JPWO2020188696A1 - Anomaly detection device and abnormality detection method - Google Patents

Abstract

The abnormality detection device (100) according to the present invention has a data division unit (102) that divides time-series data into a learning section and a test section, and a portion of the time-series data that generates a substring of the learning section as learning data. A column generation unit (103), a prediction distribution calculation unit (104) that obtains a probability distribution corresponding to a data point in a test section using training data, and an abnormality detection unit (107) that detects an abnormality using a probability distribution. And.

Description

The present invention relates to an abnormality detection device and an abnormality detection method for determining an abnormality of an object for abnormality detection such as equipment such as a factory, a chemical plant, and a steel plant.

In equipment such as factories and buildings, control systems for controlling equipment such as air conditioning equipment and electric lighting in the equipment have been introduced. Control systems for controlling processes have also been introduced in equipment such as power plants, chemical plants, and steel plants, including thermal power, hydraulic power, and nuclear power. In addition, factory equipment, automobiles, railroad vehicles, and the like are often equipped with a logging system for recording the state of these equipment. The state of the equipment includes the state of the equipment provided in the equipment, the state indicating the environment inside or outside the equipment, and the like. Logging systems and control systems generally store time-series data, measured by sensors, that indicate the state of the equipment over time.

Conventionally, it has been practiced to analyze changes in the time-series data to detect an abnormality in an object for abnormality detection such as the equipment. For example, Patent Document 1 describes an abnormality detection method in which features are extracted from time-series data, and when the distance between the extracted features and the features extracted from training data that does not include anomalies exceeds a threshold value, anomalies are determined. Is disclosed.

JP-A-2015-11027

On the other hand, the tendency of time series data may differ depending on the equipment in the equipment or the sensor that measures the state. Therefore, when making a determination using a threshold value as in the method described in Patent Document 1, there is a problem that the threshold value needs to be evaluated and verified for each device and sensor. Further, the evaluation and verification of this threshold value requires external information such as the knowledge of a skilled operator and the knowledge of the equipment designer, so that the load on the operator and the designer is high and it takes time. Therefore, it is desired to suppress the workload for setting the threshold value.

The present invention has been made in view of the above, and an object of the present invention is to obtain an abnormality detection device capable of detecting an abnormality of an object for abnormality detection by suppressing a workload for setting a threshold value. To do.

In order to solve the above-mentioned problems and achieve the object, the abnormality detection device according to the present invention has a data division unit that divides time-series data into a learning section and a test section, and a portion of the time-series data in the learning section. It includes a sub-column generation unit that generates columns as training data. Further, the abnormality detection device includes a prediction distribution calculation unit that obtains a probability distribution corresponding to a data point in a test section using learning data, and an abnormality detection unit that detects an abnormality using the probability distribution.

The abnormality detection device according to the present invention has the effect of suppressing the workload for setting the threshold value and detecting the abnormality of the object for abnormality detection.

The figure which shows the functional configuration example of the abnormality detection apparatus which concerns on embodiment of this invention. The figure which shows the configuration example of the computer system which realizes an abnormality detection device. Diagram showing an example of time series data Diagram showing an example of time series data Diagram showing an example of time series data Flow chart showing an example of the abnormality detection processing procedure in the abnormality detection device Diagram showing an example of a Gaussian distribution Diagram showing how the learning section is updated Diagram showing an example of the confidence interval and anomaly score at each point in the test interval

Hereinafter, the abnormality detection device and the abnormality detection method according to the embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to this embodiment.

Embodiment.
FIG. 1 is a diagram showing a functional configuration example of the abnormality detection device according to the embodiment of the present invention. As shown in FIG. 1, the abnormality detection device 100 of the present embodiment includes a data acquisition unit 101, a data division unit 102, a substring generation unit 103, a prediction distribution calculation unit 104, a confidence interval calculation unit 105, and an abnormality score calculation. A unit 106 and an abnormality detection unit 107 are provided.

The abnormality detection device 100 of the present embodiment acquires time-series data indicating the state of the object for abnormality detection, and detects the abnormality of the object for abnormality detection based on the acquired time-series data. As the object of abnormality detection, data on facilities such as factories, chemical plants, steel plants, water and sewage plants, automobiles, railroad vehicles, economy or management can be exemplified. The time series data is a data string including data corresponding to a plurality of different times, and is a data string in which the time change of the data can be grasped. The time series data may be any data, for example, a data string containing data observed at a plurality of different times, or data processed at a plurality of different times. It may be a data string containing the results. Further, the time series data may be feedback data used for control or the like. That is, the time series data includes a plurality of data points corresponding to different times. In the following, the data point corresponds to one point when the time information indicating the time and the value such as the sensor value corresponding to the time are represented by the two-dimensional coordinate system. For example, the time-series data is data in which sensor values measured by sensors at regular time intervals are arranged together with the acquisition time of the sensor values. The sensors include, for example, a temperature sensor that measures the temperature of equipment, equipment, etc., a sensor that detects the rotational position of a motor provided in a factory machine, a force sensor that measures the acceleration of a factory machine, a current sensor, and the like. A voltage sensor or the like. Time-series data on the economy, management, etc. include time-series data on exchange rates, stock prices, and futures prices. Examples of the anomaly of these data include anomalies such as a sharp drop in price.

