JP6582527B2 - Alarm prediction device, alarm prediction method and program - Google Patents

Description

  The present invention relates to an alarm prediction device, an alarm prediction method, and a program.

  Conventionally, a prediction model has been created to predict the occurrence of an alarm indicating a failure or abnormality based on an event output from a plant, facility, equipment, control device, etc., and the occurrence of an alarm is predicted based on this prediction model The technique to do is known (for example, refer patent document 1).

JP 2011-81697 A

  Here, the prediction model is created based on parameters specified by the user. However, in the above-described conventional technology, the user cannot evaluate the performance (for example, the accuracy of prediction) of the created prediction model in advance. Therefore, the user has evaluated the said prediction model using the actual prediction result by a prediction model.

  The embodiment of the present invention has been made in view of the above points, and an object thereof is to present an evaluation of a created prediction model.

  In order to achieve the above object, an embodiment of the present invention is an alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output from a device or facility, and stores the information in a predetermined storage area according to the time series. Extraction means for extracting, from the plurality of event information stored in advance, a column of first event information that includes prediction target event information indicating the occurrence of an abnormality of the prediction target at the end, and the first extracted by the extraction means A second event information column obtained by removing the prediction target event information from the one event information column is extracted, and a model creating unit that creates a prediction model, and an evaluation value of the model created by the model creating unit are displayed. And display means for displaying on the apparatus.

  According to the embodiment of the present invention, the evaluation of the created prediction model can be presented.

It is a lineblock diagram of an example of the alarm prediction system concerning this embodiment. It is a hardware block diagram of an example of the alarm prediction apparatus which concerns on this embodiment. It is a functional lineblock diagram of an example of an alarm prediction system concerning this embodiment. It is a figure for demonstrating an example which symbolizes an event signal. It is a figure for demonstrating an example of the event stored in the event information storage part. It is a flowchart of an example of preparation of a prediction model and evaluation processing concerning this embodiment (example 1). It is a figure for demonstrating an example of prediction omission and misprediction. (Example 1) which is an image figure of an example of the screen which shows the evaluation result of a prediction model. It is a flowchart of an example of the alarm prediction process which concerns on this embodiment (Example 1). It is a flowchart of an example of preparation of a prediction model and evaluation processing concerning this embodiment (example 2). It is an image figure of an example of the screen which shows the evaluation result of a prediction model (Example 2). 10 is a flowchart of an example of a prediction model creation and evaluation process according to the present embodiment (Example 3). (Example 3) which is an image figure of an example of the screen which shows the evaluation result of a prediction model. It is a flowchart of an example of preparation of a prediction model and evaluation processing concerning this embodiment (example 4). It is a figure of an example for demonstrating clustering. (Example 4) which is an image figure of an example of the screen which shows the evaluation result of a prediction model. It is a flowchart of an example of the alarm prediction process which concerns on this embodiment (Example 4).

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

Example 1
<System configuration>
First, the system configuration of the alarm prediction system 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a configuration diagram of an example of an alarm prediction system according to the present embodiment.

  In an alarm prediction system 1 shown in FIG. 1, an alarm prediction device 10, one or more monitoring devices 20, and one or more device control devices 30 communicate via a network N such as a LAN (Local Area Network). Connected as possible. In addition, one or more devices 40 are connected to the device control device 30.

  The operation of this system includes a “model creation” phase in which a prediction model for predicting the occurrence of an alarm indicating a failure or abnormality of the device 40 is created in advance, a received event signal, and a prediction model created in advance. There is a “prediction” phase for predicting the occurrence of an alarm based on the above. Basically, the “model creation” phase is offline processing, and the “prediction” phase is online processing. Here, the event signal is information indicating the status information of the device 40 and the like transmitted from the device control apparatus 30 when any event occurs in the device 40.

  In the “model creation” phase, the alarm prediction device 10 creates a prediction model from information related to past event signals accumulated, and evaluates the prediction model. In the “prediction” phase, the alarm prediction device 10 predicts the occurrence of an alarm based on the event signal received from the device control device 30 and the prediction model. Note that the alarm prediction device 10 may be configured by one or more computers.

  The monitoring device 20 displays the prediction result received from the alarm prediction device 10 in the “prediction” phase. Thereby, for example, an operator such as a plant can recognize that an alarm may occur based on the prediction result displayed on the monitoring device 20.

  The device control device 30 is a device that controls the device 40. The device control apparatus 30 indicates state information (for example, that a predetermined part of the device 40 is in an operating state) when an event (for example, a state change of the device 40) occurs in the device 40 connected to the device control apparatus 30. Information etc.) is acquired and transmitted to the alarm prediction device 10 as an event signal.

  The device 40 is, for example, a facility such as a gas turbine or a steam turbine, a plant, or the like controlled by the device control device 30.

  In the alarm prediction system 1 according to the present embodiment, a plant, equipment, or the like is assumed as an example of the device 40, but is not limited thereto. That is, the alarm prediction system 1 according to the present embodiment can also be applied to a case where an alarm such as a failure of a network device is predicted using, for example, a router as the device 40 controlled by the device control apparatus 30. Similarly, the present invention can be applied to a case where various electronic devices are used as the device 40 to predict an alarm such as a failure of various electronic devices.

