JP7040851B2 - Anomaly detection device, anomaly detection method and anomaly detection program - Google Patents

Description

The present invention relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program.

If a failure occurs in a production facility and production is stopped, production efficiency will drop. Therefore, it is desirable to detect a sign of failure and perform maintenance to prevent production stoppage, and to promptly identify the cause of failure and perform repair when a failure occurs. However, with the increase in scale and complexity of production equipment, workers manually detect abnormalities that are predictive of failure and detect abnormal parts that are the cause of failure (hereinafter, also referred to as abnormality detection). Things are getting harder.

In addition, in information systems that provide web services and business services via the Internet, as the importance of social infrastructure increases, delays and interruptions in services due to failures are not allowed, and the services are provided. It is important to operate and manage devices such as servers so that they can be operated stably. Therefore, it is required to detect not only the abnormalities that have occurred but also the states such as performance deterioration that is not a clear abnormality and signs of failures that are expected to occur in the future, and perform planned maintenance.

Examples of the technique for detecting such an abnormality include Patent Documents 1 to 3 shown below. In Patent Document 1, the first performance series information indicating the time-series change of the performance information relating to at least the first element and the time-series change of the performance information relating to the second element are shown with the performance item or the observation target as an element. A correlation function with the performance series information of 2 is derived, a correlation model is generated based on this correlation function, this correlation model is obtained for the combination between each element, and based on the performance information newly detected and acquired from the observation target. Therefore, an anomaly detection device that analyzes changes in the correlation model has been proposed.

In Patent Document 2, a transaction of a service performed by each of a plurality of computers to any other computer is collected, a correlation matrix between nodes in the system is calculated from the transaction, and the activity balance of the node is calculated from the transaction. Find the feature vector to represent. An anomaly detection system has been proposed that detects the transition to an abnormal state by monitoring the feature vector with a probability model.

In Patent Document 3, a plurality of correlation function candidates representing the correlation of a pair of metrics in a system are stored, and among the plurality of correlation function candidates, correlation destruction is likely to occur when the metric related to the correlation function is abnormal. A system analyzer has been proposed that extracts one correlation function as a correlation function of the pair of metrics based on the detection sensitivity indicating the above.

In addition, a technique of machine learning about measurement data and determining an abnormality by a neural network or SVM (support vector machine) has also been proposed.

Japanese Unexamined Patent Publication No. 2009-199533 Japanese Unexamined Patent Publication No. 2005-21066 Japanese Patent No. 6183450

In a system that determines an abnormality in a black box manner by a neural network or SVM, even if the abnormality can be detected, the basis of the abnormality is not shown, and it is difficult to take appropriate measures according to the abnormality.

In addition, a system has been proposed in which an abnormal element can be identified by finding a correlation for each combination of two elements and detecting an abnormality. In such a system, two elements are used. There is a problem that anomalies cannot be detected unless there is a linearly continuous correlation for the combination.

When detecting an abnormality in a computer system, information such as the CPU operating rate, memory usage rate, and the number of running threads, which are the factors for detecting the abnormality, can be easily obtained, and the same phenomenon occurs under the same conditions. It is easy to select elements that have a linear correlation because they are likely to do so.

On the other hand, when detecting an abnormality in production equipment or the like, various elements may be related to each other and an abnormality may occur, so that the measurement data of each element does not always correlate linearly. In addition, in order to measure the state of production equipment, sensors and input interfaces for that purpose will be installed, so it is realistic to install sensors etc. in every element to search for data with linear correlation. Not. For this reason, it has sometimes been difficult to accurately detect anomalies with a conventional anomaly detection system.

Therefore, an object of the present invention is to provide a technique for accurately detecting an abnormality even when measurement data having no linear correlation is used when detecting an abnormality of a measurement target.

The abnormality detection device according to the present invention is
A data acquisition unit that acquires measurement data indicating the state of multiple items in the observation target, and
The measurement data acquired at a predetermined timing is regarded as one data group (for example, a record), a plurality of data groups acquired at different timings are regarded as training data, and N combinations of the plurality of items are included in the training data. A model generation unit that generates a learning model by obtaining an N-dimensional probability density from the measurement data and obtaining the N-dimensional probability density for the plurality of the combinations.
A score calculation unit that obtains the probability of obtaining the measurement data related to N combinations of the items from the data group to be evaluated from the learning model and calculates an abnormal score based on the probability.
A detection unit that calculates the score of the data group based on the abnormality score related to a plurality of combinations of the items and detects the abnormality of the observation target based on the score of the data group.
To prepare for.

The abnormality detection device may include a display control unit that causes the link to be generated in a display form corresponding to the abnormality score when displaying a node indicating the item and a link indicating a combination of the nodes on the display device. ..

