Anomaly Detection via Optimal Symbolic Observation of Physical Processes∗ Humberto E. Garcia and Tae-Sic Yoo Sensor, Control, and Decision Systems Group Idaho National Laboratory Idaho Falls, ID 83415-6180 {humberto.garcia}@inl.gov

Abstract This paper describes a discrete-event approach for online anomaly detection. The approach uses automata representations of the underlying physical process to make anomaly occurrence determination. Automata may represent a discrete-event formulation of the operation of the monitored system, consisting of diverse equipment components, during both normal and abnormal operations. Automata may also be generated from the conversion of symbol sequences associated with parametric variations of equipment. This symbol generation may result from variations in the wavelet transform coefficients of selected process signals, for example. Methods are utilized for encoding the underlying process dynamics from observed time series data and for constructing finite-state models from symbolic sequences. This collection of automata represents the possible-behavior symbolic model of the underlying physical process and can be used as a pattern for anomaly detection. Within the possible behavior, there is a special sub-behavior whose occurrence is required to be detected. The special behavior may be specified by the occurrence of special events representing deviations of anomalous behaviors from the nominal behavior. These intermittent or non-persistent events or anomalies may occur repeatedly. An observation mask is then defined, characterizing the actual observation configuration available for collecting process-symbolic data. The analysis task is to determine whether this observation configuration is capable of detecting the specified anomalies. The assessment is accomplished by evaluating several observability notions, such as detectability and diagnosability. If the corresponding property is satisfied, associated formal observers are constructed to perform the monitoring task at hand. The synthesis of an optimal observation mask may also be conducted to suggest an appropriate observation configuration guaranteeing the detection of anomalies and to construct associated monitoring agents. Polynomial-time, computationallyefficient verification algorithms have been developed for checking several notions of diagnosability/detectability. An on-line diagnosis algorithm has also been developed that has a lower time and space complexity than on-line diagnosis algorithms reported in literature for counting the occurrence of repeated/intermittent events. The proposed discrete-event approach and supporting techniques for anomaly detection via optimal symbolic observation of physical processes are briefly presented and illustrated with an example. ∗

This work was supported by the U.S. Department of Energy contract DE-AC07-05ID14517

1

Introduction

Condition monitoring and anomaly detection are essential for the prevention of cascading failures but also for the assurance of acceptable operations dynamics and the improvement of process reliability, availability, performance, and cost. An anomaly can be defined as a deviation from a system nominal behavior. Three types of anomalies are considered here. First, anomalies may be associated with parametric or non-parametric changes evolving in system components. Lubricant viscosity changes, bearing damages, and structural fatigues are examples in this category. Second, anomalies may be associated with violations executed during operations contrary to operability specifications that should be met at all times. For example, a specification may be to avoid starting a given pump when its associated down-stream valve is closed. If a command is sent to start the pump when its valve is closed, this condition needs to be monitored and reported (and possibly aborted). Third, anomalies may be associated with the occurrence of special events or behaviors. One relevant field is failure analysis, in which special events are identified as faults. Other examples of special behaviors include (permanent) failures, execution of critical events, reaching unstable states, or more generally meeting formal specifications defining special behaviors or anomalies. To detect anomalies (including the three types mentioned above), it is needed not only a set of sensors (i.e., a sensor configuration) to retrieve process data but also an observer to integrate and analyze the gathered process data. Optimization of sensor configurations and observers is thus an important design goal in on-line condition monitoring. One relevant field is failure analysis, in which special events are identified as faults. Recently, significant attention has been given to anomaly detection and fault analysis; see for example [1-10]. The definition of diagnosability based on failure-event specifications was first introduced in [8]. Variations to the initial definition in [8] have been proposed recently. Failure states are introduced in [10] and the notion of diagnosability is accordingly redefined. The issue of diagnosing repeatedly and the associated notion of [1, ∞]-diagnosability are first introduced in [6], along with a polynomial algorithm for checking it. To improve the complexity of previously-reported algorithms, which severely restricts its applicability, methods and an associated tool have been developed that utilizes the approach introduced in [9] for checking [1, ∞]-diagnosability with the reduced complexity of O(|X|5 × |Σ|2 ) and O(min(|X|5 , |X|3 × |Σ|2 )) for nondeterministic and deterministic behaviors, respectively, on the number of system states X and the cardinality of the system event set Σ. Similarly, techniques in symbolic time series analysis [7] have been developed to translate the problem of anomaly detection from a time series setup to discrete event formulations, upon which the above algorithms can be utilized. This transformation allows to deal with complex processes and information systems in a more efficient manner by abstracting monitored systems/signals into simpler mathematical representations. This paper builds upon the above efforts to introduce a methodology for optimizing sensor configuration meeting given system property requirements regarding condition monitoring. These requirements may include observability specifications for supervisory control applications and for event/anomaly detection applications.

