JP2015108990A - Abnormality detection device and abnormality detection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To pinpointedly extract data on abnormality through analysis of a histogram collecting data causing a periodic variation due to an elapsed time.SOLUTION: An abnormality detection device acquiring data from a sensor device outputting a time-variant measurement value includes: a database in which a histogram collecting past measurement values is stored; a periodicity extraction processing unit that extracts periodicity from the histogram; a clustering processing unit that clusters a plurality of histograms stored in the database using the extracted periodicity and extracts a normal time pattern; and an abnormality detection processing unit that determines if the histogram of a determination object is abnormal, depending upon whether the histogram of the determination object and the normal time pattern have the same periodic characteristic.

Description

  The present invention relates to an anomaly detection device, and more particularly to a technique for efficiently extracting a pattern using an index that varies periodically and detecting exceptional data.

  By downsizing, speeding up, and increasing capacity of IT equipment and devices, it is possible to observe various human activities such as consumer equipment, industrial equipment, IT systems that form the basis of them, and human behavior. It is becoming possible to discover new knowledge by analyzing (sensor data), effectively use it in business, and transform society. In big data analysis, it is an issue to obtain accurate knowledge while reducing costs. The use of all observation data increases the capacity and communication volume, so an analysis method using aggregate values such as a histogram is important.

  Conventionally, many analysis methods for histograms have been proposed, mainly medical image classification technology based on a hue histogram of pixels (Patent Document 1), and document classification technology based on a histogram of word appearance frequency of a document (Patent Document 2). )and so on. In these methods, the observation target is composed of a plurality of states, and it is assumed that a certain tendency appears in the histogram depending on the state, and analysis is performed using histogram clustering or a discriminator.

Japanese Patent Application No. 2012-29903 Japanese Patent Application No. 2013-84216

  However, when the above-described conventional method is applied to the histogram of the device observation data, the influence of environmental factors other than the state to be extracted on the histogram and the cluster becomes a problem. In particular, in business activities, human behavior, natural phenomena, etc., fluctuations according to time and season are often observed, and this fluctuation may become a noise factor when extracting a tendency of a histogram. Therefore, the present invention provides a histogram data analysis method for data that undergoes periodic fluctuations over time.

  A typical example of the invention disclosed in the present application is as follows. That is, an anomaly detection device that acquires data from a sensor device that outputs a measurement value that changes with time, a database that stores a histogram that summarizes past measurement values, and a periodicity that extracts periodicity from the histogram An extraction processing unit, a clustering processing unit that extracts a normal pattern by clustering a plurality of histograms stored in the database using the extracted periodicity, and a determination target histogram and the normal pattern And an abnormality detection processing unit that determines whether the histogram to be determined is abnormal depending on whether or not the same periodic characteristics are included.

  According to the representative embodiment of the present invention, abnormal data can be accurately extracted. Problems, configurations, and effects other than those described above will become apparent from the description of the following embodiments.

It is a functional block diagram which shows the structure of the abnormality detection apparatus of embodiment of this invention. It is a figure explaining the data structure of the measurement item of this embodiment. It is a figure explaining the data structure of the histogram of this embodiment. It is a figure explaining the data structure of the cluster of this embodiment. It is a figure explaining the data structure of the real-time histogram of this embodiment. It is a flowchart of the process performed in the periodicity fluctuation pattern extraction process part of this embodiment. It is a figure explaining the example of the periodicity parameter | index setting screen of this embodiment. 5 is a flowchart of processing executed by a periodicity variation index extraction processing unit in Step 402 of FIG. 4. 5 is a flowchart of processing executed by a clustering processing unit in Step 403 of FIG. 4. It is a flowchart of the periodicity fluctuation | variation index extraction process which a clustering process part performs in step 706 of FIG. It is a figure explaining the example of the class ring result display screen of this embodiment. It is a flowchart of the process which the abnormal data detection process part of this embodiment performs. It is a flowchart of the process which an abnormality determination process part performs in step 1011 of FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

  1 to 11 are diagrams illustrating an embodiment of the present invention. In these drawings, parts denoted by the same reference numerals represent the same thing, and the basic configuration and operation are the same. In addition, in embodiment of this invention, the apparatus, method, etc. which are used are examples, and this invention is not limited to these.

  Further, as will be described later, the embodiment of the present invention may be implemented by software running on a general-purpose computer, may be implemented by dedicated hardware, or implemented by a combination of software and hardware. May be.

  In the following description, each information of the present invention will be described in a “table” format. However, such information does not necessarily have to be represented by a table data structure, such as a list, database, queue, or other data structure. It may be expressed as Therefore, “table”, “list”, “DB”, “queue”, etc. may be simply referred to as “information” in order to show that they do not depend on the data structure.

  In addition, when explaining the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID” can be used, and these can be replaced with each other. It is.