In the abnormality detection device, the model generation unit
Of the N combinations of the above items, the range of measurement data that can be taken by each item is taken on the first to Nth axes, and the range of measurement data that can be taken by the second item is orthogonal to the first axis. For the second axis,
Regarding the N-dimensional probability density obtained from the measurement data of the first to Nth items, the space with high probability density and the probability density are obtained when the probability density of each item is accumulated from the higher one and the predetermined cumulative probability is reached. Divided into a low space by a superplane, the area of the N-dimensional probability density in the superplane is defined as the α% cross-sectional area, and the area within the range that each item can take in the superplane is obtained as the total area.
Divide the total area by the α cross-sectional area to obtain the α% cross-sectional ratio.
A combination having an α% cross-sectional ratio less than the threshold value may be selected, and the learning model may be generated for the selected combination.

Further, the abnormality detection method according to the present invention is
A step to acquire measurement data indicating the state of multiple items in the observation target, and
The measurement data acquired at a predetermined timing is regarded as one data group, the plurality of data groups acquired at different timings are regarded as training data, and N combinations of the plurality of items are obtained from the measurement data included in the training data. A step of obtaining an N-dimensional probability density, obtaining the N-dimensional probability density for the plurality of the above combinations, and generating a learning model.
A step of obtaining the probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model and calculating an abnormality score based on the probability.
A step of calculating the score of the data group based on the abnormality score related to a plurality of combinations of the items and detecting the abnormality of the observation target based on the score of the data group.
Is executed by the computer.

The abnormality detection method may include a step of generating the link in a display form corresponding to the abnormality score when displaying the node indicating the item and the link indicating the combination of the nodes on the display device.
The abnormality detection method is
Of the N combinations of the above items, the range of measurement data that can be taken by each item is taken on the first to Nth axes, and the range of measurement data that can be taken by the second item is orthogonal to the first axis. For the second axis,
Regarding the N-dimensional probability density obtained from the measurement data of the first to Nth items, the space with high probability density and the probability density are obtained when the probability density of each item is accumulated from the higher one and the predetermined cumulative probability is reached. Divided into a low space by a superplane, the area of the N-dimensional probability density in the superplane is defined as the α% cross-sectional area, and the area within the range that each item can take in the superplane is obtained as the total area.
Divide the total area by the α cross-sectional area to obtain the α% cross-sectional ratio.
A combination having an α% cross-sectional ratio less than the threshold value may be selected, and the learning model may be generated for the selected combination.

The contents described in the means for solving the problem can be combined as much as possible without departing from the problem and the technical idea of the present invention. The content of the means for solving the problem can be provided as a device such as a computer or a system including a plurality of devices, a method executed by the computer, or a program executed by the computer. For example, the present invention may be a program for causing a computer to execute each step of the abnormality detection method. Further, the present invention may be a computer-readable recording medium that holds this program.

INDUSTRIAL APPLICABILITY According to the present invention, when detecting an abnormality of a measurement target, it is possible to provide a technique for accurately detecting an abnormality even when measurement data having no linearly continuous correlation is used.

FIG. 1 is a block diagram showing a configuration of an abnormality detection device according to an embodiment. FIG. 2 is a diagram showing an example of measurement data stored in the storage device. FIG. 3 is a diagram showing a hardware configuration of the abnormality detection device. FIG. 4 is a diagram showing a processing procedure for acquiring measurement data. FIG. 5 is a diagram showing a processing procedure for generating a learning model. FIG. 6 is a diagram showing a processing procedure for detecting an abnormality of an observation target. FIG. 7 is a graph showing an example of a two-dimensional probability density. FIG. 8 is an explanatory diagram of an abnormality score obtained from a probability density function for the measurement data (sample) to be evaluated. FIG. 9 is a diagram showing a display example of the detection result. FIG. 10 is a diagram showing an example of a network diagram showing anomalous factors. FIG. 11 is a diagram illustrating a time series graph of abnormal scores in a combination of specific items. FIG. 12 is an explanatory diagram of an example of performing anomaly detection using probability density. FIG. 13A is a diagram showing an example of adding and averaging Gaussian kernel functions. FIG. 13B is a diagram showing an example of approximating a complicated probability density function with a Gaussian kernel function. FIG. 14 is a diagram showing an example of mixing Gaussian distributions. FIG. 15 is a diagram showing contour lines of the mixed elements. FIG. 16 is a diagram showing contour lines of the peripheral probability densities of the mixture distribution. FIG. 17 is an explanatory diagram of the α% cross-sectional ratio.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. The following embodiments are examples of the present invention, and the present invention is not limited to the following configurations.

