JP2019159604A - Abnormality detection device, abnormality detection method and abnormality detection program - Google Patents

Abstract

To provide a technique for detecting abnormality with high accuracy even in the case of using measurement data having no linearly continuous correlations during detecting abnormality of a measurement object.SOLUTION: A learning model is generated by acquiring measurement data showing states of a plurality of items about the items in a measurement object, acquiring N-dimensional probability density from the measurement data included in learning data about N combinations among the plurality of items by regarding measurement data acquired at prescribed timing as one data group and regarding a plurality of data groups acquired at different timing as the leaning data, and acquiring the N-dimensional probability density about a plurality of the combinations. Abnormality of the measurement object is detected on the basis of a score of the data groups by calculating a probability that measurement data related to the N combinations among data groups to be an evaluation object is acquired from the learning model, calculating an abnormality score on the basis of the probability, and calculating a score of the data groups on the basis of the abnormality score related to the plurality of combinations of the items.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program.

  If a failure occurs in a production facility and production stops, production efficiency decreases. For this reason, it is desired to perform maintenance by detecting a sign of failure, and to prevent the stoppage of production, or to promptly identify the cause of failure and repair when a failure occurs. However, as the production facilities become larger and more complex, workers manually detect abnormalities that are predictive of failures and abnormal locations that cause failures (hereinafter also referred to as abnormal detections). Things are getting harder.

  In addition, as information systems that provide web services and business services via the Internet are becoming increasingly important as social infrastructure, service delays and interruptions due to failures are not allowed. It is important to manage and operate a device such as a server that can stably move. For this reason, it is required to perform planned maintenance by detecting not only an abnormality that has occurred, but also a state of performance degradation that is not a clear abnormality or a sign of a failure that is expected to occur in the future.

  Examples of techniques for detecting such an abnormality include Patent Documents 1 to 3 shown below. Japanese Patent Laid-Open No. 2004-268831 describes a first performance series information indicating a time series change of performance information related to at least a first element and a time series change of performance information related to a second element. The correlation function with the performance series information of 2 is derived, a correlation model is generated based on the correlation function, the correlation model is obtained for the combination between each element, and based on the performance information newly detected and acquired from the observation target Therefore, an anomaly detection device that analyzes changes in the correlation model has been proposed.

  In Patent Document 2, each of a plurality of computers collects transaction of services for any other computer, calculates a correlation matrix between nodes in the system from the transaction, and determines the activity balance of the nodes from the transaction matrix. Find the feature vector to represent. An anomaly detection system that detects a transition to an abnormal state by monitoring the feature vector using a probabilistic model has been proposed.

  In Patent Document 3, a plurality of correlation function candidates representing correlations of metric pairs in the system are stored, and among the plurality of correlation function candidates, correlation destruction is likely to occur when a metric related to the correlation function is abnormal. There has been proposed a system analysis apparatus that extracts one correlation function as a correlation function of the metric pair based on the detection sensitivity indicating the above.

  In addition, a technique is proposed in which machine learning is performed on measurement data and an abnormality is determined by a neural network or SVM (support vector machine).

JP 2009-199533 A Japanese Patent Application Laid-Open No. 2005-216066 Japanese Patent No. 6183450

  In a system that determines an abnormality in a black box using a neural network or SVM, even if the abnormality can be detected, the basis of the abnormality is not indicated, and it is difficult to take an appropriate response according to the abnormality.

  In addition, a system has been proposed in which an abnormal element can be identified by obtaining a correlation for each combination of two elements and detecting an abnormality. There is a problem that an abnormality cannot be detected unless there is a linearly continuous correlation for the combination.

  When detecting an abnormality in a computer system, information such as the CPU operation rate, memory usage rate, and the number of threads being executed can be easily obtained, and the same phenomenon occurs under the same conditions. Therefore, it is easy to select an element having a linear correlation.

  On the other hand, when detecting an abnormality in a production facility or the like, various elements are related and an abnormality may occur. Therefore, the measurement data of each element does not always correlate linearly. In addition, in order to measure the state of production equipment, sensors and input interfaces are installed for this purpose, so it is realistic to install sensors, etc. in every element in order to search for data having a linear correlation. Not. For this reason, it is sometimes difficult to detect an abnormality with high accuracy in a conventional abnormality detection system.

  In view of the above, an object of the present invention is to provide a technique for accurately detecting an abnormality even when measurement data having no linear correlation is used when detecting an abnormality of a measurement target.