  Hereinafter, each process in the embodiment of the present invention will be described using “program” as a subject (operation subject). However, the program uses a memory and a communication port (communication control device) to perform the process defined by the processor. However, the description can be replaced with a processor as the subject. Further, the processing disclosed with the program as the subject may be described as processing performed by a computer such as a management server or an information processing apparatus. Part or all of the program may be realized by dedicated hardware or may be modularized. Various programs may be installed in each computer by a program distribution server or a storage medium.

<Outline of abnormality detection device>
FIG. 1 is a functional block diagram showing the configuration of the abnormality detection apparatus according to the embodiment of the present invention.

  The abnormality detection device includes a histogram data DB 100, a display device 101, an input device 102, a data transfer terminal 103, a central processing unit 104, a program memory 105, and a data memory 106.

  The histogram data DB 100 is a database that stores a histogram transferred from the data transfer terminal 103. The display device 101 is an interface such as a liquid crystal display device that displays the execution result of the program in a format that can be visually recognized by the user. The input device 102 is an interface that receives an operation from a user, such as a keyboard and a mouse. The data transfer terminal 103 aggregates the measured values of the sensors attached to the devices and transfers them as a histogram.

  The central processing unit 104 executes a program stored in the program memory 105. The program memory 105 is provided in a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and stores a program executed by the central processing unit 104. The data memory 106 is provided in a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and stores data used when the program is executed.

  The central processing unit 104 includes a periodic variation pattern extraction processing unit 107, an abnormal data detection processing unit, a periodic variation index setting screen display processing unit, a cleansing condition selection screen display processing unit, and a periodic variation index setting screen display. A processing unit 109 and a clustering result display processing unit 110 are included. In the present embodiment, these processing units are realized as part of the functions of a program executed on the computer. These programs are stored in the program memory 105, and are read into the internal memory by the central processing unit 104 when processing is executed. The periodic variation pattern extraction processing unit 107 includes a periodic variation index extraction processing unit 111 and a clustering processing unit 112. In addition, the abnormal data detection processing unit 108 includes an abnormality determination processing unit 113.

  The data memory 106 is sequentially transferred from the data transfer terminal 103 via a network or the like, through the measurement item 114 and the histogram 115 read from the histogram data DB 100, the histogram cluster 116 generated by the periodic variation pattern extraction processing unit 107, and the like. Real-time histogram 117 to be stored.

<Data structure>
Next, the data structure used by the abnormality detection apparatus of the present embodiment will be described. Note that the member names illustrated in FIGS. 2A to 3B are merely examples, and each of the industrial equipment, the trend of the mobile body at a predetermined position, the population distribution for each area using the coordinates of the mobile terminal, the communication state, etc. An appropriate measurement item for monitoring the state of the measurement target may be selected, and a data structure for storing them may be used.

  FIG. 2A is a diagram for explaining the data structure of the measurement item 114 stored in the data memory 106.

  The measurement item 114 includes an item name 200 and a series 201, and holds such information in an array format, for example. The item name 200 stores, for example, the types of measurement items such as the types of sensors and operation states attached to monitor the state of a moving object to be monitored. In the series 201, values defining the series in the frequency distribution of the measurement items are held in an array. For example, in the speed series, the series is defined with an interval of 15 km / s.

  FIG. 2B is a diagram for explaining the data structure of the histogram 115 stored in the data memory 106.

  The histogram 115 includes ID 202, item name 203, measurement start date and time 204, measurement end date and time 205, route 206, weather 207, temperature 208, accumulated traffic time 209, frequency 210, state 211, and periodicity variation index 212, for example. This information is held in the form of an array.

  The ID 202 stores an identifier for uniquely identifying the histogram. The item name 203 stores the types of sensors and operation states that are tabulated in the histogram. The measurement start date and time 204 holds the date and time when measurement item aggregation has started. The measurement end date and time 205 holds the date and time when the aggregation of measurement items is completed. The route 206 holds the departure place name and arrival place name of the mobile unit. The weather 207 stores any one of “sunny”, “cloudy”, “rain”, and “snow” indicating the weather state. The temperature 208 stores the average temperature in the area of the route during the aggregation period of the histogram. The accumulated traffic time 209 holds a cumulative value of the time during which traffic jams from the departure point to the destination. Note that the route 206 is assumed to be determined in advance based on coordinate information from an external resource by mounting a positioning device (GPS or the like) on the moving body. The same applies to the measurement points for the temperature 208 and the accumulated traffic time 209.

