JP2020098373A - Abnormality detection device and program and method for the same - Google Patents

Abstract

To provide an abnormality detection device which can find where and in what time zone an event contributing to an abnormality occurred.SOLUTION: An abnormality detection device generates a failure sign model for a normal data constellation of teacher data; derives a threshold value for abnormality detection by calculating a first abnormality score from the teacher data; generates a first regression model whose explanatory variable is an abnormal data constellation of teacher data and whose objective variable is the first abnormality score about the abnormal data constellation and calculates a first abnormality contribution; calculates a second abnormality score for the failure sign model of actual measurement data outputted from plural respective sensors installed in plural positions of monitoring objects; using the threshold value for abnormality detection, gets a new second abnormality score of the actual measurement data in an abnormal section where the new second abnormal scores among the actual measurement data are equal to or more than the threshold value; generates a second regression model whose explanatory variable is the actual measurement data in the abnormal section and whose objective variable is the new second abnormal score about the actual measurement data in the abnormal section; and calculates a second abnormality contribution by the detection data of the plural sensors from the second regression model.SELECTED DRAWING: Figure 7

Description

The present invention relates to an abnormality detection device, an abnormality detection program, and an abnormality detection method.

Conventionally, acquisition means for acquiring time-series data of an objective variable representing the result of an event from factor analysis data, and time-series data of an explanatory variable representing a factor of an event, and a plurality of acquisition units based on the time-series data of the objective variable. There is a reference value setting means for setting the reference value of the objective variable of 1. The plurality of objective variable reference values that have been set and time series data of the acquired explanatory variables are learned, and a relational expression between the objective variable reference value and the explanatory variable is generated for each objective variable reference value. Then, among the generated relational expressions, a coefficient of the explanatory variable, and an influence degree calculating unit that extracts the explanatory variable corresponding to the coefficient, and the extracted coefficient is output as an influence degree. An output unit that outputs the explanatory variable name related to the extracted explanatory variable is further included (see, for example, Patent Document 1).

International publication 2016/079972

By the way, the conventional factor analysis device does not distinguish whether the object represented by the explanatory variable name is in a normal state or an abnormal state. Further, it does not disclose obtaining the degree to which the object represented by the explanatory variable name contributes to the abnormal state in the abnormal state.

Therefore, it is an object of the present invention to provide an abnormality detection device, an abnormality detection program, and an abnormality detection method capable of grasping a place and a time zone in which an event contributing to abnormality occurs.

The abnormality detection device according to the embodiment of the present invention, a normal data group of the normal data group and the abnormal data group representing a normal and abnormal events in a plurality of locations of the monitored object respectively in a time series of normal data group of the teacher data. A predictive model generator that generates a failure predictive model that represents a normal distribution, a first abnormality score calculator that calculates a first abnormality score from the teacher data, and a threshold for abnormality detection based on the first abnormality score. A threshold value derivation unit, a first regression model generation unit that generates a first regression model in which the abnormal data group of the teacher data is an explanatory variable, and the first abnormal score of the abnormal data group is an objective variable; A first contribution degree calculation unit that calculates a first abnormal contribution degree of an event at the plurality of locations from one regression model, and the measurement data output from a plurality of sensors provided at the plurality of locations of the monitored object, respectively. A second anomaly score for the failure sign model is calculated, and a second anomaly score of the actual measurement data of the abnormal section in which the second anomaly score is equal to or higher than the threshold value is calculated using the anomaly detection threshold value; 2 an abnormality score calculation unit, a second regression model generation unit that generates a second regression model that uses the actual measurement data of the abnormal section as an explanatory variable and the second abnormality score of the actual measurement data of the abnormal section as an objective variable,
And a second contribution calculating unit that calculates a second abnormality contribution of the detection data of the plurality of sensors from the second regression model.

It is possible to provide an abnormality detection device, an abnormality detection program, and an abnormality detection method capable of grasping the place and time zone where an event contributing to abnormality has occurred.

It is a figure which shows the abnormality detection apparatus 100 of embodiment. 2 is a perspective view of a computer system 20 that realizes the abnormality detection device 100. FIG. 3 is a block diagram illustrating a configuration of a main part in a main body 21 of the computer system 20. FIG. It is a figure which shows the structure of the abnormality detection apparatus 100. It is a figure which shows the failure predictive model which the predictive model production|generation part 112 produces|generates. It is a figure which shows the regression model using a some decision tree, and the relationship of the explanatory variable x and the objective variable y. It is a figure which shows the temperature data and abnormality score acquired by six sensors 50. It is a figure which shows the correlation of the estimated value and true value of the random forest regression model which the regression model generation part 115 produces. It is a figure which shows the abnormal contribution degree calculated|required about the normal area and the sign area of the temperature data of sensors 1-6. 3 is a diagram showing a flowchart executed by a control device 110 of the abnormality detection device 100. FIG. It is a figure which shows the relationship between a failure sign model and test data, and an abnormality score.

