JP2022169290A - Method for generating learning model, program, information processor, and method for generating learning data - Google Patents

Abstract

To provide a method for generating a learning model that can reduce the load of preparing abnormal training data.SOLUTION: A method for generating a learning model according to one aspect includes the steps of: acquiring time-series data which was determined to be normal: generating abnormal data on the basis of the acquired time-series data; and executing processing of generating a learning model that outputs information about abnormalities when time-series data is input on the basis of the time-series data determined to be normal, a normality label put on the time-series data, the generated abnormal data, and an abnormality label put on the abnormal data.SELECTED DRAWING: Figure 7

Description

The present invention relates to a learning model generation method, a program, an information processing apparatus, and a learning data generation method.

In recent years, machine learning algorithms have been used to perform anomaly detection. For example, Patent Literature 1 discloses an anomaly detection device capable of accurately detecting an anomaly from a plurality of data.

JP 2021-038946 A

However, in order to improve the accuracy of the learning model, there is a problem that a large amount of training data regarding both normal and abnormal conditions is required.

An object of one aspect is to provide a learning model generation method and the like that can reduce the burden of preparing abnormal training data.

A method for generating a learning model according to one aspect acquires time-series data determined to be normal, generates abnormal data based on the acquired time-series data, generates the time-series data determined to be normal and the time-series data Generates a learning model that outputs information about anomalies when time-series data is input, based on the normal labels labeled for the data, the generated anomalous data, and the anomaly labels labeled for the anomalous data. It is characterized by executing a process to

In one aspect, it is possible to reduce the burden of preparing abnormal training data.

It is a block diagram which shows the structural example of a server. FIG. 4 is an explanatory diagram showing an example of record layouts of a training data management DB and a learning model management DB; FIG. 10 is an explanatory diagram illustrating processing for obtaining an average of a plurality of time-series data; FIG. 4 is an explanatory diagram for explaining a method of generating abnormal data; FIG. 10 is an explanatory diagram illustrating a process of generating multiple patterns of abnormal data; FIG. 5 is an explanatory diagram showing an example of a reception screen for a method of generating abnormal data; 4 is a flowchart showing a processing procedure when generating an anomaly detection model; FIG. 10 is a flow chart showing the procedure of a subroutine for generating abnormal data; FIG. It is explanatory drawing explaining the process which performs a correction process. FIG. 4 is an explanatory diagram for calculating a ratio between a maximum effective value and an average effective value; FIG. 10 is a flowchart showing a subroutine processing procedure of processing for generating abnormal data according to the second embodiment; FIG. FIG. 12 is a block diagram showing a configuration example of a server according to Embodiment 3; FIG. 10 is an explanatory diagram of learning processing of a generative model; 4 is a flow chart showing a processing procedure for generating a generative model; FIG. 14 is a flow chart showing a processing procedure for generating an anomaly detection model according to the third embodiment; FIG.

Hereinafter, the present invention will be described in detail based on the drawings showing its embodiments.

(Embodiment 1)
Embodiment 1 generates a learning model that outputs information about anomalies when time-series data is input, based on time-series data determined to be normal and abnormal data generated based on the time-series data. Regarding morphology. Time-series data is data in which measured values at each of a plurality of consecutive times are arranged in time series, or a set thereof.

The system of this embodiment includes an information processing device 1 . The information processing device 1 is an information processing device that processes, stores, and transmits/receives various information. The information processing device 1 is, for example, a server device, a personal computer, a general-purpose tablet PC (personal computer), or the like. In the present embodiment, the information processing apparatus 1 is assumed to be a personal computer that detects anomalies based on time-series data.

The computer 1 according to this embodiment acquires time-series data determined to be normal, and generates abnormal data based on the acquired time-series data. The computer 1 assigns a normal label to time-series data determined to be normal, and an anomalous label to anomalous data. The computer 1 inputs time-series data based on the time-series data determined to be normal, the normal label labeled for the time-series data, and the abnormal data and the abnormal label labeled for the abnormal data. Generates a learning model that outputs information about anomalies when The generated learning model is deployed to the computer 1 or an information system terminal device or controller (not shown) attached to a machine tool or the like.

FIG. 1 is a block diagram showing a configuration example of a computer 1. As shown in FIG. The computer 1 includes a control section 11 , a storage section 12 , an input section 13 , a display section 14 , a reading section 15 and a mass storage section 16 . Each configuration is connected by a bus B.

The control unit 11 includes arithmetic processing units such as a CPU (Central Processing Unit), an MPU (Micro-Processing Unit), and a GPU (Graphics Processing Unit). , various information processing, control processing, etc. related to the computer 1 are performed. Note that although FIG. 1 illustrates the controller 11 as a single processor, it may be a multiprocessor.

The storage unit 12 includes memory elements such as RAM (Random Access Memory) and ROM (Read Only Memory), and stores the control program 1P or data necessary for the control unit 11 to execute processing. The storage unit 12 also temporarily stores data and the like necessary for the control unit 11 to perform arithmetic processing.

The input unit 13 is an input device such as a mouse, keyboard, touch panel, buttons, etc., and outputs received operation information to the control unit 11 . The display unit 14 is a liquid crystal display, an organic EL (electroluminescence) display, or the like, and displays various information according to instructions from the control unit 11 .