The abnormality detection device according to the present invention is
A data acquisition unit for acquiring measurement data indicating the state of the item for a plurality of items in the observation target;
Measurement data acquired at a predetermined timing is set as one data group (for example, a record), a plurality of data groups acquired at different timings are set as learning data, and N combinations of the plurality of items are included in the learning data. A model generation unit for obtaining an N-dimensional probability density from the measurement data, obtaining the N-dimensional probability density for the plurality of the combinations, and generating a learning model;
A score calculation unit that calculates a probability that the measurement data related to N combinations of the items is obtained from the learning model in the data group to be evaluated, and calculates an abnormal score based on the probability;
Calculating a score of the data group based on the abnormality score related to a plurality of combinations of the items, and detecting an abnormality of the observation target based on the score of the data group;
Is provided.

  The abnormality detection device may include a display control unit that causes the link to be generated in a display form according to the abnormality score when the node indicating the item and the link indicating the combination of the node are displayed on the display device. .

In the abnormality detection device, the model generation unit is
Of the N combinations of items, the range of measurement data that can be taken by each item is taken as the first to Nth axes, and the range of measurement data that can be taken by the second item is taken perpendicularly to the first axis. For the second axis,
With regard to the N-dimensional probability density obtained from the measurement data of the first to Nth items, the probability density of each item is accumulated from the higher one, and when a predetermined cumulative probability is reached, the space and probability density having a high probability density are obtained. Dividing into a low space by a hyperplane, the area of the N-dimensional probability density in the hyperplane is α% cross-sectional area, and the area of the range that each item can take in the hyperplane is obtained as an overall area,
Dividing the total area by the α cross-sectional area to obtain an α% cross-sectional ratio,
A combination having an α% cross-sectional ratio less than a threshold value may be selected, and the learning model may be generated for the selected combination.

In addition, the abnormality detection method according to the present invention includes:
Obtaining measurement data indicating the state of the item for a plurality of items in the observation target;
The measurement data acquired at a predetermined timing is used as one data group, a plurality of data groups acquired at different timings is used as learning data, and N combinations among the plurality of items are included in the learning data from the measurement data. Determining an N-dimensional probability density, determining the N-dimensional probability density for the plurality of combinations, and generating a learning model;
Obtaining a probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model, and calculating an abnormality score based on the probability;
Calculating a score of the data group based on the abnormality score relating to a plurality of combinations of the items, and detecting an abnormality of the observation target based on the score of the data group;
Is executed by the computer.

The abnormality detection method may include a step of causing the link to be generated in a display form corresponding to the abnormality score when a node indicating the item and a link indicating a combination of the nodes are displayed on a display device.
The abnormality detection method is:
Of the N combinations of items, the range of measurement data that can be taken by each item is taken as the first to Nth axes, and the range of measurement data that can be taken by the second item is taken perpendicularly to the first axis. For the second axis,
With regard to the N-dimensional probability density obtained from the measurement data of the first to Nth items, the probability density of each item is accumulated from the higher one, and when a predetermined cumulative probability is reached, the space and probability density having a high probability density are obtained. Dividing into a low space by a hyperplane, the area of the N-dimensional probability density in the hyperplane is α% cross-sectional area, and the area of the range that each item can take in the hyperplane is obtained as an overall area,
Dividing the total area by the α cross-sectional area to obtain an α% cross-sectional ratio,
A combination having an α% cross-sectional ratio less than a threshold value may be selected, and the learning model may be generated for the selected combination.

  The contents described in the means for solving the problems can be combined as much as possible without departing from the problems and technical ideas of the present invention. The contents of the means for solving the problems can be provided as a device such as a computer or a system including a plurality of devices, a method executed by the computer, or a program executed by the computer. For example, the present invention may be a program for causing a computer to execute each step of the abnormality detection method. Further, the present invention may be a computer-readable recording medium that holds this program.

  ADVANTAGE OF THE INVENTION According to this invention, when detecting the abnormality of a measuring object, even when the measurement data which do not have a linearly continuous correlation are used, the technique which detects an abnormality accurately can be provided.

FIG. 1 is a block diagram illustrating a configuration of the abnormality detection apparatus according to the embodiment. FIG. 2 is a diagram illustrating an example of measurement data stored in the storage device. FIG. 3 is a diagram illustrating a hardware configuration of the abnormality detection apparatus. FIG. 4 is a diagram illustrating a processing procedure for acquiring measurement data. FIG. 5 is a diagram illustrating a processing procedure for generating a learning model. FIG. 6 is a diagram illustrating a processing procedure for detecting an abnormality of an observation target. FIG. 7 is a graph showing an example of a two-dimensional probability density. FIG. 8 is an explanatory diagram of an abnormality score obtained from a probability density function for measurement data (sample) to be evaluated. FIG. 9 is a diagram illustrating a display example of detection results. FIG. 10 is a diagram illustrating an example of a network diagram showing an abnormality factor. FIG. 11 is a diagram illustrating a time-series graph of abnormality scores in specific item combinations. FIG. 12 is an explanatory diagram of an example of performing abnormality detection using probability density. FIG. 13A is a diagram illustrating an example in which Gaussian kernel functions are added and averaged. FIG. 13B is a diagram illustrating an example of approximating a complex probability density function with a Gaussian kernel function. FIG. 14 is a diagram illustrating an example of mixing Gaussian distributions. FIG. 15 is a diagram showing contour lines of the mixing element. FIG. 16 is a diagram showing contour lines of the peripheral probability density of the mixed distribution. FIG. 17 is an explanatory diagram of the α% cross-sectional ratio.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, the following embodiment is an illustration of this invention and this invention is not limited to the following structure.