Hereinafter, an embodiment to which the abnormality detection device, the abnormality detection program, and the abnormality detection method of the present invention are applied will be described.

<Embodiment>
FIG. 1 is a diagram showing an abnormality detection device 100 according to an embodiment. A plurality of sensors 50 are connected to the abnormality detection device 100. The plurality of sensors 50 are, for example, provided along the optical fiber cable 10 and are temperature sensors that detect the temperature of the optical fiber cable 10. Data representing the temperature detected by the sensor 50 (temperature data) is input to the abnormality detection device 100. A time stamp is added to the temperature data acquired by the sensor 50. That is, the temperature data is associated with time data representing the detected time.

The abnormality detection device 100 detects, based on the temperature data input from the plurality of sensors 50, which of the plurality of sensors 50 the temperature data detected by the sensor 50 is abnormal. The optical fiber cable 10 provided with the plurality of sensors 50 is an example of an object to be monitored by the abnormality detection device 100.

FIG. 2 is a perspective view of a computer system 20 that realizes the abnormality detection device 100. The computer system 20 shown in FIG. 2 includes a main body 21, a display 22, a keyboard 23, a mouse 24, and a modem 25.

The main body 21 includes a CPU (Central Processing Unit), a HDD (Hard Disk Drive), a disk drive, and the like. The display 22 displays processing results and the like on the screen 22A according to an instruction from the main body 21. The display 22 may be, for example, a liquid crystal monitor. The keyboard 23 is an input unit for inputting various information to the computer system 20. The mouse 24 is an input unit for designating an arbitrary position on the screen 22A of the display 22. The modem 25 accesses an external database or the like to download a program or the like stored in another computer system.

The program that causes the computer system 20 to function as the abnormality detection device 100 is stored in a portable recording medium such as a disk 27 or downloaded from a recording medium 26 of another computer system using a communication device such as a modem 25. And is input to the computer system 20 to be compiled.

A program (abnormality detection program) that causes the computer system 20 to function as the abnormality detection device 100 causes the computer system 20 to operate as the abnormality detection device 100. This program may be stored in a computer-readable recording medium such as the disk 27, for example. The computer-readable recording medium is limited to a portable recording medium such as a disk 27, an IC card memory, a magnetic disk such as a floppy (registered trademark) disk, a magneto-optical disk, a CD-ROM, a USB (Universal Serial Bus) memory, or the like. Not something. The computer-readable recording medium includes various recording media accessible by a computer system connected via a communication device such as a modem 25 or a LAN.

FIG. 3 is a block diagram illustrating a configuration of a main part in the main body 21 of the computer system 20. The main body 21 includes a CPU 31 connected by a bus 30, a memory 32 including a RAM or a ROM, a disk drive 33 for the disk 27, and a hard disk drive (HDD) 34.

The computer system 20 is not limited to the configuration shown in FIGS. 2 and 3, and various well-known elements may be added or alternatively used.

FIG. 4 is a diagram showing the configuration of the abnormality detection device 100. The abnormality detection device 100 includes a control device 110, an operation unit 120, and a display unit 130.

The control device 110 includes a main control unit 111, a predictive model generation unit 112, an abnormality score calculation unit 113, a threshold derivation unit 114, a regression model generation unit 115, a contribution degree calculation unit 116, and a memory 117.

The main control unit 111, the predictive model generation unit 112, the abnormality score calculation unit 113, the threshold value derivation unit 114, the regression model generation unit 115, and the contribution degree calculation unit 116 represent the functions realized by the computer that realizes the control device 110. The memory 117 is a functional representation of the memory of the computer that implements the control device 110.

The main control unit 111 is a processing unit that controls the control device 110, and is other than the processes executed by the predictive model generation unit 112, the abnormality score calculation unit 113, the threshold derivation unit 114, the regression model generation unit 115, and the contribution degree calculation unit 116. The process of is executed. The specific processing performed by the main control unit 111 will be described later with reference to the flowchart of FIG.

The predictive model generation unit 112 generates a predictive failure model that represents a normal distribution of normal data groups in the teacher data that represents the temperature data detected by the plurality of sensors 50 of the optical fiber cable 10 in time series. The failure sign model is a model used to detect (analyze) a sign of failure of the optical fiber cable 10. The normal data group is a set of normal data, and is a data set (data group) of normal data.

The teacher data includes normal temperature data and abnormal temperature data. Normal temperature data is an example of normal data, and abnormal temperature data is an example of abnormal data. The teacher data only needs to specify the sensor 50 in which the normal temperature data and the abnormal temperature data have been detected, may be actual measurement data (actual measurement value) of the sensor 50, or is artificially created data. May be. The abnormal temperature data is temperature data whose temperature value is larger than a predetermined value. For example, the predetermined value may be set to the lower limit value of the abnormal temperature of the optical fiber cable 10.