  The frequency 210 is a value obtained by storing numerical values measured at regular time intervals in a frequency distribution. The state 211 indicates the state of the monitoring target during the aggregation period of the histogram, and stores either normal, exception, or abnormality. In addition, when abnormalities are categorized in detail in advance, those categories (abnormality types) may be stored. For example, when dangerous driving is detected, causes such as forward carelessness, drinking, and falling asleep may be stored as categories for the histogram when an accident occurs. Moreover, when detecting fuel consumption (efficient driving tendency) as in the drive recorder of an automobile used in the delivery business, the definition of the state may be made efficient and inefficient instead of normal and abnormal. The periodicity variation index 212 stores a feature vector whose feature quantity is an external environment that affects the histogram distribution. In the initial state, the periodicity fluctuation index 212 is null.

  FIG. 3A is a diagram for explaining the data structure of the cluster 116 included in the data memory 106.

  The cluster 116 includes an item name 300, a histo ID list 301, a periodicity variation index 302, and a normal pattern flag 303, and holds such information in the form of an array, for example. The item name 300 stores the types of sensors and operation states that are tabulated in the histogram. The histogram ID 301 list stores the IDs of histograms included in a cluster in the form of an array. The periodicity variation index 302 stores a feature vector whose feature quantity is an external environment that affects the histogram distribution. Note that the initial state is null. The normal pattern flag 303 is a flag indicating whether the moving object to be monitored is a cluster including only a histogram pattern observed at normal time. It is assumed that the normal state is true for True and the normal state is false for False.

  FIG. 3B is a diagram for explaining the data structure of the real-time histogram 117 included in the data memory 106.

  The real-time histogram 117 includes an item name 304, a measurement start date / time 305, a measurement end date / time 306, a route 307, a weather 308, an air temperature 309, an accumulated traffic time 310, a frequency 311, an abnormal time flag 312, and a moving body ID 313.

  The item name 304 stores the types of sensors and operation states that are tabulated in the histogram. The measurement start date and time 305 holds the date and time when measurement item aggregation has started. The measurement end date and time 306 holds the date and time when measurement item aggregation has been completed. The route 307 holds the departure place name and arrival place name of the mobile object. The weather 308 stores one of “sunny”, “cloudy”, “rain”, and “snow” indicating the weather condition. The temperature 309 stores the average temperature in the route area during the aggregation period of the histogram. The accumulated traffic time 310 holds a cumulative value of the time during which traffic jams from the departure point to the destination. Note that the route 307 is assumed to be determined in advance based on coordinate information from an external resource by mounting a positioning device (such as GPS) on the moving body. The measurement points of the weather 308, the temperature 309, and the accumulated traffic time 310 are the same.

  The frequency 311 is a value obtained by storing numerical values measured at regular time intervals in a frequency distribution. The abnormal flag 312 stores a score indicating whether or not the moving object is a histogram measured when abnormal. Note that the initial state is null. The mobile body ID 313 stores an identifier for uniquely identifying the monitoring target.

<Outline of periodic fluctuation pattern extraction processing>
FIG. 4 is a flowchart of processing performed in the periodic variation pattern extraction processing unit 107.

  The periodic fluctuation pattern extraction processing unit 107 performs a process of extracting a histogram pattern of periodic conditions by normal clustering using the histogram accumulated as log data and the temperature, day of the week, time zone, etc., which are periodic fluctuation indexes. Do.

  First, a histogram is acquired from the histogram data DB 100 and stored in the data memory 106 (step 400).

  Next, the periodicity variation index setting screen display processing unit 109 is activated, and a screen for setting the definition of periodicity that has an influence on the variation of the histogram is displayed on the display device 101 (step 401). The screen displayed on the display device 101 in step 401 will be described later with reference to FIG.

  Subsequently, the periodicity fluctuation index extraction processing unit 111 assigns a periodicity fluctuation index to the histogram 115 based on the periodicity (step 402). The process of step 402 will be described later with reference to FIG.

  Then, the clustering processing unit 112 clusters histograms having similar shapes, and extracts normal histogram patterns in the systems and devices to be monitored as clusters (step 403).

  After the clustering process, the clustering result display processing unit 110 is activated, and a clustering result display screen for confirming the generated cluster is drawn on the display device 101 (step 404). The screen displayed on the display device 101 in step 404 will be described later with reference to FIG. The user confirms the generated cluster on the clustering result display screen and ends the process.

<Details of Periodic Variation Index Setting Screen Display Processing Unit 109 (Step 401)>
FIG. 5 is a diagram for explaining the screen displayed on the display device 101 in step 401 of FIG.

  As shown in FIG. 5, in the periodicity index setting screen, the periodicity can be defined by a monthly unit 500, a week unit 505, a day unit 506, a day unit 507, and a time unit 508. For example, in a monthly unit 500, there are events in a period of January to December 501, a quarter in a business period of time 502, a half period 503 in which a year is divided in half, and an event in a specific month. In this case, for example, a month with a settlement month or a busy period in business can be arbitrarily designated 504 as one category. As described above, the user defines a cycle that is a factor of fluctuation of the histogram from the periodicity variation index setting screen. Then, the user operates the execution button 509 to acquire the periodicity index set by the user, and ends the periodicity index setting process.