The time-series data may be stored in, for example, processing machines that are equipment on the factory line, manufacturing equipment such as robot pumps, equipment such as automobiles and railroad vehicles, air conditioning equipment such as factories and buildings, electricity, and so on. It may be data stored in a control system such as lighting and water supply / drainage. Further, the time-series data may be data accumulated in a control system for controlling processes of a power plant such as thermal power, hydraulic power, nuclear power, a chemical plant, a steel plant, a water and sewage plant, and the like. Further, the time series data may be data accumulated in an information system related to economy, management, or the like.

Returning to the description of FIG. The data acquisition unit 101 of the abnormality detection device 100 receives input of data such as settings used for the abnormality detection process. The data acquisition unit 101 may accept input of time series data. The data division unit 102 divides the time series data into a learning section and a test section, which will be described later. The substring generation unit 103 generates learning data which is a substring of the learning section of the time series data.

The prediction distribution calculation unit 104 obtains the probability distribution corresponding to the data points in the test section based on the learning data. The credible interval calculation unit 105 calculates the credible interval corresponding to the data points of the test interval based on the probability distribution. The anomaly score calculation unit 106 calculates an anomaly score indicating the degree of deviation between the confidence interval and the time series data of the test interval. The anomaly detection unit 107 detects an abnormality using the probability distribution calculated by the prediction distribution calculation unit 104. The abnormality detection unit 107 detects an abnormality based on, for example, an abnormality degree score. Details of the operation of each part of the abnormality detection device 100 will be described later.

Here, the hardware configuration of the abnormality detection device 100 will be described. The abnormality detection device 100 is realized by a computer system. FIG. 2 is a diagram showing a configuration example of a computer system that realizes the abnormality detection device 100. This computer system includes a computer 20, an input device 209 connected to the computer 20, and a display 210.

The computer 20 includes a processor 201, an auxiliary storage device 202, a memory 203, an input interface (hereinafter abbreviated as I / F) 204, a display I / F 205, an alarm output device 206, and a network I / F 207. The processor 201 is connected to the auxiliary storage device 202, the memory 203, the input I / F 204, the display I / F 205, the alarm output device 206, and the network I / F 207 via the signal line 208. The processor 201 is, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. The auxiliary storage device 202 and the memory 203 are a RAM (Random Access Memory), a ROM (Read Only Memory), an HDD (Hard Disk Drive), and the like.

The input I / F 204 is connected to the input device 209 via the cable 211. The input I / F 204 is a circuit for exchanging data with the input device 209. The input device 209 is a device that receives input from the user, and includes a keyboard, a mouse, and the like.

The display I / F 205 is connected to the display 210 via a cable 212. The display I / F 205 is a circuit for exchanging data with the display 210. The input device 209 and the display 210 may be integrated and realized by a touch panel. The display 210 is an example of an output device, but in addition to the display 210, an output device such as a printer may be connected via the I / F of the output device.

The alarm output device 206 is an indicator light including an LED (Light Emitting Diode) pilot lamp, a speaker, and the like. Note that FIG. 2 shows an example in which the alarm output device 206 is provided inside the computer 20, but the present invention is not limited to this, and the alarm output device 206 is provided outside the computer 20 like the display 210 and has a cable. It may be connected to the computer 20 via.

The network I / F 207 is a communication circuit for communicating with the outside, and is connected to a network (not shown) via a wired line or a wireless line. Other devices such as a computer (not shown) and a database server having a database are connected to the network. The network I / F 207 sends / receives e-mail to / from another device, receives data stored in the database of the other device, and stores data in the database of the other device. Send to the device of.

The functions of each functional unit of the abnormality detection device 100 shown in FIG. 1 are realized by software, firmware, or a combination of software and firmware. The software, firmware, or software and firmware for realizing the functions of each functional unit of the abnormality detection device 100 are described as a program. This program is stored in the auxiliary storage device 202. This program causes the computer 20 to execute the procedure or method of each functional unit. Specifically, when the processor 201 executes the program, each functional unit of the abnormality detection device 100 shown in FIG. 1 is realized. Of the functional units of the abnormality detection device 100 shown in FIG. 1, the input device 209 is also used to realize the function of the data acquisition unit 101. Further, at least one of the display 210 and the alarm output device 206 is used to realize the function of the abnormality detection unit 107. This program may be provided by a recording medium or a communication medium and stored in the auxiliary storage device 202.

The above-mentioned time series data is stored in the auxiliary storage device 202. For example, the time series data is transmitted from another device and stored in the auxiliary storage device 202 via the network I / F 207. Alternatively, the time-series data may be stored in the auxiliary storage device 202 by being recorded on the recording medium and read from the recording medium, or may be input by the user via the input device 209.

