JP6847591B2 - Anomaly detection system, model generator, anomaly detection device, anomaly detection method, model generation program, and anomaly detection program - Google Patents

Description

The present invention relates to an abnormality detection technique for detecting an abnormality using a plurality of sensors.

In recent years, IoT (Internet of Things) has been studied in which various devices are provided with a communication function and connected to a network or communicate with each other to perform various controls.

Further, Patent Document 1 describes an abnormality detection device that detects abnormal log generation for the user without the user knowing the generation side of the log message generated by the device.

Japanese Unexamined Patent Publication No. 2014-153723

In rich devices such as personal computers and smartphones (devices with high processing power), it is possible to install software for detecting abnormalities such as virus detection, failure detection, and theft detection on the device.

However, in the case of a simple sensor (device) such as a sensor installed in a machine operating in a factory, software for detecting an abnormality cannot be installed in the sensor. That is, in an environment where data is continuously collected from a large number of simple sensors that cannot incorporate an abnormality detection function, if an abnormality such as failure, falsification, theft, or replacement occurs in a certain sensor, the abnormality is detected. I can't find it.

The present invention has been made in view of the above circumstances, and an object of the present invention is to detect an abnormality generated in a sensor into which an abnormality detection function cannot be incorporated.

In order to solve the above problems, the first invention is an abnormality detection system including a model generation device and an abnormality detection device, in which the model generation device includes a plurality of sensors as a target sensor and the target sensor. By dividing into sensor groups other than the above, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and a model capable of estimating the sensor data of the target sensor from the sensor data of the sensor group is generated. The abnormality detection device inputs sensor data of a receiving unit that receives sensor data from the plurality of sensors and sensor data of the sensor group received by the receiving unit into the model, and estimates the sensor data of the target sensor. Abnormality detection that detects an abnormality of the target sensor when the difference between the estimation unit that acquires the value, the estimated value of the target sensor, and the sensor data of the target sensor received by the receiving unit is equal to or greater than a predetermined threshold value. It has a part and.

The second invention is a model generation device that generates a model for detecting an abnormality of a sensor, and is a receiving unit that receives sensor data from a plurality of sensors, the plurality of sensors as a target sensor, and the target. Separated from the sensor group other than the sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and a model capable of estimating the sensor data of the target sensor from the sensor data of the sensor group is generated. A model generation unit is provided.

The third invention is an abnormality detection device that detects an abnormality of a sensor, and is a receiving unit that receives sensor data from a plurality of sensors, the plurality of sensors as a target sensor, and a sensor group other than the target sensor. A storage unit that analyzes the correlation between the sensor data of the sensor group and the sensor data of the target sensor and stores a model capable of estimating the sensor data of the target sensor from the sensor data of the sensor group. The estimation unit that inputs the sensor data of the sensor group received by the receiving unit to the model and acquires the estimated value of the sensor data of the target sensor, the estimated value of the target sensor, and the receiving unit receives the estimated value. It includes an abnormality detection unit that detects an abnormality of the target sensor when the difference from the sensor data of the target sensor is equal to or greater than a predetermined threshold value.

A fourth aspect of the present invention is an abnormality detection method performed by an abnormality detection system including a model generation device and an abnormality detection device. The model generation device includes a plurality of sensors as a target sensor and a sensor other than the target sensor. A generation step of dividing into groups, analyzing the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and generating a model in which the sensor data of the target sensor can be estimated from the sensor data of the sensor group is performed. Then, the abnormality detection device inputs the sensor data of the sensor group received in the reception step into the reception step and the reception step of receiving the sensor data from the plurality of sensors, and inputs the sensor data of the target sensor to the model. An abnormality that detects an abnormality of the target sensor when the difference between the estimation step for acquiring the estimated value, the estimated value of the target sensor, and the sensor data of the target sensor received in the reception step is equal to or greater than a predetermined threshold value. Perform the detection step and.

A fifth aspect of the present invention is a model generation program executed by a computer to generate a model for detecting an abnormality of a sensor, wherein the computer is a receiving unit that receives sensor data from a plurality of sensors, and the above-mentioned receiving unit. A plurality of sensors are divided into a target sensor and a sensor group other than the target sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and the target sensor is obtained from the sensor data of the sensor group. The sensor data of the above is made to function as a model generation unit that generates an estimable model.

A sixth aspect of the present invention is an abnormality detection program executed by a computer for detecting an abnormality in a sensor, wherein the computer is a receiving unit that receives sensor data from a plurality of sensors, and the plurality of sensors are target sensors. , It is possible to divide into a sensor group other than the target sensor, analyze the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and estimate the sensor data of the target sensor from the sensor data of the sensor group. A storage unit that stores a model, an estimation unit that inputs sensor data of the sensor group received by the reception unit into the model and acquires an estimated value of the sensor data of the target sensor, and an estimated value of the target sensor. When the difference between the data received by the receiving unit and the sensor data of the target sensor is equal to or greater than a predetermined threshold value, the receiving unit functions as an abnormality detecting unit for detecting an abnormality of the target sensor.

According to the present invention, it is possible to detect an abnormality that has occurred in a sensor that cannot incorporate an abnormality detection function.

It is a block diagram which shows the structure of the abnormality detection system of 1st Embodiment. It is a block diagram which shows the functional structure of a model generator. It is a block diagram which shows the functional structure of an abnormality detection device. It is explanatory drawing explaining the model generation process of 1st Embodiment. It is a figure which shows an example of the sensor data used in the model generation processing of 1st Embodiment. It is explanatory drawing explaining the abnormality detection processing of 1st Embodiment. It is a figure which shows an example of the sensor data used in the abnormality detection processing of 1st Embodiment. It is a figure which shows an example of the sensor data used in the model generation processing of 1st Embodiment (variant example). It is explanatory drawing explaining the model generation process of 2nd Embodiment. It is a figure which shows an example of the sensor data used in the model generation processing of 2nd Embodiment. It is explanatory drawing explaining the abnormality detection processing of the 2nd Embodiment. It is a figure which shows an example of the sensor data used in the abnormality detection processing of the 2nd Embodiment. It is a figure which shows an example of the sensor data used in the model generation processing of the 2nd Embodiment (a modification). It is a figure which shows an example of the sensor data used in the abnormality detection processing of the 2nd Embodiment (a modification). It is a block diagram which shows the structure of the abnormality detection system of 3rd Embodiment. It is a block diagram which shows the structure of the abnormality detection system of 4th Embodiment. It is explanatory drawing explaining the abnormality detection processing of 4th Embodiment. It is explanatory drawing explaining the abnormality detection processing of the modification of the 4th Embodiment. It is a block diagram which shows the structure of the abnormality detection system of 5th Embodiment. It is explanatory drawing explaining the model generation process of 5th Embodiment. It is explanatory drawing explaining the generation processing of the classification model of 6th Embodiment. It is a figure which shows an example of the sensor data used in the generation processing of the classification model of 6th Embodiment. It is explanatory drawing explaining the abnormality detection processing of 6th Embodiment. It is a figure which shows an example of the sensor arranged in the three-dimensional space of the 7th Embodiment. It is a figure which shows an example of the sensor data of the sensor which changes with time of the 7th Embodiment. It is an image diagram of the convolutional neural network of the 7th embodiment. It is explanatory drawing explaining the model generation process of 7th Embodiment. It is explanatory drawing explaining the abnormality detection processing of 7th Embodiment.