<Device configuration>
FIG. 1 is a block diagram showing the configuration of the abnormality detection apparatus of the present embodiment. The abnormality detection device 3 acquires measurement data for a plurality of items in an observation target such as a production facility, estimates the probability density of this data, and determines that the likelihood is low.

  As shown in FIG. 1, the abnormality detection device 3 is connected to each production facility 2 that is an example of an observation target via a communication line N. The communication line N may be a simple cable or a network such as a LAN. The communication line may be wired or wireless.

  The abnormality detection device 3 includes a data acquisition unit 31, a model generation unit 32, a score calculation unit 33, a detection unit 34, and a display control unit 35.

  The data acquisition unit 31 acquires measurement data indicating the state of the items for the plurality of items in the observation target, and stores them in the storage device. The measurement data is acquired via the communication line N as measurement data, for example, information used for control in the production facility 2 such as the number of rotations of the motor, the value of the drive current, the control signal of the actuator and the number of operations. Moreover, the data acquisition part 31 is a sensor with which the abnormality detection apparatus 3 is provided, measures the sound, heat | fever, vibration, etc. which are emitted from the production facility 2, and is good also considering this measured value as measurement data.

The model generation unit 32 uses the measurement data acquired at a predetermined timing as one record (data group), a plurality of records acquired at different timings as learning data, and the learning data for two combinations of the plurality of items. A two-dimensional probability density is obtained from the measurement data included in the data, and the two-dimensional probability density is obtained for the plurality of combinations to generate a learning model.

  The score calculation unit 33 obtains a probability that the measurement data related to two combinations of the items in the data group to be evaluated is obtained from the learning model, and calculates an abnormal score based on the probability.

  The detection unit 34 detects an abnormality of the observation target based on the abnormality score related to a combination of a plurality of the items.

  The display control unit 35 causes the display device to display an abnormality detection result detected by the detection unit 34. For example, when displaying a node indicating the item and a link indicating a combination of the nodes on a display device, the display control unit 35 causes the link to be generated in a display form corresponding to the abnormality score.

  FIG. 2 shows an example of measurement data acquired by the data acquisition unit 31 and stored in the storage device. In the example of FIG. 2, measurement data is acquired at predetermined time intervals after the start of observation, and measurement values of a plurality of items acquired at a predetermined timing are stored as one record, and a plurality of data acquired sequentially at different timings are stored. Records are accumulated as learning data.

FIG. 3 is a diagram illustrating a hardware configuration of the abnormality detection device 3. The abnormality detection device 3 is a computer (information processing device) as shown in FIG. 3, for example. 3 includes a CPU (Central Processing Unit) 301, a main storage device 302, an auxiliary storage device (external storage device) 303, a communication IF (Interface) 304, an input / output IF (Interface) 305, and a drive device. 306 and a communication bus 307 are provided. CPU301 performs the process etc. which concern on this Embodiment by running a program. The main storage device 302 caches programs and data read by the CPU 301 and develops a work area of the CPU. Specifically, the main storage device is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like. The auxiliary storage device 303 stores programs executed by the CPU 301, position information, and the like. Specifically, the auxiliary storage device 303 is an HDD (Hard-disk Drive).
), SSD (Solid State Drive), eMMC (embedded Multi-Media Card), flash memory, and the like. The main storage device 302 and the auxiliary storage device 303 also function as storage devices that store measurement data. The communication IF 304 transmits / receives data to / from other computers.

  The abnormality detection device 3 is connected to the network via the communication IF 304. Specifically, the communication IF 304 is a wired or wireless network card or the like. The input / output IF 305 is connected to the input / output device, and receives input from the user or outputs information to the user. Specifically, the input / output devices are a keyboard, a mouse, a display 351, a touch panel, a sensor 352, and the like. The display 351 displays information such as an abnormality detection result to the user. The sensor 352 is a unit that measures the state of the observation target, such as a temperature sensor, a vibration sensor, an acceleration sensor, an imaging device, or a microphone.