<Details of Periodic Variation Index Extraction Processing Unit 111 (Step 402)>
FIG. 6 is a flowchart of processing executed by the periodicity variation index extraction processing unit 111 in step 402 of FIG. The periodic variation index extraction process shown in FIG. 6 is performed by using a periodic variation index that affects the pattern of the histogram from the period defined by the user on the periodic index setting screen (FIG. 5) and the external environment value during the aggregation period of the histogram. This is a process for extracting.

  First, the index hist_idx of the histogram 115 is initialized with 0 (step 600).

  Next, it is determined whether or not there is a hist_idx-th histogram (step 601).

  If there is a hist_idx-th histogram 115, it is determined whether the aggregation period of the histogram 115 is a time unit (aggregated within one hour) (step 602), and the aggregation period of the histogram 115 is a time unit. In this case, corresponding values of time unit, day unit, weather, day of week unit, week unit, and month unit are assigned to the periodicity fluctuation index 212 of the histogram (steps 606 to 610). Note that the periodicity fluctuation index of the histogram in which no index is selected on the periodicity fluctuation index setting screen (FIG. 5) is null.

  If it is determined in step 602 that the aggregation period of the histogram 115 is not in time units, it is determined whether the aggregation period in the histogram 115 is in days (aggregated within 24 hours) (step 603). When the aggregation period of the histogram 115 is daily, corresponding values of daily, weather, day of the week, weekly, and monthly are assigned to the periodicity fluctuation index 212 of the histogram (steps 607 to 610).

  If it is determined in step 603 that the aggregation period of the histogram is not in units of days, it is determined whether the aggregation period of the histogram is in weeks (totaled within 168 hours) (step 604). When the aggregation period of the histogram is a week unit, the corresponding values of the week unit and the month unit are assigned to the periodicity fluctuation index 212 of the histogram (steps 609 and 610).

  If it is determined in step 604 that the histogram aggregation period is not weekly, it is determined whether the histogram aggregation period is monthly (aggregated within 720 hours) (step 605). When the aggregation period of the histogram is monthly, a corresponding value of the monthly unit is assigned to the periodicity fluctuation index 212 of the histogram (step 610).

  If it is determined in step 605 that the aggregation period of the histogram is not in units of months, for example, if the data transfer terminal 103 transfers the histogram when the accumulated value of the aggregation time reaches a preset threshold value, Calculate the correlation coefficient between continuous values (environment variables) such as histograms and statistical values such as the average, variance, kurtosis, and skewness of the feature values of the histogram. This is assigned to the periodicity fluctuation index 212 of the histogram (step 611).

  Then, hist_idx is incremented (step 612), and the process returns to step 601. If there is no hist_idx-th histogram in step 601, the process ends.

<Details of Clustering Processing Unit 112 (Step 403)>
FIG. 7 is a flowchart of processing executed by the clustering processing unit 112 in step 403 of FIG. In the clustering process shown in FIG. 7, clustering is performed using normal and abnormal histograms to which periodicity fluctuation indexes are assigned, and a cluster at the time of periodic fluctuations is generated, whereby the influence of external factors is used as a parameter. This is a process of extracting a normal histogram pattern for holding.

  First, the index sensor_idx of the measurement item 114 is initialized to 0 (step 700). Next, it is determined whether or not there is a sensor_idx-th measurement item 114 (step 701).

  When there is a sensor_idx-th measurement item 114, the histogram 115 having the item name 200 of the measurement item 114 is acquired and clustered (step 702). Clustering is a process of collecting histograms having similar frequency distribution shapes as a cluster, and the distance between histograms (for example, Euclidean distance, Mahalanobis distance, etc.) by a feature vector characterized by each frequency 210 array. ) May be calculated and classified by the Ward method. Further, the similarity between histograms may be calculated using the Batacharia coefficient or Pearson coefficient and classified by the county average method.

  Next, the index cluster_idx of the cluster 116 generated by clustering is initialized with 0 (step 703). Then, it is confirmed whether or not the cluster_idx-th cluster 116 exists (step 704). If not, sensor_idx is incremented (step 709), and the process returns to step 701.

  Further, when there is a cluster_idx-th cluster in the processing of step 704, it is determined whether or not the state 211 of all histograms included in the cluster is abnormal (step 705).

  If all the histogram states 211 in the cluster are abnormal, the cluster is a histogram pattern when the monitoring target is abnormal, and therefore False is stored in the normal pattern flag 303 of the cluster (step 707).

  On the other hand, if some of the histograms in the cluster are not abnormal in step 705, the periodicity fluctuation index of the cluster is extracted (step 706). This periodicity variation index extraction process will be described later with reference to FIG.

  Then, cluster_idx is incremented (step 708), and the process returns to step 704.