2

Problem Statement

In anomaly detection applications, the objective is to detect abnormal conditions occurring within the monitored system by analyzing observable process data. To this end, models are often used to characterize normal and abnormal behaviors. A model may represent the possible and unacceptable operational dynamics of a monitored process. Thus, finite state machine (FSM) representations of system components (e.g., tanks, valves, and pumps) can be formulated and composed to describe relevant operations of the integrated system (e.g., a PUREX-based reprocessing installation). For example, operations models may define the expected changes on the state of a tank if an associated valve is open and a pump is started. Operation models may also integrate material flow specifications defining possible and special material transfers (e.g., violations or critical movements) with an interest to detect. Models may also be generated from symbolic string generations characterizing variations on representative parameters associated with process signals. In this case, time series data from a signal may be symbolized into discrete symbolic strings. This symbolization may be accomplished using wavelet transform, for example. In particular, coefficients of the wavelet transform of the time-domain signal are utilized for symbol generation instead of directly using the time series data. Variations in the monitored signal is thus detected as variations of its associated wavelet coefficients. From the symbol sequences, a FSM model can then be constructed. Within the scope of this paper, the mentioned models are formulated as discrete event systems (DES) to describe their dynamics at a higher level of abstraction, reduce computational complexity and benefit from a developed mathematical framework in where to synthesize optimal configurations and observers. In either symbolic time series analysis and event or specification violation detection applications, the objective is to detect whether a special event or an operability specification violation has occurred during operations by recording and analyzing observable events. System behavior is often divided into two mutually exclusive components, namely, the special behavior of interest (needed to be detected) and the ordinary behavior (which does not need to be reported). To accomplish the task of online detection and reporting, two design elements must be addressed. The first element is the identification of the observational information required by an observer to determine whether a special event or/and a specification violation has occurred. The second element is the construction of the associated observer algorithm that automatically integrates and analyzes collected data to assess system behavior. To improve information management and cost, the design goal is to construct a monitoring observer with a detection capability that relies on not only observed measurements but also on recorded knowledge built from continuous observation. It is then important to rigorously assess whether the monitored DES is intrinsically observable given a specified sensor configuration and a special behavior of interest. Otherwise, the goal is to identify optimized observation configurations that meet given observability property requirements. The related cost functional may be based on different design criteria, such as costs and implementation difficulty of considered sensor technologies.

3

Proposed Anomaly Detection Approach

A methodology and associated tool has been developed to identify optimal sensor configurations and associated observers to detect specification violations or specified behav-

iors. The developed framework requires first formal descriptions of the given monitored DES, (observability) property requirements, and observational constraints as shown in Fig. 1. Property requirements may include condition monitoring specifications for meetInput DE models information cost, property requirements

Input initial sensor configuration

Return online algorithm and computed sensor set

No Sensor configuration satisfies property requirements

Yes No Optimize sensor configuration

Yes Optimize sensor configuration (Random/Sequential/Manual)

No

Yes Optimization is satisfactory

Figure 1: Flow chart of developed sensor optimization framework ing detectability or/and supervisory observability objectives, for example. Given these descriptions, optimized observational configurations and associated algorithms for data integration and analysis can be systematically found that meet the specified property requirements. To formalize the monitored process, a DES model G must be constructed defining how system states change due to event occurrences. Other design elements are requested by the developed framework according to the optimization task at hand. For example, in the case of designing observers for determining whether given operability specifications are being met during operations, one elements must be specified, namely, the set of operability specifications S that should be preserved (the intrinsic observability property P here is supervisory observability). Similarly, in the case of designing sensor configurations for event detection applications, two elements must be specified, namely, the set of anomalies or special events S requiring detection and the intrinsic observability property P (i.e., detectability or diagnosability) regarding S. To formalize observational constraints, a cost functional C should be included indicating the costs associated with observation devices. Given G, S, P , and C, the design task is to compute an observational configuration or observation mask M that guarantees P of S with respect to G, while optimizing C. This mask M defines an underlying observational configuration required to assure the observability of anomalies or the detection of operability violations. After a suitable observation mask M has been computed, the implementation task is to construct an observer O that will guarantee the P of S by observing G via the observation mask M . The use of the proposed methodology in computing optimized sensor configurations for anomaly detection can be summarized as follows. For verification, the

