Anomaly detection on dynamic sensor data
Methods and systems for anomaly detection include determining whether a system is in a stable state or a dynamic state based on input data from one or more sensors in the system, using reconstruction errors from a respective stable model and dynamic model. It is determined that the input data represents anomalous operation of the system, responsive to a determination that the system is in a stable state, using the reconstruction errors. A corrective operation is performed on the system responsive to a determination that the input data represents anomalous operation of the system.
1 . A method for anomaly detection, comprising:
determining whether a system is in a stable state or a dynamic state based on input data from one or more sensors in the system, using reconstruction errors from a respective stable autoencoder model and dynamic autoencoder model;
determining that the input data represents anomalous operation of the system with a hardware processor, responsive to a determination that the system is in a stable state; and
operating the system by performing a corrective action responsive to a determination that the input data represents anomalous operation of the system, wherein the corrective action is selected from the group consisting of halting and/or restarting an application, halting and/or rebooting a hardware component, and changing a network interface's status or settings.
2 . The method of claim 1 , wherein the stable model and the dynamic model are both trained on data that represents normal operation of the system.
3 . The method of claim 1 , wherein determining whether the system is in a stable state or a dynamic state further includes calculating a mode score based on the reconstruction scores from the stable model and the dynamic model.
4 . The method of claim 3 , further comprising determining a stable anomaly score and a dynamic anomaly score using the respective reconstructive errors from the stable model and the dynamic model.
5 . The method of claim 4 , wherein determining that the input data represents anomalous operation of the system includes determining a mode score as a ratio of the stable anomaly score to the dynamic anomaly score.
6 . The method of claim 1 , wherein determining that the input data represents anomalous operation of the system includes calculating an anomaly score from the reconstruction score of the stable model and comparing the anomaly score to a predetermined threshold value.
7 . The method of claim 1 , wherein determining the mode score includes comparing the reconstruction errors from the respective stable model and dynamic model to respective training reconstruction errors for the stable model and the dynamic model.
8 . The method of claim 1 , wherein the trained stable model and the trained dynamic model are each implemented as respective long-short term (LSTM) autoencoder neural network models.
9 . A system for anomaly detection, comprising:
a hardware processor; and
a memory that stores a computer program which, when executed by the hardware processor, causes the hardware processor to:
determine whether a system is in a stable state or a dynamic state based on input data from one or more sensors in the system, using reconstruction errors from a respective stable autoencoder model and dynamic autoencoder model;
determine that the input data represents anomalous operation of the system, responsive to a determination that the system is in a stable state; and
operate the system by performing a corrective action responsive to a determination that the input data represents anomalous operation of the system, wherein the corrective action is selected from the group consisting of halting and/or restarting an application, halting and/or rebooting a hardware component, and changing a network interface's status or settings.
10 . The system of claim 9 , wherein the stable model and the dynamic model are both trained on data that represents normal operation of the system.
11 . The system of claim 9 , wherein the computer program further causes the hardware processor to calculate a mode score based on the reconstruction scores from the stable model and the dynamic model.
12 . The system of claim 11 , wherein the computer program further causes the hardware processor to determine a stable anomaly score and a dynamic anomaly score using the respective reconstructive errors from the stable model and the dynamic model.
13 . The system of claim 12 , wherein the computer program further causes the hardware processor to determine a mode score as a ratio of the stable anomaly score to the dynamic anomaly score.
14 . The system of claim 12 , wherein the computer program further causes the hardware processor to calculate an anomaly score from the reconstruction score of the stable model and to compare the anomaly score to a predetermined threshold value.
15 . The system of claim 9 , wherein the computer program further causes the hardware processor to compare the reconstruction errors from the respective stable model and dynamic model to respective training reconstruction errors for the stable model and the dynamic model.
16 . The system of claim 9 , wherein the trained stable model and the trained dynamic model are each implemented as respective long-short term (LSTM) autoencoder neural network models.