<Hardware configuration>
Next, the hardware configuration of the alarm prediction device 10 according to the present embodiment will be described with reference to FIG. FIG. 2 is a hardware configuration diagram of an example of the alarm prediction device according to the present embodiment.

  The alarm prediction device 10 according to the present embodiment includes an input device 101, a display device 102, an external I / F 103, a RAM (Random Access Memory) 104, and a ROM (Read Only Memory) 105. The alarm prediction device 10 includes a CPU (Central Processing Unit) 106, a communication I / F 107, and a storage device 108. These pieces of hardware are communicably connected via a bus B.

  The input device 101 is a keyboard, a mouse, a touch panel, or the like, for example, and is used by a user to input each operation signal. The display device 102 is an LCD (Liquid Crystal Display), for example, and displays the processing result. The input device 101 and / or the display device 102 may be connected and used when necessary.

  The external I / F 103 is an interface with an external device. The external device includes a recording medium 103a. Thereby, the alarm prediction device 10 can read and / or write the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD, a DVD, an SD memory card, and a USB memory. Note that the recording medium 103a may store a program for realizing the present embodiment.

  The RAM 104 is a nonvolatile semiconductor memory that can retain programs and data even when the power is turned off. The ROM 105 stores programs and data such as BIOS (Basic Input / Output System), OS (Operating System) settings, and network settings that are executed when the alarm prediction device 10 is started.

  The CPU 106 is an arithmetic unit that realizes control and functions of the entire alarm prediction device 10 by reading a program and data from the ROM 105, the storage device 108, and the like onto the RAM 104 and executing processing.

  The communication I / F 107 is an interface for connecting the alarm prediction device 10 to the network N. Thereby, the alarm prediction device 10 can perform data communication via the communication I / F 107.

  The storage device 108 is a non-volatile memory that stores programs and data, and is, for example, an HDD (Hard Disk Drive), an SSD (solid state drive), or the like. The stored programs and data include a program that realizes the present embodiment, an OS that is basic software for controlling the entire alarm prediction apparatus 10, and application software that provides various functions on the OS. Note that the storage device 108 manages stored programs and data by a predetermined file system and / or DB.

  The alarm prediction apparatus 10 according to the present embodiment can realize various processes as described later by having the above hardware configuration.

<Functional configuration>
Next, the functional configuration of the alarm prediction system 1 according to the present embodiment will be described with reference to FIG. FIG. 3 is a functional configuration diagram of an example of an alarm prediction system according to the present embodiment.

  The alarm prediction device 10 includes a symbolizing unit 11, a prediction target alarm setting unit 12, an event sequence extraction unit 13, a prediction model creation unit 14, a prediction model evaluation unit 15, a display control unit 16, and an alarm prediction unit. 17. Each of these units is realized by processing that the CPU 106 executes one or more programs installed or downloaded in the alarm prediction device 10.

  The alarm prediction device 10 uses an event information storage unit 18 and a prediction model storage unit 19. Each of these storage units can be realized using a storage device connected to the storage device 108 or the alarm prediction device 10 via a network.

  The symbolizing unit 11 converts the event signal received from the device control device 30 into a predetermined character or symbol. This will be specifically described with reference to FIG. As illustrated in FIG. 4, the alarm prediction device 10 includes the time when an event occurs in the device 40 and the content of the event that has occurred. For this reason, the symbolizing unit 11 converts the contents of the generated event into a predetermined symbol or the like. In the example of FIG. 4, an event indicating “air blow valve A, open” is converted into a symbol “A”, and an event indicating “pump B, operation” is converted into a symbol “B”. As described above, the symbolizing unit 11 converts the content of the event included in the event signal into a symbol that uniquely indicates the content of the event.

  Here, as described above, the event signal is a set of the time when the event occurs and the content of the event. Therefore, for example, the event signal in the first row shown in FIG. 5 is a combination of a symbol indicating the content of the event and the occurrence time (A) when the occurrence time (2004/06/06 000: 14: 17) is t. , T). This is the same for other event signals, but for the sake of simplicity, a pair of a symbol indicating the content of an event and an occurrence time is simply expressed only by the symbol (that is, the pair “(A, t ) "Is simply represented as" A "). Further, hereinafter, the event signal symbolized as described above is also simply referred to as “event”.

  The prediction target alarm setting unit 12 sets an alarm designated by the user as a prediction target alarm. Here, the prediction target alarm is an alarm whose occurrence is to be predicted in the “prediction” phase. An alarm is also included in the event signal. That is, for example, when a certain device 40 fails, the device control device 30 that controls the device 40 transmits an event signal indicating the failure of the device 40 to the alarm prediction device 10. In other words, an event signal indicating occurrence of a failure or abnormality of the device 40 is referred to as an “alarm”.

  The event sequence extraction unit 13 extracts an event sequence (a sequence of one or more events) including the prediction target alarm set by the prediction target alarm setting unit 12 from the event information storage unit 18.

  The prediction model creation unit 14 creates a prediction model based on the event sequence extracted by the event sequence extraction unit 13.

  The prediction model evaluation unit 15 evaluates the prediction model created by the prediction model creation unit 14. That is, the prediction model evaluation unit 15 calculates the prediction failure rate and the misprediction rate of the prediction model created by the prediction model creation unit 14. Here, the prediction failure rate is a probability that the prediction model cannot predict the occurrence of the prediction target alarm, while the misprediction rate is a probability that the prediction target alarm is erroneously predicted when the prediction target alarm occurs. That is.