Hereinafter, embodiments of the present invention will be described.

<First Embodiment>
FIG. 1 is a configuration diagram showing a configuration of an abnormality detection system according to the first embodiment of the present invention. The illustrated abnormality detection system includes a model generation device 1, an abnormality detection device 2, a sensor utilization device 3, and a plurality of sensors 4. In addition, these devices are connected by a network.

The model generation device 1 analyzes and learns the correlation of sensor data (sensor values) of a plurality of sensors 4, and generates a model (learning model) for detecting an abnormality of the sensors 4. Specifically, the model generator 1 divides a plurality of sensors 4 into a target sensor and a sensor group other than the target sensor, analyzes the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and analyzes the sensor group. Generate a model in which the sensor data of the target sensor can be estimated from the sensor data of.

The abnormality detection device 2 detects an abnormality (fault, falsification, theft, replacement, etc.) of each sensor 4 by using the model generated by the model generation device 1.

The sensor utilization device 3 is a device that utilizes sensor data of a plurality of sensors 4. For example, the sensor utilization device 3 may be a monitoring device that displays an abnormality detected by the abnormality detection device 2 on a display or the like. Further, the sensor utilization device 3 may be a monitoring device that alerts an abnormality detected by the abnormality detection device 2 to an e-mail, a messenger, or the like. Further, the sensor utilization device 3 may be a data processing device that collects sensor data from a plurality of sensors 4 and uses the collected sensor data to provide various services such as control of a device to be sensed.

The sensor 4 senses (measures, detects) a target physical quantity and outputs sensor data. Specifically, the sensor 4 periodically applies a time-varying physical quantity (for example, voice, video, linguistic information (frequency detection of a specific word, etc.), numerical value, etc.) to a predetermined timing (for example, n-second interval). ) Is sensed in chronological order, and the sensor data that is the sensing result is transmitted to the abnormality detection device 2 via the network. Further, the sensor 4 may transmit the sensor data to the sensor utilization device 3.

The plurality of sensors 4 may be the same type of sensor 4, or a plurality of types of sensors may be mixed.

FIG. 2 is a block diagram showing a functional configuration of the model generation device 1. The model generation device 1 shown in the figure includes a reception unit 11, a model generation unit 12, a model transmission unit 13, a data storage unit 14, and a model storage unit 15.

The receiving unit 11 receives the sensor data transmitted from each sensor 4 and stores it in the data storage unit 14. The model generation unit 12 analyzes and learns the correlation of the sensor data of the plurality of sensors 4 stored in the data storage unit 14, and generates a model for detecting an abnormality of the sensor 4. Specifically, the model generation unit 12 divides a plurality of sensors 4 into a target sensor and a sensor group other than the target sensor, analyzes the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and analyzes the sensor group. Generate and update a model in which the sensor data of the target sensor can be estimated from the sensor data of. The model transmission unit 13 transmits the model generated by the model generation unit 12 to the abnormality detection device 2.

The data storage unit 14 stores the sensor data of the plurality of sensors 4 collected by the reception unit 11. The model stored in the model storage unit 15 stores the model generated by the model generation unit 12. A memory, a DB, or the like can be used for the data storage unit 14 and the model storage unit 15.

FIG. 3 is a block diagram showing a functional configuration of the abnormality detection device 2. The illustrated abnormality detection device 2 includes a reception unit 21, an estimation unit 22, an abnormality detection unit 23, a data storage unit 24, and a model storage unit 25.

The receiving unit 21 receives the sensor data transmitted from the plurality of sensors 4 and stores it in the data storage unit 14. The estimation unit 22 inputs the sensor data of the sensor group received by the reception unit 21 into the model stored in the model storage unit 25, and acquires an estimated value of the sensor data of the target sensor. The abnormality detection unit 23 has an abnormality of the target sensor when the difference between the estimated value of the target sensor estimated by the estimation unit 22 and the sensor data (actual measurement value) of the target sensor received by the reception unit 21 is equal to or greater than a predetermined threshold value. Is detected.

The data storage unit 24 stores the sensor data of the plurality of sensors 4 collected by the reception unit 21. The model storage unit 25 stores the model received from the model generation device 1. A memory, a DB, or the like can be used for the data storage unit 24 and the model storage unit 25.

As the model generation device 1, the abnormality detection device 2, and the sensor utilization device 3 described above, for example, a general-purpose computer system including a CPU, a memory, an external storage device such as a hard disk, and the like can be used. The computer system may be a virtual machine such as a cloud, or may be composed of a plurality of computers. Further, the computer system may include a GPU (Graphics Processing Unit) in addition to the CPU.

In this computer system, each function of each device is realized by executing a predetermined program loaded on the memory by the CPU or GPU. For example, when the functions of the model generator 1, the abnormality detection device 2, and the sensor utilization device 3 are the CPU or GPU of the model generation device 1 in the case of the program for the model generation device 1, the CPU or GPU of the model generation device 1 is the program for the abnormality detection device 2. Is realized by the CPU or GPU of the abnormality detection device 2 and, in the case of the program for the sensor utilization device 3, the CPU or GPU of the sensor utilization device 3 respectively.

The program for the model generator 1, the program for the abnormality detection device 2, and the program for the sensor utilization device 3 are computer-readable recording media such as hard disks, flexible disks, CD-ROMs, MOs, and DVD-ROMs. It can be stored on a computer or distributed over a network.

Next, the operation of this embodiment will be described.

FIG. 4 is an explanatory diagram illustrating a model generation process performed by the model generation device 1.

Each of the plurality of sensors 4 includes a sensing unit 41 that senses a target physical quantity and converts it into sensor data, and a transmission unit 42 that transmits the sensor data. Each sensor 4 performs sensing at a predetermined timing (time interval) and transmits sensor data. The transmission unit 42 transmits the sensor identification information (sensor ID) and the sensing time indicating the sensed time as sensor information together with the sensor data (sensor value) which is the sensing result.

The receiving unit 11 of the model generation device 1 receives the sensor data, the sensor ID, and the sensing time transmitted from each sensor 4 (S11), and stores them in the data storage unit 14 in association with each other (S12). As a result, the data storage unit 14 stores the sensor data (time-series sensor data) generated in the time series of each sensor 4.

When the sensor 4 does not transmit the sensing time, the receiving unit 11 may consider the time when the sensor data is received as the sensing time and store it in association with the sensor data.

Then, the model generation unit 12 reads out a set (set) of sensor data of all the plurality of sensors 4 having the same sensing time from the data storage unit 14 as teacher data, and generates a model using the set of sensor data. And update (S13), and store in the model storage unit 15. The model transmission unit 13 transmits the model stored in the model storage unit 15 to the abnormality detection device 2 (S14).

FIG. 5 is a diagram showing an example of the model generation process of S13. In the present embodiment, the plurality of sensors 4 are divided into a target sensor to be estimated and a sensor group other than the target sensor, and a model in which the sensor data of the target sensor can be estimated is generated from the sensor data of the sensor group.