The program stored in the auxiliary storage device 202 is executed by being loaded from the auxiliary storage device 202 into the memory 203 and read into the processor 201. By executing the program, the functions of each functional unit shown in FIG. 1 are realized. Further, when the program is executed, data used for executing the program, such as time series data, is also loaded from the auxiliary storage device 202 into the memory 203. The execution result of the program is written in the memory 203, stored in the auxiliary storage device 202, displayed on the display 210 via the display I / F 205, or displayed on the display 210 via the network I / F 207, depending on the description content of the program. It may be sent to other devices on the network.

The input device 209 receives from the user setting information used in the processing of the abnormality detection device 100 such as the data division ratio described later. Further, the input device 209 receives from the user instructions regarding processing such as a start request and an end request for time-series data processing. The setting information received by the input device 209 is stored in the auxiliary storage device 202 via the input I / F 204. The instruction received by the input device 209 is input to the processor 201 via the input I / F 204.

Next, the abnormality detection method of the present embodiment will be described. In the following, as time-series data, data measured by a plurality of types of sensors installed in a manufacturing apparatus continuously operating on a factory line will be described as an example. That is, an example in which the object of abnormality detection is a manufacturing apparatus will be described. As described above, the time series data is not limited to the data measured by the sensor.

3 to 5 are diagrams showing an example of time series data. The sensor values 303 shown in FIGS. 3 to 5 are sensor values that are data measured at regular intervals by a plurality of types of sensors installed in a manufacturing apparatus that continuously operates on a factory line. The sensor value 303 is associated with time information 301 indicating the time when each data is acquired. In the example shown in FIGS. 3 to 5, the set of the time information 301 and the sensor value 303 is time series data. In the examples shown in FIGS. 3 to 5, the plurality of types of sensors include the acceleration sensor A. The sensor value is not limited to the value measured by the acceleration sensor A, and the measured values of the current, voltage, vibration, acceleration, pressure, etc. of the manufacturing apparatus can be exemplified.

In FIGS. 3 to 5, time information 301 indicating the time when each data of the sensor value 303 is acquired and control information 302 indicating the control conditions of the manufacturing apparatus are shown together with the sensor value 303. The control information 302 is, for example, recipe information which is a command value related to the number of manufactured products, which is the number of manufactured products, and the manufacturing conditions. The command value is, for example, the command value of the speed of the motor when the object of abnormality detection is a rotating mechanism, the command value of the temperature at the time of welding in the case of a welding device, and the laser in the case of a laser machine. This is the command value of the output voltage. The recipe information will be explained. Depending on the product, the command value may be changed in several steps. Here, some command value change patterns, a set of processing conditions, and the like are called recipes. An example of a rotating mechanism is a vacuum pump in semiconductor manufacturing. In a vacuum pump, air is discharged by rotating a motor to create a vacuum state. When manufacturing a semiconductor, chemicals, gas, etc. are applied to the wafer. The types of chemicals, gas, etc. differ depending on the product type. The application timing of chemicals, gas, etc. differs depending on the product, and the rotation speed of the motor differs depending on the product. For example, the rotation speed of the motor is A before the gas is charged, the rotation speed of the motor is B when the gas is charged, and the rotation speed of the motor is C after the gas is charged. These steps are called recipes. Recipe information is information indicating these procedures. In the example shown in FIGS. 3 to 5, the control information 302 includes the command value 1. Here, it is assumed that the control information 302 is recorded as state information together with the time information 301 and the sensor value 303 which are time series data. The state information is recorded by, for example, a control device that controls the manufacturing device, and the abnormality detection device 100 acquires the state information from this control device via the network.

In the examples shown in FIGS. 3 to 5, the time information 301 is indicated by the time, but the time information is not limited to the one indicating the time itself, and may be a continuous number assigned mechanically. It may be a numerical value such as a row number of a matrix. Further, when the time series data is periodically acquired and it is clear that there is no loss, the time information may not be added to each sensor as long as the data are arranged in the order of acquisition time. In this case, if the start time of the time-series data is managed separately by, for example, being described in the file name of the data file containing the time-series data, and the information indicating the acquisition interval of each sensor value is managed. , The acquisition time of each data can be known from the start time and the number of the data in the time series data. The time information is not added for each data point in this way, but may be given indirectly.

Although the state information is described as one table in FIG. 3, the format of the state information is not limited to the example shown in FIG. For example, the time information and the control information may be created as one table, and the set of the time information 301 and the sensor value 303, which are time series data, may be created as another table. Further, the time series data may be created as a separate table for each sensor type. In this way, the state information may be divided into a plurality of pieces as long as the information can be associated with each other.