The abnormality score calculation unit 113 calculates an abnormality score from the teacher data. Further, the abnormality score calculation unit 113 calculates an abnormality score for the failure sign model of the actually measured temperature data output from the plurality of sensors 50 provided in the optical fiber cable 10, and detects the abnormality detected by the threshold value deriving unit 114. Using the threshold value, the abnormality score of the actual measurement data of the abnormal section in which the abnormality score is equal to or higher than the threshold value is obtained from the measured temperature data. The abnormal section is a period (time zone) in which the temperature data is abnormal. The abnormality score calculation unit 113 is an example of a first abnormality score calculation unit and a second abnormality score calculation unit.

The threshold derivation unit 114 derives an abnormality detection threshold based on the abnormality score calculated by the abnormality score calculation unit 113.

The regression model generation unit 115 generates a random forest regression model in which the abnormal data group of the teacher data is the explanatory variable and the abnormal score of the abnormal data group is the objective variable. Further, the regression model generation unit 115 generates a random forest regression model in which the actual measurement data of the abnormal section is the explanatory variable and the abnormality score of the actual measurement data of the abnormal section is the objective variable. The regression model generation unit 115 is an example of a first regression model generation unit and a second regression model generation unit. The random forest regression model is a non-linear regression model.

The contribution calculating unit 116 calculates the abnormal contribution of the temperature data acquired by the plurality of sensors 50 from the random forest regression model based on the teacher data. Further, the contribution degree calculation unit 116 calculates the abnormality contribution degree of the temperature data acquired by the plurality of sensors 50 from the random forest regression model based on the actual measurement data. The contribution degree calculation unit 116 is an example of a first contribution degree calculation unit and a second contribution degree calculation unit.

The anomalous contribution rate based on the teacher data is the degree of contribution of the temperature data acquired by each of the plurality of sensors 50 to the generation of the anomaly data, and the anomaly contribution rate based on the actual measurement data is acquired by each of the plurality of sensors 50. It is the degree of contribution that the temperature data made gives to the occurrence of abnormal data.

The degree of abnormality contribution based on the teacher data and the degree of abnormality contribution based on the actual measurement data are reduction rates of the Gini coefficient. Therefore, the anomalous contribution rate based on the teacher data and the anomalous contribution rate based on the actual measurement data are calculated based on the reduction degree of the data non-uniformity obtained from the random forest regression model based on the teacher data and the random forest regression model based on the teacher data, respectively. Is.

The Gini coefficient takes a larger value as the data is more uneven. Therefore, the anomalous contribution rate based on the teacher data of the temperature data and the anomalous contribution rate based on the actual measurement data represented by the reduction rate of the Gini coefficient represent the degree to which certain temperature data contributes to the generation of abnormal temperature data.

The memory 117 stores programs, data, and the like necessary for processing executed by the control device 110, and also stores temperature data received from the sensor 50. The memory 118 also stores other data necessary for the abnormality detection device 100 to perform processing.

The operation unit 120 is, for example, a keyboard and a mouse. The display unit 130 is, for example, a display panel or the like.

Next, the failure predictive model generated by the predictive model generator 112 will be described. FIG. 5 is a diagram showing a failure predictive model generated by the predictive model generator 112. In FIG. 5, each data of the normal data group of the teacher data that represents the temperature data detected by the plurality of sensors 50 of the optical fiber cable 10 (see FIG. 1) in time series is indicated by an X mark.

Since the failure sign model represents the normal distribution of the normal data group in such teacher data, the ellipse shown by the dotted line in FIG. 5 is a contour line where the probability density of the normal distribution is constant. Further, here, the horizontal axis is the sensor 1 and the vertical axis is the sensor 2, which is shown by a two-dimensional plane.

Here, the failure sign model p(x|μ, Σ) that represents the normal distribution of the normal data group of the teacher data with respect to the data group x and the average μ can be expressed by the following equation (1). N(x|μ, Σ) on the right side represents the normal distribution.

Further, as the distance from the center of the normal distribution approaches an abnormal value instead of a normal value, the distance from the center of the normal distribution is treated as an abnormal score here. The abnormality score a(x) can be expressed by the following equation (2).

Further, in order to determine whether or not the abnormality score represents abnormality using the threshold value, the following equation (3) may be used.

Next, a method of calculating the regression coefficient of the random forest regression model will be described. The regression coefficient of the random forest regression model is the degree of abnormal contribution.

A general linear regression model y is represented by the following equation (4).

Here, the data X, the weight w, and the result Y are set as follows.

y is the result obtained from the data X. X is an M×N matrix. w is an M-dimensional vector. Further, the element X _j of X is an N-dimensional vector. Let y also be an N-dimensional vector. This means that X and y include N data groups. If this is expressed as a matrix, the following expression (6) is obtained.

Here, if X ₀ =1, X ₁ =x, X ₂ =x ^2, ..., The linear regression model y can be represented by the polynomial regression model of the following equation (7). Here, the bold 1 represents a vector in which all the elements are 1.

Next, the regression coefficient is calculated. When N data groups are prepared, they are not expressed as equal signs in reality as in Expression (4), but are represented by approximate expressions as in Expression (8) below.

