ANOMOLY DETECTION IN TIME-BASED EVENTS VIA PATTERN MINING

Anomaly detection in neural networks is provided. The method comprises extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors. The method references known node activations of the RNN produced by normal sequences of event data, and for each layer of the RNN, calculates a maximum nonparametric divergence of the on-the-fly node activations from the known node activations. For each layer of the RNN, the method determines a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window and identifies data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.

BACKGROUND

The present disclosure relates generally to an improved computing system, and more specifically to identifying anomalies in artificial neural networks.

Many typical modern life functions, ranging from banking systems to utility consumption control, rely on a series of heterogeneous computing systems. Anomaly detection and identifying early indicators of system malfunctioning such as system failures, abnormalities, and carbon emission, are critical components of building a robust and sustainable system. The primary purpose of a system log or sensor readings is to record system states at various essential points to help monitor and detect these malfunctioning and provide recommendations for asset maintenance or perform root cause analysis. These types of countermeasure solutions reduce system or asset unavailability, critical failures, and associated carbon footprint through effective asset utilization for energy production. As systems and applications become increasingly complex (code, dependencies interactions, or sensor data complexity), they are subject to more bugs and vulnerabilities

SUMMARY

An illustrative embodiment provides a method of anomaly detection in neural networks. The method comprises extracting, from different layers of a recurrent neural network (RNN) for a specified time interval, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors. The method references known node activations of the RNN produced by normal sequences of event data, and for each layer of the RNN, calculates a maximum nonparametric divergence of the on-the-fly node activations from the known node activations. For each layer of the RNN, the method determines a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window and identifies data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer. According to other illustrative embodiments, a computer system, and a computer program product for anomaly detection in neural networks are provided.

DETAILED DESCRIPTION

With reference now to the figures, and in particular, with reference toFIG.1, a diagram of a data processing environment is provided in which illustrative embodiments may be implemented. It should be appreciated thatFIG.1is only meant as an example and are not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

The illustrative embodiments recognize and take into account that modern systems maintain log data or sensor readings as a regular practice to record system states at various essential points to help debug system malfunctioning such as failures, anomalies, and emissions. Modern systems are also used to design countermeasures, such as providing recommendations for asset maintenance, performing root cause analysis, and recommending emission reduction strategies.

The illustrative embodiments also recognize and take into account console logs rarely help system administrators to detect problems in large-scale data center services. These logs often consist of the voluminous intermixing of messages from many software components written by independent developers.

The illustrative embodiments also recognize and take into account that traditional anomaly detection frameworks operate primarily as supervised or semi-supervised methods. The former expects there is enough labeled data to learn a discriminative model which is not always the case, whereas the latter expects that there exists a distinct feature-level signature of anomalies globally when compared to normal data. This assumption need not always hold true as anomalous instances can be normal at the feature signature level, but they can demonstrate abnormal behavior across a set of features.

The illustrative embodiments provide a method to identify anomalies in time-based event logs by detecting a subset of anomalous node activations in a Recurrent Neural Network's (RNN) inner layers. These nodes, as a group, maximize a nonparametric measure of divergence away from the normal behavior of activations created from typical sequences of events data. The illustrative embodiments efficiently score subsets of nodes and return the nodes within each layer of the recurrent network that contribute to the maximum score.

Artificial neural networks comprise a number of nodes. Each node combines multiple inputs from other nodes, and the input is multiplied by a respective weight that either amplifies or dampens that input, thereby assigning significance to each input for the task the algorithm is trying to learn. The connections between nodes are called edges. When the node receives an input value, it multiplies that input value by the weight assigned to that edge. A net input function adds each weighted input to a bias term and then passes the result to an activation function which produces the node's activation (i.e., output).

An RNN is a type of neural network in which the nodes are formed along a temporal sequence. RNNs exhibit temporal dynamic behavior, meaning they model behavior that varies over time. RNNs are recurrent because they perform the same task for every element of a sequence, with the output being dependent on the previous computations. RNNs can be thought of as multiple copies of the same network, in which each copy passes a message to a successor. Whereas traditional neural networks process inputs independently, starting from scratch with each new input, RNNs persistence information from a previous input that informs processing of the next input in a sequence. There are several variants of RNNs such as, e.g., “vanilla” RNNs. Gated Recurrent Unit (GRU), Long Short-Term Memory (LSTM), and others with which the illustrative embodiments can be implemented.