Further, the time series data may be a summarized summary value instead of the measured value itself measured by the sensor. Depending on the factory, line, manufacturing equipment, etc., a value that summarizes the data measured by the sensor according to a certain rule may be recorded. The term "summary" as used herein means that data with a smaller amount of data than the original data is generated by performing processing using the original data. The specific processing content of the abstract is not particularly limited, but may be, for example, statistical processing, Fourier transform processing, or the like. For example, the sensor acquires the measured value from every second, and the control device of the manufacturing apparatus generates one representative value per hour based on the measured value. The representative value may be the average value of the measured values for one hour, the median value of the measured values for one hour, or the mode value of the measured values for one hour. Good. Further, the abnormality detection device 100 may acquire the measured values measured by the sensor, summarize the acquired measured values, and generate time series data.

In the example shown in FIG. 3, the time series data is data every second. In the example shown in FIG. 3, the value of the command value 1 is not changed. In the examples shown in FIGS. 4 and 5, the time series data is data every hour. In the example shown in FIG. 4, the command value 1 is changed from 20 to 40 at 14:00:00 on December 01, 2018, from 40 to 80 at 16:00:00 on December 01, 2018, and 2018. It was changed from 80 to 20 at 17:00:00 on 12/01. In this way, the command value may be changed depending on the production status and the like. In the abnormality detection process described later, data can be extracted according to the command value and the abnormality detection process can be performed using the time series data for each command value so that the tendency of the time series data can be easily predicted. In such a case, if data having the same operating conditions, that is, the same value of the command value 1, is extracted, the extracted data will be defective. For example, in the example shown in FIG. 4, if the command value 1 with a value of 20 is extracted, it will be at three time points from 2018/12/01 14:00:00 to 2018/12/01 16:00:00. The corresponding data will be lost.

In addition, depending on the operating state and energized state of the equipment, the measured values that should have been acquired at regular intervals may not be acquired, or the measurement itself may not be performed due to equipment maintenance, etc., resulting in data loss. Sometimes. FIG. 5 shows an example in which the time series data is missing. In the example shown in FIG. 5, the data corresponding to the two time points of 2018/12/01 14:00:00 and 2018/12/01 15:00:00 are missing.

When data is extracted for each command value in the example shown in FIG. 4, and when the time series data is missing, such as when the original data is missing as shown in FIG. As will be described later, the abnormality detection device 100 may interpolate the missing data by interpolation processing.

FIG. 6 is a flowchart showing an example of the abnormality detection processing procedure in the abnormality detection device 100. First, the data acquisition unit 101 accepts the selection of time-series data to be processed (step S1). As described above, when the measured values of a plurality of types of sensors are used as time series data, the time series data is generated for each sensor. In step S1, the user receives a selection of which of these time series data is to be processed. At this time, the data acquisition unit 101 displays information for identifying selectable time-series data, for example, a name indicating a sensor corresponding to the time-series data, on the display 210, and the user selects the displayed names. You may accept the selection. Further, not only the type of the sensor but also the selection of the period of the processing target may be accepted as the time series data of the processing target. By operating the input device 209, the user selects a name corresponding to the time-series data to be processed from the displayed names. Further, the data acquisition unit 101 may also accept the input of the processing conditions in step S1. As the processing condition, for example, it is possible to specify whether to perform the processing of extracting the data for each command value as described above. When it is specified whether to perform the processing of extracting the data for each command value, the processing condition also determines which command value the data corresponding to which command value is to be processed.

After step S1, the data acquisition unit 101 performs preprocessing according to the processing conditions (step S2). When the processing conditions are not defined, the data acquisition unit 101 performs a process of extracting the time-series data of the processing target specified in step S1 from the state information as a preprocessing. When it is specified in step S1 that the data is extracted and processed for each command value as the processing condition, the data acquisition unit 101 is instructed in step S2 from the time-series data to be processed as preprocessing. Extract the data corresponding to the command value. Further, when the time series data is missing, the data acquisition unit 101 may make up for the missing data by the interpolation process as preprocessing.

Further, the data acquisition unit 101 receives the ratio between the learning section and the test section (step S3). In the present embodiment, as will be described later, the time series data is divided into a learning section and a test section, and the data of the test section is predicted using the time series data of the learning section. In step S3, the data acquisition unit 101 receives the input of the ratio of the learning section and the test section used at the time of this division from the user. The learning interval and the test interval may be the ratio of the time length corresponding to the data or the ratio of the data points, but here, as described above, the case where the time series data is missing is considered. Then, the ratio of the data points is used.

Next, the data division unit 102 divides the time series data into a learning section and a test section based on the ratio of the learning section and the test section (step S4). Specifically, the data division unit 102 calculates the division position for dividing the time series data into the learning section and the test section based on the ratio of the learning section and the test section. For example, suppose that the number of data points of the time-series data to be processed is N _all , and the ratio of the learning section to the test section is R _t : R _d for the learning section: test section. At this time, the data dividing unit _102, among the _{N all} pieces of data, the beginning of _{N all} × a _{(R t / (R t +} R d)) pieces of data as training interval, the time series data after the learning period Let it be a test section. When N _all x (R _t / (R _t + R _d )) is not an integer, learning is performed by rounding, rounding, rounding up, etc. to _{N all} x (R _t / (R _t + R _d)). Determine the number of data points for the section. Let n be the data length of the learning section obtained in this way, that is, the number of data points, and m be the data length of the test section. n + m = N _all . The division position between the learning section and the test section is between the nth and n + 1th of the time series data. In this way, the learning section is a section in which the time corresponding to the time series data precedes the test section. The number of data points in the learning section and the number of data points in the test section are also hereinafter referred to as the learning data length and the test data length, respectively. The data division unit 102 notifies the substring generation unit 103 of the training data length and the test data length.