  By this clustering process, a cluster including all the histograms at the time of abnormality can be clustered as an abnormal pattern, and a cluster including the histogram at the normal time can be clustered as a normal pattern.

<Details of Cluster Periodic Variation Index Extraction Processing (Step 706)>
FIG. 8 is a flowchart of processing executed by the clustering processing unit 112 in step 706 of FIG. The cluster periodicity fluctuation index extraction process shown in FIG. 8 is a process for finding a common item in the periodicity fluctuation index from a cluster including a normal histogram and extracting a histogram pattern associated with the periodic fluctuation.

  First, it is determined whether the state 211 of all histograms included in the cluster is normal (step 800). If all the histograms in the cluster are normal, the cluster represents a normal pattern, and the process proceeds to step 805.

  On the other hand, if some of the histograms in the cluster are abnormal, a histogram having the same value of the periodicity variation index as the histogram at the time of abnormality is removed from the cluster (step 801). By removing the normal histogram having the same pattern as that in the abnormal state, the normal histogram is obtained more accurately. In addition, the periodicity variation index includes those represented by categories such as day of the week and climate, and those represented by numerical values (discrete values or continuous values) such as temperature. With respect to the periodic fluctuation index represented by the category, it can be determined whether it is a normal histogram depending on whether the values of any of the periodic fluctuation indices match. In addition, regarding periodicity fluctuation indexes represented by numerical values (discrete values or continuous values), are distances such as Euclidean distances and Mahalanobis distances equal to or less than a threshold in a feature vector using the value of each periodicity fluctuation index as a feature quantity? Can determine whether the histogram is normal.

  Next, an abnormal histogram is extracted from the cluster to generate one new cluster (step 802).

  Then, False is stored in the normal pattern flag 303 of the newly generated cluster (step 803). In this way, a more accurate normal pattern is extracted by excluding the normal histogram similar to the abnormal histogram.

  Next, it is determined whether or not one or more normal histograms remain (step 804). If no histogram remains, the process ends.

  On the other hand, if there are one or more normal histograms, it is determined whether all the periodic fluctuation indexes 212 in the normal histogram are the same (step 805). Regarding the periodicity variation index represented by the category, it can be determined whether the periodicity variation index is the same depending on whether the values of the periodicity variation index are the same in all the histograms in the normal cluster. In addition, regarding the periodic fluctuation index represented by a numerical value (discrete value or continuous value), the value of the periodic fluctuation index depends on whether there is a periodic fluctuation index value in which the dispersion of distances between all histograms is equal to or less than a threshold value. Can be determined to be the same. When a plurality of periodic fluctuation indices are included, it is necessary to determine that all periodic fluctuation indices are the same.

  If it is determined in step 805 that the values of some periodic fluctuation indices are not the same, the cluster including the normal histogram is excluded from the data memory 106 (step 807).

  On the other hand, if it is determined in step 805 that all periodic fluctuation indices are the same, a feature vector characterized by the value of each periodic fluctuation index is stored in the periodic fluctuation index 302 of the cluster (step 806). . Note that the periodicity fluctuation index that is not shared is null.

<Details of Clustering Result Display Processing Unit 110 (Step 404)>
FIG. 9 is a diagram for explaining the screen displayed on the display device 101 in step 404 of FIG. The user can confirm the periodicity common to the generated clusters on the clustering result display screen, and can delete unnecessary clusters.

  As shown in FIG. 9, the classing result display screen includes units such as a speed 900, an acceleration 901, a brake pressure 902, a blinker lighting time 903, a change angle 904 in the traveling direction centered on the front of the vehicle body, and an engine speed 905. Items that measure the state of the moving body over time can be selected from the tab menu. For example, when the user selects the speed 900, a list 906 of clustering results of the speed histogram is displayed.

  The list 906 displays a radio button for selecting each cluster and a periodicity change index 907 assigned to the cluster. By selecting a radio button from the list of class ring results, a line graph 908 that displays the superimposed histograms included in the selected cluster is drawn. Further, the list 906 displays the number of nodes of the cluster and the common periodicity variation index, and an unnecessary cluster can be selected by the check box 909 and deleted. When the user operates the confirmation button 910, the cluster selected by the check box can be deleted from the data memory 106.

<Overview of abnormal data detection processing>
FIG. 10 is a flowchart of processing executed by the abnormal data detection processing unit 108. The abnormal data detection process shown in FIG. 10 is a process for determining in real time whether or not the histogram transferred from the data transfer terminal 103 is abnormal, using a cluster including a normal histogram stored in the data memory 106. .

  First, the histogram transferred in real time from the data transfer terminal 103 is stored in the data memory 106 (step 1000).