In the illustrated example, of the n sensors, the sensor Sn is the target sensor, and the sensors S1 to Sn-1 are the sensor group. Then, the model generation unit 12 sets the sensor data of the sensor groups S1 to Sn-1 and the sensor data of the target sensor Sn at each time of a plurality of times (tk, ..., t-2, t-1, t). Is used as the teacher data to generate a model (Sn model) capable of estimating the sensor data of the target sensor Sn. That is, a model is generated by analyzing the correlation between the sensor data of the target sensor and the sensor data of the sensor group.

Specifically, the teacher data (input / output pair) in which the value of the sensor data of the sensor group having the same sensing time is used as the input data and the output data in this case is used as the sensor data of the target sensor is machine-learned. When the sensor data of the sensor group at time (t) (S1 (t), S2 (t), S3 (t),…, Sn-1 (t)) 51 is input, the sensor data of the target sensor (Sn (t)) ) 52 generates an estimable model (function). That is, the model is a function that outputs the estimated sensor data (estimated value) of the target sensor at a certain time when the sensor data of the sensor group at a certain time is input.

The model generation unit 12 reads out a plurality of sensor data of the sensor groups S1 to Sn-1 at the same time and a plurality of sensor data of the target sensor Sn, repeats the process of S13, and updates the model.

In this embodiment, sensor data of a plurality of sensors 4 is analyzed and analyzed for mutual relations by using multidimensional correlation analysis technology, machine learning such as AutoEncoder, and a model is generated.

Multivariate analysis, multiple regression analysis and the like are used for multidimensional correlation analysis. Multivariate analysis is a statistical technique that analyzes the interrelationships between these variables based on data about multiple variables. Multiple regression analysis is one of multivariate analysis, in which there are two or more independent variables in regression analysis.

AutoEncoder is an algorithm for dimension compression using a neural network in machine learning.

In this embodiment and all the embodiments and modifications described below, a corresponding model is generated for each sensor. That is, similarly to the generation of the Sn model, "the sensor S1 is the target sensor and the sensors S2 to Sn are the sensor groups to generate the S2 model", and "the sensor S2 is the target sensor and the sensors S1, S3 to Sn are generated". Generate a model for S3 with the sensor group as a group. ”Generate models for all sensors S1 to Sn. Therefore, the model storage unit 15 stores the model for each sensor.

The model generation device 1 first performs the model generation process shown in FIG. 4, for example, before the operation of the abnormality detection system, generates a model, and transmits the model to the abnormality detection device 2, and the abnormality detection device 2 first performs the model generation process. You may continue to use the generated model. Alternatively, the model generation device 1 may collect sensor data from each sensor at a predetermined timing, update the model, and transmit the updated model to the abnormality detection device 2.

The model update at a predetermined timing includes the case where the model is updated regularly by inputting the period as a parameter in advance, and the case where the model is updated triggered by some trigger such as an operator (administrator) instruction. Is done.

By updating the model at a predetermined timing, the model with high estimation accuracy can be maintained even if the sensor data (correlation between the target sensor and the sensor group) of each sensor changes with time from moment to moment. Can be done.

FIG. 6 is a diagram illustrating an abnormality detection process performed by the abnormality detection device 2.

The receiving unit 21 of the abnormality detection device 2 receives the sensor data, the sensor ID, and the sensing time transmitted from each sensor 4 (S21) and stores them in the data storage unit 24 (S22). Then, when the sensor data of all the sensors 4 at the same sensing time is stored in the data storage unit 24, the estimation unit 22 reads out the sensor data of the sensor group (estimation source) at that time from the data storage unit 24 ( S23), the read sensor data is input to the model of the target sensor stored in the model storage unit 25, and an estimated value of the sensor data of the target sensor is acquired (S24).

Specifically, as shown in FIG. 7, when the estimation unit 22 acquires the estimated value 72 of the target sensor Sn at the sensing time t, for example, the sensor data of the sensor group (S1 (t), S2 (t). ), S3 (t),…, Sn-1 (t)) 71 is input to the sensor Sn model.

Then, the abnormality detection unit 23 reads out the sensor data (measured value) of the target sensor (estimation destination) at the same sensing time from the data storage unit 24 (S25) and compares it with the estimated value acquired in S24 (S26). The abnormality detection unit 23 determines whether or not the difference between the estimated value of the target sensor and the actually measured value is equal to or greater than a predetermined threshold value (S27).

Specifically, as shown in FIG. 7, the abnormality detection unit 23 reads the measured value Sn (t) 73 of the sensor data of the target sensor Sn at the sensing time t from the data storage unit 24, and reads the estimated value Sn_eval (t). 72 is compared with the measured value 73.

When it is equal to or higher than a predetermined threshold value (S27: YES), the abnormality detection unit 23 detects the abnormality of the target sensor (that is, determines that the abnormality has occurred in the target sensor), and determines that the abnormality has occurred in the sensor utilization device 3. Notify (S28).

When the difference between the estimated value and the measured value is equal to or greater than a predetermined threshold value, it means that the correlation between the target sensor and the sensor group is broken or has disappeared. For example, in the event of an abnormality such as a failure, falsification, theft, or replacement of the target sensor, the correlation between the target sensor and the sensor group is broken or lost. In the present embodiment, an abnormality is detected when the difference between the estimated value of the target sensor estimated using the model showing the correlation between the target sensor and the sensor group and the actually measured value of the target data deviates from each other. It is possible to detect an abnormality of a sensor that does not have an abnormality detection function with high accuracy.

In this embodiment and all the embodiments and modifications described below, the model storage unit 25 of the abnormality detection device 2 stores the model for each sensor. Then, the abnormality detection device 2 acquires the estimated values for all the other sensors S1 to Sn-1 as the target sensors using the corresponding models, and the difference between the estimated values and the actually measured values is predetermined. If it is a threshold value, an abnormality is detected.

Then, the sensor utilization device 3 outputs an error message indicating that an abnormality has occurred in the target sensor to an output device such as a display. When an abnormality is detected in the plurality of target sensors, a plurality of error messages are output to the sensor utilization device 3. The error message includes, for example, the sensor ID of the target sensor, the sensing time, and the like.

In the present embodiment described above, the model generation device 1 generates a model using the sensor data measured by each of the plurality of sensors 4 at the same time. The abnormality detection device 2 inputs the sensor data of the sensor group at a predetermined time into the model, acquires the estimated value of the target sensor at the predetermined time, and receives the estimated value of the target sensor and the sensor of the target sensor at the received predetermined time. When the difference from the data (actual measurement value) is equal to or greater than a predetermined threshold value, an abnormality of the target sensor is detected.

As described above, in the present embodiment, when the difference between the estimated value and the actually measured value is equal to or more than a predetermined threshold value (that is, when the correlation between the target sensor and the sensor group is broken to a certain ratio), the abnormality is caused. Detect. As a result, in the present invention, if the sensor fails, or if a malicious third party replaces the sensor with a fake, falsifies the sensor data to a fake value, steals, or otherwise performs fraudulent acts, it is easy. It is possible to detect an abnormality in the sensor.

