Method for analyzing time series activity streams and devices thereof

A method, non-transitory computer readable medium, and data manager computing device comprises retrieving a time series data of a monitored asset based on one or more tags in response to a request. Further, a heterogeneous data based on the one or more tags is retrieved. Furthermore, a cause of an anomaly period in retrieved time series data of the monitored asset is determined based on the retrieved heterogeneous data. Finally, the determined cause of the anomaly period in the time series data in the monitored asset is provided.

FIELD

This technology generally relates to method for analyzing data and particularly relates to analyzing time series activity streams and devices thereof.

BACKGROUND

The connected world, also referred to as the internet of things, is growing quickly. Analysts have estimated that along with the continued growth of humans using the Internet, the number of connected devices and systems will rise from five billion to one trillion in the next ten years. However, the traditional ways to manage and communicate with these systems has not changed. In other words, all the information from these systems is not accessible or is not able to be correlated in a way that helps people or businesses do their jobs better and more efficiently, find information they are looking for in the proper context, or make this data consumable in a meaningful way.

There are a variety of specific solutions to handle the rising amount of data found in industry today. These solutions can be categorized into the following types of systems: Enterprise Resource Planning (ERP) systems; Portals and related technology systems; Traditional Business Intelligence systems; and Manufacturing Intelligence systems.

Enterprise Resource Planning systems are used by large and small companies to run their businesses. The typical minimal requirements for these systems are to provide financial and accounting services. However, these systems often have additional functionality for specific vertical industries, such as manufacturing, utilities, construction, and retail by way of example. These Enterprise Resource Planning systems are rigid, in both business process support and data models. They also are very expensive to implement and maintain. Further, these systems are usually implemented to enforce repeatable, standard business processes and it generally is not possible to use these systems for dynamic analysis of different types of data.

Traditional Business Intelligence systems usually rely on specific, detailed data models, such as data warehouses. While the data is typically current, for example about a day old, in these systems, the models are rigid and report writing may require Information Technology (IT) skills. While these systems have become much better at providing users with the ability to self-serve, the self service capability is restricted to the previously designed semantic search models. As a result, these Traditional Business Intelligence systems do not address current conditions, rapidly changing data, third party collaboration, or external data sources.

Manufacturing Intelligence systems (also referred to as Enterprise Manufacturing Intelligence or EMI) are typically concerned with real-time data collected from machines and devices. This time series data usually does not have any business context associated with it. The users of these Manufacturing Intelligence systems typically are plant operators and engineers. These systems do not handle other business related data, do not understand or correlate unstructured data, and are not easily readable.

Currently, most of the utilized solutions to pull all these separate systems with their different sources of data together so users can consume data from more than one of these solutions in a meaningful way, is to execute a complex, multi-year integration project that results in a data mart. Typically, this involves replicating large quantities of data from multiple systems into a rigid model, similar to a hub and spoke model. The hub is the data mart holding all the replicated data. As the systems changes at the end of the spokes, new time consuming integration and modeling is required. Unfortunately, this type of solution is expensive to maintain, the data model and semantics are not dynamic, and the ability to consume data is available only through pre-defined reports.

Other existing approaches to pull all these separate systems with their different sources of data together rely on relational data bases which are adept at answering known questions against known data structures (Known-Known) and can answer known questions against unknown data structures (Known-Unknown). Unfortunately, these existing approaches can not effectively answer unknown questions against known data structure (Unknown-Known), and unknown questions against unknown data structures (Unknown-Unknown).

As a result, currently users of existing technologies to identify and access data are concerned with the timeliness and relevance of acquired data. In particular, there is a concern about deficiencies with accurately identifying and accessing real-time data from devices and other storage systems. Additionally, these existing technologies have difficulties identifying and accessing different types of relevant data, such as business related data which can be stored in many varying formats and unstructured data. Further, these existing technologies typically require large quantities of data from multiple systems to first be entered into a rigid model and then this entered data can only be access in limited manners.

