Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
  • G06N20/00—Machine learning
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
  • G06F11/0721—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment within a central processing unit [CPU]
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/079—Root cause analysis, i.e. error or fault diagnosis
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
  • G06F17/10—Complex mathematical operations
  • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F18/00—Pattern recognition
  • G06F18/20—Analysing
  • G06F18/24—Classification techniques
  • G06F18/245—Classification techniques relating to the decision surface
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
  • G06N7/00—Computing arrangements based on specific mathematical models
  • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks

Definitions

• the present invention relates to a method and system for evaluating collected measurements of a system S that may be in a healthy or faulty state.
• the system has at least one communication network, a network component of a communication system and / or a service of a communication network.
• outliers In the field of recognizing abnormal or non-normal measured values, so-called outliers, the prior art has various methods for finding abnormal or non-normal measured values.
• the finding of non-normal measured values is referred to as “outlier detection” or as outlier detection or as “anomaly detection”.
• [1] describes the use of outlier detection as one of the major steps in the area of data mining. Special attention is given in [1] to the robustness of the estimation used and different ways of outlier detection based on distance measurements, clustering and spatial methods are presented.
• a measured value can be regarded as an outlier or as a normal measured value.
• thresholds usually have to be determined with elaborate tests and evaluations. Also, readings from the set V, which have very large deviations from the majority of the measured values, but belong to a normal system state of S, are filtered out by the use of a threshold, without these being assigned according to an associated probability to a learning quantity for determining the state of a Systems could be included.
• the invention is based on the basic idea that a preferably mechanical or statistical learning system L can automatically evaluate measured values from unmarked measured values V of a system S to be monitored.
• the non-normal measured values can be an indication that the system S is in a faulty state.
• Unmarked means that there is no information about the measured value in which state - error-free / faulty - the system S was located at the time the measured value was taken.
• a randomized / randomized method is provided which, prior to the application of a learning system, removes from a learned set V of measurements those most likely to originate from a faulty state of a system S.
• the invention relates to a method for assessing collected measurements of a system S which may be in a healthy / normal or faulty / non-normal state, the system S comprising at least one communication network, a network component of a communication system and / or a communication network service comprising, with the following steps, preferably in the following order: a) forming a set V of unmarked measured values v of the system S; b) forming a modified learning set V with measured values v 'for a learning system L by removing and / or weighting measured values from the set V using a random-based method; c) forming a model M for evaluating measured values of the system S by the learning system L from the modified learning quantity V; and d) evaluating measurements of the system S by a rating system B using the model M.
• the system S may be a system with two system states - error free / normal and faulty / not normal.
• the method can also be applied to other systems S which have other system states, for example several system states.
• Reliable information about the unmarked measured values v of the system S does not necessarily have to be present according to the invention as to whether the respective measured value was measured at a point in time when the system S was in a faulty state or faultless state.
• the measured values are recorded on the measuring system S and can represent indicators of the system status. In the event that different types of measured values are available, information about the type of the measured value can also be assigned to the corresponding measured value. In the event that the measured values are time series, the quantity V can additionally Information about the time of the measurement for the individual measured values v be assigned.
• the scoring function F can form a scoring value for each individual measured value of the set V or of a subset of measured values-for example, in the case of measured values for different types of measured values at a time or a certain instance.
• the score can be a real number without restriction of generality. For example, a low score may be associated with a good score and a high score with a bad score.