If a malicious third party replaces one sensor with a fake or falsifies the sensor data with a fake value, even if it is possible to consider the continuity of the sensor data of the sensor, the other It is extremely difficult to replace the sensor with a fake or falsify the sensor data while maintaining the correlation with a large number of sensors. Therefore, in the present embodiment, it is possible to detect an abnormality with high accuracy and ensure robust security.

Further, in the present embodiment, the abnormality of the sensor can be detected without the sensor itself implementing the abnormality detection function. That is, even if the sensor itself does not have a high processing capacity, it can detect an abnormality.

<Modified example of the first embodiment>
As a modification of the first embodiment, the model generation unit 12 of the model generation device 1 determines a sensor to be used for model generation from the sensor data of the sensor group, and generates a model using the sensor data of the determined sensor. It may be that.

FIG. 8 is a diagram showing an example of sensor data used for the model generation process in the modified example of the first embodiment. In this modification, when generating a model in which the sensor data of the target sensor can be estimated from the sensor data of the sensor group, the model generation unit 12 does not use all the sensor data of the sensor group, but generates a model. The sensor to be used is randomly determined for each time. That is, the model generation unit 12 eliminates the sensors used for model generation at a constant rate. In the illustrated example, at time tk, the sensors S1, S3, etc. are excluded, the remaining sensors are determined as the sensors used for model generation, and the sensor data of the determined sensors are used for model generation as the teacher data of the sensor group. Used.

As a result, in this modified example, it is possible to avoid generating a model that is excessively dependent on the sensor data of a specific sensor, and to further improve the accuracy of sensor abnormality detection.

It should be noted that this modification can be applied to all the embodiments and modifications described below.

<Second embodiment>
The second embodiment is different from the first embodiment in that time-series sensor data sensed in a certain time width is used when generating a model and detecting an abnormality, and the other embodiments are the first. It is the same as the embodiment of. Since the configuration of this embodiment is the same as that of the first embodiment (FIGS. 1 to 3), description thereof will be omitted here.

The fixed time width is the time (time range) used in the model generation process and the abnormality detection process. In the present embodiment described below, for example, the time from time t-k to time t is used as a constant time width.

In the present embodiment, the model generator 1 obtains the model in which the latest sensor data of the target sensor in the time width can be estimated from the sensor data of the sensor group sensed in a time series in a fixed time width. Generate. The estimation unit 22 of the abnormality detection device 2 inputs sensor data generated in the time series of the sensor group retroactive by the time width from the predetermined time received by the reception unit 21 into the model, and estimates the target sensor at the predetermined time. After acquiring the value, the abnormality detection unit 23 detects the abnormality of the target sensor when the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the receiving unit 21 at a predetermined time is equal to or greater than a predetermined threshold value. Detect.

FIG. 9 is a diagram illustrating a model generation process performed by the model generation device 1 of the present embodiment. Here, S13 different from the first embodiment will be described. Since the other processes S11, S12, and S14 are the same as those in the first embodiment, the description thereof will be omitted.

In S13, the model generation unit 12 reads out from the data storage unit 14 the time-series sensor data sensed at the same time (a plurality of the same time) with a fixed time width for all of the plurality of sensors 4. A model is generated and updated using the time-series sensor data, and stored in the model storage unit 15.

FIG. 10 is a diagram showing an example of sensor data used in the model generation process of the present embodiment. In the illustrated example, of the n sensors, the sensor Sn is the target sensor, and the sensors S1 to Sn-1 are the sensor group. Then, the model generation unit 12 can estimate the latest sensor data of the target sensor Sn within the time width from the sensor data of the sensor groups S1 to Sn-1 sensed in a time series with a constant time width. (Model for Sn) is generated.

Specifically, as shown in FIG. 10, the model generation unit 12 has sensor data 101 sensed in time series with a constant time width (tk to t), and the latest target sensor Sn in the time width. A model is generated using the sensor data 102 of the above as training data. Further, the model generation unit 12 includes sensor data 103 sensed in time series with the next constant time width (t-k + 1 to t + 1) obtained by shifting the time width in the time direction, and the time width. The model is updated using the latest sensor data 104 of the target sensor Sn as training data. In this way, the model generation unit 12 reads out a plurality of sensor data of the sensor group sensed in a time series in a fixed time width and the latest target sensor data in the time width by shifting them in the time direction. The process of S13 is repeated to update the model.

The fixed time width may be set differently for each type of sensor.

In the present embodiment, a model is generated by analyzing the correlation between the sensor data generated in the time series of a fixed time width of the sensor group and the latest sensor data of the time width of the target sensor. In the present embodiment, by analyzing the correlation including the past sensor data having a certain time width, it is possible to generate a precise model in which the sensor data of the target sensor can be estimated with higher accuracy.

Further, in the example shown in FIG. 10, it was decided to generate a model using all the sensor data 101 and 102 of the fixed time width of the sensor group, but the sensor of a part of the fixed time width is used. The model may be generated using the data.

In this embodiment, a model corresponding to each sensor is generated as in the first embodiment, and a model for each sensor is stored in the model storage unit 25.

FIG. 11 is an explanatory diagram illustrating an abnormality detection process performed by the abnormality detection device 2. Here, S23 to S26 different from the first embodiment will be described. The other processes S21, S22, and S27 to S28 are the same as those in the first embodiment, and thus the description thereof will be omitted.

In S23, when the sensor data of all the sensors 4 that are traced back by a certain time width from a predetermined time (for example, the current time) is stored in the data storage unit 24, the estimation unit 22 has the time width from the data storage unit 24. Read out the sensor data generated in the time series of the sensor group (estimation source) in. Then, the estimation unit 22 inputs the read sensor data into the model of the target sensor stored in the model storage unit 25, and acquires an estimated value of the target sensor at a predetermined time (S24).

Specifically, as shown in FIG. 12, when acquiring the estimated value 72 of the target sensor Sn at the time t, the estimation unit 22 obtains the sensor data 121 of the sensor group that goes back a certain time width from the time t. Input to the sensor Sn model and acquire the estimated value at time t of the target sensor.

Then, the abnormality detection unit 23 reads out the sensor data (measured value) at a predetermined time of the target sensor (estimation source) from the data storage unit 24 (S25) and compares it with the estimated value acquired in S24 (S26).

Specifically, as shown in FIG. 12, the abnormality detection unit 23 reads the measured value Sn (t) 123 of the sensor data of the target sensor Sn at a predetermined time t from the data storage unit 24, and reads the estimated value Sn_eval (t). ) 122 and the measured value 123 are compared.

In the present embodiment, as in the first embodiment, the abnormality is detected by acquiring the estimated value for each sensor and comparing it with the actually measured value.

In the present embodiment described above, a model is generated by analyzing the correlation between the sensor data generated in the time series of a certain time width of the sensor group and the latest sensor data of the time width of the target sensor. Therefore, in the present embodiment, it is possible to generate a precise model in which the sensor data of the target sensor can be estimated with higher accuracy by analyzing the correlation including the past sensor data having a certain time width.

It should be noted that this embodiment can be applied to all the embodiments and modifications described below.