Next, the substring generation unit 103 generates learning data which is a substring of the learning section based on the division result of step S4, that is, the division position calculated in step S4 (step S5). That is, the sub-sequence generation unit 103 generates a sub-sequence of the learning section by extracting the first n points from the time-series data, and extracts the remaining m points of the time-series data to generate the sub-sequence of the test section. Generate. The substring generation unit 103 outputs the substring of the generated learning section to the prediction distribution calculation unit 104. As will be described later, the learning section is updated in the process of step S9 later. Hereinafter, the learning section divided in step S5 is also referred to as an initial learning section.

Next, the prediction distribution calculation unit 104 obtains the probability distribution and the predicted value at point j of the test section based on the learning data which is a substring of the learning section (step S6). j is a natural number indicating the number of data in the substring in the initial test interval, and the initial value is 1. The j-time point indicates a time point corresponding to the j-th data point in the substring in the test interval, that is, the j-th time point. Specifically, in the first step S6, the prediction distribution calculation unit 104 is a test corresponding to the next data point of the learning data, that is, the n + 1 point from the beginning, based on the learning data which is a substring of the initial learning section. Calculate the probability distribution of the data at the jth point in the interval. Therefore, in the first step S6, j is 1. The prediction distribution calculation unit 104 calculates a conditional distribution at the next point of the training data based on the training data, for example, using a model by Gaussian process regression (GPR).

Gaussian process is a set of n data _{(x 1, x 2, ...} , x n) _{for, Y = (y 1, y} 2, ..., y n) corresponding to these data simultaneously distribution in p (Y ) Follows the Gaussian distribution. Applying a Gaussian process to a regression problem, that is, applying a Gaussian process to the above data set, is Gaussian process regression. Therefore, in Gaussian process regression, as described above, n data points (X, Y) = (x ₁ , y ₁ ), (x ₂ , y ₂ ), ..., (X _n , y _n ) are given. when _in, as predictive distribution of Y at the point of _{x n + 1,} the conditional distribution _p | will be determined _{(x n +} 1 Y). When i = 1, 2, ..., N, (xi _, y _i ) indicates the i-th data point of the learning section, x _i is the time information, and y _i is the sensor corresponding to _{x i.} Indicates a value such as a value.

In order to calculate the conditional distribution p (x _{n + 1} | Y), the joint distribution p (Y _{n + 1} ) represented by the following equation (1) is required. _{C n + 1} in the equation (1) is a covariance matrix of (n + 1) × (n + 1) and can be expressed in the form shown in the equation (2).

Here, _{C n} is the covariance matrix of n × n, can be expressed using a kernel function _{k (x i, x j)} . In addition, j is n + 1. The kernel function is a function that expresses the degree of similarity, that is, the correlation between two variables _{, x i} and x _j. Further, K is a vector having an element of _{k (x n} , x _{n + 1).} Further, c is a scalar as shown in the formula (3). β is a constant. δ _ij is a variable that becomes 0 when i = j. It is assumed that Y has an error such as a measurement error and the error follows a Gaussian distribution. This error corresponds to the result of multiplication ^{of the constant β -1} and the variable δ _ij in Eq. (3).

Here, it is assumed that the Gauss kernel shown in Eq. (4) is used as the kernel function. An exponential kernel or a linear kernel may be used, and the kernel function is not limited to the Gauss kernel.

The prediction distribution calculation unit 104 uses the above equations (1) to (4) to obtain (x ₁ , y ₁ ), (x ₂ , y ₂ ), ..., (x _n ,) the time series data of the learning interval. By using it as _{y n} ), the mean value μ of the conditional distribution p (x _{n + 1 | Y), which is a Gaussian distribution of y n + 1} ^{, and the variance σ 2} can be obtained by Eqs. (5) and (6). .. The conditional distribution p (x _{n + 1} | Y) can be expressed by the equation (7).

The probability distribution at the time point corresponding to x _{n + 1} , that is, the time point j is a Gaussian distribution with a ^{mean value μ and a variance σ 2.} FIG. 7 is a diagram showing an example of a Gaussian distribution. Here, the predicted value of the time series data at time j can be the average value of the Gaussian distribution. Further, when the credit interval is, for example, a 95% confidence interval, the range excluding the left and right 2.5% in the Gaussian distribution is the credit interval at time j. The 95% confidence interval is an interval in which the probability that the true value exists in the confidence interval is 95%.