SUMMARY

A method for analyzing a time series activity stream including a data management computing apparatus for retrieving a time series data of a monitored asset based on one or more tags in response to a request. Further, a heterogeneous data based on the one or more tags is retrieved by the data management computing apparatus. Furthermore, a cause of an anomaly period in retrieved time series data of the monitored asset is determined based on the retrieved heterogeneous data by the data management computing apparatus. Finally, the determined cause of the anomaly period in the time series data in the monitored asset is provided by the data management computing apparatus.

A non-transitory computer readable medium having stored thereon instructions for analyzing a time series activity stream comprising machine executable code which when executed by at least one processor, causes the processor to perform steps including retrieving a time series data of a monitored asset based on one or more tags in response to a request. Further, a heterogeneous data based on the one or more tags is retrieved. Furthermore, a cause of an anomaly period in retrieved time series data of the monitored asset is determined based on the retrieved heterogeneous data. Finally, the determined cause of the anomaly period in the time series data in the monitored asset is provided.

A data management computing apparatus comprising one or more processors, a memory coupled to the one or more processors which are configured to execute programmed instructions stored in the memory including retrieving a time series data of a monitored asset based on one or more tags in response to a request. Further, a heterogeneous data based on the one or more tags is retrieved. Furthermore, a cause of an anomaly period in retrieved time series data of the monitored asset is determined based on the retrieved heterogeneous data. Finally, the determined cause of the anomaly period in the time series data in the monitored asset is provided.

This technology provides a number of advantages including providing more effective and efficient methods, non-transitory computer readable medium and device for analyzing time series data. With this technology, a wide variety of different types of data, such as business related data, social media data and unstructured data, can be easily identified and accessed. Further, this technology does not require the data to be first loaded into a rigid model which can only be accessed in limited manners.

DETAILED DESCRIPTION

An exemplary environment10with a data management computing apparatus14that analyzes time series data is illustrated inFIG. 1. In this particular example, the environment10includes the data management computing device14, plurality client computing devices12, and a plurality of data servers16, a social network database17, monitored asset32and sensors34which are coupled together by the Local Area Network (LAN)28and Wide Area Network (WAN)30, although the environment10can include other types and numbers of devices, components, elements and communication networks in other topologies and deployments. While not shown, the exemplary environment10may include additional components, such as routers, switches and other devices which are well known to those of ordinary skill in the art and thus will not be described here. This technology provides a number of advantages including providing more effective and efficient methods, non-transitory computer readable medium and device for analyzing time series data.

Referring more specifically toFIG. 1, the data management computing apparatus14provides a number of functions analyzing time series data, although other numbers and types of systems can be used and other numbers and types of functions can be performed. The data management computing apparatus14includes at least one processor18, memory20, input and display devices22, and interface device24which are coupled together by bus26, although data management computing apparatus14may comprise other types and numbers of elements in other configurations.

Processor(s)18may execute one or more computer-executable instructions stored in the memory20for the methods illustrated and described with reference to the examples herein, although the processor(s) can execute other types and numbers of instructions and perform other types and numbers of operations. The processor(s)18may comprise one or more central processing units (“CPUs”) or general purpose processors with one or more processing cores, such as AMD®processor(s), although other types of processor(s) could be used (e.g., Intel®).

Memory20may comprise one or more tangible storage media, such as RAM, ROM, flash memory, CD-ROM, floppy disk, hard disk drive(s), solid state memory, DVD, or other memory storage types or devices, including combinations thereof, which are known to those of ordinary skill in the art. Memory20may store one or more non-transitory computer-readable instructions of this technology as illustrated and described with reference to the examples herein that may be executed by the one or more processor(s)18. The flow chart shown in FIGS.2and3A-3B is representative of example steps or actions of this technology that may be embodied or expressed as one or more non-transitory computer or machine readable instructions stored in memory20that may be executed by the processor(s)18. Additionally, as illustrated inFIG. 4-5, the memory20includes a graph database to which maintains the model relationship and indexes which support rapid retrieval of tag and nodal relationship data.

Input and display devices22enable a user, such as an administrator, to interact with the data management computing apparatus14, such as to input and/or view data and/or to configure, program and/or operate it by way of example only. Input devices may include a touch screen, keyboard and/or a computer mouse and display devices may include a computer monitor, although other types and numbers of input devices and display devices could be used. Additionally, the input and display devices22can be used by the user, such as an administrator to develop applications using an application interface.