<Modified example of the second embodiment>
As a modification of the second embodiment, the model generator 1 estimates the sensor data of the target sensor after a lapse of a predetermined time (future, future) from the sensor data of the time series having a fixed time width of the past sensor group. It may be possible to generate a model capable of.

In this modification, the model generation unit 12 of the model generation device 1 obtains the sensor data of the target sensor after a lapse of a predetermined time from the time width from the sensor data of the sensor group sensed in time series with a constant time width. Generate the estimable model. The estimation unit 22 of the abnormality detection device 2 inputs the sensor data received by the reception unit 21 in the time series of the sensor group retroactive by the time width from the predetermined time into the model, and starts from the predetermined time of the target sensor. Obtain an estimated value after a predetermined time has elapsed. The abnormality detection unit 23 detects an abnormality of the target sensor when the difference between the estimated value of the target sensor and the sensor data received by the reception unit 21 after a predetermined time elapses from the predetermined time is equal to or greater than a predetermined threshold value. Is detected.

FIG. 13 is a diagram showing an example of sensor data used in the model generation process of this modified example. In the illustrated example, the sensor data 131 sensed in time series with a fixed time width (tk to t) and the sensor data 132 of the target sensor Sn after a lapse of a predetermined time (t + α) from the time width are used. Generate a model as teacher data. Further, the model generation unit 12 has the sensor data 133 sensed in time series with the next constant time width (t-k + 1 to t + 1) obtained by shifting the time width in the time direction, and the time width. The model is updated using the sensor data 134 of the target sensor Sn after a lapse of a predetermined time (t + 1 + α) as training data. In this way, the model generation unit 12 obtains the sensor data of the sensor group sensed in time series with a fixed time width and the sensor data of the target sensor in the near future after a predetermined time elapses from the time width. The model is updated by sequentially reading the data by shifting the direction and repeating the process of S13.

The predetermined time (α) may be set according to the service requirement or the type of sensor. Increasing the predetermined time (α) generally lowers the estimation accuracy, but makes it possible to predict the future farther away. On the other hand, if the predetermined time (α) is reduced, the estimation accuracy is generally higher, but only predictions in the near future can be made. In addition, since the optimum solution of α depends on the characteristics of the applicable system, it shall be determined according to the applicable system and service requirements (how much future value should be predicted).

FIG. 14 is a diagram showing an example of sensor data used in the abnormality detection process of this modified example. In this modification, in S23 of FIG. 11, when the sensor data of all the sensors having a certain time width is stored in the data storage unit 24, the estimation unit 22 receives the sensor group (from the data storage unit 24 to the sensor group in the time width). Read the sensor data of the estimation source). Then, the estimation unit 22 inputs the read sensor data into the model of the target sensor stored in the model storage unit 25, and acquires an estimated value of the target sensor after a predetermined time elapses (S24).

Specifically, as shown in FIG. 14, when the estimation unit 22 acquires the estimated value Sn_eval (t + α) 142 of the target sensor Sn at the time t + α, the estimation unit 22 goes back a predetermined time from the time t + α. , The sensor data 141 having a fixed time width (tk to t) of the sensor group is input to the sensor Sn model.

Then, when the sensor data (actual measurement value) of the target sensor Sn at a predetermined time (t + α) is stored in the data storage unit 24, the abnormality detection unit 23 reads out the sensor data (actual measurement value) (S25). , It is compared with the estimated value acquired in S24 (S26), and it is determined whether or not the difference between the estimated value of the target sensor and the sensor data (measured value) is equal to or more than a predetermined threshold value (S27).

In this modification, a model is generated by analyzing the correlation between the sensor data generated in the past fixed time width time series of the sensor group and the sensor data after a predetermined time elapses from the fixed time width of the target sensor. .. As a result, even if the correlation between the sensor data of the sensor group and the sensor data of the target sensor is time-shifted, it is possible to generate a precise model in which the sensor data of the target sensor can be estimated with higher accuracy. it can.

Further, in this modification, the correlation between the sensor group and the target sensor based on the time delay is modeled. As a result, when the sensor data at a certain time of the target sensor has a correlation with the past sensor data before a certain time of the sensor group, the model generated in this modification is used to be closer to the sensor data of the sensor group. The sensor data of future target sensors can be predicted. Therefore, by using the model of this modified example, it is possible to predict the occurrence of anomalies in the near future.

It should be noted that this modification can be applied to all the embodiments and modifications described below.

<Third embodiment>
FIG. 15 is a configuration diagram showing a configuration of an abnormality detection system according to a third embodiment of the present invention. The illustrated abnormality detection system includes two networks, an internal network constructed near the plurality of sensors 4 and an external network (so-called cloud) constructed at a location distant from the plurality of sensors 4. The external network is connected to the internal network via, for example, a dedicated line or VPN.

In the illustrated example, in a facility such as a factory where a plurality of sensors 4 are arranged, the plurality of sensors 4, the abnormality detection device 2, and the model generation device 1 are connected via an internal network. On the other hand, the sensor utilization device 3 is connected to an external network. The sensor utilization device 3 is installed at a place away from the facility where the sensor 4 is arranged, for example, as a cloud server.

In the present embodiment, the abnormality detection device 2 is arranged in the vicinity of the plurality of sensors 4. The receiving unit 21 of the abnormality detection device 2 receives sensor data from a plurality of sensors 4 installed in the vicinity via the internal network, and when the abnormality detecting unit 23 detects an abnormality in the sensor 4, the external network is connected. The abnormality is notified to the sensor utilization device 3 arranged at a distant place via the device.

Sensor data is likely to occur in large quantities and frequently. For example, a sensor 4 installed in a factory machine outputs sensor data at very short intervals. Therefore, when the abnormality detection device 2 is arranged at a location away from the sensor 4, a large number of sensors 4 are used every moment. Since it is necessary to transmit a large amount of sensor data to the abnormality detection device 2 in a remote location, a large amount of network bandwidth is required, and a network delay occurs, which makes it impossible to realize quick abnormality detection. There is.

On the other hand, in the present embodiment, a large amount of sensor data is processed by the abnormality detection device 2 installed near the sensor 4, the abnormality is detected, and only the detection result is transmitted to the sensor utilization device 3 at a remote location. As a result, processing with low delay is possible without imposing a load on the network band, and abnormality detection and prediction can be performed immediately.

Further, since the abnormality detection device 2 transmits only the abnormality detection result to the sensor utilization device 3 when the abnormality is detected, the network connecting the internal network and the external network may have a narrow transmission band.

It should be noted that this embodiment can be applied to all the above-described embodiments (including modified examples) and all the embodiments (including modified examples) described below.

<Fourth Embodiment>
FIG. 16 is a configuration diagram showing a configuration of an abnormality detection system according to a fourth embodiment of the present invention. The illustrated anomaly detection system differs from the anomaly detection system of the third embodiment in that it includes a network disconnection device 5 and a data processing device 6.

The network disconnection device 5 disconnects the instructed sensor 4 from the internal network in response to an instruction from the abnormality detection device 2. When the abnormality detection unit 23 of the abnormality detection device 2 of the present embodiment detects an abnormality of the sensor 4, it controls to disconnect the sensor 4 from the network.