The reading unit 15 reads a portable storage medium 1a including CD (Compact Disc)-ROM or DVD (Digital Versatile Disc)-ROM. The control unit 11 may read the control program 1P from the portable storage medium 1a via the reading unit 15 and store it in the large-capacity storage unit 16. FIG. Alternatively, the control unit 11 may download the control program 1P from another computer via a network or the like and store it in the large-capacity storage unit 16 . Furthermore, the control unit 11 may read the control program 1P from the semiconductor memory 1b.

The large-capacity storage unit 16 includes a recording medium such as an HDD (Hard disk drive) or an SSD (Solid State Drive). The large-capacity storage unit 16 includes an anomaly detection model 161 , a training data management DB (database) 162 , a learning model management DB 163 and a training data file 164 .

The anomaly detection model 161 is an anomaly detector that outputs information about anomalies based on time-series data, and is a learned model generated by machine learning. The training data management DB 162 stores management information of training data (learning data) for constructing (creating) the anomaly detection model 161 . The learning model management DB 163 stores information on the learned anomaly detection model 161 . The training data file 164 stores training data.

In addition, in this embodiment, the storage unit 12 and the large-capacity storage unit 16 may be configured as an integrated storage device. Also, the large-capacity storage unit 16 may be composed of a plurality of storage devices. Furthermore, the large-capacity storage unit 16 may be an external storage device connected to the computer 1 .

The computer 1 may execute various information processing, control processing, and the like as a single computer, distributed among a plurality of computers, or distributed among virtual machines. Various information processing and control processing related to the computer 1 may be executed by a server device or the like having a communication environment.

FIG. 2 is an explanatory diagram showing an example of record layouts of the training data management DB 162 and the learning model management DB 163. As shown in FIG.
The training data management DB 162 includes a training ID column, a file name column, and a registration date/time column. The training ID column stores a unique training data ID for identifying each training data. The file name column stores the names of files containing time-series data. The file name column may store the file name together with the file path. The registration date and time column stores information on the date and time when the training data was registered.

The learning model management DB 163 includes a model ID column, a learning model column, and a generation date/time column. The model ID column stores IDs of uniquely identified anomaly detection models 161 in order to identify each learned anomaly detection model 161 . The learning model column stores files of learned anomaly detection models 161 . The generation date/time column stores date/time information when the anomaly detection model 161 was generated.

Note that the storage form of each DB described above is an example, and other storage forms may be used as long as the relationship between data is maintained.

The training data file 164 stores training data for constructing the anomaly detection model 161 . Specifically, the training data file 164 stores time-series data, types of labels attached to the time-series data, and the like. Label types include, for example, "normal" and "abnormal". Note that the types of labels are not limited to "normal" and "abnormal", and may be detailed according to the types of abnormalities that actually occur. The training data file 164 may be, for example, an EXCEL® file, such as an extension XLS or XLSX, or a user-defined file defined by a user.

Next, processing for outputting information about anomalies based on time-series data will be described. In this embodiment, the anomaly detection model 161 is used to output information about an anomaly. The anomaly detection model 161 is generated using a machine learning algorithm such as OneClassSVM (One Class Support Vector Machine). OneClassSVM is an algorithm for detecting outliers from the learning value of good products learned without supervision, and is a model that maps (projects) normal data to non-negative values and abnormal data to negative values.

OneClassSVM assigns all training data to cluster 1, and maps data to a high-dimensional feature space using a technique called kernel trick so that only the origin belongs to cluster-1. At this time, since the training data are mapped so as to be located far from the origin, time-series data that are not similar to the original training data gather near the origin. This property can be used to distinguish between normal and abnormal data.

The computer 1 generates an anomaly detection model 161 that performs machine learning using training data. The computer 1 uses OneClassSVM as a machine learning algorithm to perform machine learning using normal data (normal time series data) and abnormal data (abnormal time series data) as training data, thereby identifying abnormal values. Determine boundaries. The computer 1 generates an anomaly detection model 161 that can detect an anomaly based on the identification boundary.

Specifically, the computer 1 uses OneClassSVM to perform unsupervised learning of two classes of normal/abnormal separating hyperplanes. Machine learning algorithms have parameters called hyperparameters. The hyperparameters include nu (ν) and gamma (γ) as parameters. The parameter ν is a parameter related to the proportion of anomalous data included in the training data. The parameter γ is a parameter that determines the complexity of the interface, and the larger the gamma, the more complex the interface.

In OneClassSVM, the ratio of outliers in learning data is specified by parameter ν, and a separating hyperplane that maximizes the margin between normal data and the origin in feature space is learned. Also, a nonlinear separating hyperplane can be obtained by mapping the feature amount space with an RBF kernel (radial basis function kernel) with a parameter γ.

When using an outlier detection algorithm such as OneClassSVM, abnormal data generated during learning may be included at a rate specified by a parameter such as new, or outlier data may be included in data acquired in the natural world. The separating hyperplane may be learned using only normal data, assuming it contains that proportion. Similarly, assuming that natural data includes outliers at a certain rate, bootstrap sampling may be repeated to adjust the rate of outliers in sample data.

The computer 1 optimizes the hyperparameters of the anomaly detection model 161 by searching based on the obtained training data including normal data and anomalous data. By optimizing the hyperparameters, the computer 1 can further improve accuracy in detecting anomalies.