The interface device24in the data management computing apparatus14is used to operatively couple and communicate between the data management computing apparatus14, the client computing devices12, and the plurality of data servers16which are all coupled together by LAN28and WAN30. By way of example only, the interface device24can use TCP/IP over Ethernet and industry-standard protocols, including NFS, CIFS, SOAP, XML, LDAP, and SNMP although other types and numbers of communication protocols can be used.

Each of the client computing devices12includes a central processing unit (CPU) or processor, a memory, an interface device, and an I/O system, which are coupled together by a bus or other link, although other numbers and types of network devices could be used. Each of the client computing devices12communicate with the data management computing apparatus14through LAN28, although each of the client computing devices12can interact with the data management computing apparatus14in other manners.

Each of the plurality of data servers16includes a central processing unit (CPU) or processor, a memory, an interface device, and an I/O system, which are coupled together by a bus or other link, although other numbers and types of network devices could be used. Each of the plurality of data servers16enters, updates and/or store content, such as files and directories, although other numbers and types of functions can be implemented and other types and amounts of data could be entered, updated, or stored used. Each of the plurality of data servers16may include by way of example only, enterprise resource planning (ERP) systems, portals and related technologies, traditional business intelligence systems and manufacturing intelligence systems.

The social network database17includes a central processing unit (CPU) or processor, a memory, an interface device, and an I/O system, which are coupled together by a bus or other link, although other numbers and types of network devices could be used. The social network database17includes heterogeneous data entered by users from social network platforms, although the social network database17can include any additional information. By way of example only, the contents of the social network database17includes information from the users of Wikipedia, blogs which are entered and tagged by the users. As illustrated inFIG. 1, the data management computing apparatus14interacts with the social network database via LAN28, although the data management computing apparatus14can interact with the social network database17via other network topologies.

The monitored asset32includes a central processing unit (CPU) or processor, a memory, an interface device, and an I/O system, which are coupled together by a bus or other link, although other numbers and types of network devices could be used. In this technology, the monitored asset32can be an electrical or mechanical devices, machines, or instruments. Additionally, the monitored asset32includes sensors34which assist with obtaining information from the monitored asset32or transmitting data out of the monitored asset32. Although the sensors34has been illustrated inFIG. 1to be coupled with the monitored asset, as it may be appreciated by a person having ordinary skill in the art, the sensors34can exist outside the monitored asset34and could be communicably coupled to the monitored asset34. Further, the data management computing apparatus14interacts, obtains data or sends data to the monitored asset32or the sensors34via LAN28, although the data management computing apparatus14can interact with the monitored asset32and the sensors34in other manners.

In this technology, sensor34is an electro-mechanical device which receives electrical data from the monitored asset32and converts the electrical signals to a format which can be read by an observer. By way of example only, sensor34can be a pressure sensor, thermal, heat, and/or temperature sensor, although other types and numbers of sensors and other monitors could be used. Accordingly, in this technology, sensors34are used by the data management computing apparatus14to obtain time series data from the monitored asset32, although the data management computing apparatus14can use the sensors34for other additional functions.

Although an exemplary environment10with the plurality of client computing devices12, the data management computing apparatus14, the plurality of data servers16, the social network database17, the monitored asset32and sensors34are described and illustrated herein, other types and numbers of systems, devices in other topologies can be used. It is to be understood that the systems of the examples described herein are for exemplary purposes, as many variations of the specific hardware and software used to implement the examples are possible, as will be appreciated by those skilled in the relevant art(s).

Furthermore, each of the systems of the examples may be conveniently implemented using one or more general purpose computer systems, microprocessors, digital signal processors, and micro-controllers, programmed according to the teachings of the examples, as described and illustrated herein, and as will be appreciated by those of ordinary skill in the art.

The examples may also be embodied as a non-transitory computer readable medium having instructions stored thereon for one or more aspects of the technology as described and illustrated by way of the examples herein, which when executed by a processor (or configurable hardware), cause the processor to carry out the steps necessary to implement the methods of the examples, as described and illustrated herein.

