JP2007164346A - Decision tree changing method, abnormality determination method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a decision tree changing method for improving the precision of abnormality determination. <P>SOLUTION: This decision tree changing method as one configurations includes inputting data to a decision tree for predicting a class from one or more attributes generated from multi-dimensional time series data as the group of data having the n-th dimensional attribute value and one-dimensional class, and generating frequency distribution information showing the frequency distribution of classes by using the data group classified into the leaves of the decision tree for every leave, and selecting one or more classes based on the frequency distribution information, and updating the class of the corresponding leaves of the decision tree with the selected class. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a decision tree changing method, an abnormality determination method, and a program, for example, a technique for determining the abnormality of multidimensional time series data.

  Some of the recent plant systems are equipped with a system for detecting a plant abnormality by monitoring an appropriate range of sensors attached to individual devices constituting the system. In this method, an appropriate range that should be taken by the sensor value is set in advance, and an abnormal warning is issued when the sensor value is outside the appropriate range. An increase in the number of sensors is desired to automate the appropriate range setting.

  A general appropriate range is given by, for example, an upper limit and a lower limit, but this is only one accuracy. The setting of an appropriate range of a certain sensor (hereinafter referred to as a target sensor) can be accurately determined by using one or more other sensors (hereinafter referred to as explanation sensors) that move in association with each other.

  More specifically, first, a plurality of models for predicting the value of the target sensor using the value of the explanatory sensor are constructed. When determining whether or not certain data is abnormal, a model used for determination is selected from a plurality of models, and data to be determined is input to the selected model. By comparing the predicted value obtained from the selected model with the actual value of the target sensor, it is determined whether or not there is an abnormality in the data (abnormality determination). If the predicted value and the actual value are significantly different, it can be said that the actual value is likely to indicate an abnormal value.

However, even if the abnormality determination is performed by such a method, there is a possibility that normal data is determined to be abnormal if the model used for prediction is not properly selected.
JP 2004-29922 A

  The present invention provides a decision tree changing method, an abnormality determination method, and a program capable of improving the accuracy of abnormality determination.

  A decision tree changing method according to an aspect of the present invention is a method for determining a class from one or more attributes generated from multidimensional time-series data that is a set of data having an n-dimensional attribute value and a one-dimensional class. Each of the data is input to a tree, and for each leaf of the decision tree, frequency distribution information representing a frequency distribution of the class is generated using a data group classified into the leaves, and one or more classes are generated based on the frequency distribution information And the leaf class of the decision tree corresponding to the frequency distribution information is updated with the selected class.

  The abnormality determination method as one aspect of the present invention clusters first multidimensional time-series data that is a set of data having n-dimensional attribute values, assigns a class to each cluster, and for each cluster, A model for predicting the value of one attribute using another attribute is created, and the class of the cluster to which each class belongs is assigned to each data in the first multidimensional time series data. A decision tree for predicting a class from the other attributes is generated using one multidimensional time-series data, the generated decision tree is changed by the decision tree changing method, and then an n-dimensional attribute value Data to be tested in the second multidimensional time-series data that is a set of data having the following is input to the decision tree after the change, the class is predicted, and the predicted class is supported Select Dell, input the value of the other attribute in the data to be tested to the selected model, and from the value of the one attribute in the data to be tested and the output of the model, Determine the anomaly of the data to be tested.

  The abnormality determination method as one aspect of the present invention clusters first multidimensional time-series data that is a set of data having n-dimensional attribute values, assigns a class to each cluster, and for each cluster, A model for predicting the value of one attribute using another attribute is created, and each class in the first multidimensional time series data is assigned a class of a cluster to which the data belongs, and assigned to the data Based on the class and the class assigned to the data included in the predetermined time range from the data, the class assigned to the data is redetermined, the class of the data is updated with the redetermined class, and after the update Using the first multi-dimensional time series data to which the class is assigned, a decision tree that predicts the class from the other attributes is generated, and has an n-dimensional attribute value. Data to be tested in the second multi-dimensional time series data that is a set of data is input to the generated decision tree, a class is predicted, and a model corresponding to the predicted class is selected and selected. The value of the other attribute in the data to be tested is input to the model, and the abnormality of the data to be tested is determined from the value of the one attribute in the data to be tested and the output of the model. Determine sex.

  According to an abnormality determination method as one aspect of the present invention, first multi-dimensional time-series data that is a set of data having n-dimensional attribute values is clustered, and one attribute value is assigned to each cluster. In the second multidimensional time series data, which is a set of data having an n-dimensional attribute value, a model for predicting using the attribute is determined, a variation allowable range of the other attribute is determined in each of the models A model in which the other attribute in the data to be tested is included in the variation allowable range is selected, and the value of the other attribute in the data to be tested is input to the selected model, and the test target The anomaly of the data to be tested is determined from the value of the one attribute in the data and the output of the model.

  The abnormality determination method as one aspect of the present invention clusters first multidimensional time-series data that is a set of data having n-dimensional attribute values, assigns a class to each cluster, and for each cluster, A model for predicting the value of one attribute using another attribute is created, and the class of the cluster to which each class belongs is assigned to each data in the first multidimensional time series data. A decision tree for predicting a class from the other attributes is generated using one multidimensional time-series data, the generated decision tree is changed by the decision tree changing method, and then an n-dimensional attribute value The data to be tested in the second multidimensional time series data that is a set of data having the following is input to the changed decision tree to predict the class, while the individual models are And determining a variation allowable range of the other attribute, selecting a model in which the other attribute in the data to be tested is included in the variable allowable range, and corresponding to the selected model and the predicted class. A model common to the model is selected, the value of the other attribute in the data to be tested is input to the selected model, the value of the one attribute in the data to be tested, and the model From this output, the abnormality of the data to be tested is determined.