The computer 1 receives the feature quantity vector for each time slot and outputs normality/abnormality detection results for each. Specifically, the computer 1 outputs 1 for a normal detection result and -1 for an abnormal detection result. The computer 1 may output 1 when the real value obtained in the process of calculating the detection result is 0 or more, and output -1 when the real value is less than 0.

In this embodiment, the anomaly detection model 161 will be described as OneClassSVM, but the anomaly detection model 161 is not limited to OneClassSVM, and may include isolation forest, LOF (Local Outlier Factor), ), CNN (Convolutional Neural Network), RNN (Recurrent Neural Network), Bayesian network, or a trained model constructed by any learning algorithm such as a regression tree. In addition, a neural network related to LTSM (Long-Short Term Memory), a transformer, or the like may be used.

Next, the process of creating training data will be described. In this embodiment, the computer 1 acquires time-series data determined to be normal, and generates abnormal data based on the acquired time-series data. The processing for generating abnormal data will be described later. The computer 1 assigns a normal label to time-series data determined to be normal, and an anomalous label to anomalous data.

A normal label may be, for example, "normal" indicating no abnormalities. The anomaly label may be, for example, "abnormal" indicating that there is an anomaly, or may be an anomaly name classified according to the type of anomaly. The computer 1 creates (generates) training data for learning the anomaly detection model 161 by labeling each piece of time series data in a plurality of pieces of time series data.

Next, the process of generating abnormal data based on time-series data will be described in detail. First, the computer 1 obtains representative data of a plurality of time-series data. Representative data is, for example, the average value of multiple time-series data, the median value of multiple time-series data, or the mode of multiple time-series data (the value with the highest frequency in time-series data). . Data indicating the most normal state specified by the user may be used as the representative data among the plurality of time-series data. In this embodiment, an example in which the representative data is the average of a plurality of time-series data will be described, but other types of representative data and a case where there are a plurality of such representative data can be similarly applied.

FIG. 3 is an explanatory diagram illustrating a process of obtaining an average of multiple pieces of time-series data. FIG. 3A is an explanatory diagram illustrating a plurality of pieces of time-series data used as original data. The computer 1 acquires a plurality of time-series data as original data. The time-series data is, for example, data from a three-axis acceleration sensor attached to a machine tool. The time-series data may also be data such as temperature, pressure, speed, blood pressure, and sales. The triaxial acceleration sensor detects acceleration in three directions of the X-axis, Y-axis, and Z-axis, and outputs acceleration signals. As shown, the acquired X-axis acceleration sensor data, Y-axis acceleration sensor data, and Z-axis acceleration sensor data are shown in a graph 11a. The horizontal axis of graph 11a indicates time, and time elapses toward the tip of the arrow. The vertical axis of graph 11a indicates the magnitude of acceleration. Also, a plurality of pieces of data from the three-axis acceleration sensors are obtained in different time periods (eg, t0 to t1, t2 to t3, and t4 to t5).

The computer 1 calculates the average of the acquired data of the plurality of acceleration sensors for each axis. Specifically, the computer 1 calculates the average of the acceleration sensor data in each time slot on the X axis, calculates the average of the acceleration sensor data in each time slot on the Y axis, and calculates the average of the acceleration sensor data in each time slot on the Z axis. Calculate the average of the accelerometer data. As shown in the figure, the average of the calculated three-axis acceleration sensor data for each time period is shown in graph 11b. Note that the horizontal axis and vertical axis of the graph 11b are the same as those of the graph 11a, so description thereof will be omitted.
According to the above process, the average of multiple pieces of time-series data can be obtained.

Next, the computer 1 will explain the process of generating abnormal data based on the average of a plurality of time-series data. In this embodiment, the average of a plurality of time-series data (hereinafter referred to as average data) is used for explanation, but it can be similarly applied to the process of generating abnormal data based on the time-series data itself. .

The abnormal data generation method includes a first generation method, a second generation method, a third generation method, and a fourth generation method. A first generation method is a generation method for generating abnormal data by adding periodic fluctuations to average data. The second generation method is a generation method that generates abnormal data by continuously increasing or decreasing average data over time. A third generation method is a generation method of generating abnormal data by adding a spike in which a value within a unit time suddenly exceeds a threshold to average data. A fourth generation method is a generation method of generating abnormal data by shifting the phase of the waveform of the average data.

Abnormal data can be generated for the average data based on at least one of a first generation method, a second generation method, a third generation method, a fourth generation method, or a combination thereof.

FIG. 4 is an explanatory diagram for explaining a method of generating anomaly data. FIG. 4A is an explanatory diagram for explaining abnormal data generation processing based on the first generation method. Abnormal data can be generated by adding periodic fluctuations to the average data at predetermined timings (points of time). Periodic fluctuations may be fluctuations that occur continuously at the same intervals in time, or fluctuations that occur by lengthening or shortening the period of periodic fluctuations. Also, the periodic fluctuation may be fluctuation caused by increasing or decreasing the amplitude of the periodic fluctuation.

For example, the computer 1 may repeat at a predetermined cycle (eg, 20 ms) from the timing when the occurrence of abnormality starts (eg, 550 ms) to the timing when the occurrence of abnormality ends (eg, 1000 ms). Alternatively, the computer 1 may reduce the amplitude of the normal fluctuation by 0.5 times from the start timing of the occurrence of the abnormality to the end timing of the occurrence of the abnormality.

