Sas Institute Inc.

Kai Shen

Zohreh Asgharzadeh Talebi

Arin Chaudhuri

Haoyu Wang

Steven Guanxing Xu

Sudipta Kolay

Chengpeng Zeng

Functions representing sequences of values of a time-series dataset measured within a particular time period are accessed. For a current time window of the time period, a first discretized covariance function is computed that represents a relationship between each value measured within the current time window. Eigenanalysis of the first covariance function is performed to estimate first eigenfunctions. The current time window is incremented to obtain a subsequent time window that overlaps a majority of the current time window at a shared window region. A second discretized covariance function is computed for the subsequent time window and eigenanalysis is performed to estimate second normalized eigenfunctions. An angle change is computed between a portion of the first normalized eigenfunctions and a corresponding portion of the second normalized eigenfunctions located within the shared window region. Based on the angle change, an anomaly detection output is generated.

Real-time anomaly detection and mitigation for streaming functional data

A computing device identifies an anomaly among a plurality of observation vectors. An observation vector is projected using a predefined orthogonal complement matrix. The predefined orthogonal complement matrix is determined from a decomposition of a low-rank matrix. The low-rank matrix is computed using a robust principal component analysis algorithm. The projected observation vector is multiplied by a predefined demixing matrix to define a demixed observation vector. The predefined demixing matrix is computed using an independent component analysis algorithm and the predefined orthogonal complement matrix. A detection statistic value is computed from the defined, demixed observation vector. When the computed detection statistic value is greater than or equal to a predefined anomaly threshold value, an indicator is output that the observation vector is an anomaly.

Anomaly detection using RPCA and ICA

A computer transforms high-dimensional data into low-dimensional data. (A) A distance matrix is computed from observation vectors. (B) A kernel matrix is computed from the distance matrix using a bandwidth value. (C) The kernel matrix is decomposed using an eigen decomposition to define eigenvalues. (D) A predefined number of largest eigenvalues are selected from the eigenvalues. (E) The selected largest eigenvalues are summed. (F) A next bandwidth value is computed based on the summed eigenvalues. (A) through (F) are repeated with the next bandwidth value until a stop criterion is satisfied. Each observation vector of the observation vectors is transformed into a second space using a kernel principal component analysis with the next bandwidth value and the kernel matrix. The second space has a dimension defined by the predefined number of first eigenvalues. Each transformed observation vector is output.

Growing community of inventors

Apex, NC, United States of America

Kai Shen