Alert similarity and label transfer

Abstract

A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device includes receiving feature data including time series data for multiple sensor devices associated with the device and receiving an alert indicator for the alert. The method includes processing a portion of the feature data that is within a temporal window associated with the alert indicator to generate feature importance data for the alert. The feature importance data includes values indicating relative importance of each of the sensor devices to the alert. The method also includes identifying one or more historical alerts that are most similar, based on the feature importance data and stored feature importance data, to the alert.

What is claimed is: 
     
         1 . A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device, the method comprising:
 receiving feature data including time series data for multiple sensor devices associated with the device;   receiving an alert indicator for the alert;   processing a portion of the feature data that is within a temporal window associated with the alert indicator to generate feature importance data for the alert, the feature importance data including values indicating relative importance of each of the sensor devices to the alert; and   identifying one or more historical alerts that are most similar, based on the feature importance data and stored feature importance data, to the alert.   
     
     
         2 . The method of  claim 1 , wherein identifying the one or more historical alerts is based on feature-by-feature processing of the values in the feature importance data with corresponding values in the stored feature importance data. 
     
     
         3 . The method of  claim 1 , wherein identifying the one or more historical alerts is based on comparing a list of features having largest relative importance to the alert to lists of features having largest relative importance to the historical alerts. 
     
     
         4 . The method of  claim 1 , further comprising displaying, for each of the identified one or more historical alerts, a label associated with that historical alert. 
     
     
         5 . The method of  claim 1 , further comprising displaying, for each of the identified one or more historical alerts, at least one diagnostic action or remedial action associated with that historical alert. 
     
     
         6 . The method of  claim 1 , wherein at least one of the historical alerts corresponds to a previous alert for the device. 
     
     
         7 . The method of  claim 1 , wherein at least one of the historical alerts corresponds to an alert for a second device. 
     
     
         8 . The method of  claim 1 , further comprising selecting, based on the identified one or more historical alerts, a control device to send a control signal to. 
     
     
         9 . The method of  claim 1 , wherein each feature of the feature data corresponds to the time series data for a corresponding sensor device of the multiple sensor devices, wherein the alert is generated responsive to anomalous behavior of one or more of the features, and wherein processing the portion of the feature data includes:
 determining, for each of the features, a feature importance value indicating a contribution of that feature to generation of the alert for each time interval within the temporal window; and   processing, for each of the features, the feature importance values of that feature to generate an average feature importance value for that feature, and   wherein the feature importance data includes, for each of the features, the average feature importance value for that feature.   
     
     
         10 . The method of  claim 1 , wherein identifying the one or more historical alerts includes:
 determining, for each of the historical alerts, a similarity value based on feature-by-feature processing of the values in the feature importance data with corresponding values in the stored feature importance data corresponding to that historical alert;   identifying one or more of the similarity values that indicate largest similarity of the similarity values; and   selecting the one or more historical alerts corresponding to the identified one or more of the similarity values.   
     
     
         11 . The method of  claim 10 , wherein determining the similarity value includes, for each feature of the feature data, selectively adjusting a sign of a feature importance value for that feature based on whether a value of that feature within the temporal window exceeds a historical mean value for that feature. 
     
     
         12 . The method of  claim 1 , wherein identifying the one or more historical alerts includes, for each of the historical alerts:
 determining a first set of features providing the largest contributions to generation of that historical alert;   combining the first set of features with a set of features providing the largest contributions to generation of the alert to identify a subset of features; and   determining, for the subset of features, a similarity value based on feature-by-feature processing of the values in the feature importance data with corresponding values in the stored feature importance data corresponding to that historical alert.   
     
     
         13 . The method of  claim 1 , wherein each feature of the feature data corresponds to the time series data for a corresponding sensor device of the multiple sensor devices, wherein the alert is generated responsive to anomalous behavior of one or more of the features, and wherein identifying the one or more historical alerts includes:
 generating, based on the feature importance data, a ranking of the features for the alert according to a contribution of each feature to generation of the alert;   for each of the historical alerts:   generating, based on the stored feature importance data for that historical alert, a ranking of features for that historical alert according to the contribution of each feature to generation of that historical alert; and   determining a similarity value for that historical alert indicating how closely a list of highest-ranked features for the alert matches a list of highest-ranked features for that historical alert;   identifying one or more of the similarity values that indicate largest similarity of the determined similarity values; and   selecting the one or more historical alerts corresponding to the identified one or more of the similarity values.   
     
     
         14 . The method of  claim 1 , further comprising generating a graphical user interface including:
 a graph indicative of a performance metric of the device over time;   a graphical indication of the alert corresponding to a portion of the graph; and   an indication of one or more sets of the feature data associated with the alert.   
     
     
         15 . The method of  claim 1 , further comprising identifying at least one diagnostic action or remedial action for the alert based on the one or more historical alerts that are most similar to the alert. 
     
     
         16 . A method of identifying a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device, the method comprising:
 obtaining feature data including time series data for multiple sensor devices associated with the device;   processing a portion of the feature data that is within a temporal window associated with the alert to generate feature importance data for the alert, the feature importance data including values indicating relative importance of each of the sensor devices to generation of the alert;   ranking the sensor devices according to the relative importance of each of the sensor devices to generation of the alert;   determining, for each of multiple historical alerts, a similarity value for that historical alert indicating how closely a list of highest-ranked sensor devices for that historical alert matches a list of highest-ranked sensor devices for the alert; and   identifying one or more of the historical alerts that are most similar to the alert based on the determined similarity values.   
     
     
         17 . The method of  claim 16 , wherein determining the similarity value for a particular historical alert includes:
 obtaining a first list of highest-ranked sensor devices for the alert;   obtaining a second list of highest-ranked sensor devices for the particular historical alert; and   determining how many of the sensor devices that are in the first list are also in the second list.   
     
     
         18 . A system to identify a historical alert that is similar to an alert associated with a detected deviation from an operational state of a device, the system comprising:
 a memory including stored feature importance data for historical alerts; and   one or more processors coupled to the memory, the one or more processors configured to:
 obtain feature data including time series data for multiple sensor devices associated with the device; 
 obtain an alert indicator for the alert; 
 process a portion of the feature data that is within a temporal window associated with the alert to generate feature importance data for the alert, the feature importance data including values indicating relative importance of each of the sensor devices to the alert; and 
 identify one or more of the historical alerts that are most similar, based on the feature importance data and the stored feature importance data, to the alert. 
   
     
     
         19 . The system of  claim 18 , further comprising a display interface coupled to the one or more processors and configured to provide a graphical user interface to a display device, wherein the graphical user interface includes a label, an indication of a diagnostic action, an indication of a remedial action, or a combination thereof, associated with each of the identified one or more of the historical alerts. 
     
     
         20 . The system of  claim 18 , wherein the one or more processors are further configured to:
 rank the sensor devices according to a contribution of each of the sensor devices to generation of the alert; and   determine, for each of multiple historical alerts, a similarity value for that historical alert indicating how closely a list of highest-ranked sensor devices for that historical alert matches a list of highest-ranked sensor devices for the alert.