FIG. 4B is an explanatory diagram for explaining abnormal data generation processing based on the second generation method. Abnormal data can be generated by continuously increasing (rising) or decreasing (falling) the average data over time. As shown in the figure, the computer 1 generates abnormal data by adding a decreasing trend to the average data with a predetermined slope coefficient from the start timing of the occurrence of abnormality (eg, 600 ms) to the end timing of the occurrence of abnormality (eg, 1000 ms). do. Abnormal data may be generated based on a combination of an increasing tendency and a decreasing tendency.

FIG. 4C is an explanatory diagram for explaining abnormal data generation processing based on the third generation method. Abnormal data can be generated by adding to the average data a spike whose value within a unit time suddenly exceeds a threshold. As shown in the figure, the computer 1 adds a spike (protrusion shape) to the average data at the positive position with a predetermined first spike width at the abnormality occurrence timing t1, and adds a predetermined second spike width at the abnormality occurrence timing t2. Add spikes at positive positions. Addition of spikes at different timings causes spike-like distortion and generates anomalous data.

Note that the spike addition position is not limited to the positive position. For example, computer 1 may generate anomalous data by adding multiple spikes to negative locations, or add multiple spikes to both positive and negative locations to generate anomalous data may be generated.

In this way, it is possible to generate a plurality of patterns of abnormal data based on the third generation method, based on at least one of the abnormal occurrence timing, spike width, and number of spikes, or a combination thereof.

FIG. 4D is an explanatory diagram for explaining abnormal data generation processing based on the fourth generation method. Abnormal data can be generated by shifting the phase of the waveform of the time-series data. The phase is positional information of a periodically varying wave. As shown, the computer 1 generates abnormal data by shifting the phase of the waveform by a predetermined shift amount (eg, 500 ms) along the horizontal axis indicating time with respect to the average data.

Note that the computer 1 may accept user settings of parameters for executing each method of generating abnormal data. For example, the computer 1 accepts the user's setting of the parameters (time point, period, amplitude, etc.) of the first generation method. The computer 1 generates abnormal data based on the received parameters of the first generation method.

Also, abnormal data can be generated based on any combination of the first generation method, the second generation method, the third generation method, and the fourth generation method. For example, the computer 1 may generate abnormal data based on a combination of the first generation method and the second generation method. Specifically, based on the first generation method, the computer 1 adds variation that repeats at a predetermined cycle (for example, 20 ms) to the average data from the abnormality occurrence start timing t1 to the abnormality occurrence end timing t2. Generate intermediate anomaly data. Based on the second generation method, the computer 1 adds an increasing tendency or a decreasing tendency to the generated intermediate abnormality data with a predetermined slope coefficient from the abnormality occurrence start timing t3 to the abnormality occurrence end timing t4. , to produce the final anomaly data.

Further, by adding colored noise (Colors of Noise) to the generated abnormal data, it is possible to generate abnormal data (second abnormal data) having a pattern different from that of the abnormal data. Colored noise is noise whose power spectral density is not flat. For example, colored noise such as pink noise whose power spectrum is inversely proportional to frequency or brown noise whose power spectrum is inversely proportional to the square of frequency is added to generate the second abnormal data. The second abnormal data may be generated by adding white noise indicating a flat power spectrum to the abnormal data, instead of the colored noise.

Furthermore, abnormal data can be generated by applying a plurality of types of abnormal data generation methods for average data to average data at different timings.

FIG. 5 is an explanatory diagram for explaining the process of generating a plurality of patterns of abnormal data. Note that although FIG. 5 illustrates an example of generating abnormal data based on the third generation method, other generation methods can be similarly applied.

A third generation method is a generation method of generating abnormal data by adding a spike, in which a value within a unit time suddenly exceeds a threshold value, to average data. For example, the computer 1 adds spikes 12a and 12b to a partial time range to the average data to generate abnormal data of the first pattern. Then, the computer 1 generates abnormal data of the second pattern and abnormal data of the third pattern by mutually shifting the time ranges obtained by adding the spikes 12a and 12b to the generated abnormal data of the first pattern.

FIG. 6 is an explanatory diagram showing an example of a reception screen for a method of generating abnormal data. The screen includes a generation method selection field 13a and a setting button 13b. The generation method selection field 13a is a field for receiving selection of a single or a plurality of abnormal data generation methods. The setting button 13b is a button for setting a method for generating abnormal data.

The computer 1 generates a reception screen that allows selection of a first generation method, a second generation method, a third generation method, a fourth generation method, and a combination generation method combining each generation method. The computer 1 displays the generated acceptance screen. As shown, a first generation method (frequency change), a second generation method (trend), a third generation method (spike), a fourth generation method (phase change), and a combination generation method (complex change) generate It is displayed in the method selection column 13a.

When the computer 1 receives a selection operation in the generation method selection field 13a, the computer 1 receives selection of the abnormal data generation method. The computer 1 stores the generation method selected in the generation method selection field 13a in the storage unit 12 or the large-capacity storage unit 16 when receiving the touch (click) operation of the setting button 13b. Then, the stored generation method is used when generating the abnormal data.

