Method and framework for pattern of life analysis
AssigneeThe United States of America as represented by the Secretary of the Air Force
InventorsWilliam M. Pottenger, James M. Nagy, Erik P. Blasch, Tuanjie Tong
Life of this patent
Estimating the term…
Abstract
In accordance with various embodiments of the disclosed subject matter, a method and framework configured for modeling a pattern of life (POL) by processing both categorical data and non-categorical data (e.g., numeric, spatial etc.), conducting pattern of life estimation (POLE), and detecting anomalous data in a multi-dimensional data set in a substantially simultaneous manner by comparing statistical PoL results.
Claims15
A computer implemented method for the detection and viewer ascertainable presentation of anomaly trends in a dataset containing both numerical and categorical attributes, the method comprising:
- grouping received data according to data type and dimension to provide thereby at least one categorical data type group and at least one non-categorical data type group;
- assigning a dimension precision value to data within each non-categorical data type group;
- building, using kernel density estimation (KDE), a first statistical model using data from each non-categorical data type group in accordance with the respective assigned precision value, where the KDE is determined as a ratio of density of streaming historical data and density of measured data for each non-categorical data type group;
- building, using a normal distribution, a second statistical model using each categorical data type group;
- determining, in accordance with respective probability thresholds, anomalous data items within each of the first and second statistical models;
- labeling the dataset in a manner indicative of the determined anomalous data items;
- and
- presenting said labeled dataset so as to depict said anomaly trends in a manner ascertainable by presentation to a viewer by any one of numerical graphs, spatial overlays, or semantic listings.
An apparatus for the detection and viewer ascertainable presentation of anomaly trends in a dataset containing both numerical and categorical attributes, the apparatus comprising a processor configured for:
- grouping received data according to data type and dimension to provide thereby at least one categorical data type group and at least one non-categorical data type group;
- assigning a dimension precision value to data within each non-categorical data type group;
- building, using kernel density estimation (KDE), a first statistical model using data from each non-categorical data type group in accordance with the respective assigned precision value, where the KDE is determined as a ratio of density of streaming historical data and density of measured data for each non-categorical data type group;
- building, using a normal distribution, a second statistical model using each categorical data type group;
- determining, in accordance with respective probability thresholds, anomalous data items within each of the first and second statistical models;
- labeling the dataset in a manner indicative of the determined anomalous data items;
- and
- presenting said labeled dataset so as to depict said anomaly trends in a manner ascertainable by presentation to a viewer by any one of numerical graphs, spatial overlays, or semantic listings.
A tangible and non-transient computer readable storage medium storing instructions which, when executed by a computer, adapt the operation of the computer to provide a method for the detection and viewer ascertainable presentation of anomaly trends in a dataset, comprising said stored instruction steps for:
- grouping received data according to data type and dimension to provide thereby at least one categorical data type group and at least one non-categorical data type group;
- assigning a dimension precision value to data within each non-categorical data type group;
- building, using kernel density estimation (KDE), a first statistical model using data from each non-categorical data type group in accordance with the respective assigned precision value, where the KDE is determined as a ratio of density of streaming historical data and density of measured data for each non-categorical data type group;
- building, using a normal distribution, a second statistical model using each categorical data type group;
- determining, in accordance with respective probability thresholds, anomalous data items within each of the first and second statistical models;
- and
- labeling the dataset in a manner indicative of the determined anomalous data items;
- and
- presenting said labeled dataset so as to depict said anomaly trends in a manner ascertainable by presentation to a viewer by any one of numerical graphs, spatial overlays, or semantic listings.
Dependencies are inferred from the claim text.