Returning to the explanation of FIG. 6, the prediction distribution calculation unit 104 calculates the probability distribution and then calculates the prediction value, that is, the average value of the Gaussian distribution based on the probability distribution. Further, the prediction distribution calculation unit 104 passes the calculated probability distribution to the confidence interval calculation unit 105. The credible interval calculation unit 105 calculates the credible interval at time j based on the probability distribution (step S7). The credit interval calculation unit 105 stores the calculated credit interval in the auxiliary storage device 202.

The credible interval calculation unit 105 determines whether or not the credible intervals of all the points in the test section have been calculated (step S8). When there is a time point in the test section where the confidence interval is not calculated (step S8 No), the confidence interval calculation unit 105 instructs the substring generation unit 103 to learn the learning interval, and the substring generation unit 103 sets the learning interval. Update (step S9). Specifically, in step S9, the substring generation unit 103 updates the learning section by sliding the learning section backward, that is, by sliding one data point toward the test section side, and updates the learning section with the updated substring of the learning section. It is generated and output to the prediction distribution calculation unit 104. After step S9, the substring corresponding to the updated learning section is used as learning data, and the process from step 6 is repeated. Since the learning section is updated in step S9, in the second and subsequent steps S6, processing corresponding to the next data point of the updated learning section is performed. Therefore, the value of j at the time j in step S6 is incremented by one each time the learning section is updated.

FIG. 8 is a diagram showing a state of updating the learning section. In Figure 8, the data points of the time series data and 20 _{N all,} the ratio of the learning period and the test _{period, R t: R d = 7} : shows an example in which a 3. That is, FIG. 8 shows an example in which the time series data is divided at a ratio of 70% for the learning section and 30% for the test section. In this example, the number of data points in the learning section is 14, and the number of data points in the test section is 6. In step S5 described above, as shown in the uppermost part of the figure, 14 points from the left of the input time series data are substrings of the learning section, and 6 points from the right are substrings of the test section. In FIG. 8, the rightmost point shows the most recent data. In FIG. 8, the sensor value is shown as an example as time series data.

Prediction 1 in the second stage of FIG. 8 shows how the predicted value is calculated in step S6 of the first time, that is, the first time of the loop. In FIG. 8, dark hatched circles indicate measured values in the learning section, and light hatched circles indicate measured values in the test section. The measured value is data input as time series data. The time-series data may be a summary value or the like instead of the measured value as described above, but since the sensor value is illustrated here, it is described as the measured value. When the time series data is a summary value, the actually measured value in FIG. 8 is a summary value. In Prediction 1, based on the learning interval, that is, the initial learning interval, which is the time point of 14 points from the left in the time series data, it corresponds to the next time point of the initial learning section, that is, the first time point of the test section indicated by the square mark. The predicted value to be calculated is calculated.

Prediction 2 in the third stage of FIG. 8 shows how the prediction value is calculated in step S6 of the second loop after the learning section is updated in step S9 of the first loop. In step S9 of the first loop, the learning section is updated so as to be slid to the left by one point. That is, the substring generation unit 103 updates the learning section so that the corresponding time shifts to a later time, and generates the substring corresponding to the updated learning section as the updated learning data. Further, in the updated learning section, the predicted value is used instead of the measured value at the time point when the test section is deviated by one point to the left. That is, in the third stage of FIG. 8, the updated learning section includes the actually measured values of 13 points from the second to the 14th from the left of the time series data and one predicted value of the test section. The learning interval updated in this way includes the predicted value of the test interval calculated according to the probability distribution. In Prediction 2, the probability distribution of the update point, which is the next data point of the updated learning interval, that is, the next time point of the updated learning interval, is calculated by using the substring of the updated learning interval. The predicted value based on the distribution is calculated. Based on the measured values of 13 points from the second to the 14th from the left of the time series data and the learning section, that is, the initial learning section, the data points next to the initial learning section, that is, the test section, indicated by the square marks. The predicted value corresponding to the first data point is calculated.

After the prediction 2, the update of the learning interval in step S9 and steps S6 to S8 are carried out until the confidence intervals of all the points in the test section are calculated, that is, the m-th prediction m, which is the number of data points in the test section, is executed. Until then, the processes of prediction 3 to prediction m are carried out in the same manner. In the update of the learning section in step S9, the learning section is sequentially shifted to the left side, and along with this, the predicted value is added one point at a time to the learning section.

Returning to the description of FIG. If it is determined Yes in step S8, the credible interval calculation unit 105 passes the credible interval data of each point of the test section to the abnormality score calculation unit 106. As a result, the abnormality degree score calculation unit 106 calculates the abnormality degree score of the test section (step S10). The anomaly degree score is a value indicating the degree of deviation between the training data and the time series data of the test interval. That is, the abnormality degree score is a value indicating the relative degree of dissociation between the behavior of the time series data in the learning interval and the behavior of the time series data in the test interval. The anomaly degree score is expressed by a numerical value from 0.0 to 1.0, for example, and it is assumed that the larger the degree of deviation, the closer to 1.0. Therefore, if the behavior of the time-series data in the learning interval and the behavior of the time-series data in the test interval are similar, the anomaly degree score becomes low. The definition of the anomaly score is not limited to this, and any degree of deviation between the behavior of the time series data in the learning section and the behavior of the time series data in the test section may be expressed.

