Anomaly detection in time-based events via pattern mining
Anomaly detection in neural networks is provided. The method comprises extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors. The method references known node activations of the RNN produced by normal sequences of event data, and for each layer of the RNN, calculates a maximum nonparametric divergence of the on-the-fly node activations from the known node activations. For each layer of the RNN, the method determines a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window and identifies data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.
1 . A computer-implemented method of anomaly detection in neural networks, the method comprising:
extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors;
referencing known node activations of the RNN produced by normal sequences of event data;
for each layer of the RNN, calculating a maximum nonparametric divergence of the on-the-fly node activations from the known node activations;
for each layer of the RNN, determining a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window; and
identifying data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.
2 . The method of claim 1 , wherein the recurrent neural network comprises one of:
a recurrent autoencoder;
a gated recurrent network; or
a long short-term memory network.
3 . The method of claim 1 , wherein the number of on-the-fly node activations corresponds to sequential overlapping series of events for a defined time window size.
4 . The method of claim 1 , wherein the data sources comprise multi-modal data sources.
5 . The method of claim 1 , further comprising identifying a subset of layers with the RNN that contribute most to an overall maximum deviation of the whole RNN.
6 . The method of claim 1 , wherein the data sources are integrated at different layers of the RNN.
7 . The method of claim 1 , further comprising using input perturbations to enhance detection of anomalous samples among the on-the-fly node activations.
8 . A system for anomaly detection in neural networks, the system comprising:
a storage device that stores program instructions;
one or more processors operably connected to the storage device and configured to execute the program instructions to cause the system to:
extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors;
referencing known node activations of the RNN produced by normal sequences of event data;
for each layer of the RNN, calculating a maximum nonparametric divergence of the on-the-fly node activations from the known node activations;
for each layer of the RNN, determining a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window; and
identifying data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.
9 . The system of claim 8 , wherein the recurrent neural network comprises one of:
a recurrent autoencoder;
a gated recurrent network; or
a long short-term memory network.
10 . The system of claim 8 , wherein the number of on-the-fly node activations corresponds to sequential overlapping series of events for a defined time window size.
11 . The system of claim 8 , wherein the data sources comprise multi-modal data sources.
12 . The system of claim 8 , wherein the program instructions further cause the system to identify a subset of layers with the RNN that contribute most to an overall maximum deviation of the whole RNN.
13 . The system of claim 8 , wherein the data sources are integrated at different layers of the RNN.
14 . The system of claim 8 , wherein the program instructions further cause the system to use input perturbations to enhance detection of anomalous samples among the on-the-fly node activations.
15 . A computer program product for anomaly detection in neural networks, the computer program product comprising:
a persistent storage medium having program instructions configured to cause one or more processors to:
extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors;
referencing known node activations of the RNN produced by normal sequences of event data;
for each layer of the RNN, calculating a maximum nonparametric divergence of the on-the-fly node activations from the known node activations;
for each layer of the RNN, determining a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window; and
identifying data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.
16 . The computer program product of claim 15 , wherein the recurrent neural network comprises one of:
a recurrent autoencoder;
a gated recurrent network; or
a long short-term memory network.
17 . The computer program product of claim 15 , wherein the number of on-the-fly node activations corresponds to sequential overlapping series of events for a defined time window size.
18 . The computer program product of claim 15 , wherein the data sources comprise multi-modal data sources.
19 . The computer program product of claim 15 , further comprising instructions for identifying a subset of layers with the RNN that contribute most to an overall maximum deviation of the whole RNN.
20 . The computer program product of claim 15 , wherein the data sources are integrated at different layers of the RNN.