developed technology assesses whether a given observation configuration assures the observability of special behaviors within possible system behaviors (Fig. 2.(a)). For design, the methodology identifies, for each event, which attributes need to be observed and suggests an optimal observation configuration meeting the condition monitoring requirements (Fig. 2.(b)).

(a) Verification

(b) Design

Figure 2: Use of developed framework for event detection applications

4 4.1

Observability in Anomaly Detection Preliminary

Denote by G the DES model of the monitored system considered and modelled as a FSM of four tuple, G = {X, Σ, δ, x0 }, where X is a finite set of states, Σ is a finite set of event labels, δ : X × Σ → X is a partial transition function, and x0 ∈ X is the initial state of the system. The symbol ² denotes the silent event or the empty trace. This model G accounts for both the ordinary (non-special) and special behavior of the monitored system, for example. To model observational limitations, an observation mask function M : Σ → ∆ ∪ {²} is introduced, where ∆ is the set of observed symbols, which may be disjoint with Σ.

4.2

Definitions

Let S denote the set of either controllability specifications, which should be met, or special events, which should be detected. In the case of event detection, special events can occur repeatedly, so they need to be detected repeatedly. It is assumed that events in S are not fully-observable because otherwise they could be detected/diagnosed trivially. Under supervisory observability, the interest is in signaling the occurrence of violations to operability specifications. Under detectability, the interest is in signaling the occurrence of special events, but without explicitly indicating which event exactly has occurred. Diagnosability is a refined case of detectability, where the interest often is in exact event identification. The developed mathematical framework can be used to evaluate different system properties. To illustrate, let’s assume we are interested on the event detectability property termed [1, ∞]-diagnosability (defined next) of a given

monitored system. The proposed methodology then utilizes the polynomial algorithm described in [9] for checking this notion. Other notions can also be checked, for example, the observability of a given system regarding specified controllability requirements. Definition 1 (Uniformly bounded delay) [1, ∞]-Diagnosability [6, 9] A prefix-closed live language L generated by a monitored system G is said to be uniformly [1, ∞]-diagnosable with respect to a mask function M and a special-event partition Πs on Σs if the following holds: (∃nd ∈ N)(∀i ∈ Πs )(∀s ∈ L)(∀t ∈ L/s)[|t| ≥ nd ⇒ D∞ ] where N is the set of non-negative integers and the condition D∞ is given by: D∞ : (∀w ∈ M −1 M (st) ∩ L)[Nwi ≥ Nsi ]. The above definition assumes the following necessary notation. For all Σsi ∈ Πs and a trace s ∈ L, let Nsi denote the number of events in s that belongs to the special event type Σsi (or i for simplicity). The post-language L/s is the set of possible suffixes of a trace s; i.e., L/s := {t ∈ (Σ)∗ : st ∈ L}.

4.3

Optimal Observation Configurations

The problem of selection of an optimal mask function is studied in [5]. Assuming a maskmonotonicity property, it introduces two algorithms for computing an optimal mask function. However, these algorithms assume that a sensor set supporting the mask function can be always found, which may not be true in practice. Given the above considerations, the developed framework utilizes instead the algorithm introduced in [1]. This algorithm searches the sensor set space rather than the mask function space. The computed sensor set induces a mask function naturally. Thus, it does not suffer from the issue of realization of the mask function.