  The abnormality determination method as one aspect of the present invention clusters first multidimensional time-series data that is a set of data having n-dimensional attribute values, assigns a class to each cluster, and for each cluster, A model for predicting the value of one attribute using another attribute is created, and each class in the first multidimensional time series data is assigned a class of a cluster to which the data belongs, and assigned to the data Based on the class and the class assigned to the data included in the predetermined time range from the data, the class assigned to the data is redetermined, the class of the data is updated with the redetermined class, and after the update Using the first multi-dimensional time series data to which the class is assigned, a decision tree that predicts the class from the other attributes is generated, and has an n-dimensional attribute value. Data to be tested in the second multi-dimensional time-series data that is a set of data is input to the generated decision tree to predict a class, while fluctuations in the other attributes in each individual model A tolerance range is determined, a model in which the other attribute in the data to be tested is included in the variation tolerance range is selected, and a model common to the selected model and a model corresponding to the predicted class is selected. A value of the other attribute in the data to be tested is input to the selected model, and the test is performed from the value of the one attribute in the data to be tested and the output of the model. Determine the anomaly of the target data.

  A program as one aspect of the present invention causes a computer to execute each step described in the decision tree changing method.

  A program according to one aspect of the present invention causes a computer to execute each step described in the abnormality determination method.

  ADVANTAGE OF THE INVENTION According to this invention, the model utilized when performing abnormality determination using a some model can be determined flexibly, and the precision of abnormality determination can be improved.

  As a prior application of the applicant of the present application, there is Japanese Patent Application No. 2005-176700 which has not been disclosed at the time of the application. Hereinafter, the background of the inventor's achievement of the present invention will be described using this prior application.

  FIG. 2 is an example of generating a model for predicting the value of the target sensor from the value of the explanation sensor, with the target sensor as the pump pressure and the explanation sensor as the power generation output in the sensor group of the power plant. In the figure, “general management value” corresponds to the upper limit value and the lower limit value described in the background art section. Such a prediction model can be created by using time series data (training data) of sensors collected in the past, and an example of a specific creation method is described in the prior application.

  Here, when an abnormality is detected, it is desirable that a model in which the value of the target sensor is uniquely determined can be created when the value of the explanatory sensor is determined. However, in general, a plant may have a plurality of operation modes, so it cannot be determined uniquely. FIG. 2 shows a model corresponding to each of two operating states (operating state and non-operating state). There are cases where a plurality of pumps exist in one power plant, and these pumps are not operating even at the same power generation output. When operating, the pressure values of models B and C are changed as the power generation output increases, and when not operating, a constant small value of model A is taken. Therefore, if the current operation mode cannot be estimated, it is unclear which model should be used to detect abnormality. If there is a sensor value indicating the operation mode, the model may be determined using that value, but such a sensor value is not always given.

  In the method of the prior application, the problem is solved by generating a plurality of models and simultaneously generating a classifier for selecting a model. In this method, training data is clustered at the time of model generation, and data at each time in the training data belongs to a cluster corresponding to one of the models. This information is assigned to each time data as a class. FIG. 3 is an example of training data to which classes are assigned. Subsequently, a decision tree for predicting the class is generated using the sensors excluding the target sensor (X1 in this example). FIG. 4 shows an example of the decision tree generated. When finding an abnormal value of the X1 series (pump pressure) of the multidimensional time series data (hereinafter referred to as test data) to be tested shown in FIG. 5, first, using the decision tree of FIG. A model to be applied to the data at each time is selected, and then the presence or absence of abnormality is determined using the selected model.

  This method causes a problem when the accuracy of the model selection decision tree is poor. FIG. 6 is an example of the result of predicting the class of data at each time in the training data by the model selection decision tree. [Na, nb, nc] added to the leaf is a class distribution actually possessed by the data group classified into each leaf. na represents the number of classes A, nb represents the number of classes B, and nc represents the number of classes C. For example, the data for 1002 hours is applied to the leaf L1, of which 1000 hours are taken for class A and 2 hours are taken for class C. If the data at time P in the test data of FIG. 5 is classified into the leaves of L1 in FIG. 6, if the data originally belongs to class A, the abnormality determination is performed with the correct model A. . However, if it originally belongs to class C, it is an error to make a determination with model A. That is, data that should have been normal may be determined to be abnormal.

  As described above, in the method of the prior application, when the abnormality determination is performed using a plurality of models, there is a possibility that the model is not correctly selected and normal data is determined to be abnormal.

  The present inventor has made many efforts to solve such problems, and has come to make the present invention. Embodiments of the present invention will be described below. One of the features of the present invention is that, when anomaly discovery is performed using a plurality of models, if the validity of using one model is high, the model is used to detect anomalies. The determination is performed, otherwise, the abnormality determination is performed using two or more models. Accordingly, it is possible to provide an abnormal value determination method that is more accurate than the abnormality detection method using the general management value described in the background art and has fewer erroneous determinations than the method using the prior application. Hereinafter, in the first to third embodiments, a method for generating a decision tree for selecting a model to be used for abnormality determination (more specifically, a method for changing a decision tree generated by the technique of the prior application) will be described. In the fourth and subsequent embodiments, details of the abnormality determination will be described.

(First embodiment)
FIG. 1 is a flowchart for explaining a decision tree changing method according to the first embodiment.

  First, the training data is applied to a decision tree generated from training data (first multi-dimensional time series data) (see FIG. 3) to generate a class distribution table (see FIG. 7) described later (S11).

  Next, a threshold value is input from the user (S12).

  Next, the following processing is performed for each leaf in the class distribution table.

  First, the leaf label is deleted from the class distribution table (S13). Next, for each leaf, from the class frequency distribution table included in the class distribution table, all the classes whose values are greater than the threshold are added to the class distribution table as leaf labels, and the decision tree is added according to the added leaf label. The corresponding leaf label is updated (S14).

  Detailed examples are shown below.