An exemplary method for analyzing time series data will now be described with reference toFIGS. 1,2and3A-3B. Particularly with respect toFIGS. 1 and 2, in step205, the data management computing apparatus14receiving the time series data of the monitored asset32from the sensors34in real time as illustrated in the first step ofFIG. 4, although the data management computing apparatus14can obtain the time series from the plurality of data servers16. By way of example only, the time series data can include real time data of monitored asset32, such as continuous temperature readings or pressure readings, although the time series data can relate to other readings. However, in another example, the data management computing apparatus14may periodically obtain the time series data from sensors34. Additionally, in yet another example, the data management computing apparatus14can obtain the time series data in response to a notification received from the sensors34when there is an event triggered in the monitored asset32.

Next, in step210, the data management computing apparatus14embeds tags to the obtained time series obtained in step105, although the data management computing apparatus14can use other techniques to quickly and efficiently identify the time series data. In this example, the data management computing apparatus14automatically embeds tags to the time series data based on pre-defined rules. As it would be appreciated by a person having ordinary skill in the art, a tag is a non-hierarchical keyword or term or a metadata assigned to a piece of information. The tag helps describe an item and allows it to be found again by browsing or searching. Additionally, tags are can be customized depending on the system and can be of various types, such as a dynamic tag which can be created by the data management computing apparatus14based on the obtained time series data or fixed tags which are created by the data management computing apparatus14based on pre-defined vocabulary. By way of example only, the pre-defined rules can relate to embedding tag for a particular type of data, such as embedding “temperature values” as tags for all the time series data obtained from the sensors34relating to the temperature values of the monitored asset32and/or add the name of the particular component as the tag for all the data obtained from the sensors for particular component of the monitored asset32, such as “therometer1”.

Optionally, the data management computing apparatus14can add metadata, such as the data source, the relationship of the source to the monitored asset34and additional context information to the obtained time series data.

In another example of the technology, the data management computing apparatus14can obtain the time series data from the sensors34and collectively create an activity stream. Additionally, the activity stream can be tagged using techniques illustrated in step210and store the activity stream within the memory20.

In step215, the data management computing apparatus14stores the tagged time series data in memory20as illustrated inFIG. 4, although the data management computing apparatus14can store the time series data at other memory locations. In this technology, the data management computing apparatus14stores the tagged time series data and in the memory20and the exact memory location of the tagged time series and the associated memory location is stored in the index table which is also present in the memory20. By storing the tagged time series data and having an index table, the technology disclosed in this application provided benefits of rapid and accurate retrieval data.

Additionally, in this technology, the data management computing apparatus14stores the tagged time series in the memory20with time stamp. In this technology, time stamp relates to the information regarding the exact time and date the time series data was obtained in real-time from the sensors34and stored. By storing the heterogeneous data and the time series data with time stamp, the technology disclosed in this application provides benefits to further analyze the cause of an anomaly period accurately, although storing with the time stamp may provide other additional benefits.

In step220, the process of obtaining and storing the time series data ends.

Next, inFIG. 3A, in step305, the data management computing apparatus14receives a request to analyze time series data with a particular tag for a monitored asset32via an executing application in client computing device12as illustrated inFIG. 5, although the data management computing apparatus14may receive other types of requests from the client computing device12.

In step310, the data management computing apparatus14retrieves the stored time series data in step115ofFIG. 2associated with the received tag in response to the received request, although the data management computing apparatus14can obtain the stored time series data without using the received tag information. By way of example only, obtains the time series data stored in the step215from the memory20by referring to the index table and using the tag information present in the received request as illustrated inFIG. 5, although the data management computing apparatus14can directly obtain the heterogeneous contextual data from memory20without directly referring to the index table stored in memory20or without using the tag information received in the request for the time series data. By way of example only, the data management computing apparatus14uses the tag information received in the request for the time series data, matches the tag information with the listed tags in the index table and accordingly obtains the time series data from the memory location associated with the tag in the index table. As previously illustrated, the technology disclosed in this application provides advantages by to quickly and effectively obtain the requested data by referring to the index table. However, as illustrated earlier in another example, if the data management computing apparatus14obtains all the time series data present within the memory20when the data management computing apparatus14does not use the received tag to obtain the time series data stored in step215.