  The display control unit 16 causes the display device 102 to display information such as the prediction omission rate and the misprediction rate of the prediction model evaluated by the prediction model evaluation unit 15. Thereby, the user can know whether the created prediction model has a desired prediction accuracy.

  The alarm prediction unit 17 predicts the occurrence of an alarm in the “prediction” phase based on the prediction model created in the “model creation” phase. The alarm prediction unit 17 notifies the monitoring device 20 of the prediction result. Thereby, for example, a plant operator or the like can know whether or not a prediction target alarm is generated based on the prediction result.

  The event information storage unit 18 stores the event signal (that is, “event”) encoded by the encoding unit 11 as time-series data. More specifically, the event information storage unit 18 stores events for N days as time-series data, as shown in FIG. That is, the first line in FIG. 5 stores, for example, yesterday's events from left to right in the order in which they occurred (in chronological order). Similarly, the second row in FIG. 5 stores, for example, the events of the day before yesterday from left to right in the order in which they occurred. As described above, the event information storage unit 18 stores (accumulates) the symbolized event signal (event) as time-series data.

  The prediction model storage unit 19 stores the prediction model created by the prediction model creation unit 14. In the “prediction” phase, the alarm prediction unit 17 predicts the occurrence of an alarm based on the prediction model stored in the prediction model storage unit 19.

<Details of processing>
Next, details of the processing of Example 1 of the alarm prediction system 1 according to the present embodiment will be described with reference to FIGS. 6 to 9.

≪Prediction model creation and evaluation process≫
First, a process of creating a prediction model and presenting the evaluation of the prediction model to the user in the “model creation” phase will be described. FIG. 6 is a flowchart of an example of a prediction model creation and evaluation process according to the present embodiment (Example 1).

  In step S11, the user designates an alarm to be predicted from the input device 101 or the like. Then, the prediction target alarm setting unit 12 sets the alarm designated by the user as the prediction target alarm. Here, it is assumed that the user has designated an event (alarm) represented by the symbol “F” as a prediction target alarm.

  In step S <b> 12, the event sequence extraction unit 13 extracts one event sequence including the prediction target alarm “F” set by the prediction target alarm setting unit 12 from the event information storage unit 18. Here, the event sequence extraction unit 13 uses, for example, a sequential pattern mining (sequence pattern mining) method disclosed in Japanese Patent Application Laid-Open No. 2004-157830 to obtain one event sequence including the prediction target alarm “F”. The event information storage unit 18 may be extracted.

  More specifically, the event sequence extraction unit 13 inputs a minimum appearance frequency a, a minimum event sequence length min, and a maximum event sequence length max specified in advance by a user or the like, and performs sequence pattern mining to generate a plurality of event sequences. To extract. And the event sequence extraction part 13 should just extract one event sequence with the highest appearance frequency among the extracted several event sequences. Here, the event string extracted in this way is referred to as “ABCDEF”.

  In step S13, the prediction model creation unit 14 extracts an event sequence that precedes the prediction target alarm in the extracted event sequence, and creates a prediction model.

  More specifically, the event sequence “ABCDE” preceding the prediction target alarm “F” is extracted from the event sequence “ABCDEF” extracted in step S12. The “ABCDE” extracted here is also referred to as a “prediction source event string”. Then, after the event sequence “ABCDE” occurs, a prediction model “ABCDE → F” that predicts the occurrence of the event (alarm) “F” is created. In the prediction model “ABCDE → F”, when events occur in the order of “A”, “B”, “C”, “D”, “E”, the event (alarm) “F” occurs next. It is a prediction model which predicts. The prediction model created in this way is stored in the prediction model storage unit 19.

In step S14, the prediction model evaluation unit 15 evaluates the created prediction model. That is, the prediction model evaluation unit 15 calculates the prediction failure rate and the misprediction rate of the created prediction model. More specifically, the prediction omission rate and the misprediction rate are calculated as follows.
(1) In the event information storage unit 18, the prediction model evaluation unit 15 calculates the number of occurrences of an event sequence other than the prediction source event sequence before the prediction target alarm. For example, as shown in FIG. 7, the number of occurrences of an event sequence (“EUDDG” in the example of FIG. 7) other than the prediction source event sequence “ABCDE” occurs before the prediction target alarm “F”. This is done using a column search technique.
(2) The prediction model evaluation unit 15 calculates the number of times an event other than the prediction target alarm occurs after the prediction source event sequence in the event information storage unit 18. For example, as shown in FIG. 7, the number of occurrences of events other than the prediction target alarm “F” (“A” in the example of FIG. 7) after the prediction source event sequence “ABCDE” occurs. This method is used.
(3) Appearance frequency (first number) of “ABCDEF” calculated in step S12 above, number of times (second number) calculated in (2) above, and calculation in (3) above Based on the number of times (the third number), the predicted omission rate and the misprediction rate are calculated by the following equations.
Predicted leakage rate = (second number / (first number + second number)) × 100
False prediction rate = (third number / (first number + third number)) × 100
In step S15, the display control unit 16 causes the display device 102 to display the prediction model evaluation result calculated in step S14. More specifically, the display control unit 16 causes the display device 102 to display a screen showing the evaluation result as shown in FIG.

