JP-7857288-B2 - Detection of abnormal computing environment behavior using glucose

JP7857288B2JP 7857288 B2JP7857288 B2JP 7857288B2JP-7857288-B2

Inventors

サラ・ケイト・ピッカス
ブライアン・ボバー

Assignees

デックスコム・インコーポレーテッド

Dates

Publication Date: 20260512
Application Date: 20211117
Priority Date: 20201124

Claims (20)

It is a method, The anomaly detection system receives glucose measurements collected by a wearable glucose monitoring device and event records associated with the glucose measurements during a first period. The event engine simulator of the anomaly detection system processes the glucose measurement values to identify missing events that are missing from the event record during the first period, A method comprising: a model manager of the anomaly detection system generating an anomaly detection model which predicts the range of the number of non-anomalous missing events in the next period based on data of missing events that occurred over a certain period in the past, wherein the anomaly detection model is generated based on the missing events during the first period, and the generation of the anomaly detection model includes a predicted range of missing events during the second period which are non-anomalous.
Identifying the missing events that are missing from the event record during the first period is Using the aforementioned event engine simulator, the glucose measurement values are processed to generate a simulated event, The method according to claim 1, further comprising comparing the simulated events with actual events in the event record for the first period to identify the missing events that are missing from the event record for the first period.
The method according to claim 2, wherein the missing events include simulated events that do not have a matching actual event in the event record during the first period.
The method according to claim 1, wherein the event engine simulator includes a replica of the event engine of the glucose monitoring application associated with the wearable glucose monitoring device.
The anomaly detection system receives additional glucose measurements collected by the wearable glucose monitoring device and additional event records associated with the additional glucose measurements during the second period. The event engine simulator of the anomaly detection system processes the additional glucose measurements to identify missing events that are missing from the additional event record during the second period. The anomaly detection system detects abnormal behavior when an identified missing event that is missing from the additional event record during the second period falls outside the predicted range of the missing event in the anomaly detection model. The method according to claim 1, further comprising outputting the abnormal behavior.
The method according to claim 5, wherein the predicted range of missing events in the anomaly detection model corresponds to the predicted range of non-anomalous missing events per day, and detecting the anomaly behavior includes detecting the anomaly behavior when the missing event missing from the additional event record for the first day of the second period is outside the predicted range of non-anomalous missing events per day.
The method according to claim 6, further comprising detecting non-abnormal behavior when the missing event from the additional event record for the second day of the second period falls within the predicted range of the number of non-abnormal missing events per day.
Identifying the missing events that are missing from the additional event records during the second period is Using the event engine simulator, the additional glucose measurements are processed to generate additional simulated events. The method of claim 5, further comprising comparing the additional simulated events with actual events in the event record during the second period to identify the missing events that are missing from the event record during the second period.
The method according to claim 1, wherein the event record includes a low glucose alert generated by the wearable glucose monitoring device during the first period.
The method according to claim 1, wherein the first period precedes the second period.
The method according to claim 1, further comprising displaying an abnormal behavior user interface that plots the missing events during the first and second periods.
The method according to claim 11, wherein the abnormal behavior user interface visually indicates the predicted range of the missing event.
The method according to claim 12, wherein missing events plotted outside the predicted range of missing events are displayed using a visual indicator to indicate that the missing events correspond to abnormal behavior.
A computer-readable storage device that includes stored instructions that perform an operation in response to execution by one or more processors, wherein the operation is: During the first period, the system receives glucose measurements collected by a wearable glucose monitoring device, and event records associated with the glucose measurements. By processing the glucose measurements using an event engine simulator, missing events that are missing from the event record during the first period are identified. A computer-readable storage device that generates an anomaly detection model, which is a model that predicts the range of the number of non-anomalous missing events in the next period based on data of missing events that occurred over a certain period in the past, wherein the anomaly detection model is generated based on the missing events during the first period, and the anomaly detection model includes a predicted range of missing events during the second period that are non-anomalous.
Identifying the missing events that are missing from the event record during the first period is Using the aforementioned event engine simulator, the glucose measurement values are processed to generate a simulated event, The computer-readable storage device according to claim 14, further comprising comparing the simulated events with actual events in the event record for the first period to identify the missing events that are missing from the event record for the first period.
The computer-readable storage device according to claim 15, wherein the missing events include simulated events for which there are no matching actual events in the event record during the first period.
The computer-readable storage device according to claim 14, wherein the event engine simulator includes a copy of the event engine of the glucose monitoring application associated with the wearable glucose monitoring device.
The aforementioned operation, During the second period, the system receives additional glucose measurements collected by the wearable glucose monitoring device, and additional event records associated with the additional glucose measurements. By processing the additional glucose measurements using the event engine simulator, the missing events that are missing from the additional event record during the second period are identified. When an identified missing event that is missing from the additional event record during the second period falls outside the predicted range of the missing event in the anomaly detection model, abnormal behavior is detected. The computer-readable storage device according to claim 14, further comprising outputting the aforementioned abnormal behavior.
The computer-readable storage device according to claim 18, wherein the predicted range of missing events in the anomaly detection model corresponds to the predicted range of non-anomalous missing events per day, and detecting the anomaly behavior includes detecting the anomaly behavior when the missing event missing from the additional event record for the first day of the second period is outside the predicted range of non-anomalous missing events per day.
The computer-readable storage device according to claim 19, further comprising detecting non-abnormal behavior when the missing event from the additional event record for the second day of the second period falls within the predicted range of non-abnormal daily missing events.