In step315, the data management computing apparatus14determines if there was an anomaly period within the time series data of the monitored asset. If the data management computing apparatus14determines there was no observed anomaly period within the time series data, then the No branch is taken to step317where the data management computing apparatus14provides the requesting client computing device12with the obtained time series data and the process flow ends. If the data management computing apparatus14determines there was an observed anomaly period within the time series data, then the Yes branch is taken to step320.

In this example, the data management computing apparatus14determines when an anomaly period is observed within the time series data by comparing the time series data of the monitored asset32against threshold values for the monitored asset22, although the data management computing apparatus14can determine when an anomaly period is observed in other manners well known to those of ordinary skill in the art, such as monitoring for readings in the time series data which are greater than a standard deviation by way of example.

In step320, the data management computing apparatus14retrieves structured and/or unstructured heterogeneous data using the tag information received in step305from the multiple sources, such as plurality of data servers16, social network database17or from sensors34as illustrated inFIG. 4by way of example only, although the data management computing apparatus14can obtain structured or unstructured heterogeneous data from other sources. However, in another example, the data management computing apparatus14may obtain heterogeneous data associated with tags which are present in the anomaly period. In this technology, the data management computing apparatus14obtains the unstructured heterogeneous data relating to the received tag information by crawling to the plurality of data servers16, although the data management computing apparatus14can obtain information relating to the tag information from other sources in other manners. In this technology, the structured or unstructured data relates to environmental data obtained from sensors34and business process information from one or more applications on one or more third party computing devices as illustrated inFIG. 4, although the contextual information can relate to other types and amounts of additional information obtained from other sources. For further illustrative purposes, the data management computing apparatus14obtains the user entered structured or unstructured data found in wikis, blogs or other social platforms from the social network database17, although the data management computing apparatus14can obtain the user entered data from other sources.

In step325, the data management computing apparatus14provides the obtained time series data and the heterogeneous time series data to the requesting client computing device12. Additionally, in this technology, while providing the time series data and the heterogeneous data, the data management computing apparatus14converts the tagged time series data into a format convenient for viewing in the requesting client computing device12. By way of example only, formats can be in a PDF, textual format, graphs, charts, tabular columns or an image format, although other formats can be used. Further, in this technology, the data management computing apparatus14provides the tagged time series data to the requesting client computing device12by embedding the converted time series data and the heterogeneous data within a work-flow of the executing application of the client computing device12, although the data management computing apparatus14can provide the tagged time series data to the requesting client computing device12using other methods.

In step330, the data management computing apparatus14receives a request from the client computing device12via the executing application for heterogeneous contextual data relating to the anomaly period, although the data management computing apparatus14may receive other types of request from the client computing device12.

In step335, the data management computing apparatus14retrieves the heterogeneous contextual data stored relating to the anomaly period from the plurality of data servers16, social network database17or sensors34based on the model relationships in response to the received request, although the data management computing apparatus14can obtain the heterogeneous contextual data without a model relationship based on other parameters from other sources. In this technology, the model relationship defines the relationship, hierarchy, data or process flow, and/or interaction of the monitored asset32with other related assets. In this technology, the model relationship is present within the memory20, although the model relationship can be stored at other locations. As it would appreciated by a person having ordinary skill in the art, heterogeneous contextual data in this technology relates to environmental data, such as temperature pressure, operator blog entries, customer order details, although heterogeneous contextual data can include other types and amounts of information.

In step340, the data management computing apparatus14provides the obtained heterogeneous contextual data relating to the anomaly period to the requesting client computing device using techniques illustrated in step325.

In step345, the data management computing apparatus14receives a request for related heterogeneous asset data relating to the anomaly from the client computing device12via the executing application. Additionally, as illustrated in step240, the data management computing apparatus14can receive keywords along with the request for the related heterogeneous asset data.

In step350, the data management computing apparatus14retrieves the related heterogeneous asset data, such as upstream data and/or downstream data based on model relationships and also activities of the other machines associated during the anomaly period from the sensors34, plurality of data servers16as illustrated inFIG. 4, although the data management computing apparatus14can obtain the related heterogeneous asset data from other sources in other manners. In this technology, upstream data includes data from related assets (not shown) upstream from the functionality performed by the monitored asset32and the downstream data includes data from related assets (not shown) downstream from the functionality performed by the monitored asset32during the anomaly period, although the obtained related heterogeneous asset data can also include the upstream and downstream data prior to the anomaly period. Additionally, in this technology, the data management computing apparatus14identifies the related assets which are upstream and downstream from the monitored asset based on the model relationship for the monitored asset32which explains the relationship hierarchy or flow between the monitored asset and related assets.

