Anomaly Detection with State Space Models Multi-dimensional State - PowerPoint PPT Presentation

Anomaly Detection CAMCOS 2009 Introduction ADAPT Anomaly Detection with State Space Models Multi-dimensional State Space Models SVD Method EM Algorithm Kalman Filter Maja Derek, Kate Isaacs, Duncan McElfresh, Jennifer Alarm Murguia, Vinh Nguyen, David Shao, Caleb Wright, Results Future Work David Zimmermann San José State University December 9, 2009

Anomaly Detection Anomaly Detection CAMCOS 2009 ◮ We wish to automatically detect anomalies in Introduction aeronautical systems. ADAPT State Space ◮ Anomalies may be broken equipment, failed sensors, Models SVD Method or operator mistakes. EM Algorithm ◮ Detection is the first step towards diagnosis and Kalman Filter Alarm repair. Results Future Work

Anomaly Detection Difficulties in Anomaly Detection CAMCOS 2009 Introduction ◮ These systems are complicated. ADAPT ◮ Cannot be reasonably ’solved.’ State Space Models ◮ Many configurations of the system, both good and SVD Method bad EM Algorithm Kalman Filter Alarm Results Future Work

Anomaly Detection Problems with Current Detection Systems CAMCOS 2009 Introduction ◮ Rely on subjective parameters from a human expert ADAPT ◮ Require examples of previous faults State Space Models ◮ Are slow to realize an error SVD Method EM Algorithm ◮ Go too far in reducing the problem Kalman Filter Alarm Results Future Work

Anomaly Detection ADAPT CAMCOS 2009 A dvanced D iagnostics a nd P rognostics T estbed Introduction ◮ Set of testbeds designed by NASA for development, ADAPT benchmarking, and competition. State Space Models ◮ ADAPT Electrical Power System is analogous to SVD Method electrical systems in air and spacecraft. EM Algorithm Kalman Filter ◮ We have nominal (healthy) and faulty (sick) Alarm time-dependent data from an ADAPT power system. Results Future Work

Anomaly Detection The Goal CAMCOS 2009 Introduction ADAPT Develop a method for building a detector that is: State Space Models SVD Method ◮ Accurate - doesn’t miss anomalies EM Algorithm (false negatives) while not sounding Kalman Filter false alarms (false positives). Alarm Results ◮ Responsive - detects anomalies Future Work soon after they occur ◮ Self-contained - should not require experience from live experts or examples of previous faults

Anomaly Detection The Solution CAMCOS 2009 Introduction ADAPT ADAPT Data State Space Models SVD Method Build State Space Models EM Algorithm Kalman Filter SVD Method Alarm EM Algorithm Results Future Work Build Alarm Detect Anomalies

Anomaly Detection The Solution CAMCOS 2009 Introduction ADAPT ADAPT Data State Space Models SVD Method Build State Space Models EM Algorithm Kalman Filter SVD Method Alarm EM Algorithm Results Future Work Build Alarm Detect Anomalies

Anomaly Detection The System CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work Power Supply Controls Load Bank

Anomaly Detection The Discrete “Inputs” CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work u t x t ◮ Switches Discrete inputs directly affect ◮ Circuit breakers the internal state of the system.

Anomaly Detection The Continuous “Outputs” CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work ◮ Voltage u y t t x t ◮ Current ◮ Temperature Continuous outputs are ◮ Phase angle affected by the internal state ◮ Speed/flow of the system, as well as by the inputs.

Anomaly Detection The Data CAMCOS 2009 Introduction Data collected from ADAPT experiments State Space Models ◮ Uniform time length SVD Method EM Algorithm ◮ Different switches Kalman Filter flipped at different Alarm times Results Future Work ◮ 79 nominal data sets ◮ 154 faulty data sets

Anomaly Detection Nominal Data CAMCOS 2009 Introduction ADAPT ◮ 79 data sets State Space Models collected with no SVD Method errors EM Algorithm Kalman Filter ◮ We used these to Alarm figure out how the Results system acts Future Work normally

Anomaly Detection Nominal Data CAMCOS 2009 Introduction ADAPT ◮ 154 data sets State Space Models collected with errors SVD Method injected EM Algorithm Kalman Filter ◮ We used these to Alarm test our alarm Results detector Future Work Can you detect both faults?