  The screen showing the evaluation result shown in FIG. 8 shows the predicted omission rate and the case where the first number described above is “90”, the second number is “3”, and the third number is “7”. The evaluation results for calculating the false prediction rate are shown. Thereby, the user can know the prediction failure rate and the misprediction rate of the created prediction model, and can confirm whether or not the desired prediction accuracy is satisfied. Here, when the user thinks that the desired prediction accuracy is satisfied, the user presses an “OK” button on the screen of FIG. 8, for example. Thus, the created prediction model is adopted, and the occurrence of an alarm is predicted based on the prediction model in the “prediction” phase. On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen of FIG. 8, for example. Thereby, the created prediction model is deleted from the prediction model storage unit 19 (that is, the created prediction model is not adopted). In general, it can be said that a lower prediction loss rate and a wrong prediction rate are better prediction models, but the prediction failure rate and the erroneous prediction rate often have a trade-off relationship with each other. Therefore, the user can adopt an appropriate prediction model desired by the user based on the prediction failure rate and the misprediction rate.

  In the above-described embodiment, as a means for evaluating the prediction model, the prediction failure rate and the misprediction rate are used as indexes, but other known indexes can also be used. For example, there are indexes such as correct answer rate, incorrect answer rate, precision rate / accuracy, sensitivity / true positive rate / detection rate, specificity / true negative rate, false positive rate, false negative rate. For example, the following two pages can be referred to as pages on the Internet for explaining these indexes.

http://popo.ara3.net/etc/confusionmatrix.htm
http://www.baru-san.net/archives/141

  A combination of any one of the precision ratio / accuracy and any one of the sensitivity / true positive ratio / detection ratio is in a trade-off relationship.

・ Accuracy rate / accuracy = 1-false prediction
= (First number of times / (first number of times + second number of times)) × 100
Sensitivity / true positive rate / detection rate = 1-predicted omission rate
= (First number of times / (first number of times + third number of times)) × 100

≪Alarm prediction process≫
Next, processing in the “prediction” phase for predicting the occurrence of an alarm based on the prediction model created in the “model creation” phase will be described. FIG. 9 is a flowchart of an example of an alarm prediction process according to the present embodiment (Example 1). In the following description, it is assumed that the prediction model is “ABCDE → F”.

  In step S <b> 21, the alarm prediction device 10 receives an event signal from the device control device 30.

  In step S <b> 22, the symbolizing unit 11 converts the event signal received from the device control device 30 into a predetermined symbol. Then, the symbolizing unit 11 stores the symbolized event signal (event) in the event information storage unit 18.

  In step S <b> 23, the alarm prediction unit 17 matches the latest five event sequences stored in the event information storage unit 18 with the prediction source event sequence “ABCDE” of the prediction model stored in the prediction model storage unit 19. It is determined whether or not to do.

More generally, prediction source event column _"X 1 _X 2 ··· _{X m"} of the predictive model, the event string stored according to the event information storage unit 18 in time series is _"Y 1 _Y 2 ··· _{Y n} "(n> m) when it, the alarm prediction unit 17 'determines whether _Y m + 1 ··· _{Y n"} matches the _"X 1 _X 2 ··· _{X m".} If they do not match, the process returns to step S21, whereas if they match, the process proceeds to step S24.

  In step S24, the alarm predicting unit 17 notifies the monitoring device 20 of the prediction result. That is, the alarm prediction unit 17 notifies the monitoring device 20 of a prediction result indicating that a prediction target alarm may occur. Thereby, for example, an operator such as a plant can know that there is a possibility that an alarm to be predicted is generated. Therefore, for example, the operator can take action according to an alarm that may occur.

(Example 2)
Next, Example 2 of the alarm prediction system 1 according to the present embodiment will be described. In the second embodiment, in the “model creation” phase, a plurality of prediction models are created, and the evaluation of each prediction model is presented to the user. Therefore, the user can select a desired prediction model from the plurality of created prediction models. In the following description, portions having substantially the same functions as those in the first embodiment and processes for executing the same processes are denoted by the same reference numerals as those in the first embodiment, and description thereof is omitted.

<Details of processing>
Next, the details of the process of Example 2 of the alarm prediction system 1 according to the present embodiment will be described with reference to FIGS. 10 and 11.

≪Prediction model creation and evaluation process≫
FIG. 10 is a flowchart of an example of a prediction model creation and evaluation process according to the present embodiment (Example 2).

  In step S <b> 31, the event sequence extraction unit 13 extracts a plurality of event sequences including the prediction target alarm “F” set by the prediction target alarm setting unit 12 from the event information storage unit 18. Here, the event sequence extraction unit 13 may use a sequence pattern mining method as in the first embodiment.

  More specifically, the event sequence extraction unit 13 inputs a minimum appearance frequency a, a minimum event sequence length min, and a maximum event sequence length max specified in advance by a user or the like, and performs sequence pattern mining to generate a plurality of event sequences. To extract. Here, it is assumed that the extracted event sequences are “EF”, “LF”, “DEF”, “KLF”, “CDEF”, “JKLF”,.