The drive device 306 reads data recorded on a storage medium such as a magnetic disk, a magneto-optical disk, and an optical disk, and writes data to the storage medium. The above components are connected by a communication bus 307. A plurality of these components may be provided, or some of the components (for example, the drive device 306) may not be provided. Further, the input / output device may be integrated with the computer. In addition, the program executed in the present embodiment is provided via a portable storage medium readable by the drive device 306, a portable auxiliary storage device 303 such as a flash memory, and a communication IF 304. It may be.

  The CPU 301 loads the program to the main storage device and executes it. In the abnormality detection device 3, the CPU 301 operates as the data acquisition unit 31, the model generation unit 32, the score calculation unit 33, and the detection unit 34.

The CPU 301 corresponds to a processing device in this example. The CPU 301 is also called an MPU (Micro Processor Unit), a microprocessor, or a processor. The CPU 301 is not limited to a single processor, and may have a multiprocessor configuration. A single CPU connected by a single socket may have a multi-core configuration. At least a part of the processing of each unit may be performed by a processor other than the CPU, for example, a dedicated processor such as a digital signal processor (DSP), a graphics processing unit (GPU), a numerical operation processor, a vector processor, or an image processing processor. good. Further, at least a part of the processing of each unit may be an integrated circuit (IC) or other digital circuit. In addition, an analog circuit may be included in at least a part of each of the above parts. Integrated circuits are LSI, Application Specific Integrated Circuit (ASIC), Programmable Logic Device (PL
D). The PLD includes, for example, a field-programmable gate array (FPGA). Each of the above units may be a combination of a processor and an integrated circuit. The combination is called, for example, an MCU (Micro Controller Unit), an SoC (System-on-a-chip), a system LSI, or a chip set.

<Abnormality detection method>
Next, an abnormality detection method executed by the abnormality detection device 3 having the above-described configuration will be described. FIG. 4 is a diagram illustrating a processing procedure for acquiring measurement data, FIG. 5 is a diagram illustrating a processing procedure for generating a learning model, and FIG. 6 is a diagram illustrating a processing procedure for detecting an abnormality of an observation target.

  When the abnormality detection device 3 receives an instruction to start observation by a user operation or the like, the abnormality detection device 3 starts the process of FIG. 4 and determines whether or not a predetermined measurement timing has been reached (step S10).

  When a negative determination is made in step S10, the abnormality detection device 3 ends the process of FIG. On the other hand, in the case of a positive determination in step S10, the abnormality detection device 3 acquires measurement data (step S20).

In step S20, the abnormality detection device 3 acquires measurement data for a plurality of preset items. For example, the abnormality detection device 3 acquires measurement data by measuring the state of the measurement target using a temperature sensor, a vibration sensor, or the like. Further, the abnormality detection device 3 may read information such as an operation history from a measurement target storage medium or acquire information such as a control signal, and use the information as measurement data. In FIG. 4, for the sake of simplicity, the process of acquiring measurement data for a plurality of items is shown in one step. However, the procedure for sequentially acquiring the measurement data for each item and the measurement data for a plurality of items are acquired in parallel. As long as measurement data can be acquired for a predetermined item such as, it may be acquired by an arbitrary procedure. The measurement data may be standardized, normalized, or standardized and converted into a predetermined format. For example, as shown in the following equation, standardization may be performed on data in which the average is 0 and the standard deviation is 1 for each item.
Standardized value = (numerical value-average value) / standard deviation

Further, as in the following equation, each item may be standardized to data in which the minimum value is 0 and the maximum value is 1.
Standardized value = (numerical value-minimum value) / (maximum value-minimum value)

Then, the abnormality detection device 3 stores the measurement data acquired at a predetermined timing in the storage device as one record (step S30). Here, the predetermined timing is, for example, the same timing. In addition, the timing is not limited to the exact same time, it may be a timing close to the extent that the state of each item is related to each other. For example, when measuring data is acquired every predetermined period, it is acquired within the same period The measurement data may be measurement data acquired at the same timing. In addition, the predetermined timing may be a measurement timing that is predetermined in order to detect the same abnormality. For example, data measured in the first to n-th processes when manufacturing a certain product is set as one record, and data measured in the first to n-th processes when manufacturing a product is set as the next record. In this case, in order to detect an abnormality for each product, the timing measured in the first to n-th processes is set as a predetermined timing.

  The abnormality detection device 3 repeatedly executes the process of FIG. 4 until receiving an instruction to end the measurement by a user operation or the like. As a result, the record of the measurement data is accumulated at each measurement timing and used as learning data.

  The abnormality detection device 3 starts the process of FIG. 5 when a start is instructed by a user operation or the like, or at a predetermined time interval.