  The result of classifying the training data of FIG. 3 using the attributes X2 to Xn is attached to the leaves of the decision tree of FIG. A class distribution table shown in FIG. 7 is created from the classification result. The class distribution table includes a leaf name, a leaf label indicating a class assigned to the leaf, and a frequency distribution table representing the class distribution of data classified into each leaf (L1 to L3). The class distribution of the data classified into one leaf corresponds to the frequency distribution information.

  Here, the leaf label is updated with reference to the frequency distribution table for each leaf. First, the user sets a threshold value. Here, it is assumed that 0 is set. Next, all the leaf labels in the class distribution table are once deleted. That is, the label A on the leaf L1, the label B on the leaf L2, and the label C on the leaf L3 are erased. Next, paying attention to one leaf, one class is selected, and when the frequency of the selected class is larger than the threshold, adding the class to the leaf label is repeated. Do this for all leaves.

  Since the frequency of classes A and C is greater than 0 in leaf L1, the new leaf labels are A and C. Similarly, for leaf L2, the new labels are A, B, and C for leaf L3. The label attached to the leaf of the decision tree in FIG. 6 is updated with the label of each leaf in the class distribution table after the update.

  The threshold value may be a ratio with respect to the overall frequency. Suppose that the user sets 1% as a value for determining the threshold value. In this case, for the leaf L1, the threshold value is (1000 + 2) × 0.01 = 1.002, and the new leaf labels are A and C. For the leaf L2, the threshold is (10 + 500) × 0.01 = 5.1, and the new leaf labels are A and B. For leaf L3, the threshold is 5 × 0.01 = 0.005, and the label for the new leaf is C.

  FIG. 8 is a diagram showing the configuration of the data processing apparatus according to the first embodiment.

  The storage device 11 stores a program executed by the CPU 12, training data, and a decision tree created from the training data.

  The CPU 12 loads the program in the storage device 11 into the memory 13 and executes it. Details of the processing of the CPU 12 will be described below.

  The CPU 12 reads the decision tree from the storage device 11 to the memory 13.

  Further, the CPU 12 sequentially reads the training data into the memory 13 and applies the data at each time included in the training data to the decision tree on the memory 13. The data at each time included in the training data is classified into one of the leaves in the decision tree. For each leaf, the frequency of the class of data classified into that leaf is counted.

  A class distribution table is created based on the above results.

  Using the created class distribution table and the threshold value given in advance by the user and stored in the memory 13 or the storage device 11, the labels are re-attached to each leaf to generate a new decision tree.

  The CPU 12 outputs a new decision tree to the display device 14.

  As described above, according to this embodiment, the probability of selecting an inappropriate model can be reduced by adding a plurality of labels to the leaves of the decision tree. The abnormal value determination using the decision tree generated in the present embodiment will be described in detail in the fourth and subsequent embodiments.

(Second Embodiment)
FIG. 9 is a flowchart illustrating a decision tree changing method according to the second embodiment.

  First, as in the first embodiment, the training data is applied to the decision tree to generate a class distribution table (S21).

  Next, a threshold value is input from the user (S22). The following processing is performed on each leaf of the class distribution table.

  First, the leaf label is erased (S23). Next, the process of S24 is performed in order from the class with the largest value in the frequency distribution table.

  In S24, the current class is added as a leaf label, the frequencies of the classes added as leaf labels are summed, and if the threshold is exceeded, the process ends. If the threshold is not exceeded, the class having the next largest value is selected and the process is continued.

  A detailed example will be described below with reference to FIGS. 6 and 7 described above.

  First, it is assumed that the class distribution table of FIG. 7 is generated, and then 99% is set as a threshold value by the user. Next, the label of the leaf in the frequency distribution table is deleted. Next, the classes are extracted in the descending order of frequency and added as leaf labels. This process is continued until the ratio of the frequency of the class added as a leaf label to the frequency of the entire class exceeds the threshold.

  In the leaf L1, since the above ratio exceeds the threshold value when class A is added (99.8%), the leaf label is only A.

  For the leaf L2, the above ratio does not exceed the threshold when only class B is added (98.0%), and further class A is added and exceeds the threshold at this point (100%), so the new label is A and B.

  Since only the class C exists for the leaf L3, when the class C is added, the ratio becomes 100%, so the leaf label is C.

  The label attached to the leaf of the decision tree in FIG. 6 is updated with the label of each leaf in the updated class distribution table.

  The data processing apparatus according to the second embodiment will be described below based on FIG. 8 used in the first embodiment.

  The storage device 11 stores a program executed by the CPU 12, training data, and a decision tree created from the training data.

  The CPU 12 loads the program in the storage device 11 into the memory 13 and executes it. Details of the processing of the CPU 12 will be described below.

  The CPU 12 reads the decision tree from the storage device 11 to the memory 13.

  Further, the CPU 12 sequentially reads the training data into the memory 13 and applies the data at each time included in the training data to the decision tree on the memory 13. The data at each time included in the training data is classified into one of the leaves in the decision tree. For each leaf, the frequency of the class of data classified into that leaf is counted.

  A class distribution table is created based on the above results.

  Using the created class distribution table and the threshold value given in advance by the user and stored in the memory 13 or the storage device 11, the labels are re-attached to each leaf to generate a new decision tree.

  The CPU 12 outputs a new decision tree to the display device 14.

  As described above, according to this embodiment, the probability of selecting an inappropriate model can be reduced by adding a plurality of labels to the leaves of the decision tree. The abnormal value determination using the decision tree generated in the present embodiment will be described in detail in the fourth and subsequent embodiments.

(Third embodiment)
FIG. 10 is a flowchart for explaining a decision tree changing method according to the third embodiment.

  First, the training data is applied to the decision tree to generate a class distribution table (S31).

  Next, the reliability CF and the threshold value are input from the user (S32).

  The following processing is performed on each leaf of the class distribution table.