FIG.2depicts a block diagram for anomaly detection in accordance with an illustrative embodiment. Anomaly detection200can be implemented in computing environment100inFIG.1.

Anomaly detection200is implemented with a trained recurrent neural network (RNN)202. RNN202comprises a number of layers206, each layer206comprising a number of nodes208. Each node210has a respective activation212in response to input data.

Number of data sources214provide data to RNN202. Data sources214might comprise, e.g., multiple sensors. Data sources214might also comprise multi-model data sources. Each data source216provides data218over a series of period time intervals220of a specified length. The data sources214can also be integrated at different layers206of RNN202. By thus integrating data sources214at different stages of the sequence model, anomaly detection can be performed at each data source216or subsets of data sources214.

Anomaly detection200extracts a number of temporal on-the-fly samples212of node activations within RNN202for a specified time window222within the series of period time intervals220. Anomaly detection200compares these temporal on-the-fly samples212to a number of offline normal samples226of node activations previously extracted from RNN202for known data, which serve as normative reference values. Input perturbations might also be used to enhance detection of anomalous samples among temporal on-the-fly samples212of node activations.

A scoring function228calculates divergence values232of the temporal on-the-fly samples224relative to the normal samples226. And a maximum divergence234is calculated for each layer206of RNN202. A priority function230determines the top-k priority nodes236in each layer206that contribute to the maximum divergence234for that layer. From these top-k priority nodes, anomaly detection determines the highest scoring subset238within each layer that produces the maximum divergence234. This higher scoring subset238can be displayed to a user through user interface123to identify which of the data sources214is producing the anomalous activations.

In addition to clustering nodes208within each layer206into subsets, a subset of layers204within RNN202can be identified that contribute most to an overall maximum deviation of the whole RNN202.

FIG.3depicts an overview of anomaly detection in accordance with an illustrative embodiment. The illustrative embodiments extract samples of on-the-fly node activations306in an RNN encoder308produced by a number of sensors302or other data sources for a given time window tm304within a series of periodic time intervals. The sampled on-the-fly node activations306are compared to offline normal sample activations (H0) for the RNN encoder308over a set of time windows, which are used as reference norms.

Deviations of the on-the-fly sample activations306from the normal sample activations are calculated as p-values, which are then maximized. From this maximization of nonparametric deviation, anomalous subsets of nodes in the network are identified. An example of a score distribution produced by abnormal sensor data310is shown contrasted with a score distribution produced by normal sensor data312.

Subset scanning is an approach to pattern detection, which treats the problem as a search for the “most anomalous” subset of observations in the data, S. Herein, anomalousness is quantified by a scoring function, F(S). The illustrative embodiments formulate the abnormal sequential pattern detection problem as being able to efficiently identify S*=arg maxSF(s) over all relevant subsets of node activations within an RNN model (e.g., LSTME) that is processing sequential time-series data (system logs or sensors) at runtime. The method of the illustrative embodiments work uses non-parametric scan statistics (NPSS). Given the nature of the datasets and problem setup, the illustrative embodiments ensure that the sampling protocol taken for this case corresponds to sequential overlapping series of events for a defined time window size w.

For NPSS one can assume a set of normal time-windows (intervals) of events Xzincluded data samples from expected or normal behavior, DH0. These samples generate activations AzjH0at each node Ojfrom a given layer. A test time-window sample under evaluation, Xi(not in DH0) creates activations Aijat each node Ojin the network. The p-value, pij, is the proportion of background activations AzjH0greater than the activation induced by the test sample Aijat node Oj. The test sample Xiis converted to a vector of p-values pijof length J=|O|. The key assumption is that under the alternative hypothesis of an anomaly present in the activation data, at least some subset of the activations SO⊆O will systematically appear extreme. To identify and quantify this set of p-values nonparametric scan statistics are used, as it makes minimal assumptions on the underlying data distribution.

The general form of the NPSS score function is:

where N(S) represents the number of empirical p-values contained in subset S, and Nα(S) is the number of p-values less than (significance level) α contained in subset S.