<Device configuration>
FIG. 1 is a block diagram showing a configuration of an abnormality detection device according to the present embodiment. The anomaly detection device 3 acquires measurement data for a plurality of items in an observation target such as a production facility, estimates the probability density of the data, and regards the one having a low likelihood as an abnormality.

As shown in FIG. 1, the abnormality detection device 3 is connected to each production facility 2 which is an example of an observation target via a communication line N. The communication line N may be a simple cable or a network such as a LAN. Further, the communication line may be wired or wireless.

The abnormality detection device 3 has a data acquisition unit 31, a model generation unit 32, a score calculation unit 33, a detection unit 34, and a display control unit 35.

The data acquisition unit 31 acquires measurement data indicating the state of a plurality of items in the observation target and stores them in a storage device. The measurement data is acquired via the communication line N, for example, information used for control or the like in the production equipment 2 such as the rotation speed of the motor, the value of the drive current, the control signal of the actuator, the number of operations, and the like. Further, the data acquisition unit 31 may measure sound, heat, vibration, etc. emitted from the production equipment 2 with a sensor included in the abnormality detection device 3, and may use this measured value as measurement data.

The model generation unit 32 uses measurement data acquired at a predetermined timing as one record (data group), a plurality of records acquired at different timings as training data, and the training data for a combination of two of the plurality of items. A two-dimensional probability density is obtained from the measurement data included in the above, and the two-dimensional probability density is obtained for the plurality of the combinations to generate a learning model.

The score calculation unit 33 obtains the probability of obtaining the measurement data related to the combination of the two items from the data group to be evaluated from the learning model, and calculates the abnormality score based on the probability.

The detection unit 34 detects the abnormality of the observation target based on the abnormality score related to the combination of the plurality of the items.

The display control unit 35 causes the display device to display the detection result of the abnormality detected by the detection unit 34. For example, when the display control unit 35 causes the display device to display the node indicating the item and the link indicating the combination of the nodes, the display control unit 35 generates the link in a display form corresponding to the abnormality score.

FIG. 2 shows an example of measurement data acquired by the data acquisition unit 31 and stored in the storage device. In the example of FIG. 2, the measurement data is acquired at predetermined time intervals after the start of observation, and the measured values of a plurality of items acquired at a predetermined timing are stored as one record, and a plurality of measured values sequentially acquired at different timings. Records are accumulated as learning data.

FIG. 3 is a diagram showing a hardware configuration of the abnormality detection device 3. The abnormality detection device 3 is, for example, a computer (information processing device) as shown in FIG. The abnormality detection device 3 shown in FIG. 3 includes a CPU (Central Processing Unit) 301, a main storage device 302, an auxiliary storage device (external storage device) 303, a communication IF (Interface) 304, an input / output IF (Interface) 305, and a drive device. It is equipped with a 306 and a communication bus 307. The CPU 301 performs the processing and the like according to the present embodiment by executing the program. The main storage device 302 caches the programs and data read by the CPU 301, and expands the work area of the CPU. Specifically, the main storage device is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like. The auxiliary storage device 303 stores programs executed by the CPU 301, location information, and the like. Specifically, the auxiliary storage device 303 is an HDD (Hard-disk Drive).
), SSD (Solid State Drive), eMMC (embedded Multi-Media Card), flash memory, etc. The main storage device 302 and the auxiliary storage device 303 also function as a storage device for storing measurement data. The communication IF 304 transmits / receives data to / from another computer.

The abnormality detection device 3 is connected to the network via the communication IF 304. Specifically, the communication IF 304 is a wired or wireless network card or the like. The input / output IF305 is connected to an input / output device, receives input from the user, and outputs information to the user. Specifically, the input / output device includes a keyboard, a mouse, a display 351 and a touch panel, a sensor 352, and the like. The display 351 displays information such as an abnormality detection result to the user. The sensor 352 is a means for measuring the state of an observation target, such as a temperature sensor, a vibration sensor, an acceleration sensor, an image pickup device, and a microphone.

The drive device 306 reads data recorded on a storage medium such as a magnetic disk, a magneto-optical disk, or an optical disk, or writes data to the storage medium. The components as described above are connected by the communication bus 307. It should be noted that a plurality of these components may be provided, or some components (for example, the drive device 306) may not be provided. Further, the input / output device may be integrally configured with the computer. Further, a program executed in the present embodiment is provided via a portable storage medium that can be read by the drive device 306, a portable auxiliary storage device 303 such as a flash memory, a communication IF 304, and the like. You may do it.