  First, the leaf label is erased (S33). Next, the process of S34 is performed in order from the class with the largest value in the frequency distribution table.

  In S34, the current class is added as a leaf label in the frequency distribution table. The frequencies of the classes added as labels are summed, and the total value is subtracted from the frequency N of the entire class in the leaf. Let this value be the difference e. From CF, N, and e, the ratio p of the leaf label class data included in the population is estimated. This can be calculated by solving the equation described in FIG. 11 for p. If p exceeds the threshold, the process is terminated. If p does not exceed the threshold, the next class is selected and the process is continued. If p does not exceed the threshold even after all classes are selected, all classes are assigned to the label and the process is terminated.

  A detailed example will be described below with reference to FIGS. 6 and 7 described above.

  First, the class distribution table of FIG. 7 is generated, and then the user sets the reliability CF and the threshold value. Here, it is assumed that the reliability CF is set to 0.25 and the threshold value is set to 0.99. Next, the label of the leaf in the frequency distribution table is deleted. Next, the classes are extracted in the descending order of frequency and added as leaf labels. The frequencies of the classes added as leaf labels are summed, and the total value is subtracted from the frequency of the entire class in the leaf to obtain a difference e.

  In the leaf L1, the frequency of the entire class is N = 1002. First, the class A having the highest frequency is selected. Since this frequency is 1000, the difference e is 2. When the ratio p is calculated from the equation of FIG. 11 using CF = 0.25, e = 2, and N = 1002, p = 0.9996. Since this value is larger than the threshold value (0.99), the processing ends at this point, and as a result, the leaf label is A.

  In leaf L2, N = 510. First, the class B having the highest frequency is selected. Since this frequency is 500, the difference e is 10. When p is calculated from the equation of FIG. 11 using CF = 0.25, e = 10, and N = 510, p = 0.9741. Since this value does not exceed the threshold value (0.99), the processing is continued. Next, class A is selected. At this time, e = 0. When p is calculated, p = 0.9986, and this value exceeds the threshold value. Therefore, the processing is terminated at this point, and as a result, the leaf labels are A and B.

  In leaf L3, class C is first selected. N = 5 and e = 0. Since p is calculated as 0.7679, the processing is continued. Next, class A is selected. e = 0. The process continues with p = 0.7679. Next, class B is selected. Since all the classes have been selected, the processing ends at this point, and as a result, the leaf labels are A, B, and C.

  The label attached to the leaf of the decision tree in FIG. 6 is updated with the label of each leaf in the updated class distribution table.

  The data processing apparatus according to the third embodiment will be described below based on FIG. 8 used in the first embodiment.

  The storage device 11 stores a program executed by the CPU 12, training data, and a decision tree created from the training data.

  The CPU 12 loads the program in the storage device 11 into the memory 13 and executes it. Details of the processing of the CPU 12 will be described below.

  The CPU 12 reads the decision tree from the storage device 11 to the memory 13.

  Further, the CPU 12 sequentially reads the training data into the memory 13 and applies the data at each time included in the training data to the decision tree on the memory 13. The data at each time included in the training data is classified into one of the leaves in the decision tree. For each leaf, the frequency of the class of data classified into that leaf is counted.

  A class distribution table is created based on the above results.

  Using the created class distribution table and the reliability CF and threshold stored in the memory 13 or storage device 11 given in advance by the user, the labels are re-labeled for each leaf to generate a new decision tree. .

  The CPU 12 outputs a new decision tree to the display device 14.

  As described above, according to this embodiment, the probability of selecting an inappropriate model can be reduced by adding a plurality of labels to the leaves of the decision tree. The abnormal value determination using the decision tree generated in the present embodiment will be described in detail in the fourth and subsequent embodiments.

(Fourth embodiment)
The fourth embodiment relates to abnormality detection of test data (second multidimensional time series data). Assume that it is desired to discover abnormality of the target sensor from the test data having the n-dimensional attribute shown in FIG. 13 using the training data having the n-dimensional attribute shown in FIG. Assume that the target sensor is X1.

  FIG. 14 is a flowchart for explaining a test data abnormality determination method according to this embodiment.

  First, the training data is clustered using the method of the prior application, and for each cluster, the model for inferring the value of the target sensor from the value of the explanatory sensor and the standard deviation σ of the training data for the model are determined using the method of the prior application or a known one. It is generated by a technique (S41). Then, a class is assigned to each cluster (S42).

  Next, the class of the cluster to which each belongs is assigned to the data at each time in the training data (S43). An example of training data after assigning a class to the data at each time is shown in FIG.

  Next, a decision tree for predicting a class is generated using the attributes excluding the target sensor X1 in the training data (S44).

  Subsequently, the decision tree is changed using any one of the methods of the first to third embodiments (S45), and the process proceeds to S46.

  In S46, when the abnormality of the X1 sensor at the P time is determined in the test data of FIG. 13, the values of the attributes X2 to Xn at the P time are applied to the changed decision tree to determine the class name, that is, the abnormality. Determine the model or models to use. Next, the values of the attributes X2 to Xn at the time P are input to the determined individual models, and the predicted value of X1 by the model is obtained. If the value of X1 at time P is in a normal range (for example, ± 3σ, where σ is a standard deviation) obtained from the standard deviation of the model, it is regarded as normal, and otherwise it is regarded as abnormal. More specifically, if any one model is determined to be normal, it is considered normal, and if all models are determined to be abnormal, it is considered abnormal.

  Detailed examples are shown below.

  FIG. 16 shows an example of a model that predicts X1 from X2 generated to determine the abnormality of the attribute X1 of the training data shown in FIG.

  X2 is an explanation sensor, and three models A, B, and C are generated. Model A has X1 = 10 and σ = 1. Model B has X1 = X2 × 3 + 1 and σ = 1. Model C has X1 = 30 and σ = 2.