  In step S110, the abnormality detection device 3 obtains a correlation coefficient for every two combinations in the learning data. For example, in the case of items A, B, and C, Pearson correlation coefficients are calculated for all combinations, such as [A, B] [B, C] [A, C].

In step S120, the abnormality detection device 3 selects a highly relevant combination based on the correlation coefficient calculated in step S110. For example, a combination having a correlation coefficient equal to or greater than a threshold value is selected. However, the present invention is not limited to this, and it is also possible to select the upper predetermined number of combinations, select a predetermined ratio of all the combinations, and further select a combination of these. In step S110 and S120, the combination of items is selected using Pearson's correlation coefficient. However, the present invention is not limited to this, and any MIC (Maximum Information Coefficient) can be used as long as the strength of relevance of each item can be evaluated. ), Or a probability density as described later.

  In step S130, the abnormality detection device 3 obtains a two-dimensional probability density from the measurement data included in the learning data for the combination selected in step S120, and obtains the two-dimensional probability density for the plurality of combinations. Generate a learning model. The probability density can be estimated using techniques such as maximum likelihood method, Bayesian estimation, kernel density estimation method, and mixed Gaussian distribution. A specific calculation method will be described later. A set of probability densities calculated for two different combinations of items is referred to as a learning model.

  FIG. 7 is a graph showing an example of a two-dimensional probability density. In FIG. 7, the measurement value of item A is taken on the x-axis, the measurement value of item B is taken on the y-axis, the probability density is taken on the z-axis, and the change in probability density with respect to each measurement value is shown in a mesh form. In FIG. 7, a portion having a high probability density, that is, a portion having a high peak indicated by a mesh is a portion having a high likelihood as a normal measurement value, and a portion having a low probability density has a likelihood as a normal measurement value. The lower part.

  Also, the abnormality detection device 3 starts the process of FIG. 6 when a predetermined detection timing is reached, such as when an abnormality detection is instructed by a user operation or when evaluation data is acquired. To do. In this example, the process of creating the learning model in FIG. 5 and the process of detecting the abnormality in FIG. 6 are shown separately. However, the process of detecting the abnormality is executed following the process of creating the learning model. Also good.

In step S210, the abnormality detection device 3 sets a newly acquired measurement data record or the like as an evaluation target, and extracts the combination of items selected in step S120 from the evaluation target record.

In step S220, the abnormality detection device 3 uses the measurement data of the combination extracted in step S210 as an evaluation target, and acquires the probability that the measurement data appears from the learning model.

  FIG. 8 is an explanatory diagram of an abnormality score obtained from a probability density function for measurement data (sample) to be evaluated. In FIG. 8, the measured value of item C is plotted on the vertical axis, and the measured value of item D is plotted on the horizontal axis, and the abnormality score obtained from each measured value is shown in contour lines. In the example of FIG. 8, the learning data indicated by black dots is concentrated on the right side and the upper side of FIG. 8, and the probability density of this portion is high. For this reason, the abnormality score at the upper right in FIG. 8 is low, and the abnormality score becomes higher toward the lower left. Here, when the measurement data with the measurement value of the item C being 85 and the measurement value of the item D being 7.5 are acquired, for the learning data in which the abnormal score is over 60000 and the abnormal score is concentrated below 15000 Thus, a high abnormal score can be detected.

  In step S230, the abnormality detection device 3 obtains a comprehensive score for each record (hereinafter also simply referred to as a record score) based on the abnormality score for each combination. The score of the record may be a function that receives the abnormal score for each combination, and may be, for example, an average value, a maximum value, a weighted average, or the like. With the weighted average, for example, a weight is set in advance for each combination of the items, and the average is calculated by multiplying each abnormal score by the weight. That is, the score is calculated by increasing the weight of an important item or an item that is easily affected by an abnormality. Alternatively, the process of selecting the combination in step S120 may be omitted, and each abnormality score may be obtained by reflecting the absolute value of the correlation coefficient obtained in step S110 in the weight. For each combination, if there is abnormal data, perform logistic regression from the measured data and abnormal data for each combination, and based on the degree of abnormality determined by this, abnormalities related to the combination. Score selection and weighting may be performed. Not limited to this, combination selection and weighting may be performed using other methods such as machine learning.

  In step S240, the abnormality detection device 3 detects an abnormality to be observed based on the score of the record obtained in step S230. For example, when the score of the record exceeds a threshold, it is detected that an abnormality has occurred, and when the score of the record does not exceed the threshold, it is detected that no abnormality has occurred.

  In step S250, the abnormality detection device 3 outputs the detection result to the user. FIG. 9 is a diagram illustrating a display example of detection results. The detection result of FIG. 9 has an occurrence / non-occurrence 81 of an abnormality, an item (hereinafter also referred to as an abnormality item) 82 in which an abnormality is detected, and a network diagram 83 showing an abnormality factor.

