# US 12,112,241 B2 · Systems and methods for detecting and grouping anomalies in data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,112,241 B2 - Document ID: US12112241B2 - Status: Granted - Kind: B2 - Application number: 16/577,699 - Filed: 2019-09-20 - Published: 2020-03-26 - Granted: 2024-10-08 - Earliest claimed: 2018-09-20 - Assignees: Cable Television Laboratories, Inc. - Applicants: Cable Television Laboratories, Inc. - Inventors: Jingjie Zhu; Karthik Sundaresan - Web page: https://patentgrep.com/patent/US12112241B2 ## CPC - G06N 20/00: Machine learning - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06F 18/23213: with fixed number of clusters, e.g. K-means clustering - G06F 2218/08: Feature extraction - G06F 2218/12: Classification; Matching - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present disclosure generally relates to apparatus, software and methods for detecting anomalous elements in data. For example, the data can be any time series, such as but not limited to radio frequency data, temperature data, stock data, or production data. Each type of data may be susceptible to repeating phenomena that produce recognizable features of anomalous elements. In some embodiments, the features can be characterized as known patterns and used to train a machine learning model via supervised learning to recognize those features in a new data series. ## Claims ### Claim 1 A method for detecting anomalous elements in data comprising: generating a data series from a plurality of signals received from one or more cable modems operating on a communication network; detrending the data series to obtain an un-tilted data series; designating a number of elements within the un-tilted data series as a sliding window; moving the sliding window in increments across the un-tilted data series; calculating a median and a standard deviation for the sliding window at each increment; when the standard deviation for the sliding window at one of the increments is greater than a threshold (SD threshold), identifying anomalous elements within the sliding window; replacing the anomalous elements with the median of the sliding window to create a modified sliding window at the one increment; calculating a new median and a new standard deviation for the modified sliding window; identifying new anomalous elements within the modified sliding window when the new standard deviation is greater than a new SD threshold; scoring the data series based on a quantity of the new anomalous elements, a magnitude of the new anomalous elements, or both a quantity and a magnitude of the new anomalous elements; when the score is greater than or equal to a specified number, identifying which of the one or more cable modems from which the data series is obtained is an impaired cable modem; and transmitting signals to/from the impaired cable modem outside frequencies associated with the new anomalous elements. ### Claim 2 (depends on 1) The method of claim 1, wherein the step of identifying the new anomalous elements comprises: determining a squared error between the median for the sliding window and each element within the modified sliding window; setting a threshold for the squared error (SE threshold); and identifying elements exceeding the SE threshold as the new anomalous elements. ### Claim 3 (depends on 2) The method of claim 2, wherein the magnitude of new anomalous elements is an average, a mean, a median or a sum of all the squared errors exceeding the SE threshold. ### Claim 4 (depends on 1) The method of claim 1, wherein the SD threshold and the new SD threshold are the same or different. ### Claim 5 (depends on 1) The method of claim 1 further comprising classifying the data series as being a patterned data series comprising a feature when the score exceeds a set value. ### Claim 6 (depends on 5) The method of claim 5, wherein the feature is selected from the group consisting of LTE ingress, an MER spike, amplifier suckout, frequency roll-off, wireless interference patterns and combinations thereof. ### Claim 7 (depends on 5) The method of claim 5 further comprising grouping a plurality of the patterned data series into one or more clusters. ### Claim 8 (depends on 7) The method of claim 7 further comprising identifying one or more cable modems transmitting the patterned data series. ### Claim 9 (depends on 5) The method of claim 5 further comprising using the patterned data series to train a machine learning model. ### Claim 10 (depends on 1) The method of claim 1 further comprising a step of normalizing the un-tilted data series. ### Claim 11 (depends on 1) The method of claim 1, wherein the step of detrending comprises substantially removing one or more slopes of the data series. ### Claim 12 A non-transitory computer-readable medium having a plurality of non-transitory instructions executable with a processor for detecting anomalous elements in data, the plurality of non-transitory instructions being executable for: generating a data series from a plurality of signals received from one or more cable modems operating on a communication network; detrending the data series to obtain an un-tilted data series; designating a number of elements within the un-tilted data series as a sliding window; moving the sliding window in increments across the un-tilted data series; calculating a median and a standard deviation for the sliding window at each increment; when the standard deviation for the sliding window at one of the increments is greater than a threshold (SD threshold), identifying anomalous elements within the sliding window; replacing the anomalous elements with the median of the sliding window to obtain a modified sliding window at the one increment; calculating a new median and a new standard deviation for the modified sliding window; identifying new anomalous elements within the modified sliding window when the new standard deviation is greater than a new SD threshold; scoring the data series based on a quantity of the new anomalous elements, a magnitude of the new anomalous elements, or both a quantity and a magnitude of the new anomalous elements; when the score is greater than or equal to a specified number, identifying which of the one or more cable modems from which the data series is obtained is an impaired cable modem; and transmitting signals to/from the impaired cable modem outside frequencies associated with the new anomalous elements. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein identifying the new anomalous elements comprises: determining a squared error between the median for the sliding window and each element within the modified sliding window; setting a threshold for the squared error (SE threshold); and identifying elements exceeding the SE threshold as the new anomalous elements. ### Claim 14 (depends on 12) The non-transitory computer-readable medium of claim 12 further comprising the plurality of non-transitory instructions being executable for classifying the data series as being a patterned data series comprising a feature when the score exceeds a set value. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14 further comprising the plurality of non-transitory instructions being executable for grouping a plurality of the patterned data series into one or more clusters. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14 further comprising the plurality of non-transitory instructions being executable for identifying one or more cable modems transmitting the patterned data series. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the feature is selected from the group consisting of LTE ingress, an MER spike, amplifier suckout, frequency roll-off, wireless interference patterns and combinations thereof. ### Claim 18 (depends on 14) The non-transitory computer-readable medium of claim 14 further comprising the plurality of non-transitory instructions being executable for using the patterned data series to train a machine learning model.