  In step S <b> 32, the prediction model creation unit 14 extracts an event sequence preceding the prediction target alarm for each of the extracted event sequences, and creates a prediction model.

  More specifically, from the plurality of event sequences “EF”, “LF”, “DEF”, “KLF”, “CDEF”, “JKLF”,. A plurality of event sequences “E”, “L”, “DE”, “KL”, “CDE”, “JKL”,... Preceding “F” are extracted. Then, prediction models “E → F”, “L → F”, “DE → F”, “KL → F”, “CDE → F”, “JKL → F”,・ ・ Create The plurality of prediction models created in this way are each stored in the prediction model storage unit 19.

  In step S33, the prediction model evaluation unit 15 evaluates each of the created prediction models. That is, the prediction model evaluation unit 15 calculates a prediction failure rate and a misprediction rate for each of the created prediction models. The calculation method of the prediction omission rate and the misprediction rate is the same as that in the first embodiment.

  In step S34, the display control unit 16 causes the display device 102 to display the evaluation results of the plurality of prediction models calculated in step S33. More specifically, the display control unit 16 causes the display device 102 to display a screen showing the evaluation result as shown in FIG.

  The screen showing the evaluation result shown in FIG. 11 shows that the first number (correct answer) of the prediction model “E → F” is “299”, the second number (prediction omission) is “1”, and the third number (error) (Prediction) is “300”, the prediction omission rate is “0.3%”, and the misprediction rate is “50.0%”. Similarly, the first number (correct answer) of the prediction model “L → F” is “1”, the second number (prediction omission) is “1”, and the third number (misprediction) is “299”. In this example, the leakage rate is “39.9%” and the misprediction rate is “99.7%”. The same applies to the other prediction models “DE → F”, “KL → F”, “CDE → F”, “JKL → F”,. Thereby, the user can know the prediction omission rate and the misprediction rate of the plurality of generated prediction models. Therefore, for example, when the user selects a desired prediction model with the radio button on the screen of FIG. 11 and presses the “OK” button, the selected prediction model is adopted, and the prediction model is selected in the “prediction” phase. Based on this, the occurrence of an alarm is predicted. Note that the prediction model not selected at this time is deleted from the prediction model storage unit 19. Further, for example, a check box may be provided instead of the radio button on the screen of FIG. 11 so that a plurality of prediction models can be selected.

  On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen of FIG. 11, for example. As a result, the plurality of created prediction models are deleted from the prediction model storage unit 19 (that is, the created prediction models are not adopted).

Example 3
Next, Example 3 of the alarm prediction system 1 according to the present embodiment will be described. In the third embodiment, in the “model creation” phase, a prediction model is created for a plurality of event sequences preceding the prediction target alarm included in the prediction source event sequence, and evaluation of each prediction model is presented to the user. In the following description, portions having substantially the same functions as those in the first embodiment and processes for executing the same processes are denoted by the same reference numerals as those in the first embodiment, and description thereof is omitted.

<Details of processing>
Next, the details of the process of Example 3 of the alarm prediction system 1 according to the present embodiment will be described with reference to FIGS. 12 and 13.

≪Prediction model creation and evaluation process≫
FIG. 12 is a flowchart of an example of a prediction model creation and evaluation process according to the present embodiment (Example 3).

  In step S41, the prediction model creation unit 14 extracts an event sequence that precedes the prediction target alarm in the extracted event sequence, and creates a plurality of prediction models.

  More specifically, the event sequence “ABCDE” (prediction source event sequence) preceding the prediction target alarm “F” is extracted from the event sequence “ABCDEF” extracted in step S12. Further, an event sequence preceding the prediction target alarm included in the prediction source event sequence (this is expressed as a “partial prediction source event sequence”) is extracted. That is, partial prediction source event sequences “E”, “DE”, “CDE”, and “BCDE” are extracted. Then, prediction models “E → F”, “DE → F”, “CDE → F”, “BCDE → F”, and “ABCDE → F” are created from the partial prediction source event sequence and the prediction source event sequence, respectively. The prediction model created in this way is stored in the prediction model storage unit 19.

  In step S41, a prediction model may be created from an event sequence including a prediction source event sequence. For example, the event sequence “ZABCDE” including the prediction source event sequence “ABCDE” may be extracted from the event information storage unit 18, and the prediction model “ZABCDE → F” may be created from the event sequence “ZABCDE”.

  In step S42, the prediction model evaluation unit 15 evaluates each of the created prediction models. That is, the prediction model evaluation unit 15 calculates a prediction failure rate and a misprediction rate for each of the created prediction models. The calculation method of the prediction omission rate and the misprediction rate is the same as that in the first embodiment.

  In step S43, the display control unit 16 causes the display device 102 to display the evaluation results of the plurality of prediction models calculated in step S42. More specifically, the display control unit 16 causes the display device 102 to display a screen showing the evaluation result as shown in FIG.