The data processing device 6 collects sensor data from a plurality of sensors 4, and uses the collected sensor data to provide various services such as control of a device to be sensed. In the illustrated example, the data processing device 6 is connected to the internal network and is arranged in the vicinity of the plurality of sensors 4. The data processing device 6 of the present embodiment is a division of the functions of the sensor utilization device 3 of the first embodiment.

FIG. 17 is an explanatory diagram illustrating the abnormality detection process of the present embodiment. Since S21 to S28 shown in FIG. 17 are the same as any of the above-described embodiments, description thereof will be omitted here.

When the abnormality detection unit 23 detects an abnormality, the sensor utilization device 3 is notified that an abnormality has occurred (S28), and the network disconnection device 5 is instructed to disconnect the sensor 4 that has detected the abnormality from the internal network. Is transmitted (S29).

When the network disconnection device 5 receives the disconnection instruction, the network disconnection device 5 disconnects the sensor 4 specified by the disconnection instruction from the internal network.

In the illustrated example, the network disconnection device 5 is installed between the internal network and the plurality of sensors 4, but is installed between the internal network and the external network, and is installed between the internal network and the external network. You may disconnect the network. The installation location of the network disconnection device 5 can be appropriately changed according to the service requirements.

In the present embodiment, it is assumed that a large amount of sensor data output from the plurality of sensors 4 is transmitted not only to the abnormality detection device 2 but also to the data processing device 6 via the internal network.

In the present embodiment, when an abnormality occurs in the sensor 4, the sensor 4 is automatically disconnected from the network, so that inappropriate sensor data (abnormal value) is input to the data processing device 6 by the data processing device 6. It is possible to prevent inappropriate services from being performed.

When a wide transmission band is used for the network connecting the internal network and the external network, the data processing device 6 may be connected to the external network, or the functions of the data processing device 6 may be integrated into the sensor utilization device 3. Good.

It should be noted that this embodiment can be applied to all the above-described embodiments (including modified examples) and all the embodiments (including modified examples) described below.

<Modified example of the fourth embodiment>
As a modification of the fourth embodiment, when the abnormality detection unit 23 detects an abnormality in the target sensor, the estimation unit 22 of the abnormality detection device 2 uses the estimated value as the sensor data of the target sensor in the data processing device 6 (external). It may be transmitted to the device).

FIG. 18 is a diagram showing an example of abnormality detection processing in the modified example of the fourth embodiment. Since S21 to S29 shown in FIG. 18 are the same as those of the fourth embodiment (FIG. 17), description thereof will be omitted here.

After the abnormality detection unit 23 disconnects the network in S29, the estimation unit 22 transmits the estimated value of the target sensor estimated in S24 to the data processing device 6 as the sensor data of the target sensor (S30).

As a result, in this modified example, even if an abnormality occurs in a certain sensor, the estimated value estimated from the sensor data of another sensor group is substituted as the sensor data of the sensor in which the abnormality has occurred. Various controls and services using data can be avoided from stopping. That is, it is possible to avoid a problem that the service using the sensor data is stopped when the loss of the sensor data is not allowed.

Further, in S30, the estimation unit 22 may transmit the estimated value and the reliability (accuracy) indicating the degree of certainty that the estimated value is estimated to the data processing device 6. In addition, in the process of calculating the estimated value using a model by machine learning such as multidimensional correlation analysis technology and AutoEncoder, the reliability is also calculated. When the data processing device 6 processes the sensor data, the reliability may be used as auxiliary information. Further, the data processing device 6 may change the processing according to the reliability.

It should be noted that this modification can be applied to all the above-described embodiments (including the modification) and all the embodiments (including the modification) described below.

<Fifth Embodiment>
FIG. 19 is a configuration diagram showing a configuration of an abnormality detection system according to a fifth embodiment of the present invention. The model generation device 1 of the present embodiment updates the model stored in the model storage unit 15 by using the sensor data transmitted from the plurality of sensors 4, and transmits the updated model to the model storage device 7.

The illustrated anomaly detection system differs from the anomaly detection system of the third embodiment (FIG. 15) in that the model storage device 7 is provided in the external network.

The model storage device 7 is a device connected to an external network, and stores the model generated / updated by the model generation device 1. The model generation device 1 of the present embodiment updates the model using the sensor data transmitted from the plurality of sensors 4, and transmits the updated model to the model storage device 7.

FIG. 20 is an explanatory diagram illustrating a model generation process performed by the model generation device 1 of the present embodiment. In the present embodiment, the model generation device 1 stores the sensor data in the data storage unit 14 (S12) each time the sensor data is received from the plurality of sensors 4 (S11), and updates the model stored in the model storage unit 25. The process (S13) is repeated. Then, the model transmission unit 13 of the model generation device 1 periodically transmits the trained model stored in the model storage unit 15 to the model storage device 7 via the external network (S14). The model storage device 7 receives the model transmitted from the model generation device 1 and stores it in a model storage unit such as a memory or a disk (S15).

In the present embodiment, the trained model is transmitted to the model storage device 7 connected to the external network and stored, so that the model of the model storage unit 15 of the model generation device 1 or the model of the abnormality detection device 2 due to a failure or the like. When the model stored in the storage unit 25 is lost, the lost model can be quickly recovered from the model storage device 7.

Further, when developing a new abnormality detection system at another location using a sensor similar to the present embodiment, learning of the model is started using the trained model stored in the model storage device 7. be able to. As a result, the model generation process can be simplified and shortened.

Further, the abnormality detection device 2 selects and acquires the optimum model from the models of the plurality of abnormality detection systems stored in the model storage device 7, stores the acquired model in the model storage unit 25, and detects the abnormality. May be used.

It should be noted that this embodiment can be applied to all the above-described embodiments (including modified examples) and all the embodiments (including modified examples) described below.

<Sixth Embodiment>
A sixth embodiment of the present invention generates a classification model for classifying abnormalities, and when an abnormality is detected, determines the type of abnormality.

That is, the model generation device 1 of the present embodiment uses the sensor data of the plurality of sensors 4 at the time of the past abnormality to generate a classification model for specifying the abnormality pattern (type). Further, when the abnormality detection device 2 of the present embodiment detects an abnormality of the target sensor, the sensor data generated in the time series of the sensor group that goes back a predetermined time from the time of the abnormality detection and the sensor generated in the time series of the target sensor. Enter the data into the classification model and get the pattern of anomalies.

FIG. 21 is a diagram showing a classification model generation process performed by the model generation device 1 of the present embodiment. The receiving unit 11 of the model generation device 1 inputs sensor data at the time of an abnormality that has occurred in the past for each abnormality pattern (type) (S31), and stores the sensor data in the data storage unit 14 (S32). Examples of abnormality patterns include sensor failure, sensor theft, sensor replacement, and sensor data falsification.

FIG. 22 is a diagram showing an example of sensor data generated in a time series when an abnormality of the abnormality pattern 1 occurs a plurality of (n) times in the past in the target sensor Sn. In the present embodiment, the time-series sensor group and the sensor data 221 and 222 of the target sensor at a predetermined time until an abnormality occurs in the target sensor Sn are input to the model generation device 1 as teacher data.