Therefore, the problem of finding an estimated value of w (w hat) such that y and w ^T are most equal is solved. When this “being equal to” is expressed by a mathematical expression, it is synonymous with minimizing the square sum error function (least square method) as shown in the following expression (9).

Minimizing means that the equation (9) is differentiated by w and the point where it becomes 0 is the minimum, so if it is differentiated and rearranged as 0, the regression coefficient (partial regression coefficient) is calculated as the following equation (10). it can.

In the case of a polynomial, the elements of the polynomial may be substituted for X as appropriate. This regression coefficient is defined as the degree of abnormal contribution here. The degree of abnormality contribution may be regarded as the degree of importance.

Next, the random forest regression will be described with reference to FIG. FIG. 6 is a diagram showing a regression model using a plurality of decision trees and the relationship between the explanatory variable x and the objective variable y.

Random forest regression is a method of creating a regression model using multiple decision trees. Here, the decision tree refers to a model in which the value of the explanatory variable x is branched and the target variable y is estimated as shown in FIG. 6(A). As a result, the regression model shown by the dotted line in FIG. 6B is obtained.

In random forest regression, a sub-data group is randomly acquired from the data group of the teacher data, and a decision tree is created for each sub-data group. At this time, there are as many decision trees as there are sub-data groups. Then, although the regression model shown by the dotted line in FIG. 6B can be obtained by the number of decision trees, a more accurate regression model can be created by obtaining the average value of the output results of a plurality of decision trees. .. This is one of the characteristics of random forest regression.

One of the important points about the decision tree (regression tree) here is that you can create a complex tree by increasing the number of branches. Here, a branch is a Yes-No branch, and as this number increases, the tree becomes complicated, and as a result, the regression model in FIG. 6B can be made more complicated and have high expressive power.

On the other hand, the more complex and expressive the result, the more the regression model that fits the data used for the decision tree (regression tree) will be created (this is called overlearning). Then, there is a possibility that the created decision tree (regression tree) does not match the newly obtained data. In other words, if the data is overly complex and has high expressiveness, the performance may deteriorate for unknown data. Therefore, it is necessary to adjust the degree of expression ability, and it is necessary to adjust the expression ability using a certain criterion (division criterion) and select the highest performance decision tree (regression tree). As a statistic that serves as a reference, a reduction rate of the Gini coefficient (Gini impurity, impurity) is often used.

The definition equation of the Gini coefficient is shown in the following equation (11).

Here, C is the number of categories (classification), N is the number of teacher data, n _i is the number of teacher data belonging to category i, and t is a node. A node is a node of a decision tree (regression tree), which is a part for determining whether a certain condition is Yes or No (see FIG. 6A).

The meaning of Expression (11) represents how many categories are included in a certain node t (called impure). If there are a large number of categories, the purity is high, and if there are few categories, the purity is low. If the impurity is low, the Gini coefficient G(t) approaches 0, and if the impurity is high, the Gini coefficient G(t) approaches 1. For example, when n _i =N, the Gini coefficient G(t) is 0, which means that there are only i categories and there is no impurity. An index similar to this is entropy.

The reduction rate of the Gini coefficient is expressed by the following equation (12).

Where G(t _B ) is the Gini coefficient of the node t _B before the branch, G(t _L ) is the Gini coefficient of the left node after the branch, and G(t _R ) is the Gini coefficient of the right node after the branch. .. w _L and w _R Represents the weight of the node after branching (ratio of data amount before branching). Expression (12) calculates the difference between the Gini coefficient before branching and the sum of the Gini coefficients of the left and right nodes after branching. Therefore, since the expression (12) becomes large if the impurity at the time of branching is low, the meaning of the expression (12) represents the reduction rate of the impurity, and whether the data is successfully divided (classified into categories). It is an index that shows whether or not. By using this index, it is possible to search for a group that reduces the impurity to the maximum extent and to quantitatively search for the optimal division.

Then, the importance (contribution) of the variable can be known by using the reduction rate of the Gini coefficient. When there are a plurality of variables, it is possible to calculate how much the impurity is reduced by dividing the variable by using Expression (12). Therefore, the degree of importance (contribution) of a variable can be expressed by the degree of reduction rate of the Gini coefficient (impurity) with respect to the variable.

FIG. 7 is a diagram showing temperature data and abnormality scores acquired by the six sensors 50. Here, the six sensors 50 are distinguished as the sensors 1 to 6. In FIG. 7A, the horizontal axis represents time and the vertical axis represents temperature (no unit).

FIG. 7A shows how the temperature data acquired by the sensors 1 to 6 changes in time series. The plurality of temperature data acquired in time series by each of the sensors 1 to 6 is a data group of temperature data. The normal section is a section in which no abnormality has occurred, and is a period (time zone) in which no abnormality has occurred. The sign section is a section in which a sign of failure has occurred, and the sign is generated in the sensors 3 and 4 so as to be surrounded by a broken line circle.