  In the screen showing the evaluation result shown in FIG. 13A, the first number (correct answer) of the prediction model “E → F” is “299”, the second number (prediction omission) is “1”, and the third In this example, the number of times (misprediction) is “300”, the prediction omission rate is “0.3%”, and the misprediction rate is “50.0%”. Similarly, the first number (correct answer) of the prediction model “DE → F” is “295”, the second number (prediction failure) is “5”, and the third number (misprediction) is “150”. In this example, the leakage rate is “1.7%” and the misprediction rate is “33.7%”. The same applies to the other prediction models “CDE → F”, “BCDE → F”, and “ABCDE → F”. Thereby, the user can know the prediction omission rate and the misprediction rate of the plurality of generated prediction models. Therefore, for example, the user selects a desired prediction model with the radio button on the screen of FIG. 11 and presses the “OK” button. Thus, the created prediction model is adopted, and the occurrence of an alarm is predicted based on the prediction model in the “prediction” phase. Note that the prediction model not selected at this time is deleted from the prediction model storage unit 19. Further, for example, a check box may be provided instead of the radio button on the screen of FIG. 11 so that a plurality of prediction models can be selected.

  On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen of FIG. 11, for example. As a result, the plurality of created prediction models are deleted from the prediction model storage unit 19 (that is, the created prediction models are not adopted).

  Furthermore, when a “graph display” button is pressed in FIG. 13A, a graph as shown in FIG. 13B may be displayed. The graph shown in FIG. 13B is a graph in which the prediction failure rate and the misprediction rate of each prediction model are represented. As described above, since the prediction failure rate and the misprediction rate are often in a trade-off relationship, the user adopts an appropriate prediction model by displaying a graph as shown in FIG. Will be able to. According to FIG. 13B, for example, when the user places importance on the prediction failure rate among the prediction failure rate and the misprediction rate, it is understood that the prediction model “BCDE → F” may be employed. On the other hand, for example, when the misprediction rate is emphasized among the user predicted omission rate and the misprediction rate, it is understood that the prediction model “ABCDE → F” may be employed.

Example 4
Next, Example 4 of the alarm prediction system 1 according to the present embodiment will be described. In the fourth embodiment, in the “model creation” phase, the same event sequence as the prediction source event sequence is clustered based on the time between events, and a prediction model is created for each cluster. Thereby, while the generated event sequence is the same, the prediction model can be created by distinguishing when the time (event occurrence interval) between events included in the event sequence is significantly different. In other words, in the fourth embodiment, it is possible to create a prediction model that can perform prediction based on the time interval at which events occur in addition to the order in which events occur. In the following description, portions having substantially the same functions as those in the first embodiment and processes for executing the same processes are denoted by the same reference numerals as those in the first embodiment and description thereof is omitted.

<Details of processing>
Next, the details of the process of Example 4 of the alarm prediction system 1 according to the present embodiment will be described with reference to FIGS. 14 to 16.

≪Prediction model creation and evaluation process≫
FIG. 14 is a flowchart of an example of a prediction model creation and evaluation process according to the present embodiment (Example 4).

  In step S51, the prediction model creation unit 14 extracts an event sequence (prediction source event sequence) preceding the prediction target alarm in the extracted event sequence. This is the same as the method of extracting the prediction source event sequence in the first embodiment.

  In step S <b> 52, the prediction model creation unit 14 acquires the same event sequence as the prediction source event sequence from the event information storage unit 18.

  That is, when the prediction source event sequence is “ABCDE”, the prediction model creation unit 14 acquires the event sequence “ABCDE” from the event information storage unit 18. Here, it is assumed that the prediction model creation unit 14 has acquired n event strings “ABCDE” from the event information storage unit 18. In addition, in order to distinguish the acquired n event strings from each other, hereinafter, for the sake of convenience, they will be referred to as “first ABCDE”, “second ABCDE”,..., “Nth ABCDE”, respectively.

  In step S53, the prediction model creation unit 14 clusters the acquired event sequences based on the time interval between events, assigns a label to each cluster, and selects the cluster to which the label is attached as a prediction source event sequence. Create a prediction model as

  More specifically, as shown in FIG. 15, the following Step 1 to Step 3 are performed.

Step 1) For each of “first ABCDE”, “second ABCDE”,..., “Nth ABCDE”, a difference in time at which each event occurs is obtained. For example, in “first ABCDE”, the difference between the occurrence time t _{B of B} and the occurrence time t _{A of A} is obtained, and this is defined as t ₁₁ . Similarly, the difference between the occurrence time t _{C of C} and the occurrence time t _{B of B} is obtained, and this is defined as t ₁₂ . It obtains the difference between the occurrence time _{t C} of occurrence time _{t D} and C and D, which is referred to as _{t 13.} The difference between the occurrence time t _{E of E} and the occurrence time t _{D of D} is obtained, and this is defined as t ₁₄ . As for “second ABCDE”,..., “Nth ABCDE”, as in “first ABCDE”, the difference in time at which each event occurs is obtained.

Step 2) For “first ABCDE”, t ₁₁ , t ₁₂ , t ₁₃ , and t ₁₄ obtained in the above Step 1 are converted into vectors T ₁ = (t ₁₁ , t ₁₂ , t ₁₃ , t ₁₄ ) ^t (where , T indicates transposition). "Second ABCDE", ..., the "ABCDE of the n", like the "first ABCDE", respectively, the vector _T 2, ..., to define _{T n.}

Step 3) The vectors T ₁ , T ₂ ,..., T _n are clustered by, for example, K-means clustering. Then, a label for identifying each cluster is given to the K clusters. Hereinafter, it is assumed that the vectors T ₁ , T ₂ ,..., T _n are clustered into three clusters, and the labels of each cluster are α, β, and γ.