  Next, it is determined whether or not the aggregation period of the histogram 115 is a time unit (aggregated within one hour) (step 1001). If the aggregation period of the histogram 115 is a time unit, the time unit and the day unit The corresponding values of weather, day of the week, week, and month are assigned to the periodicity change index 212 as feature vectors (steps 1005 to 1009). Note that the periodicity variation index not selected on the periodicity variation index setting screen (FIG. 5) is null.

  If it is determined in step 1001 that the aggregation period of the histogram 115 is not in time units, it is determined whether the aggregation period in the histogram is in days (aggregated within 24 hours) (step 1002). When the aggregation period of the histogram 115 is daily, corresponding values of daily, weather, day of the week, weekly, and monthly are assigned to the periodicity variation index 212 as feature vectors (steps 1006 to 1009).

  If it is determined in step 1002 that the aggregation period of the histogram 115 is not a day unit, it is determined whether the aggregation period of the histogram is a week unit (totaled within 168 hours) (step 1003). In step 1003, when the aggregation period of the histogram is in units of weeks, the corresponding values in units of weeks and months are assigned to the periodicity variation index 212 as feature vectors (steps 1008 and 1009).

  If it is determined in step 1003 that the aggregation period of the histogram is not weekly, it is determined whether the histogram aggregation period is monthly (aggregated within 720 hours) (step 1004). If the tabulation period of the histogram is in units of months, the corresponding value in units of months is assigned to the periodicity fluctuation index 212 as a feature vector (step 1009).

  If it is determined in step 1004 that the histogram total period is not in units of months, for example, when the data transfer terminal 103 transfers the histogram when the cumulative value of the total time reaches a preset threshold value, Calculate the correlation coefficient between continuous values (environment variables) such as histograms and statistical values such as the average, variance, kurtosis, and skewness of the feature values of the histogram. This is assigned to the periodicity fluctuation index 212 of the histogram (step 1010).

  In steps 1005 to 1010, the values assigned as periodicity fluctuation indexes are stored as feature vectors, respectively, as feature vectors. Next, the abnormality determination processing unit 113 determines whether or not the real-time histogram is abnormal (step 1011), and ends the process. Note that the processing of step 1011 will be described later with reference to FIG.

<Details of Abnormality Determination Processing Unit 113 (Step 1011)>
FIG. 11 is a flowchart of processing executed by the abnormality determination processing unit 113 in step 1011 of FIG. The abnormality determination process shown in FIG. 11 uses a cluster including a normal histogram stored in the data memory 106 to evaluate whether a real-time histogram has a normal histogram pattern with a similar periodic fluctuation index, and score Is a process for calculating.

  First, False is stored in the abnormal flag 312 of the real-time histogram 117 (step 1100).

  Next, the cluster index cluster_idx including the histogram having the same item name as that of the real-time histogram 117 is initialized to 0 (step 1101).

  Then, it is determined whether there is a cluster_idx-th cluster (step 1102). If there is a cluster_idx-th cluster, it is determined whether the cluster_idx-th cluster is an abnormal pattern (step 1103).

  If it is determined in step 1103 that the cluster is not an abnormal pattern, it is determined whether the value of the periodic variation index, which is a feature quantity other than null in the real-time histogram, is the same as the value of the periodic variation index of the cluster ( Step 1104). Regarding the periodic fluctuation index represented by the category, it is determined whether the periodic fluctuation index value is the same depending on whether the periodic fluctuation index value of the histogram and the periodic fluctuation index value of the cluster are the same. . In addition, for periodicity fluctuation indices expressed as numerical values (discrete values or continuous values), distances such as the Euclidean distance and Mahalanobis distance of the centroid (mass center) of the cluster are calculated, and if the distance is below the threshold, the period It is determined that the values of the sex variation index are the same. When a plurality of periodic fluctuation indices are included, it is necessary to determine that all periodic fluctuation indices are the same.

  If it is determined in step 1104 that there is a cluster having the same value of the real-time histogram and the periodicity variation index, it is determined whether the frequency distribution of the real-time histogram is similar to the frequency distribution of the histogram in the cluster (step 1105). Whether the real-time histogram and the histogram in the cluster are similar is calculated by calculating distances such as Euclidean distance and Mahalanobis distance between histograms using the frequency array as a feature vector, and using the Ward method, the distance between the real-time histogram and the cluster If the distance between the real-time histogram and the cluster is equal to or smaller than the threshold, it is determined that they are similar. Also, instead of the distance, the Batacharia coefficient or Pearson coefficient is used as the similarity, the similarity between the real-time histogram and the cluster is calculated by the county average method, and it is determined that the similarity is similar when the similarity is greater than or equal to the threshold. May be.

  If it is determined in step 1105 that the real-time histogram and the cluster are similar, it is determined that the real-time histogram is normal, false is stored in the abnormal flag 312 of the real-time histogram 117 (step 1106), and processing is performed. finish.