4.4

Procedure for Constructing an Observer

The design task leads into a twofold objective: i) to compute objective-driven sensor configurations that optimize given information costs, and ii) to construct formal observers that guarantee the detectability of special events, specification violations, or anomalies, in general. The key design issue is then the management of sensor deployments. After computing an acceptable M that guarantees the desired property requirement (e.g., supervisory observability, detectability, or diagnosability) using the optimization algorithm of Fig. 1, an associated observer O is constructed. In event detection applications, for example, the observer algorithm will integrate and analyze observed event information (or measurements) and report the occurrences of special events. In supervisory control applications, the observer estimates system state and determines whether events executed by the observed system may violate given operability specifications. To implement the observer, either an offline or an online design approach may be used for its construction. Under an offline design approach, the deterministic automaton representation of the observer is a priori constructed, which may have high computational complexity. To overcome computational complexity, an online approach may be used instead, as proposed in [6]. Further improving [6] regarding computational complexity, the developed framework utilizes an improved version of the algorithm reported in [9]

that reduces not only the space required for realizing the observer state by |X|2 but also the time complexity by |X|2 if log(|X|) ≈ |Σ|. In event detection applications, for example, this mathematical construction of observers can thus guarantee that there is no false alarm, and no missed detection of special events (such as anomalies or failures).

5

Illustrative Applications

To illustrate the notion of anomaly detection via optimal symbolic observation of physical processes, an application in specification violation detection and another in event detection are briefly introduced next. Due to page limitation, an application of the proposed approach to symbolic time series analysis is not provided here.

5.1

Specification Violation Detection

Consider the monitored system illustrated in Fig. 3. This system consists of a pump, a tank, two valves, and interconnecting pipes. The monitored system may represent a portion of a PUREX-based reprocessing facility, for example. The basic operation of this system is as follows. With Valve 1 open and Valve 2 close, the pump starts and operates in order to fill the tank by pumping a fluid from an up-stream reservoir (not shown). When the tank is full, the pump should stop, Valve 1 close, and Valve 2 open until the tank is emptied; the cycle then repeats. Assume that there is the need to monitor the system and detect the possible violation of three specifications. In particular, Spec. 1 delineates that the pump should not start when Valve 1 is closed; Spec. 2 delineates that Valve 1 should not be closed when pump is running; and Spec. 3 delineates the basic system operation described earlier. The synthesis task is to compute an optimized sensor configuration and associated observer to conduct this anomaly detection. To this end, DES models of each component (i.e., pump, tank, valve 1, valve 2) and their interactions are constructed. FSMs of the concerned specifications are also formulated. The developed framework then automatically determines minimal sets of events (and associated observers) that need to be observed to achieve the desired condition monitoring task. For example, using the proposed methodology, it was determined that Valve 2 does not need to be observed (hence no sensor for Valve 2 is needed) in order for the monitoring system to make a determination on whether a specification violation has occurred. Valve 1 Pump

Overflow Tank Full

Medium

Valve 2

Empty

Figure 3: Monitored system under specification violation detection

5.2

Event/Anomaly Detection

Consider the monitored system illustrated in Fig. 4(a). This system consists of one input port, I1 , four internal stations, Si , i = 1, 2, 3, and 4, and two output ports, O1 and O2 . This system may represent a nuclear reprocessing facility or a nuclear power plant site, for example. Two authorized routes, (1) or (2), are identified in Fig. 4(a). Under route (1), an item should enter the monitored system through the input port I1 , move sequentially to locations S1 and S3 , and move either to location S2 or S4 ; if it goes to S2 , then an item may either exit through the output port O2 or continue to location S4 ; if at location S4 , it should exit through the output port O1 . Under route (2), an item should enter the monitored system through the input port I1 , move sequentially to locations S1 , S2 , and S3 ; it may then exit through the output port O2 or continue to location S4 , from which it should exit through the output port O2 . Besides

(a) Monitored System

(b) Ad-hoc Sensor Placement Solution

Figure 4: Monitored system and ad-hoc sensor placement solution the normal (non-special) item movements shown, assume that the two item transfer anomalies labeled with an S (for special) in Fig. 4(a) (i.e., 1S and 2S) are also possible. The design objective is to identify observation configurations (i.e., set of sensors and locations) M that provide sufficient tracking information to an observer O for detecting the occurrence of any anomaly defined in S. For comparison, Fig. 4(b) illustrates a sensor configuration that would allow an observer to immediately detect any anomaly after its occurrence. Three sensor types are shown for retrieving item movement data. “Circle,” “square,” and “triangular” sensors provide current item locations, previous item locations, and item types, respectively. This configuration may result from conducting an ad hoc design, without a rigorous analysis of the anomaly detection problem at hand. It is desired to determine whether there are other (objective-driven) sensor configurations with reduced information requirement and optimal information management. To this end, the possible-behavior model G of the system is constructed. The monitoring goal P regarding the set of special events S is also specified. Finally, an information cost C criterion is formulated. The developed framework is then invoked to compute an observation mask M that optimizes C and meets P . Figs. 5 illustrate optimized sensor configurations and the reduction in the observational requirement M that may be obtained when selecting detectability rather than diagnosability of S as the observability goal P . The imposed cost objective C is to reduce information requirements and preferably exclude sensors