  Classes are assigned to the training data (FIG. 12) from which models A, B, and C are generated. Here, it is assumed that a class is allocated as shown in FIG.

  Using this training data, a decision tree that predicts a class from attributes other than X1 is generated. Here, it is assumed that a decision tree for predicting a class (model) is generated from the attributes X3 and X4 shown in FIG.

  This decision tree is changed by the method of the first to third embodiments. Here, the method of the first embodiment is used, but the method of the second or third embodiment may be used. An example of the decision tree after the change is shown in FIG.

  Here, the abnormality determination of the time P is performed in the test data of FIG.

  First, a model to be used is determined using the decision tree of FIG. X3 at time P is 20 and X4 is 1. Therefore, the models to be used are determined as models A and B allocated to the leaf L2 from the decision tree of FIG.

  Next, abnormality determination is performed by each of models A and B.

  In model A, as shown in FIG. 16, X1 = 10 and σ = 1. When the normal range is ± 3σ, the normal range is 7 to 13. Since X1 at time P is 17, it is determined from model A that the value of the target sensor at time P is abnormal.

  Subsequently, the determination is made by model B. Since X2 at time P is 5, the predicted value by model B is 5 × 3 + 1 = 16. Since σ = 1, if the normal range is ± 3σ, the normal range is 13-19. Since X1 at time P is 17, it is determined from model B that the value of the target sensor at time P is normal.

  Since one of the two models is determined to be normal, X1 at time P is finally determined to be normal.

  FIG. 19 is a diagram illustrating a configuration of a data processing apparatus according to the fourth embodiment.

  The storage device 21 stores a program executed by the CPU 22 and training data.

  The CPU 22 loads the program in the storage device 21 into the memory 23 and executes it. Details of the processing of the CPU 22 will be described below.

  The training data is read from the storage device 21 to the memory 23 and is divided into one or more clusters by the CPU 22.

  For each cluster, the CPU 22 generates a model for predicting a value of one attribute from values of other attributes.

  A class indicating a cluster to which individual time data belongs in the training data is assigned to the training data by the CPU 22.

  A decision tree for estimating a class (model) to be used is generated by the CPU 22 from the other attributes using the training data to which the class is assigned.

  The leaf label in the decision tree is changed by the CPU 22 by any of the methods of the first to third embodiments.

  One time of test data is loaded onto the memory 23 via the interface 25.

  The CPU 22 applies this test data to the decision tree and selects one or more models to be used for abnormality determination.

  Using the selected model, the certain attribute is predicted from the values of the other attributes in the test data for one time. Then, the abnormality determination is performed from the difference between the predicted value and the value of the one attribute in the test data.

  When abnormality is detected in all models, the CPU 22 determines that the test data for one time is abnormal, and determines that it is normal when there is at least one model determined to be normal.

  The CPU 22 displays the determination result on the display device 24.

  As described above, according to the present embodiment, it is possible to reduce the possibility of erroneously determining an abnormality by using only one model in finding abnormalities in test data.

(Fifth embodiment)
FIG. 20 is a flowchart for explaining a test data abnormality determination method according to this embodiment.

  In this flowchart, the class assignment change process S43-1 is inserted between S43 and S44 in FIG. 14 used in the fourth embodiment, and the decision tree change process of S45 is excluded. However, it is also possible to perform processing without removing S45. In S43-1, the number of classes of n steps (predetermined time range) before and after the training data for a certain time is totaled. The class with the largest aggregate value is the class at that time. Detailed examples are shown below.

  The left side of FIG. 21 is training data immediately after S43 shown in FIG. Here, the number of classes of n steps before and after each time is totalized. A table in which the number of classes is tabulated with n = 1 is shown in the center of FIG. For example, at time 3, the previous class at time 2 is A, its own class is B, and the next class at time 4 is A, so (A, B, C) = (2, 1, 0). When counting the number of classes, the weight of data close to the current time may be increased.

  The right side of FIG. 21 is the final class determined from the tabulation table shown in the center. For example, at time 3, since the number of classes A is the largest since (A, B, C) = (2, 1, 0), the class at time 3 is A. In this embodiment, a decision tree for selecting a model to be used for abnormality determination is generated using the changed class.

  In the present embodiment, the class attached to the training data is rewritten as described above. This will be further described as follows.

  The sensor data of the plant or the like shows the behavior as shown in FIG. 2 because the plant may have a plurality of operation modes, but the operation mode is rarely switched and the same mode continues. There are many. The data at time 3 in FIG. 21 is assigned the class B in the process of S43, but this is highly likely to be A considering time-series continuity. Therefore, the class at time 3 is rewritten from B to A here.

  The data processing apparatus according to the fifth embodiment will be described below based on FIG. 19 used in the fourth embodiment.

  The storage device 21 stores a program executed by the CPU 22 and training data.

  The CPU 22 loads the program in the storage device 21 into the memory 23 and executes it. Details of the processing of the CPU 22 will be described below.

  The training data is read from the storage device 21 to the memory 23 and is divided into one or more clusters by the CPU 22.

  For each cluster, the CPU 22 generates a model for predicting a value of one attribute from values of other attributes.

  A class indicating a cluster to which individual time data belongs in the training data is assigned to the training data by the CPU 22.

  This class is rewritten by the CPU according to the contents of the class at the previous and subsequent times.

  Using the rewritten training data, the CPU 22 generates a decision tree for estimating a class (model) to be used from the other attributes.

  One time of test data is loaded onto the memory 23 via the interface 25.

  The CPU 22 applies this test data to the decision tree and selects one or more models to be used for abnormality determination.

  Using the selected model, the certain attribute is predicted from the values of the other attributes in the test data for one time. Then, the abnormality determination is performed from the difference between the predicted value and the value of the one attribute in the test data.