Here, as a specific calculation method of the abnormality degree score, the abnormality degree score calculation unit 106 determines at each point whether or not the actually measured value of the test section is within the credible interval, and the actually measured value is within the credible interval. A method of calculating the anomaly score by dividing the data score by the total data score of the test interval is used. That is, the abnormality degree score calculation unit 106 calculates the abnormality degree score based on the confidence interval corresponding to the plurality of data points of the test section and the time series data of the test section.

FIG. 9 is a diagram showing an example of a confidence interval and an abnormality score at each time point of the test interval. In FIG. 9, there are 5 actually measured values that do not exist in the confidence interval shown by the broken line in the test section, and the number of data points in the test section is 6. Therefore, the abnormality degree score is 5/6 = 0.833 .... In FIG. 9, the anomaly score is described as 0.83 by rounding off the third decimal place of the anomaly score. If the substring used as the training data is missing ^{, the value of the variance σ 2} becomes large and the tail of the probability distribution is widened, so that the confidence interval is widened and the prediction accuracy is lowered. With respect to such points with low prediction accuracy, it is possible to suppress the influence of data with low prediction accuracy on the abnormality determination by weighting the points when calculating the abnormality score. For example, when ^{the value of the variance σ 2} is abnormal to the specified value, a weighting method can be considered in which the corresponding point is set to 0.5 points instead of 1 point in the calculation of the anomaly degree score. As described above, the abnormality degree score calculation unit 106 may calculate the abnormality degree score based on the variance of the probability distribution calculated by the prediction distribution calculation unit 104.

Returning to the description of FIG. 6, after step S10, the abnormality detection unit 107 outputs the abnormality determination result according to the abnormality degree score (step S11). For example, the abnormality detection unit 107 determines that the abnormality is normal when the abnormality score is 0.0 or more and less than 0.5, and needs attention when the abnormality score is 0.5 or more and less than 0.7. It is judged that the abnormality requires a warning when the abnormality score is 0.7 or more. Although caution is also included here as a part of the abnormality, only the abnormality that requires a warning may be defined as the abnormality. The abnormality detection unit 107 transmits the abnormality determination result to another device via the network I / F 207 by e-mail, or displays the abnormality determination result on the display 210 via the display I / F 205. If the determination result is an abnormality that requires a warning, the abnormality detection unit 107 may issue an alarm by the alarm output device 206. Further, the abnormality detection unit 107 may treat the transition of the abnormality degree score as time-series data, and display the trend graph on the display 210 via the display I / F 205.

In the above example, the abnormality detection unit 107 determines the abnormality using the abnormality degree score, but the abnormality determination method is a method using the calculated confidence interval or the predicted value, in other words, the probability distribution. Any method may be used to determine an abnormality, and the method is not limited to the above-mentioned example. For example, the abnormality detection unit 107 may determine that there is an abnormality if there is even one actually measured value that deviates from the confidence interval in the test section. That is, the abnormality detection unit 107 may determine an abnormality based on the probability distribution calculated by the prediction distribution calculation unit 104.

In the above example, since there are a plurality of points in the test section, the predicted values for the number of times in the test section are obtained, but if the test section has one point, Yes in the first step S8. , The learning section is not updated. That is, the update of the learning section is not indispensable, and the substring generation unit 103 may generate the substring of the learning section of the time series data as the learning data. Then, when the test section has a plurality of points, the substring generation unit 103 updates the learning section as described above.

Further, the abnormality detection unit 107 may display information including the confidence interval and the abnormality degree score shown in FIG. 9 on the display 210 via the display I / F 205. Further, data such as a credit interval and an abnormality degree score may be transmitted to an external display via the network I / F 207 and displayed on the external display. By constantly displaying this information on the display 210 or an external display, the operator can confirm the presence or absence of an abnormality and an abnormality sign in real time on a factory line or the like.

As described above, when there are a plurality of time-series data, the processing shown in FIG. 6 may be performed for each time-series data, or the processing shown in FIG. 6 may be performed for the specific time-series data. May be good. Further, when the time series data is extracted for each control condition such as the value of the command value and the processing shown in FIG. 6 is performed, the processing shown in FIG. 6 may be performed for each value of the command value or specified. The processing shown in FIG. 6 may be carried out with respect to the command value of.

Further, when real-time performance is not required, the above-mentioned information may be recorded and displayed as a graph on a regular basis. In the present embodiment, if there is a lack of time-series data, it can be dealt with by weighting or the like when calculating the abnormality score, so that it is a case where a plurality of types of indicated values are switched according to the production plan with the same device. Also, the processing shown in FIG. 6 can be performed for each command value.