The CPU 301 loads the program into the main storage device and executes it. In the abnormality detection device 3, the CPU 301 operates as a data acquisition unit 31, a model generation unit 32, a score calculation unit 33, and a detection unit 34.

The CPU 301 corresponds to a processing device in this example. The CPU 301 is also called an MPU (Micro Processor Unit), a microprocessor, or a processor. The CPU 301 is not limited to a single processor, and may have a multiprocessor configuration. Further, a single CPU connected by a single socket may have a multi-core configuration. Even if at least a part of the above processing is performed by a processor other than the CPU, for example, a dedicated processor such as a Digital Signal Processor (DSP), Graphics Processing Unit (GPU), numerical arithmetic processor, vector processor, image processing processor, etc. good. Further, at least a part of the processing of each of the above parts may be an integrated circuit (IC) or another digital circuit. Further, an analog circuit may be included in at least a part of each of the above parts. Integrated circuits include LSI, Application Specific Integrated Circuit (ASIC), and programmable logic device (PL).
D) is included. The PLD includes, for example, a Field-Programmable Gate Array (FPGA). Each of the above parts may be a combination of a processor and an integrated circuit. The combination is called, for example, an MCU (Micro Controller Unit), a SoC (System-on-a-chip), a system LSI, a chipset, or the like.

<Abnormality detection method>
Next, an abnormality detection method executed by the abnormality detection device 3 having the above configuration will be described. FIG. 4 is a diagram showing a processing procedure for acquiring measurement data, FIG. 5 is a diagram showing a processing procedure for generating a learning model, and FIG. 6 is a diagram showing a processing procedure for detecting an abnormality in an observation target.

When the abnormality detection device 3 receives an instruction to start observation by an operation or the like of a user, the abnormality detection device 3 starts the process of FIG. 4 and determines whether or not a predetermined measurement timing has been reached (step S10).

In the case of a negative determination in step S10, the abnormality detection device 3 ends the process of FIG. On the other hand, in the case of an affirmative determination in step S10, the abnormality detection device 3 acquires measurement data (step S20).

In step S20, the abnormality detection device 3 acquires measurement data for a plurality of preset items. For example, the abnormality detection device 3 acquires measurement data by measuring the state of the measurement target with a temperature sensor, a vibration sensor, or the like. Further, the abnormality detection device 3 may read information such as an operation history from a storage medium to be measured, or acquire information such as a control signal, and use these information as measurement data. In FIG. 4, for the sake of simplicity, the process of acquiring measurement data for a plurality of items is shown in one step, but the procedure for sequentially acquiring the measurement data of each item and the measurement data of a plurality of items are acquired in parallel. If the measurement data can be acquired for a predetermined item, such as, the measurement data may be acquired by any procedure. The measured data may be standardized, normalized, standardized and converted into a predetermined format. For example, the data may be standardized with the average set to 0 and the standard deviation set to 1 for each item as shown in the following equation.
Value after standardization = (numerical value-mean value) / standard deviation

Further, as in the following equation, the data may be standardized with the minimum value set to 0 and the maximum value set to 1 for each item.
Value after standardization = (numerical value-minimum value) / (maximum value-minimum value)

Then, the abnormality detection device 3 stores the measurement data acquired at a predetermined timing in the storage device as one record (step S30). Here, the predetermined timing is, for example, the same timing. Further, the timing is not limited to exactly the same time, and the timing may be close to the extent that the states of each item are related to each other. For example, when the measurement data is acquired every predetermined period, the measurement data is acquired within the same period. The measurement data may be the measurement data acquired at the same timing. Further, the predetermined timing may be a predetermined measurement timing for detecting the same abnormality. For example, one record is the data measured in the first to nth processes when manufacturing a certain product, and the next record is the data measured in the first to nth processes when manufacturing a product. In this case, the timing measured in the first to nth processes is set as a predetermined timing in order to detect an abnormality in each product.

The abnormality detection device 3 repeatedly executes the process of FIG. 4 until it receives an instruction to end the measurement by the user's operation or the like. As a result, records of measurement data are accumulated for each measurement timing and used as learning data.

The abnormality detection device 3 starts the process of FIG. 5 when the start is instructed by the user's operation or the like, or at a predetermined time interval.

In step S110, the abnormality detection device 3 obtains a correlation coefficient for each combination of two of the training data. For example, when there are items A, B, and C, Pearson's correlation coefficient is calculated for all combinations, such as [A, B], [B, C], and [A, C].