FIG. 7 is a flowchart showing a processing procedure for generating the anomaly detection model 161. As shown in FIG. The control unit 11 of the computer 1 acquires a plurality of pieces of time-series data determined to be normal through the input unit 13 (step S101). The control unit 11 receives the selection of the abnormal data generation method through the input unit 13 (step S102). The control unit 11 executes a subroutine of processing for generating abnormal data based on the acquired plurality of time-series data and the received abnormal data generating method (step S103). The subroutine for generating abnormal data will be described later.

The control unit 11 creates training data based on the plurality of time-series data and the generated abnormal data (step S104). Specifically, the control unit 11 assigns a normal label (for example, “normal”) to the time-series data, and assigns an abnormal label (for example, “abnormal”) to the abnormal data.

The control unit 11 stores the plurality of time-series data and the generated abnormal data as training data (learning data) in the training data file 164 (step S105). Specifically, the control unit 11 creates the training data file 164 . The control unit 11 assigns a label name (for example, “normal”) to each piece of time-series data, associates the time-series data with the label name, and writes them in the training data file 164 . The control unit 11 assigns a label name (for example, “abnormality”) to each abnormal data, associates the time-series data with the label name, and writes them in the training data file 164 . The control unit 11 stores in the large-capacity storage unit 16 the file in which the time-series data and label names are associated and written.

The control unit 11 stores management information for managing the training data file 164 in the training data management DB 162 of the large-capacity storage unit 16 (step S106). Specifically, the control unit 11 assigns a training ID, and stores the name and registration date and time of the file containing the training data as one record in the training data management DB 162 .

The control unit 11 uses the created training data to generate the anomaly detection model 161 (step S107). Specifically, the control unit 11 uses OneClassSVM to machine-learn a plurality of time-series data that are training data, thereby determining an identification boundary with an abnormal value, and detecting an abnormality based on the identification boundary. generates an anomaly detection model 161 capable of

The control unit 11 stores the generated anomaly detection model 161 in the learning model management DB 163 of the large-capacity storage unit 16 (step S108), and ends the series of processes. Specifically, the control unit 11 assigns a model ID to the generated anomaly detection model 161, associates the assigned model ID with the file of the anomaly detection model 161 and the date and time of generation as one record for learning model management. Store in DB 163 .

FIG. 8 is a flow chart showing the procedure of a subroutine for generating abnormal data. The control unit 11 of the computer 1 calculates an average of multiple pieces of time-series data (step S11). For example, when the time-series data is data of a three-axis acceleration sensor, the control unit 11 averages the data of the X-axis acceleration sensor, the average of the data of the Y-axis acceleration sensor, and the average of the data of the Z-axis acceleration sensor. are calculated respectively.

The control unit 11 acquires the method for generating the received abnormal data (step S12). Using the acquired generation method, the control unit 11 generates abnormal data based on the calculated average of the plurality of time-series data (step S13). For example, when the abnormal data generation method is the first generation method, the control unit 11 generates abnormal data by adding periodic fluctuations at a predetermined timing to the average of a plurality of time-series data using the first generation method. Generate. The control unit 11 terminates the abnormal data generation processing subroutine and returns.

In this embodiment, an example of processing for generating the abnormality detection model 161 using normal data and abnormal data generated based on the normal data has been described, but the present invention is not limited to this. For example, when the computer 1 directly acquires a plurality of abnormal data from the user, the computer 1 may create training data based on the acquired multiple abnormal data and normal data. Alternatively, the computer 1 may combine a plurality of abnormal data acquired from the user and abnormal data generated based on normal data to create training data in combination with the normal data. The created training data is used when generating or learning the anomaly detection model 161 .

According to this embodiment, it is possible to generate an anomaly detection model 161 that outputs information about anomalies when time-series data is input.

According to this embodiment, it is possible to generate abnormal data based on time-series data determined to be normal.

According to the present embodiment, it is possible to generate various types of abnormal data by using a plurality of generation methods indicating methods for generating abnormal data or a combination method combining each generation method.

According to this embodiment, when only normal data can be obtained or when it is difficult to obtain abnormal data, by automatically generating abnormal data, it is possible to help generate the abnormality detection model 161 .

(Embodiment 2)
Embodiment 2 relates to a form in which correction processing is performed on representative data of a plurality of time-series data. In addition, description is abbreviate|omitted about the content which overlaps with Embodiment 1. FIG. In this embodiment, an example in which the representative data is the average of a plurality of time-series data will be described, but other types of representative data and a case where there are a plurality of such representative data can be similarly applied.

FIG. 9 is an explanatory diagram for explaining the process of performing the correction process. FIG. 9A is an explanatory diagram illustrating averaging of multiple pieces of time-series data. The time-series data is, for example, data from a triaxial acceleration sensor. The computer 1 acquires an average of the data of the acceleration sensors of each axis based on the data of the multiple 3-axis acceleration sensors. Note that the processing for obtaining the average of the data of the acceleration sensor is the same as in FIG. 3, so the description is omitted. As shown, the average X-axis accelerometer data, the average Y-axis accelerometer data, and the average Z-axis accelerometer data are shown in graph 14a. The horizontal axis of the graph 14a indicates time. The vertical axis of graph 14a indicates the magnitude of acceleration.