  When abnormality is detected in all models, the CPU 22 determines that the test data for one time is abnormal, and determines that it is normal when there is at least one model determined to be normal.

  The CPU 22 displays the determination result on the display device 24.

  As described above, according to the present embodiment, the accuracy of a decision tree for selecting a model to be used for anomaly detection is improved by considering the time series of classes attached to training data in the anomaly detection of test data. be able to. In addition to this effect, the possibility of erroneously determining an abnormality by using only one model can be reduced.

(Sixth embodiment)
FIG. 22 is a flowchart for explaining a test data abnormality determination method according to this embodiment.

  First, the training data (see FIG. 12) is clustered using the method of the prior application, and a model is generated for each cluster (S51).

  Subsequently, the range in which the explanatory variable (explanatory sensor) constituting the model is allowed to vary is calculated for each model (S52).

  Subsequently, it is assumed that the abnormality determination of X1 at the time P of the test data is performed. First, one model is selected, and it is checked whether or not X2 at time P is within a range in which the explanation sensor (X2) of the selected model is allowed to fluctuate. If so, the model is judged to be abnormal. This process is performed for all models.

  Detailed examples are shown below.

  Assume that a model as shown in FIG. 23 is generated in S51 of FIG.

  Next, in S52, an allowable variation range of the explanatory variable (X2) is obtained. Here, the fluctuation range of the explanatory variable of the cluster corresponding to the model is used. Therefore, 3 to 16 for the model A, 1 to 10 for the model B, and 11 to 22 for the model C.

  Next, in S53, the abnormality determination at time P in the test data is performed. At this time, if X2 at time P is 3, models A and B having 3 in the allowable variation range are selected as models used for abnormality determination. If X2 is 13, models A and C are selected.

  If X2 does not fall within the variation allowable range of all models, a method of using a model having a variation range close to X2 in the number specified by the user can be considered. Further, the variation allowable range for each model may be determined from the average and variance of points included in the cluster.

  The data processing apparatus according to the sixth embodiment will be described below based on FIG. 19 used in the fourth embodiment.

  The storage device 21 stores a program executed by the CPU 22 and training data.

  The CPU 22 loads the program in the storage device 21 into the memory 23 and executes it. Details of the processing of the CPU 22 will be described below.

  The training data is read from the storage device 21 to the memory 23 and is divided into one or more clusters by the CPU 22.

  For each cluster, the CPU 22 generates a model for predicting a value of one attribute from values of other attributes.

  For each model, the CPU 22 calculates an allowable variation range of attributes constituting the model.

  One time of test data is loaded onto the memory 23 via the interface 25.

  The CPU 22 determines whether or not the value of another attribute in the test data is included in the allowable variation range of each model. If so, the model is selected for use in anomaly determination.

  The CPU 22 determines that the test data for one hour is abnormal when it is determined to be abnormal in all models, and determines that it is normal if there is at least one model determined to be normal.

  The CPU 22 displays the determination result on the display device 24.

  As described above, according to the present embodiment, the accuracy of selecting a model to be used for abnormality detection can be improved by considering the allowable variation range of the attribute value in the test data in the abnormality detection of the test data.

(Seventh embodiment)
In the seventh embodiment, a model for performing abnormality determination is selected from each of the methods according to the fourth or fifth embodiment and the method according to the sixth embodiment, and selected from both methods. The final model is selected from the models and the abnormality is determined. For example, the final model is obtained by taking an AND of models selected from both methods. If AND is an empty set, for example, the model selected in the sixth embodiment is used.

  If the models obtained in the fourth or fifth embodiment are A, B, and C, and the models obtained in the sixth embodiment are A and C, then models A and C that take both ANDs. Is adopted as the final model. This is because, for example, if X2 of the data for which abnormality determination is to be performed based on the model of FIG. 23 is 13, it may not be appropriate to use model B that does not have 13 in the allowable fluctuation range.

  Further, if the model obtained in the fourth or fifth embodiment is A and the models obtained in the sixth embodiment are A and C, the model A that takes both ANDs is used as the final model. adopt. This is because it is considered that it is appropriate to remove the model C because it is highly certain that the class (operation mode) is A in the model selection of the fourth or fifth embodiment.

  The data processing apparatus according to the seventh embodiment will be described below based on FIG. 19 used in the fourth embodiment.

  The storage device 21 stores a program executed by the CPU 22 and training data.

  The CPU 22 loads the program in the storage device 21 into the memory 23 and executes it. Details of the processing of the CPU 22 will be described below.

  The training data is read from the storage device 21 to the memory 23 and is divided into one or more clusters by the CPU 22.

  For each cluster, the CPU 22 generates a model for predicting a value of one attribute from values of other attributes.

  For each model, the CPU 22 calculates an allowable variation range of attributes constituting the model.

  One time of test data is loaded onto the memory 23 via the interface 25.

  The CPU 22 calculates whether or not the values of other attributes in the test data are included in the variation allowable range of each model. If so, select that model.

  A model obtained by ANDing the selected model and the model selected using the fourth or fifth embodiment is a model used for the abnormality determination.

  The CPU 22 determines that the test data for one hour is abnormal when it is determined to be abnormal in all models, and determines that it is normal if there is at least one model determined to be normal.

  The CPU 22 displays the determination result on the display device 24.

  As described above, according to the present embodiment, in finding abnormality in test data, it is used for finding abnormality by taking into account the time series nature of classes attached to training data and the allowable variation range of attribute values in test data. It is possible to improve the accuracy of the classification rule (decision tree) for selecting a model and the accuracy of selecting a model used for finding anomalies. Furthermore, in detecting abnormalities in test data, the possibility of erroneously determining abnormalities can be reduced by using only one model.

(Eighth embodiment)
In the eighth embodiment, a model to be used is corrected when abnormality detection is performed using any of the fourth to seventh embodiments. The model to be used is determined from the model used up to m times before the test data and the model determined for the current time. Here, two methods are shown.

