# US 2020/0401470 A1 · Method and system for performing automated root cause analysis of anomaly events in high-dimensional sensor data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401470 A1 - Document ID: US20200401470A1 - Status: Published application - Kind: A1 - Application number: 16/448,273 - Filed: 2019-06-21 - Published: 2020-12-24 - Earliest claimed: 2019-06-21 - Assignees: Palo Alto Research Center Incorporated - Applicants: Palo Alto Research Center Incorporated - Inventors: Deokwoo Jung - Web page: https://patentgrep.com/patent/US20200401470A1 ## CPC - G05B 19/4184: {characterised by fault tolerance, reliability of production system} - G05B 23/0281: {Quantitative, e.g. mathematical distance; Clustering; Neural networks; Statistical analysis} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 18/2323: based on graph theory, e.g. minimum spanning trees [MST] or graph cuts - G06F 18/2415: based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies} - H04L 41/142: using statistical or mathematical methods - Y02P 90/02: Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS] - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y02P: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS ## Abstract One embodiment of the present invention can provide a system for identifying a root cause of an anomaly event in operation of one or more machines is provided. During operation, the system can obtain sensor data from a set of sensors associated with the one or more machines, convert the sensor data into a set of sensor states, build an optimal DAG based on the set of sensor states to model causal dependency; determining, by using the DAG, a probability of an anomaly state of a target sensor given a state of a direct neighbor sensor, and determining a root cause of the anomaly event associated with the target sensor by back-tracking the anomaly state in the DAG. ## Claims ### Claim 1 A method for identifying a root cause of an anomaly in operation of one or more machines, the method comprising: obtaining sensor data from a set of sensors associated with the one or more machines; converting the sensor data into a set of sensor states; building an optimal Directed Acyclic Graph (DAG) for the set of sensors based on the set of sensor states to model causal dependency; determining, by using the DAG, a probability of an anomaly state of a target sensor based on a state of a direct neighbor sensor; and determining a root cause of the anomaly state associated with the target sensor by back-tracking the anomaly state in the DAG. ### Claim 2 (depends on 1) The method of claim 1, wherein converting the sensor data into a set of sensor states comprises: applying a data pre-processing technique to the sensor data to time align the sensor data with a unified global reference time, wherein the unified global reference time includes a set of time intervals; and applying a data summarization technique to the pre-processed sensor data. ### Claim 3 (depends on 2) The method of claim 2, wherein applying the data pre-processing technique further comprises: applying data interpolation techniques to the time aligned sensor data to replace missing sensor data samples. ### Claim 4 (depends on 2) The method of claim 2, wherein applying the data summarization technique to the pre-processed sensor data comprises: applying a data transformation technique to generate a set of metrics for each time interval associated with the unified global reference time; and based on the set of metrics, grouping similar attributes, strongly connected components, in a set of attributes associated with the set of sensors by using a clustering technique to shrink each strongly connected component down to a single meta-node; and based on a set of meta-nodes, constructing a meta-graph as a DAG of the meta-nodes. ### Claim 5 (depends on 1) The method of claim 1, wherein building the optimal DAG for the set of sensors based on the set of sensor states comprises: building a set of DAGs based on a set of inputs and the set of sensor states; and searching for the optimal DAG from the set of DAGs by using a Bayesian network discovery technique. ### Claim 6 (depends on 5) The method of claim 5, wherein the set of inputs includes one or more of: weather data; a user-specified black list; and a user-specified white list. ### Claim 7 (depends on 1) The method of claim 1, wherein the set of sensor states are obtained by using a K-means algorithm. ### Claim 8 (depends on 1) The method of claim 1, wherein the DAG for the set of sensors comprises: a set of nodes, wherein each node in the graph represents a sensor in a set of sensor clusters; and a set of directed edges, wherein each directed edge in the set of edges represents a casual dependency between two nodes in the graph. ### Claim 9 An apparatus for identifying a root cause of an anomaly in operation of one or more machines, comprising: one or more processors; a set of sensors embedded in the one or more machines; and memory storing instructions that, when executed by the one or more processors, cause the apparatus to: obtain sensor data from a set of sensors associated with the one or more machines; convert the sensor data into a set of sensor states; build an optimal Directed Acyclic Graph (DAG) for the set of sensors based on the set of sensor states to model causal dependency; determine, by using the DAG, a probability of an anomaly state of a target sensor based on a state of a direct neighbor sensor; and determine a root cause of the anomaly state associated with the target sensor by back-tracking the anomaly state in the DAG. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein converting the sensor data into a set of sensor states comprises: applying a data pre-processing technique to the sensor data to time align the sensor data with a unified global reference time, wherein the unified global reference time includes a set of time intervals; and applying a data summarization technique to the pre-processed sensor data. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein applying the data pre-processing technique further comprises: applying data interpolation techniques to the time aligned sensor data to replace missing sensor data samples. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein applying the data summarization technique to the pre-processed sensor data comprises: applying a data transformation technique to generate a set of metrics for each time interval associated with the unified global reference time; and based on the set of metrics, grouping similar attributes, strongly connected components, in a set of attributes associated with the set of sensors by using a clustering technique to shrink each strongly connected component down to a single meta-node; and based on a set of meta-nodes, constructing a meta-graph as a DAG of the meta-nodes. ### Claim 13 (depends on 9) The apparatus of claim 9, wherein building an optimal DAG for the set of sensors based on the set of sensor states comprises: building a set of DAGs based on a set of inputs and the set of sensor states; and searching for the optimal DAG from the set of DAGs by using a Bayesian network discovery technique. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the set of inputs includes one or more of: weather data; a user-specified black list; and a user-specified white list. ### Claim 15 (depends on 9) The apparatus of claim 9, wherein the set of sensor states are obtained by using a K-means algorithm. ### Claim 16 (depends on 9) The apparatus of claim 9, wherein the DAG for the set of sensors comprises: a set of nodes, wherein each node in the graph represents a sensor in a set of sensor clusters; and a set of directed edges, wherein each directed edge in the set of edges represents a casual dependency between two nodes in the graph. ### Claim 17 A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for identifying a root cause of an anomaly in operation of one or more machines, the method comprising: obtaining sensor data from a set of sensors associated with the one or more machines; converting the sensor data into a set of sensor states; building an optimal Directed Acyclic Graph (DAG) for the set of sensors based on the set of sensor states to model causal dependency; determining, by using the DAG, a probability of an anomaly state of a target sensor based on a state of a direct neighbor sensor; and determining a root cause of the anomaly state associated with the target sensor by back-tracking the anomaly state in the DAG. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium claim 17, wherein converting the sensor data into a set of sensor states comprises: applying a data pre-processing technique to the sensor data to time align the sensor data with a unified global reference time, wherein the unified global reference time includes a set of time intervals; and applying a data summarization technique to the pre-processed sensor data. ### Claim 19 (depends on 18) The non-transitory computer-readable storage medium claim 18, wherein applying the data summarization technique to the pre-processed sensor data comprises: applying a data transformation technique to generate a set of metrics for each time interval associated with the unified global reference time; and based on the set of metrics, grouping similar attributes, strongly connected components, in a set of attributes associated with the set of sensors by using a clustering technique to shrink each strongly connected component down to a single meta-node; and based on a set of meta-nodes, constructing a meta-graph as a DAG of the meta-nodes. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium claim 17, wherein building an optimal DAG for the set of sensors based on the set of sensor states comprises: building a set of DAGs based on a set of inputs and the set of sensor states; and searching for the optimal DAG from the set of DAGs by using a Bayesian network discovery technique.