• the transformation function T can assign to a score value, for example a real number, a probability value, for example a real number in the interval of [0, 1].
• the weight function G can calculate a weight for each probability p, which is determined by T, of a measured value v.
• the weight of the associated measured value v can represent a value with which the measured value v is to be weighted in the learning process / recording in V. This allows high weight readings have greater impact on the Model M.
• the functions F, T and G can be defined for individual measured values v as well as for a set of measured values V.
• the method further comprises the step of determining whether the system S is in a faultless or a faulty state.
• the transformation function T can also be a steadily growing function, preferably with 0 ⁇ T (x) ⁇ 1 for all x E, more preferably a normal distribution, a Weibull distribution, a beta distribution, or a continuous uniform distribution.
• the steadily increasing function of the transformation function T can preferably have the property 0 ⁇ T (x) ⁇ 1 for all x E E with T (-oo)> 0 and T (+ QO) ⁇ 1.
• the Scoring function F can also have a Local Outlier Factor Algorithm or a Local Outlier Probability Algorithm.
• the steps b1) to b3) can be carried out iteratively several times in succession.
• the scoring function F, the transformation function T and the random removal of measured values from V or the weighting of measured values from V can be applied several times in succession.
• the set V in step a) can be partitioned into subsets VI,..., V_N with N £ N, and in step b) modified partial quantities V_l V_N 'can be formed with N 6 and the learned set V can be the modified Operatentmengen V_ l ', ..., V_N' are joined together.
• score blocks V_1, V_N corresponding score amounts Q_1, Q_N with N G N can also be formed by at least one score function F.
• probability quantities P I,... P_N with N e N can be formed from the corresponding scoring value sets Q_ 1, Q_N by means of at least one transformation function T.
• step b) when removing and / or weighting measured values v from the set V, at least one nearest neighbor of the measured value v can also be removed.
• the removal of the nearest neighbors of the measured value v can be carried out according to value and / or time criteria.
• a next neighbor can be removed that has a comparable value, as the measured value v or the value of the measured value v comes very close.
• the nearest neighbor may be selected to be in close proximity to the reading.
• the next neighbor may have been collected at the same time or within a time limit before or after the actual measured value to be removed.
• the measurements may be selected from the group consisting of: utilization of a calculation unit, used and free memory space, utilization and status of input and output channels, number of error-free or erroneous packets, length of transmission queues, error-free or error service requests, Processing time of a service request.
• the invention also relates to a system for evaluating collected measurements of a system S which may be in a faultless or faulty state, the system S comprising at least one communication network, a network component of a communication system and / or a service of a communication network, comprising: a Means for forming a set V of unmarked measurements v of the system S; means for forming a modified learning amount V with measured values v 'for a learning system L by removing and / or weighting measured values from the set V using a random-based method; Learning system L suitable for forming a model M for evaluating measured values of the system S from the modified learning quantity V; and evaluation system B suitable for evaluating measurements of the system S using the model M.
• the means for forming the modified learning amount V ' may be adapted to form the modified learned quantity V of measured values by weighting the measured values v G V by at least one weighting function G.
• the system for evaluating collected measurements of a system S may further comprise means for Determine if the system S is in a healthy or faulty state.
• the means for forming a score amount Q may be capable of forming the score amount Q several times.
• the means for forming a probability set P may be capable of forming the probabilistic set a plurality of times.
• the means for forming the modified learning amount V may be adapted to form the modified learning amount V several times.
• the means for forming a set V of unmarked measurements v of the system S may be capable of partitioning the set V into subsets V_l, ..., V_N with N E N.
• the means for forming a modified learning amount V may be adapted to form modified partial quantities V_1 ', ..., V_N' with N ⁇ and to assemble the learned quantity V from the modified partial quantities V_l ', ..., V_N'.
• the means for forming a modified learning set V may be adapted to remove at least one nearest neighbor of the measured value v when removing and / or weighting measured values v from the set V.
• the present invention provides a method for evaluating collected measurements of a system S that manages without the application of thresholds and instead uses a randomized / randomized method.