  [First Method] The model used for abnormality detection at a certain time (current time) is the model determined by any of the fourth to seventh embodiments at each time within the past m times, and the current time. And a model determined by any of the fourth to seventh embodiments (logical sum: OR). Hereinafter, a detailed example will be described with reference to FIG. However, m = 2.

  The models determined by any of the fourth to seventh embodiments at time 2 are A and C, and the models determined by any of the fourth to seventh embodiments at time 3 are A and C. At time 4, the model determined by any one of the fourth to seventh embodiments is B. Therefore, at time 4, models A, B, and C obtained by ORing models A and C at time 2, models A and C at time 3, and model B at time 4 are actually used models.

  At time 3, the model determined by any of the fourth to seventh embodiments is A, C, and at time 4, the model determined by any of the fourth to seventh embodiments is B, time 5 Then, the model determined by any of the fourth to seventh embodiments is B. Therefore, at time 5, models A, B, and C obtained by ORing models A and C at time 3, model B at time 4, and model B at time 5 are actually used models.

  At times 4, 5, and 6, the model determined by any of the fourth to seventh embodiments is B. Therefore, at time 6, model B becomes a model that is actually used.

  [Second Method] A model used for abnormality detection at a certain time (current time) is a model in which abnormality is determined within the past m times and is determined to be normal, and the fourth to seventh embodiments at the current time. (OR) combined with the model determined by any of the above. Hereinafter, a detailed example will be described with reference to FIG. However, m = 2 and the model with “◯” in the figure is a model that is used for abnormality determination and is determined to be normal.

  At time 2 and 3, it is determined to be normal when model C is used. On the other hand, the model determined by any of the fourth to seventh embodiments at time 4 is B. Therefore, at time 4, models B and C are actually used models.

  Further, it is determined to be normal when model C is used at time 3 and model B is used at time 4. On the other hand, the model determined by any of the fourth to seventh embodiments at time 5 is B. Therefore, at time 5, models B and C are actually used models.

  Further, it is determined that model B is used at time 4 and model B is used at time 5 as well. On the other hand, the model determined by any of the fourth to seventh embodiments at time 6 is B. Therefore, at time 6, model B is the model that is actually used.

  The data processing apparatus according to the eighth embodiment will be described below with reference to FIG. 19 used in the fourth embodiment.

  The storage device 21 stores a program executed by the CPU 22 and training data.

  The CPU 22 loads the program in the storage device 21 into the memory 23 and executes it. Details of the processing of the CPU 22 will be described below.

  The training data is read from the storage device 21 to the memory 23 and is divided into one or more clusters by the CPU 22.

  For each cluster, the CPU 22 generates a model for predicting a value of one attribute from values of other attributes.

  For each model, the CPU 22 calculates an allowable variation range of attributes constituting the model.

  One time of test data is loaded onto the memory 23 via the interface 25.

  The CPU 22 determines a model to be used for abnormality determination using any of the fourth to seventh embodiments.

  Information on the model selected by any of the fourth to seventh embodiments at the past time in the test data is stored in the memory 23, and the final information is obtained from the information and the model used for the abnormality determination. Determine the model (s) to be used.

  The CPU 22 determines that the test data for one hour is abnormal when it is determined to be abnormal in all models, and determines that it is normal if there is at least one model determined to be normal.

  The CPU 22 displays the determination result on the display device 24.

  As described above, according to the present embodiment, it is possible to improve the accuracy of selecting a model used for finding an abnormality in test data.

The flowchart explaining the change method of the decision tree concerning 1st Embodiment. The figure explaining the relationship between the sensors in a plant, and the setting of a general management value. The figure which shows the example of training data. The figure which shows the example of the decision tree for selecting a model. The figure which shows the example of test data. The figure which shows the state which added the classification result of training data to the decision tree. The figure which shows the example of a class distribution table. The figure which shows the structural example of a data processor. 9 is a flowchart for explaining a decision tree changing method according to the second embodiment. 12 is a flowchart for explaining a decision tree changing method according to the third embodiment. The figure which shows the example of the equation for calculating the distribution of a population. The figure which shows the example of training data. The figure which shows the example of test data. 10 is a flowchart for explaining a test data abnormality determination method according to a fourth embodiment; The figure which shows the example of the training data to which the class was added. The figure which shows the model and the numerical formula showing a model. The figure which shows the state which added the classification result of training data to the decision tree. The figure which shows the example of the decision tree after a change. The figure which shows the structural example of another data processing apparatus. 10 is a flowchart for explaining a test data abnormality determination method according to a fifth embodiment; The figure explaining the change process of the class attached | subjected to training data. 10 is a flowchart for explaining a test data abnormality determination method according to a sixth embodiment; The figure explaining the fluctuation | variation tolerance range. The figure explaining a 1st method. The figure explaining a 2nd method.

Explanation of symbols

11, 21: Storage device 12, 22: CPU
13, 23: Memory 14, 24: Display device 25: Interface

Claims (16)