FIG. 9B is an explanatory diagram illustrating acceleration sensor data after the first correction. The computer 1 performs correction processing on the average of data of a plurality of acceleration sensors on each axis. Specifically, first, the computer 1 performs processing for averaging the data of a plurality of acceleration sensors on each axis to zero, and the acceleration sensors after the first correction on each axis with the average set to zero. Generate data. As shown, the generated acceleration sensor data after the first correction on the X axis, the acceleration sensor data after the first correction on the Y axis, and the acceleration sensor data after the first correction on the Z axis are shown in a graph 14b. shown in Note that the horizontal axis and vertical axis of the graph 14b are the same as those of the graph 14a, so description thereof will be omitted.

FIG. 9C is an explanatory diagram illustrating acceleration sensor data after the second correction. The computer 1 generates the accelerometer data after the second correction for each axis based on the effective value for the accelerometer data after the first correction for each axis.

First, the computer 1 calculates the ratio between the maximum effective value and the average effective value of each axis. FIG. 10 is an explanatory diagram for calculating the ratio between the maximum effective value and the average effective value. RMS is the root mean square (RMS) and is a value that indicates the effective magnitude of a signal as it changes over time. As shown, for x i (i=1, 2, . . . , n), the data of variable x, the root mean square RMS(x) of x is defined by Equation 15a. The variable x is, for example, X-axis acceleration sensor data.

The computer 1 acquires a plurality of X-axis acceleration sensor data in different time periods (eg, t0-t1, t2-t3 and t4-t5). As shown in the figure, the acquired data of the acceleration sensor in each time period is displayed in the graph 15b. The horizontal axis of graph 15b indicates time. The vertical axis of the graph 15b indicates the magnitude of the X-axis acceleration. The computer 1 calculates the effective value of the accelerometer data obtained in each time period. Specifically, the computer 1 calculates the effective value of the acceleration sensor data in the time period “t0 to t1”, calculates the effective value of the acceleration sensor data in the time period “t2 to t3”, and calculates the effective value of the acceleration sensor data in the time period “t4 to Calculate the effective value of the acceleration sensor data in the time period t5. The computer 1 acquires the maximum effective value from each calculated effective value.

The computer 1 calculates the average of the accelerometer data obtained in each time period. As shown in the figure, the average of the calculated acceleration sensor data for each time period is shown in the graph 15c. Note that the horizontal axis and vertical axis of the graph 15c are the same as those of the graph 15b, so description thereof will be omitted. The computer 1 calculates the average effective value of the acceleration sensor data for each time period.

The computer 1 calculates the ratio between the maximum effective value of the acquired data of the X-axis acceleration sensor and the average effective value of the calculated data of the X-axis acceleration sensor. For example, the ratio of the maximum effective value to the average effective value is "1:0.978". Note that FIG. 10 illustrates an example of the data of the X-axis acceleration sensor, but the same can be applied to the data of the Y-axis acceleration sensor and the data of the Z-axis acceleration sensor.

Next, returning to FIG. 9C, the computer 1 multiplies the acceleration sensor data after the first correction for each axis (FIG. 9B) by the calculated ratio of the maximum effective value to the average effective value for each axis. Through multiplication processing, the computer 1 converts the position of the acceleration sensor data (FIG. 9B) after the first correction for each axis (the average is set to 0) to the original average of the multiple acceleration sensor data for each axis (FIG. 9A ) to generate acceleration sensor data after the second correction. Graph 14c shows the generated acceleration sensor data after the second correction on the X axis, the acceleration sensor data after the second correction on the Y axis, and the acceleration sensor data after the second correction on the Z axis. shown in Note that the horizontal axis and vertical axis of the graph 14c are the same as those of the graph 14a, so description thereof will be omitted.

FIG. 11 is a flowchart showing the procedure of a subroutine for generating abnormal data according to the second embodiment. The control unit 11 of the computer 1 calculates an average of multiple pieces of time-series data (step S21). Note that the processing for calculating the average of a plurality of pieces of time-series data is the same as the processing in step S11 of FIG. 8, so description thereof will be omitted.

The control unit 11 performs a process of aligning the average of the calculated multiple time-series data to 0, and generates time-series data after the first correction (step S22). The control unit 11 calculates the effective value of each time-series data (step S23), and obtains the maximum effective value from the calculated effective values (step S24). The control unit 11 calculates an average effective value of a plurality of time-series data (step S25).

The control unit 11 calculates the ratio between the obtained maximum effective value and the calculated average effective value (step S26). The control unit 11 multiplies the time-series data after the first correction by the calculated ratio of the maximum effective value to the average effective value to generate the time-series data after the second correction (step S27).

The control unit 11 acquires the method for generating the received abnormal data (step S28). Using the acquired generation method, the control unit 11 generates abnormal data based on the generated time-series data after the second correction (step S29). The control unit 11 terminates the abnormal data generation processing subroutine and returns.

According to this embodiment, it is possible to perform correction processing on representative data of a plurality of time-series data or a set of representative data using the effective value.

(Embodiment 3)
Embodiment 3 relates to a mode of generating abnormal time-series data (hereinafter referred to as abnormal data) from time-series data determined to be normal (hereinafter referred to as normal data) using artificial intelligence. Note that the description of the contents overlapping those of the first and second embodiments will be omitted.