The predictive section is, for example, a section in which the range of temperature fluctuation is twice or more the normal section. There is an interval between the normal section and the predictive section. Note that a failure section in which a failure occurs may follow the predictive section. Here, the abnormality is a concept including a sign of failure and a failure.

FIG. 7B shows an abnormality score obtained from the temperature data from the beginning of the normal section of the sensor 3 to the end of the precursor section. The abnormality score is obtained by the abnormality score calculation unit 113. It can be seen that the abnormality score in the sign segment is higher than the abnormality score in the normal segment.

FIG. 8 is a diagram showing the correlation between the estimated value and the true value of the random forest regression model created by the regression model generation unit 115.

The regression model generation unit 115 uses the abnormal data group of the teacher data as an explanatory variable, the random forest regression model having the abnormal score of the abnormal data group as an objective variable, and the actual measurement data of the abnormal section as the explanatory variable, and measures the abnormal section. A random forest regression model in which the anomaly score for the data is used as the objective variable is generated, but here, for the sake of explanation, the estimated value of the random forest regression model created for the normal interval and the predictive interval in FIG. 7A. The correlation between and the true value will be described.

FIG. 8A is a diagram showing an estimated value (horizontal axis) and a true value (vertical axis) obtained by a random forest regression model created for time-series temperature data in a normal section. The R2 score is 0.95, which shows that the correlation is high.

FIG. 8B is a diagram showing an estimated value (horizontal axis) and a true value (vertical axis) obtained by the random forest regression model created for the time series temperature data of the predictive section. The R2 score is 0.97, which shows that the correlation is high.

FIG. 9 is a diagram showing the degree of abnormality contribution obtained for the normal section and the sign section of the temperature data of the sensors 1 to 6. The hatched bar graphs represent the anomalous contributions calculated for the temperature data in the normal sections of the sensors 1 to 6, and the open bar graphs represent the anomalous contributions found in the temperature data of the sensors 1 to 6 in the abnormal sections.

The abnormality contribution obtained for the temperature data of the normal section is an abnormality obtained from the temperature data of the normal section of each of the sensors 1 to 6 using the temperature data of each of the sensors 1 to 6 shown in FIG. 7 as explanatory variables. It is calculated from a random forest regression model in which the score is the objective variable.

The abnormality contribution obtained for the temperature data of the abnormal section is an abnormality obtained from the temperature data of each abnormal section of the sensors 1 to 6 using the temperature data of each abnormal section of the sensors 1 to 6 shown in FIG. 7 as an explanatory variable. It is calculated from a random forest regression model in which the score is the objective variable.

The abnormal contributions in the normal section are not significantly different between the sensors 1 to 6, but the abnormal contributions in the abnormal section are larger in the sensors 3 and 4 than in the sensors 1, 2, 5, and 6. From this, the sensor (here, the sensors 3 and 4) that has acquired the abnormal temperature data can be specified by using the abnormality contribution rate obtained for the abnormal section as described above. Since the time data is associated with the temperature data, it is possible to detect which sensor has detected an abnormal temperature and when.

FIG. 10 is a diagram showing a flowchart executed by the control device 110 of the abnormality detection device 100. The flowchart shown in FIG. 10 is realized by executing the abnormality detection program according to the embodiment. Further, by executing the abnormality detection program of the embodiment, the abnormality detection method of the embodiment is realized. Note that FIG. 11 is used in the description of step S12. FIG. 11 is a diagram showing the relationship between the failure sign model and the test data and the abnormality score.

When the flow starts, the main control unit 111 acquires the teacher data X (step S1). The teacher data X is an M-dimensional×N-dimensional matrix, which is a set of multidimensional vectors. M and N are arbitrary integers of 2 or more.

The teacher data X includes a plurality (K) of normal data groups X ₁ ^{ok to} X _K ^ok and a plurality of abnormal data groups X _K+1 ^{ng to} X _N ^ng . The normal data group X ₁ ^{ok to} X _K ^ok and the abnormal data group X _K+1 ^{ng to} X _N ^ng are time-sequential like the temperature data acquired by each of the sensors 1 to 6 shown in FIG. It includes a plurality of data groups arranged in. As described above, the normal data group X ₁ ^{ok to} X _K ^ok and the abnormal data group X _K+1 ^{ng to} X _N ^ng are each a set of multidimensional vectors.

The predictive model generation unit 112 extracts the normal data group X _i ^ok from the teacher data X and generates a failure predictive model representing the normal distribution of the normal data group X _i ^ok based on the equation (1) (step S2). In the normal data group X _i ^ok used for generating the failure sign model in step S2, i is one of 1 to K. In the process of step S2, data of normal distribution as shown in FIG. 5 is generated.

The abnormality score calculation unit 113 sets the equation (2) for calculating the abnormality score a (step S3). More specifically, the abnormality score calculation unit 113 reads out the data representing the equation (2) from the memory 117.