The model generation unit 12 learns the tendency of the correlation between the sensor data 221 of the sensor group and the sensor data 222 of the target sensor to be broken for each abnormality pattern, generates a classification model, and stores the classification model in the model storage unit 15. (S33). That is, when an abnormality is detected, the model generation unit 12 generates a classification model for discriminating the abnormality pattern by inputting the sensor data of the sensor group and the target sensor that go back a predetermined time from the time when the abnormality is detected. To do.

FIG. 23 is an explanatory diagram showing an abnormality detection process performed by the abnormality detection device 2 in the present embodiment. The model storage unit 25 of the abnormality detection device 2 of the present embodiment stores a model for acquiring an estimated value for each sensor and a classification model for discriminating an abnormality pattern for each sensor. ..

The illustrated S21 to S27 are the same as any of the processes of the above-described embodiment. When an abnormality of the target sensor is detected in S27, the abnormality detection unit 23 transfers the sensor data of the sensor group having a time width that goes back a predetermined time from the time of abnormality detection to the classification model for the target sensor from the model storage unit 25 and the sensor data. The sensor data of the target sensor is input to the classification model, and the abnormality pattern is determined (S28). Then, the abnormality detection unit 23 transmits that an abnormality has occurred in the target sensor and the abnormality pattern to the sensor utilization device 3 (S29).

In the present embodiment, not only the notification that an abnormality has been detected but also the notification including the abnormality pattern enables the recovery work according to the abnormality pattern to be performed quickly.

It should be noted that this embodiment can be applied to all the above-described embodiments (including modified examples) and all the embodiments (including modified examples) described below.

<7th Embodiment>
A seventh embodiment of the present invention applies a convolutional neural network (hereinafter referred to as "CNN") using position information (spatial information) when a plurality of sensors are arranged in a geographical vicinity. , Generate a model.

CNN is one of the deep learning technologies, and is a neural network that automatically acquires features by repeating convolution and pooling processes multiple times. The CNN is described below.

Literature "Development of new artificial intelligence (AI)" time series deep learning "to understand human" movement ", succeeded in identification with accuracy of over 80%", NTT Communications Corporation, October 7, 2015, [online ], [Search on April 25, 2016], <URL: http://www.ntt.com/about-us/press-releases/news/article/2015/20151007_4.html>

24 to 26 are explanatory views for explaining CNN in the present embodiment. FIG. 24 shows a plurality of sensors 4 arranged in a certain space. FIG. 25 shows the type V of the sensor (1) and the sensor data generated in time series. It is assumed that the model generation device 1 and the abnormality detection device 2 of the present embodiment manage the three-dimensional position information (W, D, H) of each sensor and the sensor type (V).

FIG. 26 shows an image of convolution. When the model generation device 1 of the present embodiment generates a model, the three-dimensional position information (W, D, H) in which the sensors are arranged, the sensor type (v), and the time information (T) are used. The five-dimensional information is convoluted in CNN to generate a model. This makes it possible to draw out feature points in space and the passage of time that were previously invisible.

In FIG. 26, five-dimensional information including the sensor type is convolved, but when only sensors of the same type are arranged, the position information (W, D, H) and the time information (T) are used. It is also possible to generate a model by convolving the four-dimensional information with CNN.

FIG. 27 is an explanatory diagram illustrating a model generation process performed by the model generation device 1 of the present embodiment. The model generation device 1 of the present embodiment includes a position / type storage unit 16 that stores three-dimensional position information of each sensor 4 and a sensor type.

Since S11, S12, and S14 of FIG. 27 are the same as any of the above-described embodiments (including modified examples), description thereof will be omitted here. In S13 of FIG. 27, the model generation unit 12 reads out the sensor data of each sensor 4 from the data storage unit 14, and also reads out the position information and the sensor type of each sensor 4 from the position / type storage unit 26. Then, the model generation unit 12 applies the CNN by using the read sensor data, the position information, and the sensor type, generates and updates the model, and stores it in the model storage unit 15.

FIG. 28 is an explanatory diagram illustrating an abnormality detection process performed by the abnormality detection device 2 of the present embodiment. The abnormality detection device 2 of the present embodiment includes a position / type storage unit 26 that stores three-dimensional position information of each sensor 4 and a sensor type.

Since S21 to S23 and S25 to S28 of FIG. 28 are the same as any of the above-described embodiments (including modified examples), description thereof will be omitted here. In S23 of FIG. 28, the estimation unit 22 inputs the sensor data of the sensor group from the model storage unit 25 into the model of the target sensor, and inputs the position information and the sensor type of the sensor group read from the position / type storage unit 26. Input and get the estimated value of the target sensor.

In the present embodiment, by applying CNN using the three-dimensional position information of each sensor to generate a model, it is possible to generate a highly accurate model in consideration of the geographical proximity of the sensors. That is, in the present embodiment, the accuracy of the estimated value can be improved, and the abnormality of the sensor can be detected with high accuracy.

This embodiment can be applied to all the above-described embodiments (including modified examples) and all the embodiments (including modified examples) described below.

The present invention is not limited to the above embodiment, and many modifications can be made within the scope of the gist thereof. For example, any of the above-mentioned first to seventh embodiments (including modified examples) can be arbitrarily combined.

1: Model generator 11: Receiver 12: Model generator 13: Model transmitter 14: Data storage 15: Model storage 16: Position / type storage 2: Anomaly detection device 21: Receiver 22: Estimator 23 : Anomaly detection unit 24: Data storage unit 25: Model storage unit 26: Position / type storage unit 3: Sensor utilization device 4: Sensor 5: Network disconnection device 6: Data processing device

Claims (16)

