US 11,719,563 B2
Distributed anomaly detection using combinable measurement value summaries
William C. Benton, Madison, WI (US); and Sophie Watson, Toronto (CA)
Assigned to Red Hat, Inc., Raleigh, NC (US)
Filed by Red Hat, Inc., Raleigh, NC (US)
Filed on Jul. 3, 2019, as Appl. No. 16/502,604.
Prior Publication US 2021/0003426 A1, Jan. 7, 2021
Int. Cl. G08B 21/18 (2006.01); G01D 21/00 (2006.01); G01D 9/00 (2006.01)
CPC G01D 21/00 (2013.01) [G01D 9/005 (2013.01); G08B 21/18 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method comprising:
obtaining, by a computing device over a first period of time, a first plurality of measurement values from a sensor that quantifies a concentration of a chemical in a first fluid;
adding, over the first period of time by the computing device, each of the measurement values to a first local t-digest, the first local t-digest having a maximum physical size irrespective of a quantity of the first plurality of measurement values added to the first local t-digest and being configured to maintain a summarization of the first plurality of measurement values, the first local t-digest being operable to, when queried with a measurement value, return a quantile or percentile of the measurement value with respect to each measurement value previously added to the first local t-digest;
sending the first local t-digest to a central computing device;
receiving, by the computing device from the central computing device, a global combined t-digest, the global combined t-digest comprising a combination of the first local t-digest and one or more other local t-digests generated by other computing devices, the global combined t-digest being operable to, when queried with a measurement value, return a quantile or percentile of the measurement value with respect to each measurement value previously added to the first local t-digest and the t-digests of the other computing devices;
obtaining, by the computing device, a new measurement value of the concentration of the chemical in the first fluid;
generating, by the computing device, a second local t-digest using the new measurement value;
combining, by the computing device, the global combined t-digest and the second local t-digest to generate a new combined t-digest;
determining, by the computing device, whether the new measurement value is an anomalous measurement value based at least partially on the new combined t-digest, wherein determining whether the new measurement value is an anomalous measurement value comprises querying the new combined t-digest based on the new measurement value; and
when the new measurement value is greater than a threshold that indicates the new measurement value is an anomalous measurement value, sending, by the computing device, an alert to a destination.