Anomaly score calculation unit 113, the teacher of the data X, and a sign of failure model normal data group generated the X _i ^ok other K-1 pieces of normal data group X _i ^ok in step S2, all contained in the training data X An abnormality score is calculated for the plurality of abnormal data groups X _K+1 ^{ng to} X _N ^ng (step S4). The abnormality score is calculated for each data group.

The threshold derivation unit 114 derives an abnormality detection threshold based on the abnormality score calculated in step S4 (step S5). The threshold has a value of a predetermined level of the abnormality score, and the abnormality score calculated from the K−1 normal data group X _i ^ok and the abnormality calculated from the abnormal data group X _K+1 ^{ng to} X _N ^ng It is set to the optimum value that separates from the score. While changing the threshold value, K-1 abnormal scores calculated from the K-1 normal data group X _i ^ok and a plurality of abnormalities calculated from the abnormal data group X _K+1 ^{ng to} X _N ^ng. An optimal threshold is derived that separates the scores from. The threshold is set to one optimal value.

The abnormality score calculation unit 113 calculates an abnormality score for each of the abnormality data groups X _K+1 ^{ng to} X _N ^ng (step S6). The abnormality score calculated for each of the abnormal data groups X _K+1 ^{ng to} X _N ^ng in step S6 is the same as the abnormality score calculated for each of the abnormal data groups X _K+1 ^{ng to} X _N ^ng in step S4. Has a value. Therefore, the abnormality score calculated in step S4 for each of the abnormality data groups X _K+1 ^{ng to} X _N ^ng may be acquired without calculating the abnormality score in step S6.

The regression model generation unit 115 sets each of the abnormal data groups X _K+1 ^{ng to} X _N ^ng as an explanatory variable, and sets each of the abnormal scores calculated for the abnormal data groups X _K+1 ^{ng to} X _N ^ng in step S5. A random forest regression model as an objective variable is generated (step S7). The objective variable corresponding to the abnormal data group X _K+1 ^{ng to} X _N ^ng which is an explanatory variable is the abnormal score calculated for each of the abnormal data group X _K+1 ^{ng to} X _N ^ng .

The contribution calculating unit 116 calculates the abnormal contribution based on the equation (10) from each random forest regression model generated in step S6 (step S8). Through the above processing, a random forest regression model is generated for the abnormal data group X _K+1 ^{ng to} X _N ^ng , and the processing for calculating the abnormal contribution rate ends (END).

Next, a description will be given of the process of obtaining the abnormality contribution rate for the test data Y including the temperature data actually acquired from the sensor 50. The test data Y includes temperature data of actual measurement values detected by the sensor 50.

When the flow starts, the main control unit 111 acquires the test data Y (step S11). Like the teacher data X, the test data Y is an M-dimensional×N-dimensional matrix and is a set of multidimensional vectors. M and N are arbitrary integers of 2 or more. The test data Y and the teacher data X may have different values of M and N.

The abnormality score calculation unit 113 applies the plurality of temperature data included in one of the plurality of data groups included in the test data Y to the failure sign model obtained in step S2 to calculate the abnormality score of each temperature data. Then, it is determined whether the temperature data is normal or abnormal by using the threshold value derived in step S5 (step S12).

In step S12, as shown in FIG. 11, the temperature data is fitted to the failure sign model obtained in step S2. In FIG. 11, each data of the normal data group shown by X in FIG. 5 is omitted, and only the contour lines are shown. In addition, in FIG. 11, one of the plurality of temperature data included in one of the plurality of data groups included in the test data Y is indicated by an X mark. As shown in FIG. 11, the data located outside the outermost contour line of the three contour lines is abnormal temperature data.

The process of step S12 is performed for all the data groups included in the test data Y by extracting a plurality of data groups included in the test data Y one by one.

The abnormality score calculation unit 113 specifies a section including abnormal temperature data included in a plurality of data groups included in the test data Y based on the processing result of step S12, and detects an abnormality in the temperature data included in the specified section. A score is calculated (step S13). Specifying the section including the abnormal temperature data included in the plurality of data groups included in the test data Y means, for example, specifying the predictive section of the sensors 3 and 4 in FIG. 7A. Since the temperature data is associated with the time data representing the time detected by the sensor (any of 1 to 6), the section specified in step S13 depends on which sensor (any of 1 to 6). , I know when it was detected.

The regression model generation unit 115 sets the abnormal temperature data (abnormal temperature data group) included in the section identified in step S13 as an explanatory variable, and sets the abnormality score calculated for the section identified in step S13 as an objective variable. A random forest regression model is generated (step S14). When there are a plurality of sections identified in step S13, the regression model generation unit 115 generates a random forest regression model for each of the plurality of sections.

The contribution calculating unit 116 calculates the abnormal contribution based on the equation (10) from each random forest regression model generated in step S14 (step S15). Through the above processing, the random forest regression model is generated for the section specified in step S13 (section including abnormal temperature data), and the abnormality contribution rate is calculated. This means that, for example, as shown by the white bar graphs shown for the sensors 1 to 6 in FIG. 9, the distribution of the abnormal contribution degree in the specified section can be known.