In step S120, the abnormality detection device 3 selects a highly relevant combination based on the correlation coefficient calculated in step S110. For example, select a combination whose correlation coefficient is equal to or greater than the threshold value. Not limited to this, a predetermined number of combinations may be selected, a combination of a predetermined ratio may be selected from all the combinations, and a combination thereof may be selected. Further, in steps S110 and S120, the combination of items is selected using the Pearson's correlation coefficient, but the present invention is not limited to this, and MIC (Maximum Information Coefficient) can be used as long as the strength of the relevance of each item can be evaluated. ) Or, as described later, the probability density may be used.

In step S130, the abnormality detection device 3 obtains a two-dimensional probability density from the measurement data included in the training data for the combination selected in step S120, and obtains the two-dimensional probability density for the plurality of the combinations. , Generate a learning model. The probability density can be estimated using methods such as maximum likelihood method, Bayesian estimation, kernel density estimation method, and mixed Gaussian distribution. The specific calculation method will be described later. In addition, the set of probability densities calculated for the combination of two different items is called a learning model.

FIG. 7 is a graph showing an example of a two-dimensional probability density. In FIG. 7, the measured value of the item A is taken on the x-axis, the measured value of the item B is taken on the y-axis, the probability density is taken on the z-axis, and the change in the probability density with respect to each measured value is shown in a mesh. In FIG. 7, the portion having a high probability density, that is, the portion having a high peak shown by the mesh is the portion having a high likelihood as a normal measured value, and the portion having a low probability density has a likelihood as a normal measured value. The low part.

Further, the abnormality detection device 3 starts the process of FIG. 6 when a predetermined detection timing is reached, such as when an abnormality detection is instructed by a user's operation or when evaluation data is acquired. do. In this example, the process of creating the learning model of FIG. 5 and the process of detecting the abnormality in FIG. 6 are shown separately, but the process of creating the learning model is followed by the process of detecting the abnormality. Is also good.

In step S210, the abnormality detection device 3 targets the newly acquired record of measurement data as an evaluation target, and extracts a combination of items selected in step S120 from the record to be evaluated.

In step S220, the abnormality detection device 3 uses the measurement data of the combination extracted in step S210 as the evaluation target, and acquires the probability that the measurement data appears from the learning model.

FIG. 8 is an explanatory diagram of an abnormality score obtained from a probability density function for the measurement data (sample) to be evaluated. In FIG. 8, the measured value of item C is taken on the vertical axis and the measured value of item D is taken on the horizontal axis, and the abnormality score obtained from each measured value is shown in contour lines. In the example of FIG. 8, the learning data shown by the black dots are concentrated on the right side and the upper side of FIG. 8, and the probability density of this portion is high. Therefore, the abnormal score in the upper right of FIG. 8 is low, and the abnormal score becomes higher toward the lower left. Here, when the measured data of the item C is 85 and the measured value of the item D is 7.5, the abnormal score exceeds 60,000 and the abnormality score is concentrated at 15,000 or less. Therefore, it can be detected that the abnormal score is high.

In step S230, the abnormality detection device 3 obtains a total score for each record (hereinafter, also simply referred to as a record score) based on the abnormality score for each combination. The score of the record may be a function that inputs an abnormal score for each combination, and may be, for example, an average value, a maximum value, a weighted average, or the like. The weighted average is, for example, a weight is set in advance for each combination of the above items, and each abnormality score is multiplied by the weight to calculate the average. That is, the score is calculated by increasing the weight of important items and items that are likely to reflect the effects of abnormalities. Further, the process of selecting the combination in step S120 may be omitted, and each abnormality score may be obtained by reflecting the absolute value of the correlation coefficient obtained in step S110 in the weight. In addition, if there is data at the time of abnormality for each combination, logistic regression is performed from the measurement data of each combination and the data at the time of abnormality, and based on the degree of abnormality obtained by this, the abnormality related to the combination is performed. Scores may be selected and weighted. Not limited to this, combination selection and weighting may be performed using other methods such as machine learning.

In step S240, the abnormality detection device 3 detects the abnormality of the observation target based on the score of the record obtained in step S230. For example, when the score of the record exceeds the threshold value, it is detected that an abnormality has occurred, and when the score of the record does not exceed the threshold value, it is detected that no abnormality has occurred.

Then, in step S250, the abnormality detection device 3 outputs the detection result to the user. FIG. 9 is a diagram showing a display example of the detection result. The detection result of FIG. 9 includes the presence / absence of an abnormality 81, an item in which the abnormality is detected (hereinafter, also referred to as an abnormality item) 82, and a network diagram 83 showing the cause of the abnormality.