Description

This application, filed on November 24, 2020, claims the benefit of U.S. Provisional Patent Application No. 63/117,705, entitled “Detection of Anomaly Computing Environment Behavior Using Glucose,” the entire disclosure of which is incorporated herein by reference. Diabetes is a metabolic condition that negatively impacts hundreds of millions of people and is one of the leading causes of death globally. For people living with type 1 diabetes, access to treatment is essential for their survival, and it can reduce adverse outcomes compared to those with type 2 diabetes. With appropriate treatment, serious damage to the heart, blood vessels, eyes, kidneys, and nerves caused by diabetes can be avoided. Regardless of the type of diabetes (e.g., type 1 or type 2), successful management of diabetes involves monitoring and repeatedly adjusting diet and activity to control a person's blood glucose levels, for example, reducing significant fluctuations in glucose and/or lowering overall glucose levels. Conventional glucose monitoring systems employ glucose monitoring devices to monitor a user's glucose levels and output glucose measurements to the user. As part of this, conventional glucose monitoring systems can also generate various events, such as low glucose alerts, which can be issued when a user's glucose level falls below or is predicted to fall below a low glucose threshold. Users of conventional glucose monitoring systems may rely on these events and alerts to take mitigation actions to prevent dangerous glucose-related conditions from occurring. Unfortunately, due to a variety of different circumstances, conventional glucose monitoring systems may fail to generate specific events. Such circumstances may include signal loss between the glucose monitoring device and the user's computing device, problems with the glucose monitoring device, operating system incompatibility issues, resource contention, and user behavior. For example, installing a new operating system for a specific brand of mobile device, or updating to a new version of that operating system, can cause incompatibility issues between the mobile device and the glucose monitoring device, which can lead to the glucose monitoring application failing to generate specific events. Traditionally, the only way for application developers to detect and correct issues causing glucose monitoring applications to miss events has been through user feedback. Users of glucose monitoring devices may, for example, notice that their glucose monitoring application is failing to output low glucose alerts, and thus file a complaint. Once sufficient complaints are received, an investigation can be initiated to determine a solution to the problem causing the missing events. However, this traditional process for detecting missing events is slow, and typically requires a certain number of users to detect the problem before an investigation can be initiated. Furthermore, some missing events may not even be noticed by users and therefore go undetected based on user complaints. The inability to detect missing events quickly is detrimental to users who rely on the accuracy of events and alerts generated by glucose monitoring applications and devices, and could even lead to life-threatening problems. Therefore, it is crucial to detect missing events generated by glucose monitoring applications as quickly as possible. This is an explanatory diagram of an environment in a typical embodiment that is operational for using the techniques described herein.A more detailed example of the wearable glucose monitoring device shown in Figure 1 is presented.Figure 1 shows an example of an anomaly detection system that detects abnormal behavior in a computing environment by simulating events.This document illustrates an exemplary embodiment of a user interface that displays a plot of observed behavior over time associated with a computing environment, and a visualization of the range of observed behavior that is not abnormal.This document illustrates an exemplary embodiment of a user interface that displays notifications of detected abnormal behavior.The procedure in an exemplary embodiment shows how an anomaly detection model is generated based on missing events identified during a first period.Figure 6 illustrates the procedure in an exemplary embodiment in which the generated anomaly detection model is used to detect abnormal behavior during a second period.Referencing Figures 1 to 7, an example of a system including various components of an exemplary device that can be implemented as any type of computing device for implementing embodiments of the techniques described herein is shown. Overview This paper describes the detection of anomalous computing environment behavior using glucose. The anomaly detection system receives glucose measurements and event records associated with those glucose measurements collected by a wearable glucose monitoring device during a first period. These glucose