As described above, according to the embodiment, the test data Y including the temperature data of the actual measurement value detected by the sensor 50 is applied to the failure sign model representing the normal distribution of the normal data of the teacher data to obtain the teacher data. A section in which an abnormality has occurred is detected by using a threshold that separates the abnormality score of the normal data and the abnormality score of the abnormal data obtained from the above.

Then, a random forest in which the data (data group) included in the section in which the abnormality has occurred is the explanatory variable, and the anomaly score calculated for the data (data group) included in the section in which the abnormality has occurred is the target variable A regression model is generated and the abnormal contribution of each section is calculated.

Therefore, it is possible to understand in which section of the temperature data acquired by which of the plurality of sensors 50 the event contributing to the abnormality has occurred. This abnormality is, for example, a sign of failure.

Therefore, it is possible to provide the abnormality detection device 100 capable of grasping the place (any one of the plurality of sensors 50) where the event contributing to the abnormality has occurred and the time zone in which the event contributing to the abnormality has occurred.

In addition, although the form which uses the random forest regression model which is a nonlinear regression model was demonstrated above, you may use a linear regression model. A linear regression model, a ridge regression model, or a Lasso regression model may be used as the linear regression model. Further, in these cases, the abnormality contribution may be obtained as a weighted regression coefficient.

Although the abnormality detection device, the abnormality detection program, and the abnormality detection method according to the exemplary embodiment of the present invention have been described above, the present invention is not limited to the specifically disclosed embodiments. Various modifications and changes can be made without departing from the scope of the claims.

The following supplementary notes will be disclosed regarding the above-described embodiment.
(Appendix 1)
A predictive model that generates a failure predictive model that represents the normal distribution of normal data groups in the teacher data that includes normal data groups and abnormal data groups that represent normal and abnormal events at multiple locations of the monitored object, respectively. A generator,
A first abnormality score calculator that calculates a first abnormality score from the teacher data;
A threshold derivation unit that derives a threshold for abnormality detection based on the first abnormality score;
A first regression model generation unit that generates a first regression model in which the abnormal data group of the teacher data is an explanatory variable and the first abnormality score for the abnormal data group is an objective variable;
A first contribution calculating unit that calculates a first abnormal contribution of an event at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the second abnormality score is used by using the abnormality detection threshold value. A second abnormality score calculation unit that obtains a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
A second regression model generation unit that generates a second regression model in which the actual measurement data of the abnormal section is an explanatory variable and the second abnormality score of the actual measurement data of the abnormal section is an objective variable;
A second contribution degree calculation unit that calculates a second abnormality contribution degree of the detection data of the plurality of sensors from the second regression model.
(Appendix 2)
The first abnormality contribution rate is a contribution rate that a predetermined event of the monitoring target in each of the plurality of places gives to the occurrence of the abnormality data group,
2. The abnormality detection device according to appendix 1, wherein the second abnormality contribution rate is a contribution rate that each detection data of the plurality of sensors gives to the generation of the abnormality data group.
(Appendix 3)
Anomaly detection according to appendix 1 or 2, wherein the first anomalous contribution rate and the second anomalous contribution rate are reduction degrees of unevenness of data obtained from the first regression model and the second regression model, respectively. apparatus.
(Appendix 4)
4. The abnormality detection device according to any one of appendices 1 to 3, wherein the first regression model and the second regression model are linear regression models or non-linear regression models.
(Appendix 5)
The linear regression model is any one of a linear regression model, a ridge regression model, and a Lasso regression model,
The abnormality detection device according to attachment 4, wherein the first abnormality contribution rate and the second abnormality contribution rate are weighted regression coefficients.
(Appendix 6)
The non-linear regression model is a random forest regression model,
5. The abnormality detection device according to attachment 4, wherein the first abnormality contribution rate and the second abnormality contribution rate are reduction rates of Gini coefficients.
(Appendix 7)
Generating a failure sign model representing a normal distribution of a normal data group of teacher data including a normal data group and an abnormal data group that respectively represent normal and abnormal events at a plurality of locations of a monitoring target in time series; ,
Calculating a first abnormality score from the teacher data,
Deriving a threshold for abnormality detection based on the first abnormality score;
Generating a first regression model having an abnormal data group of the teacher data as an explanatory variable and the first abnormal score for the abnormal data group as an objective variable;
Calculating a first anomalous contribution rate of events at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the second abnormality score is used by using the abnormality detection threshold value. Obtaining a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
Generating a second regression model having the measured data of the abnormal section as an explanatory variable and the second abnormal score of the measured data of the abnormal section as an objective variable;
An anomaly detection program that causes a computer to execute a process including: calculating a second anomalous contribution degree of detection data of the plurality of sensors from the second regression model.
(Appendix 8)
Generating a failure sign model representing a normal distribution of a normal data group of teacher data including a normal data group and an abnormal data group that respectively represent normal and abnormal events at a plurality of locations of a monitoring target in time series; ,
Calculating a first abnormality score from the teacher data,
Deriving a threshold for abnormality detection based on the first abnormality score;
Generating a first regression model having an abnormal data group of the teacher data as an explanatory variable and the first abnormal score for the abnormal data group as an objective variable;
Calculating a first anomalous contribution rate of events at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the abnormality detection threshold is used to calculate the second of the actual measurement data. Obtaining a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
Generating a second regression model using the actual measurement data of the abnormal section as an explanatory variable and the second abnormality score of the actual measurement data of the abnormal section as an objective variable;
Calculating a second degree of abnormality contribution of detection data of the plurality of sensors from the second regression model.

