Abstract: A computer-implemented method, system, and computer program product are provided for anomaly detection. The method includes receiving, by a processor, sensor data from a plurality of sensors in a system. The method also includes generating, by the processor, a relationship model based on the sensor data. The method additionally includes updating, by the processor, the relationship model with new sensor data. The method further includes identifying, by the processor, an anomaly based on a fused single-variant time series fitness score in the relationship model. The method also includes controlling an operation of a processor-based machine to change a state of the processor-based machine, responsive to the anomaly.

Abstract: Systems and methods for managing components of physical systems, including decomposing raw time series by extracting an aging trend and a fluctuation term from the time series using an objective function of an optimization problem, the objective function minimizing reconstruction error and ensuring flatness of the fluctuation term over time. The optimization problem is transformed into a Quadratic Programming (QP) formulation including a monotonicity constraint and a non-negativity constraint, the constraints being merged together to reduce computational costs. An aging score and a confidence score are generated for the extracted aging trend to determine a severeness of aging for one or more components of the physical system, and the aging score and confidence score are fused to provide a fused ranking for the extracted aging trend for predicting future failures of the components.

Abstract: A power generator system with anomaly detection and methods for detecting anomalies include a power generator that includes one or more physical components configured to provide electrical power. Sensors are configured to make measurements of a state of respective physical components, outputting respective time series of said measurements. A monitoring system includes a fitting module configured to determine a predictive model for each pair of a set of time series, an anomaly detection module configured to compare new values of each pair of time series to values predicted by the respective predictive model to determine if the respective predictive model is broken and to determine a number of broken predictive model, and an alert module configured to generate an anomaly alert if the number of broken predictive models exceeds a threshold.

Abstract: A method is provided for banking with suspicious remittance detection for a set of users. The method includes detecting, by a server having a processor operatively coupled to a memory, unrealistic user location movements, based on login activities and remittance activities. The method includes detecting abnormal user remittance behavior based on account activities and the remittance activities by detecting any users who are silent for a threshold period of time and thereafter remit an amount of money greater than a threshold money amount. The method includes detecting abnormal overall user behavior, based a joint user profile determined across all users from the login, remittance, and account activities. The method includes aggregating detection results to generate a final list of suspicious transactions. The method includes performing a loss preventative action for the suspicious transactions in the final list by preventing a completion of the suspicious transactions and notifying bank personnel.

Abstract: Systems and methods for mitigating fraud in transactions including clustering account holders into groups with a cluster generator by jointly considering account activities as features in a clustering algorithm such that account holders in each group have similar behavior according to analysis of the features in the clustering algorithm. In each group, a list of suspicious transactions is detected with a suspicious behavior detector by determining outlier transactions for a transaction type of interest relative to transactions of each account holder in a group. An alert is generated and sent to users with a fraud suspicion response system to mitigate the suspicious transactions.

Abstract: A system, method, and computer program product are provided for suspicious remittance detection for a set of users. The method includes detecting, by a processor, unrealistic user location movements, based on login activities and remittance activities. The method includes detecting, by the processor, abnormal user remittance behavior based on account activities and the remittance activities by detecting any users who are silent for a threshold period of time and thereafter remit an amount of money greater than a threshold money amount. The method includes detecting, by the processor, abnormal overall user behavior, based a joint user profile determined across all users from the login activities, the remittance activities, and the account activities. The method includes aggregating, by the processor, detection results to generate a final list of suspicious transactions. The method includes performing, by the processor, loss preventative actions for each of the suspicious transactions in the final list.

Abstract: A computer-implemented method, system, and computer program product are provided for anomaly detection. The method includes receiving, by a processor, sensor data from a plurality of sensors in a system. The method also includes generating, by the processor, a relationship model based on the sensor data. The method additionally includes updating, by the processor, the relationship model with new sensor data. The method further includes identifying, by the processor, an anomaly based on a fused single-variant time series fitness score in the relationship model. The method also includes controlling an operation of a processor-based machine to change a state of the processor-based machine, responsive to the anomaly.

Abstract: A power generator system with anomaly detection and methods for detecting anomalies include a power generator that includes one or more physical components configured to provide electrical power. Sensors are configured to make measurements of a state of respective physical components, outputting respective time series of said measurements. A monitoring system includes a fitting module configured to determine a predictive model for each pair of a set of time series, an anomaly detection module configured to compare new values of each pair of time series to values predicted by the respective predictive model to determine if the respective predictive model is broken and to determine a number of broken predictive model, and an alert module configured to generate an anomaly alert if the number of broken predictive models exceeds a threshold.

Abstract: Methods and systems for detecting anomalies include determining a predictive model for each pair of a set of time series, each time series being associated with a component of a system. New values of each pair of time series are compared to values predicted by the respective predictive model to determine if the respective predictive model is broken. A number of broken predictive models is determined. An anomaly alert is generated if the number of broken predictive models exceeds a threshold.

Abstract: Systems and methods for managing one or more physical systems, including determining system behavior switching based on time series data from one or more sensors in the system. Time series is divided into a plurality of segments, and each of the segments represents a system behavior. A fitness model is generated for each of the segments to determine whether to select each of the segments as invariants, and an ensemble of local relationship models are built for each of the time series for each invariant to identify local behavior switching points over time. The identified local behavior switching points of each invariant are aggregated by aligning the local switching points of all invariant segments, computing a density distribution of the aligned switching points, and extracting local maximas of the density distribution to determine the global switching points. System operations are controlled based on the determined system behavior switching.

Abstract: A process to control a machine by receiving data captured from one or more sensors in the machine generating high-dimensional time series sets in a machine; performing structure precomputing to obtain structures of different sets and time series in each set; performing supervised distance learning by imposing label information to the obtained structures, learning a transformation matrix; transforming the data to shrink a distance between sets with the same label and to stretch the distance between sets with different labels; and applying the transformed data to control the machine responsive to the time series data.

Abstract: Systems and methods for managing components of physical systems, including decomposing raw time series by extracting an aging trend and a fluctuation term from the time series using an objective function of an optimization problem, the objective function minimizing reconstruction error and ensuring flatness of the fluctuation term over time. The optimization problem is transformed into a Quadratic Programming (QP) formulation including a monotonicity constraint and a non-negativity constraint, the constraints being merged together to reduce computational costs. An aging score and a confidence score are generated for the extracted aging trend to determine a severeness of aging for one or more components of the physical system, and the aging score and confidence score are fused to provide a fused ranking for the extracted aging trend for predicting future failures of the components.

Abstract: Systems and methods for quality control for physical systems, including a quality control engine for transforming raw time series data collected from each of a plurality of sensors in the physical system into one or more sets of feature series by extracting features from the raw time series. Feature ranking scores are generated for each of the sensors by ranking each of the features using an ensemble of feature rankers, and fused importance scores are generated by aggregating the feature ranking scores for each of the sensors and combining ranking scores from each ranker in the ensemble. System quality is controlled by identifying sensors responsible for quality degradation based on the fused importance scores.