  If it is determined in step 1105 that the real-time histogram and the cluster are not similar, the cluster index cluster_idx is incremented (step 1107), and the process returns to step 1102. If it is determined in step 1104 that the value of the periodic variation index, which is a feature quantity other than null in the real-time histogram, is not the same as the value of the periodic variation index common to the normal cluster, the cluster index cluster_idx is set. Increment (step 1107) and return to the processing of step 1102. If it is determined in step 1103 that the cluster has an abnormal pattern, the cluster index cluster_idx is incremented (step 1107), and the process returns to step processing.

  If it is determined in step 1102 that there is no cluster_idx-th cluster, the process ends.

  Through the above processing, it is determined whether the real-time histogram is abnormal, and a flag is set. A GUI that draws an abnormal histogram on the display screen in real time using the determination result may be provided. Moreover, you may provide the process which stores a discrimination | determination result in DB sequentially and displays it as a list. From these, an abnormality histogram may be confirmed.

  If the real-time histogram is not similar to any cluster, the determination condition may be relaxed in step 1104 and the abnormality determination process may be executed once again.

  Further, the abnormality determination process shown in FIG. 11 determines whether or not the real-time histogram is abnormal, but it is also possible to determine whether or not the histogram stored in advance in the database is abnormal.

<Summary>
In the present embodiment, the operation log data of the moving body is taken as an example of the histogram data as an example of the histogram data, and a sensor for measuring a change in the state of the device for monitoring the operation per unit time attached to the device is used. For example, regarding the histogram that is the aggregate value of speed, acceleration, brake pressure, blinker lighting time, change angle of the traveling direction centered on the front of the vehicle body, engine speed, etc., time zone, day of the week, business day, quarter period, etc. As a periodicity, a histogram pattern related to a specific route, fuel consumption, and safe operation is extracted by clustering to determine whether the histogram sent in real time from the sensor is a specific route, fuel consumption, safe operation, etc. explained.

  In addition, as a kind of sensor, it is not restricted to what was described in this embodiment, For example, as a sensor which measures the operation log data for monitoring the state of the system attached to industrial equipment, for example, a temperature sensor, When detecting abnormalities in equipment from histograms that are aggregate values such as frequency, number of rotations of rotating parts, oil viscosity in hydraulic drive systems, etc. from measured values from vibration analysis sensors, etc., temperature and humidity as periodicity of the external environment Using the operating time as the periodicity of the operating state, the histogram pattern at normal time under a specific periodic condition is extracted by clustering to determine whether the histogram sent in real time from the sensor is abnormal Processing may be performed.

  In addition, when detecting abnormalities in a multifunction device, in addition to the histograms exemplified in industrial equipment, a histogram that summarizes the measured values by sensors such as heat sensitivity, power consumption, roller rotation speed, consumption of consumables such as ink, etc. The abnormality may be determined by making the number of printed sheets for each paper size periodic.

  In addition, when detecting an abnormality in an elevator (for example, an elevator), in addition to the histogram exemplified in the industrial equipment, processing is performed using a histogram in which measured values by sensors such as pressure sensitivity, acceleration, and sound frequency are aggregated. May be performed. In addition to this, abnormality may be determined using a histogram that is a total value of sensors that are measured every unit time attached to a machine tool, a manufacturing machine, an agricultural machine, or the like as industrial equipment.

  In addition, for example, using a moving body detection log data, a periodicity such as time zone, day of the week, etc. is normal using a histogram that aggregates the passing amount (traffic volume) of a moving body per unit time attached to a specific location. Histogram patterns of traffic volume are extracted by clustering, and histogram patterns that are exceptions under specific periodic conditions are extracted by clustering from the timing of specific events such as the occurrence of accidents, and the location where the sensor is attached ( For example, it may be used for an optimal arrangement of an administrator (for example, a police officer) or the like.

  Also, for example, the population per unit time with the area as a series from the coordinate log data of mobile terminals equipped with GPS, and the terminal owner's profile data, for example, segments such as age, gender, annual income, consumption expenditure trends Using another histogram, the time pattern, date, day of the week, etc. are periodic, and the histogram pattern of sales and population distribution for each product is classified by clustering under a specific periodic condition. You may analyze the relation with goods.

  Further, for example, communication traffic may be analyzed using communication log data. For example, the time zone, day of the week using a histogram that summarizes the number of transfers of packets per unit time (for example, TCP, UDP, ICMP, SYN, FIN, PHS, RST, etc. in fragments) at observation points in the network The normal time histogram pattern may be extracted by clustering based on the periodicity, and it may be determined whether the real-time histogram is unauthorized access under a specific periodic condition from the timing of a specific event such as a press release.