• a randomized / randomized method By using a randomized / randomized method, the user does not have to ascertain a threshold with elaborate trials and evaluations and also have readings from the set V that have very large deviations from the majority of the readings, but belong to a normal system state of S a chance - according to the assigned probability - to be included in the learning quantity of measured values. For procedures with thresholds, this goal is difficult or impossible to achieve.
• the method according to the invention requires no knowledge of the underlying distributions of the measured values; However, if this knowledge is fully or partially present, this can be done by selecting the score function (s) F and Transformation function (s) T are used.
• probabilities calculated by the randomized method with function T are used in the present invention to randomize a learned set; not only the current learning quantity V can be important, but also the possible behavior of the measured values of the system S beyond.
• the calculated probability values are not used (only) to compile a list of outliers, but are used in a randomized procedure to determine a reduced learning quantity V from the original learning set V.
• FIG. 1 shows a schematic representation of a method for evaluating measured values of a system according to a conventional method of the prior art
• FIG. 2 shows a schematic representation of a preferred embodiment of a method for evaluating measured values of a system according to the present invention
• FIG. 3 is a schematic representation of a preferred embodiment of a system for evaluating collected measurements of a system S according to the present invention.
• FIG. 4 shows a schematic representation of a Weibull distribution used as transfer function of a preferred exemplary embodiment of a method for evaluating measured values of a system according to the present invention.
• Fig. 1 shows a schematic representation of a conventional method for evaluating collected measurements of a system S according to the prior art.
• a set V of measured values v is collected.
• This set V should serve as a learning set for a learning system L.
• the measured values v The set V are unmarked, ie it can not be said that the measured values v are faulty or not, ie whether or not the system S is in a faulty state when the measured values are taken.
• the learning system L uses a defined threshold value to evaluate the measured value quantity V or the measured values v. In the present case, measured values v, which are below the threshold value, are removed from the learning quantity and are not considered further.
• the learning amount V thus obtained, which has only the measured values v above the threshold value, is used by the learning system L to form a model M.
• the model M represents a representation of the error-free system S with respect to the learned measured values.
• the model M should now make a statement for future, new measured values w, as to whether the system S is in a faulty or faulty state with respect to the new measured values w located.
• a rating system B is formed using the model M.
• the measured values w to be evaluated of the new measured value quantity W are fed to the rating system B.
• the evaluation system B carries out the evaluation of the measured values w of the measured value quantity W taking into account the model M formed, and makes a statement as to whether the measured values w are faulty or not and thus whether the system S is in a faulty state or not.
• FIG. 2 shows a schematic representation of a preferred embodiment of a method for evaluating collected measurements of a system S according to the present invention.
• measured values v are collected again on a system S and combined into a measured value quantity V, which is intended as a learning quantity.
• a score function F is now applied to the measured values v and thus a score value Q with scoring values q is formed.
• a transformation function T is applied to this score value Q, and thus a probability set P with probabilities p is formed.
• the modified learning quantity V of measured values is then formed.
• the measured values v are taken into the modified learning quantity V with a corresponding probability of 1-p.
• the measured values v can also (or only) receive a corresponding weighting by means of a suitable weighting function G and accordingly all measured values v EV with corresponding weightings into the modified learning volume V was added.
• the learning system L forms a suitable model M using the learning set V, the model M again representing a representation of the error-free system S.
• a rating system B is subsequently formed.
• the evaluation system B is provided with newly acquired measurements w 6 W of the system and the evaluation system evaluates whether the new measurements w G W are faulty or normal and, accordingly, the system S is in a faulty or a normal state.