FIG. 12 is a block diagram showing a configuration example of the computer 1 of the third embodiment. In addition, the same code|symbol is attached|subjected about the content which overlaps with FIG. 1, and description is abbreviate|omitted. A generative model 165 is stored in the large-capacity storage unit 16 . The generative model 165 is a generator that generates abnormal data based on normal data, and is a learned model generated by machine learning.

When acquiring multiple normal data and multiple abnormal data, the computer 1 generates a generative model 165 using the acquired multiple normal data and multiple abnormal data.

FIG. 13 is an explanatory diagram of the learning process of the generative model 165. As shown in FIG. In this embodiment, the computer 1 learns normal data and abnormal data using a GAN (Generative Adversarial Network) technique to generate the generative model 165 . FIG. 13 conceptually illustrates the configuration of the GAN.

The GAN includes a generator 16a that generates output data from input data and a discriminator 16b that discriminates whether the data generated by the generator 16a is true or false. The generator 16a receives input of random noise (latent variable) and generates output data. The discriminator 16b learns whether the input data is true or false by using true data given for learning and data given from the generator 16a. In the GAN, the generator 16a and the discriminator 16b perform competitive learning, and finally construct a network such that the loss function of the generator 16a is minimized and the loss function of the discriminator 16b is maximized.

In the present embodiment, GAN is used as a method for generating (learning) the generative model 165, but the generative model 165 is not limited to a trained model related to GAN, and U-NET (U-shaped neural network) A model that has been trained by a learning method such as deep learning, decision tree, or the like may be used.

The computer 1 generates (builds) a generative model 165 based on training data including normal data and abnormal data. Specifically, the computer 1 inputs time-series data or random noise data determined to be normal to the generator 16a. Generator 16a generates false anomaly data. Further, the computer 1 inputs a plurality of pre-obtained true abnormal data or false abnormal data to the discriminator 16b. This causes the generator 16a and classifier 16b to perform deep learning.

The computer 1 alternately trains the generator 16a and the discriminator 16b. First, the parameters of these two networks are initialized with random numbers. Then, the computer 1 uses the time-series data or random noise data input to the generator 16a to cause the generator 16a to generate false abnormal data. The computer 1 inputs either true abnormal data or false abnormal data generated by the generator 16a to the discriminator 16b for identification.

In the initial stage of learning, the discriminator 16b is trained using the backpropagation method, and the parameters of the discriminator 16b are adjusted. Backpropagation is a supervised learning algorithm that updates parameters such as weight filters and biases for each layer by backpropagating the error gradient from the output layer to the input layer in a network consisting of an input layer, an intermediate layer, and an output layer. is.

When the discrimination error of the discriminator 16b becomes small, the computer 1 similarly uses the backpropagation method to train the generator 16a. The computer 1 repeats the learning of the generator 16a and the learning of the discriminator 16b, thereby improving the discrimination power of the discriminator 16b and also improving the ability of the generator 16a to generate false abnormal data. In this way, a generative model 165 is generated that can output abnormal data when time-series data determined to be normal is input.

In the initial stage of learning, a plurality of true abnormal data obtained in advance, abnormal data generated based on time-series data determined to be normal (embodiment 1), or a combination of both may be used. . As the ability of the generator 16a to generate false anomaly data improves, only a plurality of pre-obtained true anomaly data may be used.

FIG. 14 is a flow chart showing a processing procedure for generating the generative model 165. As shown in FIG. The control unit 11 of the computer 1 acquires a group of training data for learning, ie, a plurality of normal data and a plurality of abnormal data through the input unit 13 (step S111). The control unit 11 uses the obtained plurality of normal data and the plurality of abnormal data to generate a generative model 165 that outputs abnormal data when normal data is input (step S112). Specifically, as described above, the control unit 11 generates the generative model 165 using the GAN method. The control unit 11 stores the generated generative model 165 in the learning model management DB 163 of the large-capacity storage unit 16 (step S113), and ends the series of processes.

FIG. 15 is a flow chart showing a processing procedure for generating the anomaly detection model 161 of the third embodiment. The control unit 11 of the computer 1 acquires a plurality of normal data through the input unit 13 (step S121). The control unit 11 generates abnormal data for each acquired normal data using the generation model 165 that outputs abnormal data when normal data is input (step S122). The control unit 11 executes the processes of steps S123 to S127. Note that the processing of steps S123 to S127 is the same as the processing of steps S104 to S108 in FIG. 7, so detailed description thereof will be omitted.

According to this embodiment, using the generative model 165, it is possible to generate abnormal data from time-series data determined to be normal.

According to this embodiment, the abnormality detection model 161 can be generated using the abnormality data generated using the generation model 165 . The method of generating abnormal data according to the present embodiment can also be used as one of the options for generating a plurality of abnormal data described in the first embodiment.
Regarding the embodiments including the first to third embodiments described above, the following additional remarks will be disclosed.
(Appendix 1)
Abnormal data is generated by inputting data into a generative model trained to generate abnormal data when data is input.
(Appendix 2)
The generative model is trained using the data and previously obtained true anomaly data.