The abnormality item 82 is, for example, a combination item in which the abnormality score exceeds the threshold value. Further, an item that is commonly present in a plurality of combinations in which the abnormal score exceeds the threshold value may be regarded as an abnormal item. For example, when the abnormal score of the combination of items A and B and the combination of items B and C exceeds the threshold value, the item B common to these combinations is determined to be an abnormal item. Further, when the items A and C are combined with the items other than the item B and the abnormality score does not exceed the threshold value, it may be determined that the items A and C are not abnormal items. In the present embodiment, the abnormal score is mainly obtained for the combination of two items, but the abnormal score may be obtained for the combination of three or more items. Even in this case, similarly to FIG. 9, the combination in which the abnormal score exceeds the threshold value can be determined as abnormal, and the combination of items can be displayed in descending order of the abnormal score.

FIG. 10 is a diagram showing an example of network FIG. 83 showing anomalous factors. In FIG. 10, each item is indicated by a round node 84, and the combination of items is indicated by a line (link) 85 connecting each node. In FIG. 10, "○○○○" of each node 84 is identification information indicating each item such as "item A" and "item B". Further, in FIG. 10, for convenience, only a part of the node 84 and the link 85 is indicated by a reference numeral, but elements having the same shape indicate the same node or link.

The link 85 is shown in a display form according to the abnormal score related to the combination of the nodes (items) 84. For example, the higher the abnormal score, the thicker the line. The display form of the link 85 is not limited to this, and may be displayed by changing the color of the line, the brightness, the blinking state, or a combination thereof according to the abnormal score. For example, if the abnormal score is low, it is displayed as a thin green line, if the abnormal score is high, it is displayed as a thick red line, and if the abnormal score is in the middle, the thickness is set to the middle according to the abnormal score. , The hue is between green and red. Further, when the abnormal score exceeds the threshold value, the link 85 may be displayed blinking, and the higher the abnormal score, the higher the blinking speed may be displayed.

By calculating and displaying the abnormality score for each combination of the two items in this way, the user can visually grasp the grounds for determining the abnormality. Further, when displaying the network diagram 83, displaying a predetermined number of nodes 84 and links 85 in the order of abnormal scores, searching for and displaying the nodes 84 and links 85 specified by the user, specific equipment, and the like. It is also possible to narrow down by displaying the node 84 and the link 85 related to the area.

FIG. 11 is a diagram illustrating a time series graph of abnormal scores in a combination of specific items. When the user selects a desired combination of items from the detection results of FIGS. 9 and 10, as shown in FIG. 11, a graph showing the time-series change of the abnormal score in the combination can be displayed.

In FIG. 11, the time is taken on the horizontal axis and the abnormal score is taken on the vertical axis so that it is possible to grasp when and how long the abnormal value is continuously shown. In the example of FIG. 11, it is shown that the measurement data (solid line) exceeds the threshold value (dotted line, 40 in the illustrated example) between 15:15 and 15:20, and is detected as abnormal. This makes it possible to accurately grasp the timing when an abnormality occurs. Further, depending on whether the abnormality is transient or continuous, it becomes easy to distinguish between the true abnormality and the noise.

Further, in the present embodiment, since the abnormality score between items is obtained based on the probability density, it is possible to accurately detect the abnormality even when the normal measurement data of each item does not have a linear correlation. .. For example, in the graph 91 of FIG. 12, the measured value of the item E is taken on the vertical axis and the measured value of the item F is taken on the horizontal axis, and the normal measurement learning data corresponding to each measured value is shown by black dots. For example, if at least a portion of the production equipment 2 can operate in different operating modes, normal measurement data may be distributed in this way. In the graph 91, since there is no linear correlation between the measured values of each item, the abnormality cannot be detected by the conventional abnormality determination method using the correlation coefficient. However, in the present embodiment, by obtaining these probability densities, a region 95 having a high probability density is specified as shown in the graph 92, and if it is within this region 95, it is normal, and the degree of abnormality is higher as it deviates from this region 95. Therefore, even if the measurement data does not have a linear correlation, the abnormality can be detected with high accuracy.

<Probability density calculation method>
(1) Kernel density estimation (KDE)

Here, K (x, x') is a kernel function, and this time, a Gaussian kernel as shown in Eq. (3) is used. h> 0 indicates the bandwidth of the Gaussian kernel, and d indicates the number of dimensions of x.

The bandwidth is calculated using Scott's Rule. Assuming that n is the number of data, Scott's Rule is as shown in equation (4).

From the above formula, as shown in FIG. 13A, the density distribution (solid line) averaged by adding the Gaussian kernel functions (broken line) at the center of each measurement data x _i is obtained. As a result, a complicated probability density function as shown in FIG. 13B can be smoothly approximated.
Then, the abnormality can be detected by calculating the position of the current measurement data in this density distribution as an abnormality score.

