Method and device for detecting anomalies in technical systems

A device comprising:

• a processor;
• a memory storing an environment anomaly model and a system anomaly model;
• wherein the processor is configured to:
• obtain sensor output;
• generate from the sensor output:
• an environment state vector that includes at least one first value characterizing a physical environment condition of an environment in which the technical system operates;
• and
• a system state vector that includes at least one second characterizing a physical condition of the technical system;
• use the environment anomaly model to ascertain as output an environment value based on the environment state vector, which is applied as input to the environment anomaly model, the environment value characterizing a probability or a probability density value of an occurrence of the input environment state vector;
• use the system anomaly model to ascertain as output a system value based on a combination of the environment state vector and the system state vector, which are both applied as input to the system anomaly model, the system value characterizing a conditional probability or a conditional probability density value of an occurrence of the input system state vector when the input environment state vector occurs;
• determine whether an anomaly is present based on the environment value and the system value;
• and
• control the technical system based on a result of the determination.

A method for training an anomaly detection device, the method comprising the following steps:

• ascertaining a plurality of environment state vectors and a plurality of respective corresponding system state vectors, each of the environment state vectors including at least one first value that characterizes a physical environment condition of an environment in which the technical system operates, and each of the respective corresponding system state vectors including at least one second value that characterizes a physical condition of the technical system;
• training an environment anomaly model of the anomaly detection device and a system anomaly model of the anomaly detection device based on the ascertained plurality of environment vectors and the respective corresponding system state vectors;
• wherein the method includes at least one of the following two features (a) and (b):
• (a) the training includes iteratively modifying parameters of at least one of the environmental anomaly model and the system anomaly model, each of one or more of the iterations including:
• obtaining a respective value pair formed of a respective environment value characterizing a probability or a probability density value of an occurrence of one of the environment state vectors and a respective system value characterizing a conditional probability or a conditional probability density value of an occurrence of one the system state vectors when the one of the input environment state vector occurs;
• comparing the obtained respective value pair to an expected value pair;
• and
• modifying the parameters based on a result of the comparison;
• and
• (b) the training is performed in response to the anomaly detection device generating a predefined inconsistency, the predefined inconsistency being that one of the environment state vectors is determined by the anomaly detection device to be anomalous and that a corresponding one of the system state vectors is not anomalous.

A training device configured to train an anomaly detection device, the training device comprising:

• a processor;
• and
• a memory storing an environment anomaly model and a system anomaly model;
• wherein:
• the processor is configured to:
• ascertain a plurality of environment state vectors and a plurality of respective corresponding system state vectors, each of the environment state vectors including at least one first value that characterizes a physical environment condition of an environment in which the technical system operates, and each of the respective corresponding system state vectors including at least one second value that characterizes a physical condition of the technical system;
• train the environment anomaly model of the anomaly detection device and the system anomaly model of the anomaly detection device based on the ascertained plurality of environment vectors and the respective corresponding system state vectors;
• and
• the training device includes at least one of the following two features (a) and (b):
• (a) the training includes iteratively modifying parameters of at least one of the environmental anomaly model and the system anomaly model, each of one or more of the iterations including:
• obtaining a respective value pair formed of a respective environment value characterizing a probability or a probability density value of an occurrence of one of the environment state vectors and a respective system value characterizing a conditional probability or a conditional probability density value of an occurrence of one the system state vectors when the one of the input environment state vector occurs;
• comparing the obtained respective value pair to an expected value pair;
• and
• modifying the parameters based on a result of the comparison;
• and
• (b) the training is performed in response to the anomaly detection device generating a predefined inconsistency, the predefined inconsistency being that one of the environment state vectors is determined by the anomaly detection device to be anomalous and that a corresponding one of the system state vectors is not anomalous.

A non-transitory machine-readable memory medium on which is stored a computer program for a technical system, the computer program, when executed by a computer, causing the computer to perform the following steps:

• obtaining sensor output;
• generating from the sensor output:
• an environment state vector that includes at least one first value characterizing a physical environment condition of an environment in which of the technical system operates;
• and
• a system state vector that includes at least one second value characterizing a physical condition of the technical system;
• using an environment anomaly model to ascertain as output an environment value based on the environment state vector, which is applied as input to the environment anomaly model, the environment value characterizing a probability or a probability density value of an occurrence of the input environment state vector;
• using a system anomaly model to ascertain as output a system value based on a combination of the environment state vector and the system state vector, which are both applied as input to the system anomaly model, the system value characterizing a conditional probability or a conditional probability density value of an occurrence of the input system state vector when the input environment state vector occurs;
• determining whether an anomaly is present based on the environment value and the system value;
• and
• controlling the technical system based on a result of the determination.

A non-transitory machine-readable memory medium on which is stored a computer program for training an anomaly detection device, the computer program, when executed by a computer, causing the computer to perform a method, the method including the following steps:

• ascertaining a plurality of environment state vectors and a plurality of respective corresponding system state vectors, each of the environment state vectors including at least one first value that characterizes a physical environment condition of an environment in which the technical system operates, and each of the respective corresponding system state vectors including at least one second value that characterizes a physical condition of the technical system;
• training an environment anomaly model of the anomaly detection device and a system anomaly model of the anomaly detection device based on the ascertained plurality of environment vectors and the respective corresponding system state vectors;
• wherein the method includes at least one of the following two features (a) and (b):
• (a) the training includes iteratively modifying parameters of at least one of the environmental anomaly model and the system anomaly model, each of one or more of the iterations including:
• obtaining a respective value pair formed of a respective environment value characterizing a probability or a probability density value of an occurrence of one of the environment state vectors and a respective system value characterizing a conditional probability or a conditional probability density value of an occurrence of one the system state vectors when the one of the input environment state vector occurs;
• comparing the obtained respective value pair to an expected value pair;
• and
• modifying the parameters based on a result of the comparison;
• and
• (b) the training is performed in response to the anomaly detection device generating a predefined inconsistency, the predefined inconsistency being that one of the environment state vectors is determined by the anomaly detection device to be anomalous and that a corresponding one of the system state vectors is not anomalous.