the plurality of feature waveforms based on the distances, for the plurality of first time-series data sequences;
performing a second process that calculates, for each of a plurality of second time-series data, which are time series-data belonging to an anomalous class among the plurality of time-series data detected by the sensor, distances to the plurality of feature waveforms and generates a plurality of second feature vectors each including feature amounts of the plurality of feature waveforms based on the distances, for the plurality of second time-series data sequences; and
determining a first number being a number of second feature vectors to be used in an update process based on the value of the performance index parameter and based on a number of the plurality of second time-series data sequences belonging to the anomalous class, wherein the first number of second feature vectors is calculated as a largest integer that does not exceed a multiplied value obtained by multiplying an upper limit of the range of false positive rates specified by the performance indicator parameter and the number of the plurality of second time-series data sequences;
performing the update process that calculates a plurality of second scores representing values of a magnitude of probability that the target-analysis device belongs to the normal class based on the plurality of second feature vectors and the model parameter of the SVM model, the model parameter including initial values of weights of the plurality of feature waveforms, selects second feature vectors of the determined number from the plurality of second feature vectors based on the plurality of second feature vectors, and updates the model parameter and the plurality of feature waveforms simultaneously based on the plurality of first feature vectors and the selected second feature vectors; and
iterating the first process, the second process, and the update process in sequence until a termination condition is satisfied, thereby obtaining the optimal feature waveforms as the finally updated plurality of feature waveforms, and the learned model parameter;
communication circuitry configured to receive a test targeted time-series data sequence from the target-analysis device via a network, the test target time-series data being output by the sensor; and
prediction circuitry configured to perform a test phase using the optimal feature waveforms and the learned model parameter, by
calculating distances between the received time-series data sequence and the optimal feature waveforms;
generating a third feature vector including feature amounts of the optimal feature waveforms, based on the calculated distances; and
calculating a score based on the third feature vector and the learned model parameter, and compare the calculated score with a threshold value to predict a class of the test targeted time-series data as one of the normal class and the anomalous class, wherein the pAUC is maximized in the specified range of false positive rates specified by the user via the GUI when the threshold value corresponds to the upper limit of the specified range of false positive rates,
the GUI includes a screen that includes
an adjustment bar allowing the user to specify an upper limit of the range of the false positive rates as the range of false positive rates, a lower limit of the range of the false positive being zero or a predetermined value less than the upper limit, and
fields for the user to specify a number K of feature waveforms and a length L of the feature waveforms,
the processing circuitry is further configured to obtain the user input information including the range of false positive rates corresponding to a position of the adjustment bar adjusted by the user in the GUI to set the value of the performance indicator parameter based on the user input information,
the processing circuitry is further configured to generate the initial waveforms of the number K specified by the user in the user interface, the initial waveforms having the length L specified by the user in the GUI, and
the processing circuitry is further configured to control the display to display the calculated score, the predicted class, and the optimal feature waveforms in association with the test targeted time-series data sequence.
7. A non-transitory computer readable medium having a computer program stored therein which causes a computer executing the computer program to perform a method, comprising:
outputting a graphical user interface (GUI) to receive input, from a user, of a performance indicator parameter being a parameter for specifying a range of false positive rates in pAUC (partial Area Under the Curve), which is an indicator for evaluation of a support vector machine (SVM);
setting a value of the performance indicator parameter based on user input information which is input from the GUI;
performing a learning phase to simultaneously learn a model parameter of the SVM model and optimal feature waveforms, by:
performing a first process that calculates, for each of a plurality of first time-series data sequences, which are time series-data sequences belonging to a normal class among a plurality of time-series data sequences detected by a sensor in an target-analysis device, distances to a plurality of feature waveforms given as initial waveforms, the initial waveforms being different from and shorter than the plurality of time-series data sequences, and generates a plurality of first feature vectors each including feature amounts of the plurality of feature waveforms based on the distances, for the plurality of first time-series data sequences;
performing a second process that calculates, for each of a plurality of second time-series data, which are time series-data belonging to an anomalous class among the plurality of time-series data detected by the sensor, distances to the plurality of feature waveforms and generates a plurality of second feature vectors each including feature amounts of the plurality of feature waveforms based on the distances, for the plurality of second time-series data sequences;
determining a first number being a number of second feature vectors to be used in an update process based on the value of the performance index parameter and based on a number of the plurality of second time-series data belonging to the anomalous class, wherein the first number of second feature vectors is calculated as a largest integer that does not exceed a multiplied value obtained by multiplying an upper limit of the range of false positive rates specified by the performance indicator parameter and the number of the plurality of second time-series data sequences;
performing the update process that calculates a plurality of second scores representing values of a magnitude of probability that the target-analysis device belongs to the normal class based on the plurality of second feature vectors and the model parameter of the SVM model, the model parameter including initial values of weights of the plurality of feature waveforms, selects second feature vectors of the determined first number from the plurality of second feature vectors based on the plurality of second feature vectors, and updates the model parameter and the plurality of feature waveforms simultaneously based on the plurality of first feature vectors and the selected second feature vectors; and
iterating the first process, the second process, and the update process in sequence until a termination condition is satisfied, thereby obtaining the optimal feature waveforms as the finally updated plurality of feature waveforms and the learned model parameter; and
performing a test phase using the optimal feature waveforms and the learned model parameter, by;
receiving, by communication circuitry, a test targeted time-series data sequence from the target-analysis device via a network, the test target time-series data being output by the sensor;
calculating, by prediction circuitry, distances between the received time-series data sequence and the optimal feature waveforms;
generating, by the prediction circuitry, a third feature vector including feature amounts of the optimal feature waveforms, based on the calculated distances; and
calculating, by the prediction circuitry, a score based on the third feature vector and the learned model parameter, and comparing the calculated score with a threshold value to predict a class of the test targeted time-series data as one of the normal class and the anomalous class, wherein the pAUC is maximized in the specified range of false positive rates specified by the user via the GUI when the threshold value corresponds to the upper limit of the specified range of false positive rates,
the GUI includes a screen that includes
an adjustment bar allowing the user to specify an upper limit of the range of the false positive rates as the range of false positive rates, a lower limit of the range of the false positive being zero or a predetermined value less than the upper limit, and
fields for the user to specify a number K of feature waveforms and a length L of the feature waveforms,
the method further comprises
obtaining the user input information including the range of false positive rates corresponding to a position of the adjustment bar adjusted by the user in the GUI to set the value of the performance indicator parameter based on the user input information, and
generating, by the processing circuitry, the initial waveforms of the number K specified by the user in the GUI, the initial waveforms having the length L specified by the user in the user interface, and
the method further comprises displaying, on a display, the calculated score, the predicted class, and the optimal feature waveforms in association with the test targeted time-series data sequence.