  Then, each cluster with a label is used as a prediction model. That is, in the above case, the prediction model “ABCDE → F” of the label α is created using the event sequence “ABCDE” included in the cluster of the label α as the prediction source event sequence. Similarly, the prediction model “ABCDE → F” of the label β is created using the event sequence “ABCDE” included in the label β as a prediction source event sequence. Similarly, the prediction model “ABCDE → F” of the label γ is created with the event string “ABCDE” included in the label γ as the prediction source event string.

  In step S54, the prediction model evaluation unit 15 evaluates the generated prediction model. That is, the prediction model evaluation unit 15 calculates the prediction failure rate and the misprediction rate of the created prediction model. The calculation method of the prediction omission rate and the misprediction rate is the same as that in the first embodiment, but the first number, the second number, and the third number are calculated for each label.

  More specifically, the number of times the prediction target alarm “F” occurs after “ABCDE” of the label α is defined as the first number of labels α. Further, the number of times that an event string other than “ABCDE” with label α occurs before the prediction target alarm “F” is set as the second number of labels α. Further, the number of times an event other than the prediction target alarm “F” occurs after “ABCDE” of the label α is set as a third number of times of the label α. The same applies to label β and label γ.

  In step S55, the display control unit 16 causes the display device 102 to display the evaluation results of the plurality of prediction models calculated in step S54. More specifically, the display control unit 16 causes the display device 102 to display a screen showing the evaluation result as shown in FIG.

  In the screen showing the evaluation result shown in FIG. 16, the first number (correct answer) of the label α described above is “86”, the second number (predicted omission) of the label α is “7”, and the first number of the label α. In the case where the number of times 3 (misprediction) is “7”, the evaluation results of calculating the prediction failure rate and the misprediction rate are shown. Similarly, the first number (correct answer) of label β is “1”, the second number of labels β (prediction omission) is “92”, and the third number of labels β (misprediction) is “40”. The evaluation result which calculated the prediction omission rate and the misprediction rate about a certain case is shown. Similarly, the first number (correct answer) of label γ is “3”, the second number of labels γ (prediction omission) is “90”, and the third number of labels γ (misprediction) is “53”. The evaluation result which calculated the prediction omission rate and the misprediction rate about a certain case is shown. Here, when the user thinks that the desired prediction accuracy is satisfied, the user selects a desired prediction model on the screen of FIG. 16, for example, and presses the “OK” button. Thereby, the created prediction model is adopted. On the other hand, when the user thinks that the desired prediction accuracy is not satisfied, the user presses a “cancel” button on the screen of FIG. 16, for example. As a result, the created prediction model is deleted from the prediction model storage unit 19.

  As described above, in the fourth embodiment, a prediction model capable of performing prediction based on the time interval at which events occur in addition to the order in which events occur is created. As a result, for example, when a prediction model with a high misprediction rate is obtained, the prediction source event sequence of the prediction model is clustered to create a plurality of prediction models, so that the prediction accuracy is high (low misprediction rate is low). ) A prediction model can be obtained.

≪Alarm prediction process≫
Next, processing in the “prediction” phase for predicting the occurrence of an alarm based on the prediction model created in the “model creation” phase will be described. FIG. 17 is a flowchart of an example of an alarm prediction process according to the present embodiment (Example 4). In the following description, it is assumed that the prediction model is “ABCDE → F” with label α.

  In step S61, the alarm prediction unit 17 determines whether or not the five latest event sequences stored in the event information storage unit 18 belong to the cluster with the label α. If it does not belong to the cluster with label α, the process returns to step S21. If it belongs to the cluster with label α, the process proceeds to step S24. When a plurality of prediction models are stored in the prediction model storage unit 19, the alarm prediction unit 17 determines whether it belongs to the label class of any prediction model.

More generally, when the prediction source event sequence of the prediction model is classified as a cluster with a label “X ₁ X ₂ ... X _m ”, the m most recent events stored in the event information storage unit 18. It is determined whether or not the column “X ₁ X ₂ ... X _m ” belongs to the cluster α.

<Summary>
As described above, in Example 1 of the alarm prediction system 1 according to the present embodiment, a prediction model for predicting a specified alarm is created based on events accumulated as time series data. In addition, at this time, evaluation values such as a prediction omission rate and an erroneous prediction rate of the created prediction model are presented to the user. Therefore, the user can know whether or not the created prediction model has a desired prediction accuracy before performing prediction based on the prediction model.

  In the second and third embodiments, a plurality of prediction models for predicting a specified alarm are created based on time-series data and accumulated events. At this time, in the same manner as in the first embodiment, evaluation values such as the prediction omission rate and the misprediction rate of the created prediction models are presented to the user. Therefore, the user can select a prediction model having desired prediction accuracy from the plurality of created prediction models.

  Furthermore, in the fourth embodiment, a prediction model that takes into account the time interval at which an event occurs is created using a clustering technique. Thereby, a prediction model with high prediction accuracy can be created.

