US 12,271,256 B2
Anomaly diagnosis for time series data
Joseph Porter, Nolensville, TN (US); Vukasin Toroman, Karlsruhe (DE); Daniel Kearns, Half Moon Bay, CA (US); Namrata Rao, Fremont, CA (US); and Nikunj R. Mehta, Cupertino, CA (US)
Assigned to Falkonry Inc., Cupertino, CA (US)
Filed by Falkonry Inc., Cupertino, CA (US)
Filed on Oct. 28, 2022, as Appl. No. 17/976,575.
Prior Publication US 2024/0143425 A1, May 2, 2024
Int. Cl. G06F 11/00 (2006.01); G06F 11/07 (2006.01)
CPC G06F 11/0751 (2013.01) [G06F 11/0721 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method of managing time series data, comprising:
obtaining, by a processor, a plurality of anomaly signals corresponding to a plurality of sensor signals of a physical system, wherein each anomaly signal comprises an anomaly value for each of a plurality of time durations during a period of time;
segmenting, by the processor, one or more anomaly signals within the plurality of anomaly signals into a plurality of time segments, wherein each time segment in the plurality of time segments represents a change in the one or more anomaly signals relative to a previous time segment;
determining, by the processor, an anomaly score for each time segment in the plurality of time segments based on anomaly values of the one or more anomaly signals during the time segment;
identifying, by the processor, an anomaly time interval corresponding to at least one consecutive time segment within the plurality of time segments;
clustering, by the processor, the plurality of anomaly signals within the anomaly time interval to identify an anomaly group of sensor signals associated with the anomaly time interval;
determining, by the processor, an aggregate anomaly score for the anomaly group of sensor signals;
generating, by the processor, a graphical user interface presenting a representation of the anomaly group of sensor signals and the aggregate anomaly score;
causing the graphical user interface to be displayed on a user device;
assigning one or more labels to each sensor signal based on one or more signal trees for the physical system, wherein each node in the one or more signal trees has an associated label and represents an attribute associated with a sensor signal;
for each label in the one or more signal trees, determining a background probability that the label occurs in the one or more signal trees;
for each label in the one or more signal trees, determining an anomaly probability that the label occurs in the anomaly group of sensor signals; and
selecting a subset of labels based on a result of comparing the anomaly probability to the background probability,
wherein the graphical user interface presents a graphical representation of the subset of labels in association with the anomaly group of sensor signals.