There are well-known goodness-of-fit statistics that can be utilized in NPSS. The illustrative embodiments use the Berk-Jones test statistic:

where KL is the Kullback-Liebler divergence:

between the observed and expected proportions of significant p-values.

Although NPSS provides a means to evaluate the anomalousness of a subset of node activations, SO, discovering which of the 2Jpossible subsets provides the most evidence of an anomalous pattern is computationally infeasible for moderately sized datasets. However, NPSS has been shown to satisfy the linear-time subset scanning (LTSS) property, which allows for an efficient and exact maximization over subsets of data. LTSS is a computational task of determining whether there exists a subset within a given set of numbers whose sum equals a target value.

The LTSS property uses a priority function G(Oj) to rank nodes and then proves that the highest-scoring subset comprises the top-k priority nodes for some k in 1 . . . . J. The priority of a node for NPSS is the proportion of p-values that are less than α. Letting S(k)be the subset containing the k nodes with the smallest p-values and letting αkbe the largest p-value among these k nodes, the LTSS property guarantees that the highest-scoring subset (over all a thresholds) will be one of these J subsets S(1), S(2), . . . S(J)with their corresponding a threshold. This approach reduces search space while still guaranteeing identification of the highest-scoring subset of nodes for a time-window sample under evaluation.

FIG.4depicts a flowchart of a process for anomaly detection in neural networks in accordance with an illustrative embodiment. The operations (i.e., steps) of process400can occur within (or on) computing environment100ofFIG.1.

Process400begins with a user inputting normative data into an RNN (step402). Process400then estimates an optimal time window (i.e., periodic interval length) to use for sampling (step404).

Process400performs sequential extraction of activations from the RNN model based on the normative data (step406). Responsive to a determination that group scanning is not selected (step408), process400builds expectation distributions with sequential subset scanning (step412). Responsive to a determination that group scanning mode is selected, process400enables an iterative ascent option to do a double optimization, between the subset of sensors and subset of time windows (step410). As process400examines groups of samples it defines thresholds to assess at which proportions of anomalies the solution is robust and can be used before proceeding to step412.

After the expectation distributions are in place, process400calculates an anomaly score estimation for new temporal samples extracted from the RNN on-the-fly (step414). Responsive to a determination that the area under the receiver operating characteristic curve (AUROC) value of step414does not meet a specified threshold (e.g., 0.7) (step416), process400returns to step404. AUROC is a metric used in machine learning to evaluate the performance of a model. Higher AUROC values indicate better discrimination between positive and negative values.

If the AUROC value of step414does meet the specified threshold, process400displays the anomaly score distributions, responsible sensors, and detected temporal samples to the user (step418) and updates a supervisory control and data acquisition (SCADA) system with warnings attached to responsible sensors (step420).

FIG.5depicts a flowchart of a process for anomaly scoring for temporal samples in accordance with an illustrative embodiment. Process500is a detailed example of step414inFIG.4.

Process500begins by extracting, from different layers of a recurrent neural network (RNN) at specified time intervals, a number of on-the-fly node activations produced by sequences of event data from a number of data sources and sensors (step502). The RNN might be, e.g., a recurrent autoencoder, a gated recurrent network, or a long short-term memory (LSTM) network.

Process500references known node activations of the RNN produced by normal sequences of event data (step504).

For each layer of the RNN, process500calculates a maximum nonparametric divergence of the on-the-fly node activations from the known node activations (step506). For each layer of the RNN, process500identifies a subset of nodes that most contribute to the maximum nonparametric divergence for that layer for a given time window (step508).

Process500then identifies data sources or sensors from among the number of data sources and sensors responsible for activating the subset of nodes that most contribute to the maximum nonparametric divergence for each layer.

As used herein, a “number of,” when used with reference to objects, means one or more objects. For example, a “number of different types of networks” is one or more different types of networks.

As used herein, a “computer instruction,” or “computer program”, means one step or a set of steps that includes information on how to operate, perform, or maintain particular computer software or hardware. For example, a “computer instruction” can be a computer program instruction in the form of lines of code or source code that are executable by a computer system.