Each of the data is input to a decision tree that predicts a class from one or more attributes generated from multidimensional time series data that is a set of data having an n-dimensional attribute value and a one-dimensional class;
For each leaf of the decision tree, generate frequency distribution information representing the frequency distribution of the class using a data group classified into the leaves,
Select one or more classes based on the frequency distribution information,
Update the leaf class of the decision tree corresponding to the frequency distribution information according to the selected class.
Decision tree change method.   The decision tree changing method according to claim 1, wherein a class whose frequency satisfies a threshold in the frequency distribution information is selected. Select a class in order from the most frequent frequency distribution information,
When the ratio of the sum of the frequencies of the selected class to the sum of the frequencies of all classes satisfies the threshold, the selection is terminated.
The decision tree changing method according to claim 1, wherein: Select a class in order from the most frequent frequency distribution information,
Based on the sum of the frequencies of the selected class, the sum of the frequencies of all the classes, and the reliability, the distribution of the population classified into the leaves is estimated,
In the estimated distribution of the population, the selection is terminated when the distribution of the selected class satisfies a threshold value.
The decision tree changing method according to claim 1, wherein: clustering the first multidimensional time series data which is a set of data having n-dimensional attribute values;
Assign a class to each cluster,
For each cluster, create a model that predicts the value of one attribute using other attributes;
Assigning to each data in the first multidimensional time series data a class of clusters to which each belongs,
Using the first multi-dimensional time-series data to which the class is assigned, to generate a decision tree that predicts the class from the other attributes;
The generated decision tree is changed by any one of claims 1 to 4,
next,
In the second multi-dimensional time-series data that is a set of data having n-dimensional attribute values, data to be tested is input to the changed decision tree to predict a class,
Select the model corresponding to the predicted class, enter the value of the other attribute in the data to be tested into the selected model,
Determining anomalies of the data to be tested from the value of the one attribute in the data to be tested and the output of the model;
Abnormality judgment method. clustering the first multidimensional time series data which is a set of data having n-dimensional attribute values;
Assign a class to each cluster,
For each cluster, create a model that predicts the value of one attribute using other attributes;
Assigning to each data in the first multidimensional time series data a class of clusters to which each belongs,
Based on the class assigned to the data and the class assigned to the data included in the predetermined time range from the data, the class assigned to the data is re-determined, and the class of the data is determined by the class after the re-determination Update
Using the first multidimensional time-series data to which the updated class is assigned, a decision tree that predicts the class from the other attribute is generated,
In the second multidimensional time-series data that is a set of data having n-dimensional attribute values, data to be tested is input to the generated decision tree to predict a class,
Select the model corresponding to the predicted class, enter the value of the other attribute in the data to be tested into the selected model,
Determining the anomaly of the data to be tested from the value of the one attribute in the data to be tested and the output of the model;
Abnormality judgment method.   The abnormality determination according to claim 6, wherein the generated decision tree is changed using the method according to claim 1, and the class is predicted using the changed decision tree. Method. clustering the first multidimensional time series data which is a set of data having n-dimensional attribute values;
For each cluster, create a model that predicts the value of one attribute using other attributes;
Determining the variation tolerance of the other attributes in each of the models,
selecting a model in which the other attribute in the data to be tested is included in the variation allowable range in the second multidimensional time-series data which is a set of data having n-dimensional attribute values;
Enter the value of the other attribute in the data to be tested into the selected model,
Determining the anomaly of the data to be tested from the value of the one attribute in the data to be tested and the output of the model;
Abnormality judgment method. clustering the first multidimensional time series data which is a set of data having n-dimensional attribute values;
Assign a class to each cluster,
For each cluster, create a model that predicts the value of one attribute using other attributes;
Assigning to each data in the first multidimensional time series data a class of clusters to which each belongs,
Using the first multi-dimensional time series data to which the class is assigned, to generate a decision tree for predicting the class from the other attributes;
The generated decision tree is changed by the method according to any one of claims 1 to 4,
next,
In the second multidimensional time series data that is a set of data having n-dimensional attribute values, data to be tested is input to the changed decision tree to predict a class,
On the other hand, the variation tolerance of the other attribute is determined in each individual model,
Select a model in which the other attribute in the data to be tested is included in the variation allowable range,
Select a model that is common between the selected model and the model corresponding to the predicted class,
Enter the value of the other attribute in the data to be tested into the selected model,
Determining the anomaly of the data to be tested from the value of the one attribute in the data to be tested and the output of the model;
Abnormality judgment method. clustering the first multidimensional time series data which is a set of data having n-dimensional attribute values;
Assign a class to each cluster,
For each cluster, create a model that predicts the value of one attribute using other attributes;
Assigning to each data in the first multidimensional time series data a class of clusters to which each belongs,
Based on the class assigned to the data and the class assigned to the data included in the predetermined time range from the data, the class assigned to the data is re-determined, and the class of the data is determined by the class after the re-determination Update
Using the first multidimensional time-series data to which the updated class is assigned, a decision tree that predicts the class from the other attribute is generated,
In the second multidimensional time-series data that is a set of data having n-dimensional attribute values, data to be tested is input to the generated decision tree to predict a class,
On the other hand, the variation tolerance of the other attribute is determined in each individual model,
Select a model in which the other attribute in the data to be tested is included in the variation allowable range,
Select a model that is common between the selected model and the model corresponding to the predicted class,
Enter the value of the other attribute in the data to be tested into the selected model,
Determining the anomaly of the data to be tested from the value of the one attribute in the data to be tested and the output of the model;
Abnormality judgment method.   The abnormality determination according to claim 10, wherein the generated decision tree is changed using the method according to claim 1, and the class is predicted using the changed decision tree. Method.   When there are a plurality of models selected or selected to determine the abnormality of the data to be tested, if at least one of the models is determined to be normal, the data to be tested is normal. The abnormality according to any one of claims 5 to 11, wherein it is determined that the data to be tested is abnormal when all the models are determined to be abnormal. Judgment method.   Logically OR the model selected or selected to determine the anomaly of the data to be tested at a certain time with the model selected or selected for each time up to m times before the certain time. The abnormality determination method according to claim 5, wherein the model is used to determine abnormality of the data to be tested at the certain time.   The model selected or selected to determine the anomaly of the data to be tested at a certain time and the model selected or selected for each time up to m times before the certain time are judged as normal. An abnormality according to any one of claims 5 to 12, wherein a model obtained by performing a logical sum of the obtained model and the model is used to determine an abnormality of the data to be tested at the certain time. Sex determination method.   The program for making a computer perform each step as described in any one of Claims 1 thru | or 4.   The program for making a computer perform each step as described in any one of Claims 5 thru | or 14.

Images