The abnormal item 82 is, for example, a combination item in which the abnormal score exceeds a threshold value. Moreover, it is good also considering the item which exists in common with the some combination whose abnormality score exceeded the threshold value as an abnormality item. For example, when the abnormal score of the combination of items A and B and the combination of items B and C exceeds a threshold, item B common to these combinations is determined as an abnormal item. In addition, when items A and C are combined with items other than item B and the abnormal score does not exceed the threshold value, it may be determined that items A and C are not abnormal items. In the present embodiment, the abnormality score is mainly obtained for a combination of two items, but the abnormality score may be obtained for a combination of three or more items. Even in this case, as in FIG. 9, a combination in which the abnormal score exceeds the threshold value can be determined as abnormal, and the combination of items can be displayed in descending order of the abnormal score.

  FIG. 10 is a diagram showing an example of the network diagram 83 showing the abnormal factors. In FIG. 10, each item is indicated by a round node 84, and a combination of items is indicated by a line (link) 85 connecting the nodes. In FIG. 10, “XXX” of each node 84 is identification information indicating each item such as “item A” and “item B”. In FIG. 10, for convenience, only a part of the node 84 and the link 85 is shown with reference numerals, but elements having the same shape indicate similar nodes and links.

  The link 85 is shown in a display form corresponding to the abnormality score related to the combination of the nodes (items) 84. For example, the higher the abnormality score, the thicker the line 85. The display form of the link 85 is not limited to this, and may be displayed by changing the line color, brightness, blinking state, or a combination thereof according to the abnormality score. For example, when the abnormal score is low, it is displayed with a thin green line. When the abnormal score is high, it is displayed with a thick red line. When the abnormal score is in the middle, it is set to an intermediate thickness according to the abnormal score. The hue is between green and red. Alternatively, the link 85 may be displayed blinking when the abnormal score exceeds the threshold, and the blinking speed may be increased and displayed as the abnormal score is higher.

  Thus, by calculating and displaying the abnormality score for each combination of the two items, the user can visually grasp the basis for determining the abnormality. Further, when displaying the network diagram 83, a predetermined number of nodes 84 and links 85 are displayed in the order of the abnormality score, and the nodes 84 and links 85 specified by the user are searched and displayed, a specific facility or It is also possible to narrow down by displaying the nodes 84 and links 85 related to the area.

  FIG. 11 is a diagram illustrating a time-series graph of abnormality scores in specific item combinations. When the user selects a desired combination of items from the detection results shown in FIGS. 9 and 10, as shown in FIG. 11, a graph showing the time-series change of the abnormal score in the combination can be displayed.

  In FIG. 11, time is plotted on the horizontal axis and abnormal score is plotted on the vertical axis so that it is possible to grasp how long and how long an abnormal value is indicated. In the example of FIG. 11, the measurement data (solid line) exceeds the threshold (dotted line, 40 in the illustrated example) between 15:15 and 15:20, indicating that an abnormality has been detected. This makes it possible to accurately grasp the timing at which an abnormality has occurred. In addition, depending on whether the abnormality is transient or continuous, it becomes easy to distinguish between true abnormality and noise.

  Further, in the present embodiment, the abnormality score between items is obtained based on the probability density, so that abnormality can be detected with high accuracy even when normal measurement data of each item does not have a linear correlation. . For example, in the graph 91 of FIG. 12, the measurement value of the item E is plotted on the vertical axis and the measurement value of the item F is plotted on the horizontal axis, and normal measurement learning data corresponding to each measurement value is indicated by black dots. For example, when at least a part of the production facility 2 can operate in different operation modes, normal measurement data may be distributed in this way. In the graph 91, since the measurement value of each item does not have a linear correlation, the abnormality cannot be detected by the conventional abnormality determination method using the correlation coefficient. However, in this embodiment, by obtaining these probability densities, a region 95 with a high probability density is specified as shown in the graph 92, and the region 95 is normal within this region 95, and the degree of abnormality is high enough to deviate from this region 95. Therefore, it is possible to detect an abnormality with high accuracy even for measurement data that does not have a linear correlation.

<Probability density calculation method>
(1) Kernel density estimation (KDE)

Here, K (x, x ′) is a kernel function, and this time a Gaussian kernel as shown in Equation (3) is used. h> 0 indicates the bandwidth of the Gaussian kernel, and d indicates the number of dimensions of x.

The bandwidth is obtained using Scott's Rule. When n is the number of data, Scott's Rule is as shown in Equation (4).

