Anomaly detection using metric time series and event sequences for medical decision making
Methods and systems for anomaly detection include encoding a multivariate time series and a multi-type event sequence using respective transformers and an aggregation network to generate a feature vector. Anomaly detection is performed using the feature vector to identify an anomaly within a system. A corrective action is performed responsive to the anomaly to correct or mitigate an effect of the anomaly. The detected anomaly can be used in a healthcare context to support decision making by medical professionals with respect to the treatment of a patient. The encoding may include machine learning models to implement the transformers and the aggregation network using deep learning.
1 . A computer-implemented method for anomaly detection, comprising:
encoding a multivariate time series and a multi-type event sequence using respective transformers and an aggregation network to generate a feature vector;
performing anomaly detection by determining an anomaly score with a support vector data description (SVDD) loss using the feature vector to identify an anomaly within a system, the SVDD lost being determined as:
ℒ
=
1
n
∑
i
=
1
n
ϕ
(
x
i
;
W
)
-
c
2
+
λ
2
W
F
2
where x i is the feature vector, n is a number of training values, ϕ is an encoder network including the transformers and aggregation network, W are neural network parameters, c is a hypersphere in feature space, and λ is a hyperparameter; and
performing a corrective action responsive to the anomaly to correct or mitigate an effect of the anomaly.
2 . The method of claim 1 , wherein performing anomaly detection uses support vector data description that includes a hypersphere radius term and a network parameter regularization term.
3 . The method of claim 2 , wherein the hypersphere radius term represents a radius of a hypersphere that encompasses input multivariate time series data in a feature space.
4 . The method of claim 1 , wherein the aggregation network includes a stack of self-attention layers that convert outputs of the respective transformers to the feature vector.
5 . The method of claim 1 , further determining a ranked list of past events and time series measurements that most influence the anomaly.
6 . The method of claim 5 , wherein determining the ranked list is performed according to attention weights from the aggregation network.
7 . The method of claim 1 , wherein the transformers and the aggregation network are trained using deep learning, with a set of training data that includes synchronized time series information and timestamped event sequences.
8 . The method of claim 1 , further comprising reporting the detected anomaly to a medical professional to support medical decision-making.
9 . The method of claim 1 , wherein performing the corrective action includes an action selected from the group consisting of changing a security setting for an application or hardware component, changing an operational parameter of an application or hardware component, halting and/or restarting an application, halting and/or rebooting a hardware component, changing an environmental condition, and changing a network interface's status or settings.
10 . A system for anomaly detection, comprising:
a hardware processor; and
a memory that stores a computer program which, when executed by the hardware processor, causes the hardware processor to:
encode a multivariate time series and a multi-type event sequence using respective transformers and an aggregation network to generate a feature vector;
perform anomaly detection by determining an anomaly score with a support vector data description (SVDD) loss using the feature vector to identify an anomaly within a system, the SVDD lost being determined as:
ℒ
=
1
n
∑
i
=
1
n
ϕ
(
x
i
;
W
)
-
c
2
+
λ
2
W
F
2
where x i is the feature vector, n is a number of training values, ϕ is an encoder network including the transformers and aggregation network, W are neural network parameters, c is a hypersphere in feature space, and λ is a hyperparameter; and
perform a corrective action responsive to the anomaly to correct or mitigate an effect of the anomaly.
11 . The system of claim 10 , wherein the computer program causes the hardware processor to support vector data description that includes a hypersphere radius term and a network parameter regularization term for anomaly detection.
12 . The system of claim 11 , wherein the hypersphere radius term represents a radius of a hypersphere that encompasses input multivariate time series data in a feature space.
13 . The system of claim 10 , wherein the computer program further causes the hardware processor to determine an anomaly score and to compare the anomaly score to a threshold, where an above-threshold anomaly score indicates an anomaly.
14 . The system of claim 10 , wherein the aggregation network includes a stack of self-attention layers that convert outputs of the respective transformers to the feature vector.
15 . The system of claim 10 , wherein the computer program further causes the hardware processor to determine a ranked list of past events and time series measurements that most influence the anomaly.
16 . The system of claim 15 , wherein the determination of the ranked list is performed according to attention weights from the aggregation network.
17 . The system of claim 10 , wherein the corrective action includes an action selected from the group consisting of changing a security setting for an application or hardware component, changing an operational parameter of an application or hardware component, halting and/or restarting an application, halting and/or rebooting a hardware component, changing an environmental condition, and changing a network interface's status or settings.
18 . A method for performing a treatment, comprising:
measuring time series information relating to a patient;
encoding the time series information and a health event sequence for the patient using respective transformers and an aggregation network to generate a feature vector;
performing anomaly detection by determining an anomaly score with a support vector data description (SVDD) loss using the feature vector to identify health event, the SVDD lost being determined as:
ℒ
=
1
n
∑
i
=
1
n
ϕ
(
x
i
;
W
)
-
c
2
+
λ
2
W
F
2
where x i is the feature vector, n is a number of training values, ϕ is an encoder network including the transformers and aggregation network, W are neural network parameters, c is a hypersphere in feature space, and λ is a hyperparameter; and
performing a corrective action responsive to the health event to correct or mitigate a negative health effect of the health event.
19 . The method of claim 18 , wherein performing the corrective action includes an action selected from the group consisting of adjusting operation of a dialysis machine, adjusting dosage of an intravenously administered drug, and halting a treatment.