The abnormality detection method of the present embodiment does not care about the equipment such as a factory, the type of the sensor, the tendency of the time series data, etc., which are the objects of the abnormality detection. Therefore, it is not necessary to evaluate for setting the threshold value for determining the abnormality for each object of abnormality detection, so that the workload for setting the threshold value can be suppressed. Further, in the present embodiment, since the abnormality can be detected based on the tendency of the change such as the gradual change of the time series data and the abnormality in which the tendency suddenly changes, the abnormality can be detected by a simple comparison between the time series data and the threshold value. Compared to the detection method, it is possible to respond to the detection of various abnormalities. Further, for example, by associating detailed information such as the type and cause of the abnormality with the abnormality degree score before and after the occurrence of the abnormality, it can be utilized for diagnosing the cause of the abnormality. As a result, the accuracy of abnormality detection can be improved and the load of investigating the cause of the abnormality can be reduced.

The configuration shown in the above-described embodiment shows an example of the content of the present invention, can be combined with another known technique, and is one of the configurations without departing from the gist of the present invention. It is also possible to omit or change the part.

100 anomaly detection device, 101 data acquisition unit, 102 data division unit, 103 substring generation unit, 104 prediction distribution calculation unit, 105 credit interval calculation unit, 106 abnormality score calculation unit, 107 abnormality detection unit, 201 processor, 202 auxiliary Storage device, 203 memory, 204 input I / F, 205 display I / F, 206 alarm output device, 207 network I / F, 209 input device, 210 display.

In order to solve the above-mentioned problems and achieve the object, the abnormality detection device according to the present invention has a data division unit that divides time-series data into a learning section and a test section, and a portion of the time-series data in the learning section. It includes a sub-column generation unit that generates columns as training data. Further, the abnormality detection device includes a prediction distribution calculation unit that obtains a probability distribution corresponding to a data point in a test section using learning data, and an abnormality detection unit that detects an abnormality using the probability distribution. The learning section is a section in which the time corresponding to the time series data precedes the test section, and the prediction distribution calculation unit obtains the probability distribution corresponding to the next data point of the learning section as the probability distribution, and substrings. The generation unit updates the learning section so that the corresponding time shifts to a later time, generates the substring corresponding to the updated learning section as the updated learning data, and the prediction distribution calculation unit after the update. The probability distribution of the update point, which is the next data point of the updated learning interval, is obtained using the learning data of, and the updated learning interval includes the predicted value of the test interval calculated according to the probability distribution.

Claims (7)

A data division unit that divides time series data into a learning section and a test section,
A sub-sequence generator that generates a sub-sequence of the learning section as learning data in the time-series data,
Using the learning data, a prediction distribution calculation unit that obtains a probability distribution corresponding to the data points of the test section, and
Anomaly detection unit that detects anomalies using the probability distribution,
Anomaly detection device characterized by being equipped with. A credible interval calculation unit that calculates a credible interval corresponding to a data point in the test section based on the probability distribution.
An anomaly score calculation unit that calculates an anomaly score indicating the degree of deviation between the learning data and the time-series data of the test interval using the confidence interval.
With
The abnormality detection device according to claim 1, wherein the abnormality detection unit detects an abnormality based on the abnormality degree score. The learning section is a section in which the time corresponding to the time series data precedes the test section.
The prediction distribution calculation unit obtains a probability distribution corresponding to the next data point in the learning section as the probability distribution.
The sub-string generation unit updates the learning section so that the corresponding time shifts to a later time, and generates the sub-string corresponding to the updated learning section as the updated learning data.
The prediction distribution calculation unit uses the updated learning data to obtain the probability distribution of the update point, which is the next data point of the updated learning section.
The credible interval calculation unit calculates the credible interval of the update point based on the probability distribution of the update point.
The claim is characterized in that the abnormality degree score calculation unit calculates the abnormality degree score based on the confidence interval corresponding to a plurality of data points of the test section and the time series data of the test section. The abnormality detection device according to 2. The abnormality detection device according to claim 3, wherein the updated learning section includes a predicted value of the test section calculated according to the probability distribution. Claim 3 or claim 3, wherein the abnormality degree score calculation unit calculates the abnormality degree score based on the score of the data that does not exist in the corresponding credit interval among the time series data of the test section. The abnormality detection device according to 4. The invention according to any one of claims 2 to 5, wherein the anomaly degree score calculation unit calculates the anomaly degree score based on the variance of the probability distribution calculated by the prediction distribution calculation unit. Anomaly detection device. This is an abnormality detection method in an abnormality detection device.
The first step of dividing the time series data into a learning interval and a test interval,
A second step of generating a substring of the learning section of the time series data as learning data, and
Using the training data, the third step of obtaining the probability distribution corresponding to the data points of the test interval, and
The fourth step of detecting anomalies using the probability distribution and
Anomaly detection method characterized by including.

Images