• the system 100 for evaluating collected measurements of a system S has a device 110 for forming a set V of unmarked measured values v of the system S, a device 120 for forming a modified learning quantity V, a learning system L 130, a rating system B 140 and a device 150 for determining whether the system S is in a faulty or a faulty state.
• the device 110 receives measured values v collected by the system S and uses these measured values to form a set V of unmarked measured values v. Subsequently, a modified learning quantity V with measured values v 'is formed in the device 120 as follows:
• a scoring value Q with the scores q is formed by means of a score function F from the set V with the measured values v.
• a probability set P with probabilities p is formed in the device 121 by means of a transformation function T from the scoring value Q with the scores q.
• a modified learning quantity V is created by randomization / random-based treatment of the originally collected quantity V.
• the modified learning amount V in the learning system L 130 is used to form a model M for the system S.
• the model M represents a representation of the error-free system S. With the aid of this model M, it is then evaluated in the evaluation system B 140 whether measurement values w to be evaluated w of a new measured value set W of the system are faulty or not.
• the measured value quantity W with the measured values w to be evaluated can likewise have been formed or recorded by the device 110. Subsequently, it is determined in a device 150 on the basis of the evaluation of the measured values w, whether the system S is in a faultless or faulty state. The results thus determined, whether the measured values w are faulty or not, or whether the system S is in a faulty or error-free state, can accordingly subsequently be further processed in a further system.
• V (101, 102, 1, 100, 103, 105).
• the learning system L has no information as to whether the outlier is an erroneous or error-free measured value and whether this outlier was measured by S in the event of a faulty or error-free system state.
• the function is instead taken as the scorefunction F (v), which for each measured value v from V forms the distance to the closest measured value from V and divides it by the mean distance m of all measured values from V. It denotes d (v) the minimum distance of the measured value v to all other measured values.
• these scores are then transformed to probabilities using a transfer function T.
• T a transfer function
• the Weibull distribution T is defined as follows:
• T (x; k, lambda) (k / lambda) (x / lambda) A (k-1) exp (- (x / lambda) A k) where " A " is the exponentiation and exp ( ) the exponential function.
• FIG. 3 shows the Weibull distribution according to the invention with these parameters.
• the individual measured values are now randomly removed from the learning quantity V on the basis of the calculated probability value.
• the modified learning quantity V thus contains the following measured values with high probability:
• a suitable model M is formed, and then using the model M, an evaluation system B is formed.
• the evaluation system B can then be provided with new measured values w EW of the system and the evaluation system can evaluate whether the new measured values w € W are faulty or normal and, accordingly, the system S is in a faulty or a normal state.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Data Mining & Analysis (AREA)
• General Engineering & Computer Science (AREA)
• Mathematical Physics (AREA)
• Software Systems (AREA)
• Computational Mathematics (AREA)
• Mathematical Analysis (AREA)
• Mathematical Optimization (AREA)
• Pure & Applied Mathematics (AREA)
• Evolutionary Computation (AREA)
• Artificial Intelligence (AREA)
• Life Sciences & Earth Sciences (AREA)
• Bioinformatics & Cheminformatics (AREA)
• Bioinformatics & Computational Biology (AREA)
• Evolutionary Biology (AREA)
• Computer Vision & Pattern Recognition (AREA)
• Probability & Statistics with Applications (AREA)
• Algebra (AREA)
• Computing Systems (AREA)
• Operations Research (AREA)
• Databases & Information Systems (AREA)
• Medical Informatics (AREA)
• Quality & Reliability (AREA)
• Biomedical Technology (AREA)
• Health & Medical Sciences (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
• Debugging And Monitoring (AREA)
• Maintenance And Management Of Digital Transmission (AREA)
• Machine Translation (AREA)

Priority Applications (4)

Applications Claiming Priority (2)

Publications (1)

Family

ID=49303764

Family Applications (1)

Country Status (7)

Families Citing this family (9)

Citations (3)

Family Cites Families (6)

• 2013
  • 2013-09-27 ES ES13186464.7T patent/ES2568052T3/es active Active
  • 2013-09-27 EP EP13186464.7A patent/EP2854045B1/de active Active
• 2014
  • 2014-08-13 WO PCT/EP2014/067352 patent/WO2015043823A1/de not_active Ceased
  • 2014-08-13 CN CN201480053481.0A patent/CN105765563B/zh active Active
  • 2014-08-13 JP JP2016517418A patent/JP6200076B2/ja active Active
  • 2014-08-13 US US15/024,365 patent/US20160239753A1/en not_active Abandoned
  • 2014-08-13 KR KR1020167010225A patent/KR101733708B1/ko active Active

Patent Citations (3)

Non-Patent Citations (5)

Also Published As

Similar Documents

Legal Events