Anomaly Detection Our System CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work

Anomaly Detection Our System CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work

Anomaly Detection The Solution CAMCOS 2009 Introduction ADAPT ADAPT Data State Space Models SVD Method Build State Space Models EM Algorithm Kalman Filter SVD Method Alarm EM Algorithm Results Future Work Build Alarm Detect Anomalies

Anomaly Detection The ADAPT System CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work ◮ Triangles around inputs ◮ Circles around outputs

Anomaly Detection The State Space Model CAMCOS 2009 Introduction ADAPT u 1 u 2 u 3 State Space Models SVD Method EM Algorithm x x x 1 2 3 Kalman Filter Alarm Results y 1 y 2 y 3 Future Work ◮ u t (triangles) are inputs; y t (circles) are outputs ◮ x t (blue squares) are called state space vectors ◮ Red arrows (which indicate interaction between u t , y t , and x t ) are parameters

Anomaly Detection What We Know CAMCOS 2009 Introduction ADAPT u 1 u 2 u 3 State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results y 1 y 2 y 3 Future Work ◮ We do not know our x t whitespace whitespace whitespace

Anomaly Detection What We Know CAMCOS 2009 Introduction ADAPT u 1 u 2 u 3 State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results y 1 y 2 y 3 Future Work ◮ We do not know our x t ◮ We do not know our parameters whitespace whitespace

Anomaly Detection The State Space Equations CAMCOS 2009 Introduction ADAPT x t = A x t − 1 + B u t + w t State Space Models SVD Method y t = C x t + D u t + v t EM Algorithm Kalman Filter whitespace Alarm Results ◮ Vectors u t are inputs Future Work ◮ Vectors y t are outputs ◮ Vectors x t are state space vectors ◮ Matrices A , B , C , D and vectors w t , v t are parameters

Anomaly Detection Problem Outline CAMCOS 2009 Introduction ADAPT State Space Models ◮ What is our state space dimension, dim ( x t ) ? (SVD SVD Method method) EM Algorithm Kalman Filter ◮ How do we find the parameters? (EM algorithm) Alarm Results ◮ How do we find our state space vectors x t ? (Kalman Future Work Filter) ◮ How does this model detect an anomaly?

Anomaly Detection The Solution CAMCOS 2009 Introduction ADAPT ADAPT Data State Space Models SVD Method Build State Space Models EM Algorithm Kalman Filter SVD Method Alarm EM Algorithm Results Future Work Build Alarm Detect Anomalies

Anomaly Detection State Space Dimension Estimation CAMCOS 2009 Introduction ADAPT State Space Models SVD Method ◮ Problem : What is the dimension of the hidden state EM Algorithm Kalman Filter space vector x t ? Alarm Results ◮ To find dim x t , we use the singular value Future Work decomposition (SVD) method.

Anomaly Detection SVD Method CAMCOS 2009 Introduction ADAPT State Space ◮ Formulate the Hankel matrix Models SVD Method ◮ The Hankel matrix describes the autocorrelations of EM Algorithm the input vectors u t and the output vectors y t . Kalman Filter Alarm ◮ Compute singular values of the Hankel matrix Results ◮ Singular values are non-negative numbers. Future Work ◮ In case of no noise, the number of nonzero singular values equals the state space dimension.

Anomaly Detection Reasons to Use SVD Method CAMCOS 2009 Introduction ADAPT State Space Models We decide to use the SVD method because: SVD Method EM Algorithm ◮ It does not rely on parameters A , B , C , D . Kalman Filter Alarm ◮ It is computationally fast. Results Future Work The SVD method is based on a theorem due to Kronecker’s contributions.

Anomaly Detection Theorem CAMCOS 2009 Introduction In the absence of error, the rank of the Hankel matrix is ADAPT equal to the state space dimension. State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work Kronecker 1823-1891 ◮ Rank of Hankel matrix = number of non-zero singular values. ◮ State space dimension = dim ( x t ) .

Anomaly Detection Simulation CAMCOS 2009 Introduction ADAPT State Space Models SVD Method ◮ We validate our SVD method with simulated data. EM Algorithm Kalman Filter ◮ Simulated data has dim ( x t ) = 5. Alarm Results ◮ We expect our result to have the same state space Future Work dimension.

Anomaly Detection Simulation Result CAMCOS 2009 Introduction ADAPT State Space Models SVD Method EM Algorithm Kalman Filter Alarm Results Future Work