10 Optical Fiber Cable 50 Sensor 100 Abnormality Detection Device 110 Control Device 111 Main Control Unit 112 Predictive Model Generation Unit 113 Abnormality Score Calculation Unit 114 Threshold Derivation Unit 115 Regression Model Generation Unit 116 Contribution Calculation Unit 117 Memory 120 Operation Unit 130 Display Unit

Claims (8)

A predictive model that generates a failure predictive model that represents the normal distribution of normal data groups in the teacher data that includes normal data groups and abnormal data groups that represent normal and abnormal events at multiple locations of the monitored object, respectively. A generator,
A first abnormality score calculator that calculates a first abnormality score from the teacher data;
A threshold derivation unit that derives a threshold for abnormality detection based on the first abnormality score;
A first regression model generation unit that generates a first regression model in which the abnormal data group of the teacher data is an explanatory variable and the first abnormality score for the abnormal data group is an objective variable;
A first contribution calculating unit that calculates a first abnormal contribution of an event at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the second abnormality score is used by using the abnormality detection threshold value. A second abnormality score calculation unit that obtains a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
A second regression model generation unit that generates a second regression model in which the actual measurement data of the abnormal section is an explanatory variable and the second abnormality score of the actual measurement data of the abnormal section is an objective variable;
A second contribution degree calculation unit that calculates a second abnormality contribution degree of the detection data of the plurality of sensors from the second regression model. The first abnormality contribution rate is a contribution rate that a predetermined event of the monitoring target in each of the plurality of places gives to the occurrence of the abnormality data group,
The abnormality detection device according to claim 1, wherein the second abnormality contribution rate is a contribution rate that the detection data of each of the plurality of sensors contributes to the generation of the abnormality data group. The abnormality according to claim 1 or 2, wherein the first abnormality contribution rate and the second abnormality contribution rate are reduction degrees of inequality of data obtained from the first regression model and the second regression model, respectively. Detection device. The abnormality detection device according to any one of claims 1 to 3, wherein the first regression model and the second regression model are linear regression models or non-linear regression models. The linear regression model is any one of a linear regression model, a ridge regression model, and a Lasso regression model,
The abnormality detection device according to claim 4, wherein the first abnormality contribution rate and the second abnormality contribution rate are weighted regression coefficients. The non-linear regression model is a random forest regression model,
The abnormality detection device according to claim 4, wherein the first abnormality contribution rate and the second abnormality contribution rate are reduction rates of Gini coefficients. Generating a failure sign model representing a normal distribution of a normal data group of teacher data including a normal data group and an abnormal data group that respectively represent normal and abnormal events at a plurality of locations of a monitoring target in time series; ,
Calculating a first abnormality score from the teacher data,
Deriving a threshold for abnormality detection based on the first abnormality score;
Generating a first regression model having an abnormal data group of the teacher data as an explanatory variable and the first abnormal score for the abnormal data group as an objective variable;
Calculating a first anomalous contribution rate of events at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the second abnormality score is used by using the abnormality detection threshold value. Obtaining a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
Generating a second regression model having the measured data of the abnormal section as an explanatory variable and the second abnormal score of the measured data of the abnormal section as an objective variable;
An anomaly detection program that causes a computer to execute a process including: calculating a second anomalous contribution degree of detection data of the plurality of sensors from the second regression model. Generating a failure sign model representing a normal distribution of a normal data group of teacher data including a normal data group and an abnormal data group that respectively represent normal and abnormal events at a plurality of locations of a monitoring target in time series; ,
Calculating a first abnormality score from the teacher data,
Deriving a threshold for abnormality detection based on the first abnormality score;
Generating a first regression model having an abnormal data group of the teacher data as an explanatory variable and the first abnormal score for the abnormal data group as an objective variable;
Calculating a first anomalous contribution rate of events at the plurality of locations from the first regression model;
A second abnormality score of the actual measurement data output from a plurality of sensors respectively provided at a plurality of locations of the monitoring target with respect to the failure sign model is calculated, and the second abnormality score is used by using the abnormality detection threshold value. Obtaining a second abnormality score for actual measurement data in an abnormal section in which the second abnormality score is equal to or greater than the threshold value;
Generating a second regression model having the measured data of the abnormal section as an explanatory variable and the second abnormal score of the measured data of the abnormal section as an objective variable;
Calculating a second degree of anomaly contribution of the detection data of the plurality of sensors from the second regression model.

Images