By the above formula, as shown in FIG. 13A, a density distribution (solid line) obtained by adding the average Gaussian kernel function (broken line) to each measurement data x _i is obtained. Thereby, a complicated probability density function as shown in FIG. 13B can be approximated smoothly.
Then, an abnormality can be detected by calculating as an abnormality score where the current measurement data is located in the density distribution.

(2) Gaussian Mixture Model (GMM)
The mixed Gaussian model (GMM) is a distribution obtained by linearly combining several Gaussian distributions as shown in FIG. The superposition of K Gaussian distributions is given by the following equation (5).
Here, π _k is a mixing coefficient, and 0 ≦ π _k ≦ 1.

The optimum parameter can be obtained by the maximum likelihood estimation method, and the logarithmic likelihood function of the mixed Gaussian model is expressed by the following equation (6). This can be solved by the EM algorithm.
Here, X is X = {x_1, x_2,..., X_N}, for example, the value of the measurement data x of each record.

  FIG. 15 shows the contour lines of the three mixing elements together with their respective mixing coefficients. FIG. 16 shows contour lines of the peripheral probability density p (x) of this mixed distribution.

  The abnormality detection device 3 obtains the peripheral probability density for normal data in advance, and can detect an abnormality by calculating the position of the density distribution of the current measurement data as an abnormality score. For example, in FIG. 16, the point 98 on which the measurement data is plotted is within the same contour line as the normal data, and therefore can be determined as normal. On the other hand, the point 99 on which the measurement data is plotted is at a position deviating from the normal data, so that it can be determined as abnormal.

<Modification>
In the above-described embodiment, an example in which items to be adopted as a learning model are selected using a correlation function, but instead, an α% cross-sectional ratio of a probability density distribution may be used. Compared with the above-described embodiment, the present modification is different in the configuration using the α% cross-sectional ratio for selection of items, and the other configurations are the same. Therefore, the same elements are denoted by the same reference numerals and the like again. The description of is omitted.

  The model generation unit 32 takes the range of measurement data that each item can take from the combination of N items on the first to Nth axes, and calculates the N-dimensional obtained from the measurement data of the first to Nth items. Regarding the probability density, when the probability density of each item is accumulated from a higher level and reaches a predetermined cumulative probability density, the space is divided into a space having a high probability density and a space having a low probability density, and the N in the hyperplane is divided. The area of the dimensional probability density is obtained as an α% cross-sectional area. In addition, the model generation unit 32 obtains the area that each item can take on the hyperplane, that is, the area of the range from the minimum value to the maximum value indicated on the hyperplane as the entire area. Then, the model generation unit 32 obtains an α% cross-sectional ratio by dividing the entire area by the α% cross-sectional area, selects a combination having the α% cross-sectional ratio less than a threshold, and generates a learning model for the selected combination. .

  FIG. 17 is an explanatory diagram of the α% cross-sectional ratio in a combination of two items. In the graph 96 of FIG. 17, the measurement value of the item A is taken on the x axis, the measurement value of the item B is taken on the y axis, and the probability density is taken on the z axis, and the change of the probability density with respect to each measurement value is shown in a mesh form. That is, in FIG. 17, the change in probability density is shown as a mesh-like mountain. That is, in the example of FIG. 17, the values of each item (measurement data and learning data) are two-dimensional (x, y) data, and the probability density is high. Here, the area of the region that the measurement values of items A and B can take is the total area, and (max (item A) -min (item A)) × (max (item B) -min (item B)) Ask.

  Further, the probability density peak is accumulated at a predetermined probability density as shown in the graph 97, for example, the probability density of each item from the higher one and cut when the predetermined cumulative probability is reached (cross-hatched shading). (Part)) area.

Then, the α% cross-sectional ratio is obtained from the overall area and the cross-sectional area as shown in Expression a.
α% section ratio = section area / ((max (item A) −min (item A)) × (max (item B) −min (item B))) Equation a

  The α% cross-sectional ratio may be approximately obtained by dividing each item by a square as in the following procedure.

(Procedure 1) A range from the minimum value of x to the maximum value of x is regarded as a section that x can take, and this section is divided into n equal parts. Similarly, a section that can be taken by y is determined and divided into n equal parts, and a region that can take a value of each item is divided into n × n squares. Note that the area of each square is the same.

  (Procedure 2) The representative coordinates (for example, center coordinates) of each square in the xy plane are determined, and the probability density of the representative coordinates is calculated.

(Procedure 3) The probability density of all the n × n cells determined in Procedure 2 is summed up, and the total value S
Ask for.

  (Procedure 4) The probability densities of all the n × n squares obtained in Procedure 3 are arranged in descending order, and the cumulative probabilities are obtained sequentially from the larger one. At this time, a cell whose value obtained by dividing the cumulative probability by the total value S is closest to a predetermined value (for example, 99.99%) is obtained.