In step355, the data management computing apparatus14provides the obtained related heterogeneous asset data to the requesting client computing device12using techniques illustrated in step325.

Next, in step360the data management computing apparatus14identifies a cause of the anomaly period in the time series data from the monitored asset based on the time series data, the heterogeneous data, the heterogeneous contextual data, and the related heterogeneous asset data, although the data management computing apparatus14can determine the actual cause of anomaly using other techniques. In this technology, the time series, the heterogeneous data, the heterogeneous contextual data and the related heterogeneous asset data collectively provides an accurate cause of the anomaly period as one of the retrieved heterogeneous information independently may not provide the complete or accurate cause of the anomaly period.

Upon identifying the cause of anomaly, in step365the data management computing apparatus14identifies and provides corrective step(s) to the requesting client computing device12obtained by correlating the identified cause against a table of stored corrective step(s) to fix the cause of the anomaly period, although other manners identifying and providing corrective step(s) can be used. For example, the opinions from technical experts, suggestions from the manufacturer or comments present in blogs and other social media relating to the monitored asset mined from one or more of the plurality of data servers16and or the social network database17can be used. Additionally, the data management computing apparatus14may also direct the requesting client computing device12to a website or a technical expert who could further assist with preventing the anomaly period. In step380, this exemplary method ends.

An example illustrating the methods for analyzing time series data is explained as follows. In this example, the data management computing apparatus14had captured the time series data of the electric car, such as car identification number, time started, time completed, level of charge to start, level of charge when completed from the sensors34when an electric car was being charged and stored the time series of the car using the date on which the car was charged and the name of the car within the memory20.

The data management computing apparatus14computing apparatus14retrieves the stored time series data of the electric car using the tags of the date of charge and the name of the car.

Further, the data management computing apparatus14identifies anomaly in the obtained time series data, which in this case is the requirement for the car to be charged earlier than expected. For further illustrative purpose, the standard time for next battery recharge of the car was 48 hours, however, in this example the car is back for charging within 36 hours which means that the car has to be charged 12 hours earlier than the standard time. However, in this technology the data management computing apparatus14cannot accurately identify the cause for the electric car to be charged earlier than expected as the time series data obtained from the sensors34as the time series data of the car does not show any battery degradation.

Accordingly for further investigative purposes, the data management computing apparatus14obtains heterogeneous data from plurality of data servers17and the social network database17, such as the driver internal blogs which indicate that the driver was behind on his delivery schedule for the day he charged the vehicle.

Next, the data management computing apparatus14retrieves the contextual data, such as the ambient temperature, from another heterogeneous data source based on the model relationship and determines the ambient temperature was above a stored threshold after the car was charged. The data management computing apparatus14retrieves other contextual data which indicates that ambient temperatures above that threshold lead to a shorter battery life.

Additionally, the data management computing apparatus14retrieves other heterogeneous business related blog data, such as information noted in a driver log data which indicated the driver was scheduled to visit an especially difficult customer and that the customer may lodge a complaint if the driver was late for delivery and this caused the driver to exceed speed recommendations, using more energy of the battery than normal.

Based on car battery information, the driver's internal blog, the ambient temperature and the driver log data, the data management computing apparatus14identifies the actual cause of the early recharge of the car to be negligence of the driver. Accordingly, the data management computing apparatus14provides improvement steps indicating that the driver may need to be reminded of proper hours and vehicle use and also indicates that the battery is in good condition and does not require any servicing.

Accordingly, as illustrated and described with the examples herein this technology provides a number of advantages including providing more effective and efficient methods, non-transitory computer readable medium and device for analyzing time series data. With this technology, a wide variety of different types of data, such as business related data, social media data and unstructured data, can be easily identified and accessed. Further, this technology does not require the data to be first loaded into a rigid model which can only be accessed in limited manners.