  Note that the present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 1 Alarm prediction system 10 Alarm prediction apparatus 11 Encoding part 12 Prediction object alarm setting part 13 Event sequence extraction part 14 Prediction model creation part 15 Prediction model evaluation part 16 Display control part 17 Alarm prediction part 18 Event information storage part 19 Prediction model memory | storage Unit 20 Monitoring device 30 Device control device 40 Device

Claims (10)

An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
Prediction target from a plurality of event information stored in advance in a predetermined storage area according to time series by sequence pattern mining using extraction conditions including minimum appearance frequency, minimum sequence length and maximum sequence length specified by the user Extraction means for extracting a column of first event information including at the end the prediction target event information indicating the occurrence of the abnormality of
A model creation means for extracting a second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit, and creating a prediction model;
Evaluation value calculating means for calculating an evaluation value of the prediction model based on the plurality of event information stored in advance in the predetermined storage area;
An alarm prediction device comprising: a display unit that causes a display device to display the evaluation value calculated by the evaluation value calculation unit . The extraction means includes
From a plurality of event information stored in advance in a predetermined storage area according to a time series, extract a plurality of first event information columns including the prediction target event information indicating the occurrence of the prediction target abnormality at the end,
The model creation means includes
The alarm prediction device according to claim 1, wherein a plurality of second event information columns excluding the prediction target event information are extracted from each of the plurality of first event information columns to create a plurality of prediction models. .   The alarm prediction device according to claim 1 or 2, wherein the first event information column is a column having a predetermined length specified in advance. The alarm prediction device according to claim 2, wherein the model creating unit extracts a sequence of all the plurality of second event information having a length of 1 or more and a predetermined length or less. The evaluation value calculation means includes
First calculation means for calculating a first appearance count at which the first event information column appears in the plurality of event information stored in advance in the predetermined storage area;
In a plurality of pieces of event information stored in advance in the predetermined storage area, a second appearance count in which an event information column other than the second event information column appears before the prediction target event information is calculated. A second calculating means;
In a plurality of pieces of event information stored in advance in the predetermined storage area, a third appearance number is calculated for event information other than the prediction target event information appearing after the second event information column. Calculating means,
The display means includes
The first appearance frequency, the second number of occurrences, and said third number of occurrences of, on the display device as the evaluation value, the alarm prediction apparatus according to any one of claims 1 to 3. The evaluation value calculation means includes
Based on the first number of appearances and the second number of appearances, a prediction omission rate indicating a probability that an event information column other than the second event information column appears before the prediction target event information is calculated. A fourth calculating means;
Based on the first number of appearances and the second number of appearances, a fifth misprediction rate is calculated that indicates a probability that event information other than the prediction target event information appears after the second event information column. Calculating means,
The display means includes
The alarm prediction device according to claim 5, wherein the prediction failure rate and the erroneous prediction rate are displayed on the display device as the evaluation values . The evaluation value calculation means includes
Sixth calculation means for calculating a precision or accuracy indicating a probability of occurrence of the first event information column based on the first appearance count and the second appearance count;
And a seventh calculating means for calculating a sensitivity, a true positive rate, or a detection rate indicating the probability of occurrence of the first event information sequence based on the first appearance number and the third appearance number. ,
The display means includes
The alarm prediction device according to claim 5, wherein the accuracy or accuracy, and the sensitivity or true positive rate or detection rate are displayed on the display device as the evaluation value . Among the plurality of event information stored in advance in the predetermined storage area, for each event information included in the same event information column as the second event information column extracted by the model creating unit, Classification means for extracting the third event information column by classifying the same event information column based on the interval of time at which each event information occurred,
The first calculation means includes
For each third event information extracted by the classifying means, calculate the first number of appearances of the prediction target event information after the third event information,
The third calculation means includes:
6. For each of the third event information extracted by the classifying means, a third appearance count at which event information other than the prediction target event information appears after the column of the third event information is calculated. 8. The alarm prediction device according to any one of items 7 to 7. An alarm prediction method used in an alarm prediction device for predicting the occurrence of an abnormality based on time-series event information output by equipment or equipment,
Prediction target from a plurality of event information stored in advance in a predetermined storage area according to time series by sequence pattern mining using extraction conditions including minimum appearance frequency, minimum sequence length and maximum sequence length specified by the user An extraction procedure for extracting a column of first event information that includes prediction target event information indicating the occurrence of an abnormality in the end,
A model creation procedure for extracting a second event information column excluding the prediction target event information from the first event information column extracted by the extraction procedure, and creating a prediction model;
An evaluation value calculation procedure for calculating an evaluation value of the prediction model based on the plurality of event information stored in advance in the predetermined storage area;
Alarm prediction method and a display procedure for displaying the evaluation value calculated by the evaluation value calculation procedure to display. An alarm prediction device that predicts the occurrence of an abnormality based on time-series event information output by equipment or equipment,
Prediction target from a plurality of event information stored in advance in a predetermined storage area according to time series by sequence pattern mining using extraction conditions including minimum appearance frequency, minimum sequence length and maximum sequence length specified by the user Extraction means for extracting a sequence of first event information including the prediction target event information indicating the occurrence of an abnormality in the end,
A model creation unit for extracting a second event information column obtained by removing the prediction target event information from the first event information column extracted by the extraction unit, and creating a prediction model;
Evaluation value calculation means for calculating an evaluation value of the prediction model based on the plurality of event information stored in advance in the predetermined storage area;
A program for causing an evaluation value calculated by the evaluation value calculation means to function as display means for displaying on a display device.

Images