  According to an embodiment of the present invention, for a period of time, day of the week, and a period of human activities such as business hours, business days, quarters, etc., an operation that easily causes an accident is detected from the operation data of the moving body, Abnormalities can be detected early. In addition, anomalies are detected from the operation data of industrial equipment, the flow of the moving object is optimized from the data that has detected the moving object at a predetermined position, customers are clustered from the owner's position data and profile data, Unauthorized access can be detected from communication log data.

  The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and the present invention is not necessarily limited to those having all the configurations described. A part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Moreover, you may add the structure of another Example to the structure of a certain Example. In addition, for a part of the configuration of each embodiment, another configuration may be added, deleted, or replaced.

  In addition, each of the above-described configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, with an integrated circuit, and the processor realizes each function. It may be realized by software by interpreting and executing the program to be executed.

  Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and the information lines are those that are considered necessary for the explanation, and not all the control lines and the information lines that are necessary for the mounting are shown. In practice, it can be considered that almost all the components are connected to each other.

100 ... Histogram data DB
DESCRIPTION OF SYMBOLS 101 ... Display apparatus 102 ... Input terminal 103 ... Data transfer terminal 104 ... Central processing unit 105 ... Program memory 106 ... Data memory 107 ... Periodic fluctuation pattern extraction process part 108 ... Abnormal data detection processing unit 109 ... Periodic index setting screen display processing unit 110 ... Clustering processing unit 111 ... Periodic variation index extraction processing unit 112 ... Clustering processing unit 113 ... Abnormal Discrimination processing unit 114 ... measurement item 115 ... histogram 116 ... cluster 117 ... real-time histogram

Claims (10)

An anomaly detection device that acquires data from a sensor device that outputs a measurement value that changes over time,
A database that stores histograms that aggregate past measurements;
A periodicity extraction processing unit for extracting periodicity from the histogram;
A clustering processing unit that extracts a normal pattern by clustering a plurality of histograms stored in the database using the extracted periodicity;
An abnormality detection apparatus comprising: an abnormality detection processing unit that determines whether the determination target histogram is abnormal depending on whether the determination target histogram and the normal pattern have the same periodic characteristics. The abnormality detection apparatus according to claim 1,
The abnormality detection apparatus, wherein the periodicity extraction processing unit extracts a periodic feature from the histogram using a period related to business utilization, human behavior, or a natural phenomenon. The abnormality detection device according to claim 1 or 2,
The periodicity extraction processing unit outputs a screen for setting at least one of a time, a day, a day of the week, a week, and a month in the periodicity that is the aggregation period of the one histogram. Anomaly detection device. The abnormality detection apparatus according to any one of claims 1 to 3,
The abnormality detection apparatus, wherein the periodicity extraction processing unit extracts periodicity from the histogram using a period related to a time-varying environmental factor. The abnormality detection device according to claim 4,
The periodicity extraction processing unit calculates a statistical correlation between the environmental factor and the histogram, and sets a period regarding the correlated environmental factor as a periodicity of the histogram. An abnormality detection device according to any one of claims 1 to 5,
The clustering processing unit
Exclude the abnormal histogram from the cluster containing multiple histograms,
Thereafter, when the periodic features of the histograms included in the cluster are the same, the abnormality detection device is characterized in that the cluster is used as a normal pattern. The abnormality detection device according to claim 6,
The clustering processing unit
If the periodicity is characterized by a category that includes multiple categories, if the category is different from other normal histograms, it is determined to be an abnormal histogram that is excluded,
When periodicity is characterized by a numerical value, the abnormality detection is characterized in that if the distance of the periodic feature from another normal histogram is larger than a predetermined threshold, it is determined that the histogram is an abnormal histogram to be excluded. apparatus. The abnormality detection device according to claim 6,
The clustering processing unit
When the periodicity is characterized by a category including a plurality of divisions, if all histograms included in the cluster have the same category, the cluster is set as a normal pattern,
When the periodicity is characterized by numerical values, if the distance between the periodic features of all the combinations of histograms included in the cluster is smaller than a predetermined threshold, the abnormality is characterized by making the cluster a normal pattern. apparatus. The anomaly detection device according to any one of claims 1 to 8,
The abnormality detection processing unit
For the histogram to be determined, a cluster having the same periodicity characterized by a category including a plurality of sections and a periodic feature whose periodicity is characterized by a numerical value is smaller than a predetermined threshold. Select as a cluster similar to
An abnormality detection apparatus, wherein when no cluster is selected, the determination target histogram is determined to be abnormal. A computer that acquires data from a sensor device that outputs a measurement value that changes with time, stores a histogram that summarizes past measurement values, a processor that executes the program, and a memory that stores the program An abnormality detection method executed in
The method
The processor extracts periodicity from the histogram;
The processor clusters a plurality of histograms stored in the database using the extracted periodicity to extract a normal pattern,
An abnormality detection method, wherein the processor determines whether the histogram to be determined is abnormal depending on whether the periodic characteristic of the determination target histogram and the normal pattern are the same.

Images