that communicate item previous locations (i.e., avoid using square sensors). Figs. 6 show the effect of sensor reliability on required sensor configurations for meeting a given detection confidence requirement. In particular, Figs. 6 suggest that as the reliability of circle sensors (implemented as motion sensors, for example) decreases, more sensors may be required to meet the specified observability requirements. While the monitored system used in this example corresponds to a material flow process, the DES model G used could have also been a high level representation of any other physical process. Numerous simulations were conducted with different M and corresponding O for given P and C, under both event and specification violation detection applications. As guaranteed by the mathematical setting of the developed framework, the observer was always capable to meet the given observability requirement.

(a) Diagnosability

(b) Detectability

Figure 5: Optimized Sensor Placements: Case of reliable sensors

(a) Sensor reliability ≥ 60%

(b) 40% ≤ Sensor reliability ≤ 60%

Figure 6: Optimized Sensor Placements: Case of unreliable sensors

6

Conclusion

An approach to anomaly detection via optimal symbolic observation of physical processes was presented. Symbolic, discrete-event reformulation of the problem of anomaly detection is suggested to deal with system complexities and utilize a rigorous framework where optimal sensor configurations and associated observers for condition monitoring can be synthesized. The proposed methodology can thus be used to answer the question of how to optimally instrument a given monitored system. This design and implementation approach opens the possibility for information management optimization to reduce costs, decrease intrusiveness, and enhance automation, for example. Furthermore, it provides rich analysis capability (enabling optimization, sensitivity, what-if, and vulnerability analysis), guarantees mathematical consistency and intended monitoring performance, yields a systematic method to deal with system complexity, and enables portability of condition monitoring. Briefly mentioned here, future research involves the extension of the proposed approach into the symbolic time series analysis paradigm.

References [1] H.E. Garcia and T. Yoo, “Model-based detection of routing events in discrete flow networks,” Automatica, 41:583-594, 2005. [2] H.E. Garcia and T. Yoo, “Option: a software package to design and implement optimized safeguards sensor configurations,” In Proc. 45th INMM Annual Meeting, Orlando, FL, Jul 18-22, 2004. [3] H.E. Garcia and T. Yoo, “A methodology for detecting routing events in discrete flow networks,” In Proc. 2004 American Control Conf., 2004. [4] A. Haji-Valizadeh and K.A. Loparo, “Minimizing the cardinality of an even set for supervisors of discrete event dynamical systems,” IEEE Trans. on Autom. Control, 41(11):1579-1593, 1996. [5] S. Jiang, R. Kumar, and H.E. Garcia, “Optimal sensor selection for discrete event systems with partial observation,” IEEE Trans. Autom. Control, 48(3):369-381, 2003. [6] S. Jiang, R. Kumar, and H.E. Garcia, “Diagnosis of repeated/intermittent failures in discrete event systems,” IEEE Trans. Robotics and Automation, 19(2):310-323, 2003. [7] A. Ray, “Symbolic dynamic analysis of complex systems for anomaly detection,” Signal Processing, 84:1115-1130, 2004. [8] M. Sampath, R. Sengupta, K. Sinnamohideen, S. Lafortune, and D. Teneketzis, “Diagnosability of discrete event systems,” IEEE Trans. Autom. Control, 40(9):15551575, 1995. [9] T. Yoo and H.E. Garcia, “Event diagnosis of discrete event systems with uniformly and nonuniformly bounded diagnosis delays,” In Proc. 2004 American Control Conf., 2004. [10] S.H. Zad, “Fault diagnosis in discrete event and hybrid systems,” Ph.D. thesis, University of Toronto, 1999.