An abnormality detection system including a model generator and an abnormality detection device.
The model generator divides a plurality of sensors into a target sensor and a sensor group other than the target sensor, analyzes the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and analyzes the correlation between the sensor data of the sensor group and the sensor group of the target sensor. A model capable of estimating the sensor data of the target sensor from the sensor data is generated.
The abnormality detection device is
A receiving unit that receives sensor data from the plurality of sensors,
An estimation unit that inputs sensor data of the sensor group received by the reception unit into the model and acquires an estimated value of the sensor data of the target sensor.
The estimated value of the target sensor, the difference between the sensor data of the target sensor received by the receiving unit is, Bei give a, an abnormality detection unit for detecting an abnormality of the subject sensors in the case of more than a predetermined threshold value,
The model generator generates a classification model that identifies the type of abnormality by using the sensor data of the plurality of sensors at the time of the past abnormality.
When the abnormality detection unit detects an abnormality in the target sensor, the abnormality detection unit inputs the sensor data of the sensor group and the sensor data of the target sensor retroactively from the time of the abnormality detection into the classification model, and inputs the sensor data of the target sensor to the classification model. Anomaly detection system characterized by acquiring the type. The abnormality detection system according to claim 1.
The model generator generates the model by using the sensor data measured by the plurality of sensors at the same time.
The estimation unit inputs the sensor data of the sensor group at a predetermined time received by the reception unit into the model, acquires the estimated value of the target sensor at the predetermined time, and obtains the estimated value of the target sensor.
The abnormality detection unit detects an abnormality in the target sensor when the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the receiving unit at the predetermined time is equal to or greater than a predetermined threshold value. Anomaly detection system characterized by this. The abnormality detection system according to claim 1.
The model generation device generates the model in which the latest sensor data of the target sensor in the time width can be estimated from the sensor data of the sensor group sensed in a time series in a fixed time width.
The estimation unit inputs the sensor data of the sensor group received by the reception unit back by the time width from the predetermined time into the model, acquires the estimated value of the target sensor at the predetermined time, and obtains the estimated value of the target sensor at the predetermined time.
The abnormality detecting unit detects an abnormality of the target sensor when the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the receiving unit at the predetermined time is equal to or greater than a predetermined threshold value. Anomaly detection system characterized by doing. The abnormality detection system according to claim 1.
The model generator generates the model in which the sensor data of the target sensor after a lapse of a predetermined time from the time width can be estimated from the sensor data of the sensor group sensed in a time series with a fixed time width. ,
The estimation unit inputs the sensor data of the sensor group received by the receiving unit back by the time width from the predetermined time into the model, and after a predetermined time has elapsed from the predetermined time of the target sensor. Get an estimate,
When the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the receiving unit after a lapse of a predetermined time from the predetermined time is equal to or greater than a predetermined threshold value, the abnormality detection unit said. An anomaly detection system characterized by detecting anomalies in the target sensor. The abnormality detection system according to any one of claims 1 to 4.
The model generation device updates the model at a predetermined timing using sensor data transmitted from the plurality of sensors, and transmits the updated model to the abnormality detection device.
The estimation unit of the abnormality detection device is an abnormality detection system characterized in that the estimated value is acquired by using the updated model. The abnormality detection system according to any one of claims 1 to 5.
The model generation device is an abnormality detection system characterized in that a sensor to be used for generating the model is determined from the sensor data of the sensor group, and the model is generated using the sensor data of the determined sensor. The abnormality detection system according to any one of claims 1 to 6.
The abnormality detection device is an abnormality detection system characterized in that the abnormality detection device is arranged in the vicinity of the plurality of sensors. The abnormality detection system according to any one of claims 1 to 7.
The abnormality detection unit is an abnormality detection system characterized in that when an abnormality of the target sensor is detected, the abnormality detection unit controls to disconnect the target sensor from the network. The abnormality detection system according to claim 8.
The estimation unit is an abnormality detection system characterized in that when the abnormality detection unit detects an abnormality in the target sensor, the estimated value is transmitted to an external device as sensor data of the target sensor. The abnormality detection system according to any one of claims 1 to 9.
The model generation device is an abnormality detection system characterized in that the model is updated using sensor data transmitted from the plurality of sensors and the updated model is transmitted to the model storage device. The abnormality detection system according to any one of claims 1 to 10.
The model generation device is an anomaly detection system characterized in that a convolutional neural network is applied based on the position information of the plurality of sensors to generate the model. A model generator that generates a model for detecting sensor abnormalities.
A receiver that receives sensor data from multiple sensors,
The plurality of sensors are divided into a target sensor and a sensor group other than the target sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and the target is obtained from the sensor data of the sensor group. It is equipped with a model generator that generates a model that can estimate the sensor data of the sensor .
The model generation unit is a model generation device characterized by generating a classification model that identifies a type of abnormality by using sensor data of the plurality of sensors at the time of a past abnormality. An abnormality detection device that detects sensor abnormalities.
A receiver that receives sensor data from multiple sensors,
The plurality of sensors are divided into a target sensor and a sensor group other than the target sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and the target is obtained from the sensor data of the sensor group. A storage unit that stores a model that can estimate the sensor data of the sensor,
An estimation unit that inputs sensor data of the sensor group received by the reception unit into the model and acquires an estimated value of the sensor data of the target sensor.
An abnormality detection unit that detects an abnormality of the target sensor when the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the reception unit is equal to or greater than a predetermined threshold value is provided .
When the abnormality detection unit detects an abnormality in the target sensor, the abnormality detection unit uses the sensor data of the sensor group and the sensor data of the target sensor, which are traced back from the time of the abnormality detection by a predetermined time, to the sensor data of the plurality of sensors at the time of the past abnormality. An anomaly detection device characterized by inputting into a classification model for identifying an abnormality type generated using sensor data and acquiring the anomaly type. It is an abnormality detection method performed by an abnormality detection system including a model generation device and an abnormality detection device.
The model generator divides a plurality of sensors into a target sensor and a sensor group other than the target sensor, analyzes the correlation between the sensor data of the sensor group and the sensor data of the target sensor, and analyzes the correlation between the sensor data of the sensor group and the sensor group of the target sensor. A generation step is performed to generate a model in which the sensor data of the target sensor can be estimated from the sensor data.
The abnormality detection device is
A reception step for receiving sensor data from the plurality of sensors, and
An estimation step in which sensor data of the sensor group received in the reception step is input to the model and an estimated value of the sensor data of the target sensor is acquired.
The estimated value of the target sensor, the difference between the sensor data of the target sensor received by the receiving step, have rows, and abnormality detecting step of detecting an abnormality of the subject sensors in the case of more than a predetermined threshold value,
In the generation step, a classification model for identifying the type of abnormality is generated by using the sensor data of the plurality of sensors at the time of the past abnormality.
In the abnormality detection step, when an abnormality of the target sensor is detected, the sensor data of the sensor group and the sensor data of the target sensor that go back a predetermined time from the time of abnormality detection are input to the classification model, and the abnormality is detected. Anomaly detection method characterized by acquiring the type. A model generation program executed by a computer that generates a model for detecting sensor abnormalities.
The computer
A receiver that receives sensor data from multiple sensors, and a receiver
The plurality of sensors are divided into a target sensor and a sensor group other than the target sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and the target is obtained from the sensor data of the sensor group. It functions as a model generator that generates a model that can estimate the sensor data of the sensor .
The model generation unit is a model generation program characterized by generating a classification model that identifies a type of abnormality by using sensor data of the plurality of sensors at the time of a past abnormality. An anomaly detection program executed by a computer that detects anomalies in sensors.
The computer
A receiver that receives sensor data from multiple sensors,
The plurality of sensors are divided into a target sensor and a sensor group other than the target sensor, the correlation between the sensor data of the sensor group and the sensor data of the target sensor is analyzed, and the target is obtained from the sensor data of the sensor group. A storage unit that stores a model that can estimate the sensor data of the sensor,
An estimation unit that inputs sensor data of the sensor group received by the reception unit into the model and acquires an estimated value of the sensor data of the target sensor, and an estimation unit.
It functions as an abnormality detection unit that detects an abnormality of the target sensor when the difference between the estimated value of the target sensor and the sensor data of the target sensor received by the reception unit is equal to or greater than a predetermined threshold value .
When the abnormality detection unit detects an abnormality in the target sensor, the abnormality detection unit uses the sensor data of the sensor group and the sensor data of the target sensor, which are traced back from the time of the abnormality detection by a predetermined time, to the sensor data of the plurality of sensors at the time of the past abnormality. An anomaly detection program characterized by inputting into a classification model that identifies the type of anomaly generated using sensor data and acquiring the type of the anomaly.

Images