  (Procedure 5) The number of squares at the same height as the squares obtained in Procedure 4 is obtained. Here, the same height means that the possible range of probability density is equally divided into n, and among the probability density of each cell, those that fall within the same range are the same height.

(Procedure 6) A value obtained by dividing the number of squares (α% cross-sectional area) obtained in Procedure 5 by the total number of squares (total area) is obtained as an α% cross-sectional area ratio.

  In the process of generating the learning model in FIG. 5, the abnormality detection device 3 of this example obtains the α% cross section ratio of each combination instead of the process of obtaining the correlation function in step S110, and in step S120, the α% cross section ratio. Choose a small combination of.

  As described above, by using the α% cross-sectional ratio, it is possible to appropriately select a combination of items whose measured values do not have a linear correlation.

  In addition, instead of cutting the cross section at a predetermined probability density, an α% cross section ratio is set according to the sample accuracy required by the user, and the cross sectional area corresponding to the α% cross section ratio is obtained from Equation 1 for the probability density of each combination. Back calculation is performed, and the probability density corresponding to the cross-sectional area is obtained as a threshold value. Thereby, it is possible to appropriately set a threshold value of probability density in the case of determining abnormality in each item combination. That is, it is possible to accurately determine an item causing an abnormality.

  In the example of FIG. 17, the α% cross-sectional area is obtained by cutting a three-dimensional space having a probability density in the height direction with respect to two-dimensional data in which two items are combined. When the items are combined, for example, a space of four or more dimensions including probability density may be divided by a hyperplane to obtain the α% cross-sectional area.

2: Production facility 3: Abnormality detection device 31: Data acquisition unit 32: Model generation unit 33: Score calculation unit 34: Detection unit 35: Display control unit

Claims (5)

A data acquisition unit for acquiring measurement data indicating the state of the item for a plurality of items in the observation target;
The measurement data acquired at a predetermined timing is used as one data group, a plurality of data groups acquired at different timings is used as learning data, and N combinations among the plurality of items are included in the learning data from the measurement data. A model generation unit for obtaining an N-dimensional probability density, obtaining the N-dimensional probability density for the plurality of combinations, and generating a learning model;
A score calculation unit that calculates a probability that the measurement data related to N combinations of the items is obtained from the learning model in the data group to be evaluated, and calculates an abnormal score based on the probability;
Calculating a score of the data group based on the abnormality score related to a plurality of combinations of the items, and detecting an abnormality of the observation target based on the score of the data group;
An abnormality detection device comprising:   The abnormality detection device according to claim 1, further comprising: a display control unit configured to cause the link to be generated in a display form according to the abnormality score when the node indicating the item and the link indicating the combination of the node are displayed on the display device. . The model generation unit
Of the combinations of N items, the range of measurement data that each item can take is taken as the first to Nth axes, and the N-dimensional probability density obtained from the measurement data of the first to Nth items is as follows. When the probability density of each item is accumulated from a higher level and reaches a predetermined cumulative probability, the space is divided into a space having a high probability density and a space having a low probability density, and the N-dimensional probability density of the hyperplane is divided. The area is α% cross-sectional area, and the area of the range that each item can take in the hyperplane is determined as the entire area,
Dividing the total area by the α% cross-sectional area to obtain an α% cross-sectional ratio,
The abnormality detection device according to claim 1 or 2, wherein a combination having the α% cross-sectional ratio of less than a threshold is selected, and the learning model is generated for the selected combination. Obtaining measurement data indicating the state of the item for a plurality of items in the observation target;
The measurement data acquired at a predetermined timing is used as one data group, a plurality of data groups acquired at different timings is used as learning data, and N combinations among the plurality of items are included in the learning data from the measurement data. Determining an N-dimensional probability density, determining the N-dimensional probability density for the plurality of combinations, and generating a learning model;
Obtaining a probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model, and calculating an abnormality score based on the probability;
Calculating a score of the data group based on the abnormality score relating to a plurality of combinations of the items, and detecting an abnormality of the observation target based on the score of the data group;
An abnormality detection method that the computer executes. Obtaining measurement data indicating the state of the item for a plurality of items in the observation target;
The measurement data acquired at a predetermined timing is used as one data group, a plurality of data groups acquired at different timings is used as learning data, and N combinations among the plurality of items are included in the learning data from the measurement data. Determining an N-dimensional probability density, determining the N-dimensional probability density for the plurality of combinations, and generating a learning model;
Obtaining a probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model, and calculating an abnormality score based on the probability;
Calculating a score of the data group based on the abnormality score relating to a plurality of combinations of the items, and detecting an abnormality of the observation target based on the score of the data group;
An abnormality detection program that causes a computer to execute.

Images