# US 7,613,668 B2 · Anomaly detection system and a method of teaching it > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,668 B2 - Document ID: US7613668B2 - Status: Granted - Kind: B2 - Application number: 10/383,224 - Filed: 2003-03-07 - Published: 2003-12-04 - Granted: 2009-11-03 - Earliest claimed: 2000-09-11 - Assignees: Nokia Siemens Networks Oy - Inventors: Albert Höglund; Kimmo Hätönen; Antti Sorvari - Web page: https://patentgrep.com/patent/US7613668B2 ## CPC - G06N 3/08: Learning methods - G06F 18/2433: Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection - G06N 3/0499: Feedforward networks - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for teaching an anomaly detecting mechanism in a system comprising observable elements (302), at least one of which has a periodic time-dependent behaviour, the anomaly detecting mechanism comprising a computerized learning mechanism (314). The method comprises assembling indicators (304) indicating the behaviour of the elements (302) and arranging the assembled indicators such that each observable element's indicators are assigned to the same input data component. The learning mechanism (314) is taught so that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators (304). Points which approximate the input data are placed in the input space. A presentation of time (420-424) is incorporated into at least one input data component wherein the presentation of time is periodic, continuous and un-ambiguous within the period of the at least one element with periodic time-dependent behaviour. ## Claims ### Claim 1 A method, comprising: assembling indicators indicating behaviour of observable elements in a system and arranging the assembled indicators such that each indicator corresponding to each observable element is assigned to the same input data component, wherein at least one of the observable elements has a periodic time-dependent behaviour; programming a computerized learning mechanism of an anomaly detecting mechanism in the system such that input data of the learning mechanism comprises input data components which are based on the assembled indicators, and wherein the learning mechanism comprises an input space to define the input data comprising the input data components; placing points which approximate the input data in the input space; and incorporating a presentation of time into at least one input data component, wherein the presentation of time is periodic, continuous and unambiguous within a period of the at least one element with periodic time-dependent behaviour, and wherein the programmed computerized learning mechanism is configured to detect an anomaly in the system. ### Claim 2 (depends on 1) A method according to claim 1, wherein the learning mechanism is or comprises a self-organizing map. ### Claim 3 (depends on 1) A method according to claim 1, wherein the presentation of time has a first period and at least one second period which is a multiple of the first period. ### Claim 4 (depends on 1) A method according to claim 1, further comprising: scaling the input data components such that each component has the same variance, preferably one. ### Claim 5 (depends on 1) A method according to claim 1, wherein the presentation of time has a variable resolution such that one bit corresponds to different units of time depending on changes in the time-dependent behaviour. ### Claim 6 A system, comprising: a computerized learning mechanism comprising an input space for defining input data comprising input data components; means for assembling indicators indicating behaviour of observable elements in a system and arranging the assembled indicators such that each indicator corresponding to each observable element is assigned to the same input data component, wherein at least one of the observable elements has a periodic time-dependent behaviour; means for programming the learning mechanism such that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators; means for placing points which approximate the input data in the input space; and at least one input data component comprising a presentation of time to detect anomalies in the system, wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with periodic time-dependent behaviour, and wherein the programmed computerized learning mechanism is configured to detect an anomaly in the system. ### Claim 7 (depends on 6) A system according to claim 6, wherein the learning mechanism is or comprises a self-organizing map. ### Claim 8 (depends on 6) A system according to claim 6, wherein the presentation of time has a first period and at least one second period which is a multiple of the first period. ### Claim 9 (depends on 6) A system according to claim 6, wherein the system is comprised in a single network element. ### Claim 10 A computer readable medium with a computer program embodied thereon, the computer program being configured to control a processor to perform: setting up an input space for defining input data comprising input data components; receiving indicators indicating behaviour of observable elements in a system and arranging the assembled indicators such that each indicator of each observable element is assigned to the same input data component, wherein at least one of the observable elements has a periodic time dependent behaviour; programming a computerized learning mechanism of an anomaly detecting mechanism in the system such that input data of the learning mechanism comprises input data components which are based on the assembled indicators; placing points which approximate the input data in the input space; and incorporating a presentation of time into at least one input data component, wherein the presentation of time is periodic, continuous, and unambiguous within a period of the at least one element with periodic time-dependent behaviour, and wherein the programmed computerized learning mechanism is configured to detect an anomaly in the system. ### Claim 11 A system, comprising: a computerized learning mechanism configured to comprise an input space to define input data comprising input data components; an assembling unit configured to assemble indicators indicating behaviour of observable elements in a system and arranging the assembled indicators such that each indicator corresponding to each observable element is assigned to the same input data component, wherein at least one of the observable elements has a periodic time-dependent behaviour; a programming unit configured to program the learning mechanism such that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators; a placing unit configured to place points which approximate the input data in the input space; and at least one input data component comprising a presentation of time to detect anomalies in the system, wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with the periodic time-dependent behaviour, and wherein the programmed computerized learning mechanism is configured to detect an anomaly in the system. ### Claim 12 (depends on 11) A system according to claim 11, wherein the learning mechanism is or comprises a self-organizing map. ### Claim 13 (depends on 11) A system according to claim 11, wherein the presentation of time has a first period and at least one second period which is a multiple of the first period. ### Claim 14 (depends on 11) A system according to claim 11, wherein the system is comprised in a single network element. ### Claim 15 A computer readable medium with a computer program product comprising a program code embodied thereon, said program code being configured to control a processor to perform: setting up an input space for defining input data comprising input data components; receiving indicators indicating behaviour of observable elements in a system and arranging the assembled indicators such that each indicator of each observable element is assigned to the same input data component, wherein at least one of the observable elements has a periodic time dependent behaviour; programming a computerized learning mechanism of an anomaly detecting mechanism in the system such that input data of the learning mechanism comprises input data components which are based on the assembled indicators; placing points which approximate the input data in the input space; and incorporating a presentation of time into at least one input data component, wherein the presentation of time is periodic, continuous, and unambiguous within a period of the at least one element with periodic time-dependent behaviour, and wherein the programmed computerized learning mechanism is configured to detect an anomaly in the system.