The embodiments disclosed this time are illustrative in all respects and should be considered not restrictive. The scope of the present invention is indicated by the scope of the claims rather than the above-described meaning, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

1 Information processing device (computer)
REFERENCE SIGNS LIST 11 control unit 12 storage unit 13 input unit 14 display unit 15 reading unit 16 large capacity storage unit 161 anomaly detection model 162 training data management DB
163 Learning Model Management DB
164 training data file 165 generative model 1a portable storage medium 1b semiconductor memory 1P control program

A method of generating a learning model according to one aspect acquires a plurality of time-series data that are determined to be normal, and averages the acquired time-series data for each hour, selects a median value, or , generating representative time-series data by mode selection processing, generating abnormal data based on the generated representative time-series data , and labeling the time-series data determined to be normal and the time-series data Based on the normal label, the generated abnormal data, and the abnormal label attached to the abnormal data, when time-series data is input, a process of generating a learning model that outputs information about anomalies is executed. Characterized by

A method of generating a learning model according to one aspect includes: a computer acquires a plurality of time-series data determined to be normal , calculates the effective values of the acquired plurality of time-series data, and calculates the calculated effective values Obtain the maximum effective value from, calculate the effective value of the representative time-series data in the plurality of time-series data, calculate the ratio between the obtained maximum effective value and the calculated effective value of the representative time-series data, Based on the calculated effective value ratio, correcting representative time-series data in the plurality of time-series data , generating abnormal data based on the corrected representative time-series data, and determining the normal time-series data and Learning to output information about anomalies when time-series data is input based on normal labels labeled for the time-series data, generated anomaly data, and anomaly labels labeled for the anomaly data. It is characterized by executing a process of generating a model.

A method of generating a learning model according to one aspect includes: a computer acquires a plurality of time-series data determined to be normal , calculates the effective values of the acquired plurality of time-series data, and calculates the calculated effective values Obtain the maximum effective value from, calculate the effective value of the representative time-series data in the plurality of time-series data, calculate the ratio between the obtained maximum effective value and the calculated effective value of the representative time-series data, Based on the calculated effective value ratio, correcting representative time-series data in the plurality of time-series data , generating abnormal data based on the corrected representative time-series data, and determining the normal time-series data and Learning to output information about anomalies when time-series data is input based on normal labels labeled for the time-series data, generated anomaly data, and anomaly labels labeled for the anomaly data. It is characterized by executing processing for generating a model.

Claims (14)

Acquire time-series data judged to be normal,
Generate anomaly data based on the acquired time series data,
When time-series data is input based on the time-series data determined to be normal, the normal label attached to the time-series data, and the generated abnormal data and the abnormal label attached to the abnormal data , generating a learning model that outputs information about anomalies. How to generate a learning model. The learning model generation method according to claim 1, wherein the abnormal data is generated based on representative data of a plurality of time-series data or a plurality of representative data. 3. The method of generating a learning model according to claim 1, wherein the abnormal data is generated by adding periodic fluctuations to the time-series data. 4. The method of generating a learning model according to any one of claims 1 to 3, wherein the abnormal data is generated by continuously increasing or decreasing the time-series data as time changes. The learning model generation method according to any one of claims 1 to 4, wherein the abnormal data is generated by adding a spike whose value within a unit time suddenly exceeds a threshold to the time series data. The learning model generation method according to any one of claims 1 to 5, wherein the abnormal data is generated by shifting the phase of the waveform of the time-series data. Calculate the effective values of multiple time-series data,
Obtain the maximum rms value from each calculated rms value,
calculating the effective value of the representative data in the plurality of time-series data;
Calculate the ratio between the maximum effective value obtained and the effective value of the calculated representative data,
The learning model generation method according to any one of claims 1 to 6, wherein representative data in the plurality of time-series data is corrected based on the calculated effective value ratio. Selectably output multiple generation methods indicating how to generate abnormal data,
Accepts the output generation method selection,
The learning model generation method according to any one of claims 1 to 7, wherein the abnormal data is generated based on the received generation method. Selectably outputting a plurality of generation methods indicating a method of generating abnormal data and a combination method combining each generation method,
Accept one of the output generation methods or a combination generation method,
The learning model generation method according to any one of claims 1 to 7, wherein the abnormal data is generated based on the received generation method or combination generation method. 10. The method of generating a learning model according to any one of claims 1 to 9, wherein second abnormal data is generated by adding colored noise to the abnormal data. The learning model generation method according to any one of claims 1 to 10, wherein abnormal data is generated by applying a plurality of types of abnormal data generation methods for the time series data to the time series data at different timings. . Acquire time-series data judged to be normal,
Generate anomaly data based on the acquired time series data,
When time-series data is input based on the time-series data determined to be normal, the normal label attached to the time-series data, and the generated abnormal data and the abnormal label attached to the abnormal data A program that causes a computer to generate a learning model that outputs information about anomalies. an acquisition unit that acquires time-series data determined to be normal;
a first generating unit that generates abnormal data based on the acquired time-series data;
When time-series data is input based on the time-series data determined to be normal, the normal label attached to the time-series data, and the generated abnormal data and the abnormal label attached to the abnormal data and a second generator that generates a learning model that outputs information about an abnormality. Acquire time-series data judged to be normal,
Generate anomaly data based on the acquired time series data,
A method of generating learning data, comprising: associating an anomaly label with the generated anomaly data, associating a normal label with the time-series data, and storing the anomaly data and the time-series data as learning data.

Images