(2) Gaussian Mixture Model (GMM)
The mixed Gaussian model (GMM) is a distribution obtained by linearly combining several Gaussian distributions, as shown in FIG. The superposition of K Gaussian distributions is given by the following equation (5).
Here, π _k is a mixing coefficient, and 0 ≤ π _k ≤ 1.

The optimum parameters can be obtained by the maximum likelihood estimation method, and the log-likelihood function of the mixed Gaussian model is as shown in the following equation (6). This can be solved by the EM algorithm.
Here, X is X = {x_1, x_2, ..., X_N}, for example, the value of the measurement data x of each record.

FIG. 15 shows the contour lines of the three mixing elements, along with their respective mixing coefficients. FIG. 16 shows contour lines of the peripheral probability density p (x) of this mixture distribution.

The anomaly detection device 3 can detect anomalies by obtaining the peripheral probability density with respect to the normal data in advance and calculating the position of the current measurement data in this density distribution as an anomaly score. For example, in FIG. 16, the point 98 on which the measurement data is plotted is within the same contour line as the normal data, so that it can be determined to be normal. On the other hand, the point 99 on which the measurement data is plotted is located at a position deviating from the normal data, and thus can be determined to be abnormal.

<Modification example>
In the above-described embodiment, an example in which the item to be adopted as the learning model is selected by the correlation function is shown, but instead, the α% cross-sectional ratio of the probability density distribution may be used. In this modification, the configuration using the α% cross-sectional ratio for item selection is different from that of the above-described embodiment, and the other configurations are the same. Therefore, the same elements are designated by the same reference numerals again. The explanation of is omitted.

The model generation unit 32 takes the range of measurement data that can be taken by each item out of the combination of N items on the first to Nth axes, and has an N dimension obtained from the measurement data of the first to Nth items. Regarding the probability density, when the probability density of each item is accumulated from the higher side and reaches a predetermined cumulative probability density, the space with a high probability density and the space with a low probability density are divided into a space having a high probability density and a space having a low probability density. The area of the probability density of the dimension is calculated as the α% cross-sectional area. Further, the model generation unit 32 obtains the area that each item can take in the hyperplane, that is, the area in the range from the minimum value to the maximum value shown in the hyperplane as the total area. Then, the model generation unit 32 divides the entire area by the α% cross-sectional area to obtain the α% cross-sectional ratio, selects a combination having the α% cross-sectional ratio less than the threshold value, and generates a learning model for the selected combination. ..

FIG. 17 is an explanatory diagram of the α% cross-sectional ratio in the combination of the two items. In the graph 96 of FIG. 17, the measured value of the item A is taken on the x-axis, the measured value of the item B is taken on the y-axis, and the probability density is taken on the z-axis, and the change in the probability density with respect to each measured value is shown in a mesh. That is, in FIG. 17, the change in probability density is shown as a mesh-like mountain. That is, in the example of FIG. 17, the values of each item (measurement data and learning data) are two-dimensional (x, y) data, and the probability density is high. Here, the area of the area where the measured values of items A and B can be taken is taken as the total area, and is as shown in (max (item A) -min (item A)) x (max (item B) -min (item B)). Ask.

Further, a cross section (wavy line shading) when the mountain of this probability density is cut at a predetermined probability density, for example, the probability density of each item is accumulated from the higher side and reaches a predetermined cumulative probability as shown in Graph 97. Find the area of the part).

Then, the α% cross-sectional ratio is obtained from the total area and the cross-sectional area as in the formula a.
α% cross-sectional ratio = cross-sectional area / ((max (item A) -min (item A)) × (max (item B) -min (item B)))

This α% cross-sectional ratio may be approximately obtained by dividing each item into squares as in the following procedure.

(Procedure 1) The range from the minimum value of x to the maximum value of x is regarded as a possible interval of x, and this interval is divided into n equal parts. Similarly, a section where y can be taken is determined and divided into n equal parts, and the area where the value of each item can be taken is divided into n × n squares. The areas of each square are all equal.

(Procedure 2) The representative coordinates (for example, the center coordinates) of each square on the xy plane are determined, and the probability density of the representative coordinates is calculated.

(Procedure 3) The probability densities of all the n × n squares defined in step 2 are totaled, and the total value S
Ask for.

(Probability 4) Arrange the probability densities of all the n × n squares obtained in step 3 in descending order, and add them in order from the largest to obtain the cumulative probability. At this time, the square in which the value obtained by dividing the cumulative probability by the total value S is closest to the predetermined value (for example, 99.99%) is obtained.

(Procedure 5) Obtain the number of squares at the same height as the squares obtained in step 4. Here, the same height means that the range in which the probability density can be taken is divided into n equal parts, and among the probability densities of each cell, those within the same range are set to the same height.

(Procedure 6) The value obtained by dividing the number of squares (α% cross-sectional area) obtained in step 5 by the total number of squares (total area) is obtained as the α% cross-sectional area ratio.

In the process of generating the learning model of FIG. 5, the abnormality detection device 3 of this example obtains the α% cross-sectional ratio of each combination instead of the process of finding the correlation function in step S110, and in step S120, the α% cross-sectional ratio is obtained. Select a small combination of.

By using the α% cross-sectional ratio in this way, it is possible to appropriately select a combination of items whose measured values do not have a linear correlation.

Further, instead of cutting the cross section with a predetermined probability density, the α% cross-section ratio is set according to the sampling accuracy required by the user, and for the probability density of each combination, the cross-section area having the α% cross-section ratio is calculated from Equation 1. Back calculation is performed, and the probability density of this cross-sectional area is obtained as a threshold. Thereby, in the combination of each item, the threshold value of the probability density when determining the abnormality can be appropriately set. That is, the item that is the cause of the abnormality can be accurately discriminated.

In the example of FIG. 17, for two-dimensional data in which two items are combined, a three-dimensional space having a probability density in the height direction is cut by a plane to obtain an α% cross-sectional area, but three or more. When the items of are combined, for example, a space having four or more dimensions including a probability density may be divided by a hyperplane to obtain an α% cross-sectional area.

2: Production equipment 3: Abnormality detection device 31: Data acquisition unit 32: Model generation unit 33: Score calculation unit 34: Detection unit 35: Display control unit

Claims (5)

A data acquisition unit that acquires measurement data indicating the state of multiple items in the observation target, and
The measurement data acquired at a predetermined timing is regarded as one data group, the plurality of data groups acquired at different timings are regarded as training data, and N combinations of the plurality of items are obtained from the measurement data included in the training data. A model generation unit that generates a learning model by obtaining an N-dimensional probability density and obtaining the N-dimensional probability density for a plurality of the above combinations.
A score calculation unit that obtains the probability of obtaining the measurement data related to N combinations of the items from the data group to be evaluated from the learning model and calculates an abnormal score based on the probability.
A detection unit that calculates the score of the data group based on the abnormality score related to a plurality of combinations of the items and detects the abnormality of the observation target based on the score of the data group.
Anomaly detection device equipped with. The abnormality detection device according to claim 1, further comprising a display control unit that causes the link to be generated in a display form corresponding to the abnormality score when displaying the node indicating the item and the link indicating the combination of the nodes on the display device. .. The model generator
Of the N combinations of the above items, the range of measurement data that can be taken by each item is set on the first to Nth axes, and the N-dimensional probability density obtained from the measurement data of the first to Nth items is obtained. When the probability density of each item is accumulated from the higher side and reaches a predetermined cumulative probability, the space is divided into a space having a high probability density and a space having a low probability density in a superplane, and the N-dimensional probability density in the superplane is divided. The area is set to α% cross-sectional area, and the area within the range that each item can take in the superplane is obtained as the total area.
Divide the total area by the α% cross-sectional area to obtain the α% cross-sectional ratio.
The abnormality detection device according to claim 1 or 2, wherein a combination having an α% cross-sectional ratio less than a threshold value is selected, and the learning model is generated for the selected combination. A step to acquire measurement data indicating the state of multiple items in the observation target, and
The measurement data acquired at a predetermined timing is regarded as one data group, the plurality of data groups acquired at different timings are regarded as training data, and N combinations of the plurality of items are obtained from the measurement data included in the training data. A step of obtaining an N-dimensional probability density, obtaining the N-dimensional probability density for the plurality of the above combinations, and generating a learning model.
A step of obtaining the probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model and calculating an abnormality score based on the probability.
A step of calculating the score of the data group based on the abnormality score related to a plurality of combinations of the items and detecting the abnormality of the observation target based on the score of the data group.
Anomaly detection method that the computer executes. A step to acquire measurement data indicating the state of multiple items in the observation target, and
The measurement data acquired at a predetermined timing is regarded as one data group, the plurality of data groups acquired at different timings are regarded as training data, and N combinations of the plurality of items are obtained from the measurement data included in the training data. A step of obtaining an N-dimensional probability density, obtaining the N-dimensional probability density for the plurality of the above combinations, and generating a learning model.
A step of obtaining the probability of obtaining the measurement data relating to N combinations of the items in the data group to be evaluated from the learning model and calculating an abnormality score based on the probability.
A step of calculating the score of the data group based on the abnormality score related to a plurality of combinations of the items and detecting the abnormality of the observation target based on the score of the data group.
Anomaly detection program to make a computer execute.

Images