JP7377678B2 - Anomaly detection model learning device, anomaly detection model and anomaly detection device - Google Patents

Description

The present invention relates to an anomaly detection model learning device, an anomaly detection model, and an anomaly detection device.

It is desired to ensure the reliability of devices that make up a mobile communication network. A base station, which is one of the devices that make up a mobile communication network, is a device that provides mobile terminals with a wireless area where communication services can be used, so if an abnormality occurs at the base station, the communication service will be interrupted. It is preferable that the necessary measures be taken promptly so that the provision of services does not stop. In general base station maintenance, for example, a management device that manages the base station receives alarms emitted from the base station, identifies the target base station and the nature of the abnormality based on the alarm, and identifies the identified content. Measures will be taken accordingly. An alarm is issued when a predefined event is detected at each base station. Furthermore, abnormalities and failures that do not appear in alarms may occur in devices such as base stations. Such an anomaly is called a silent anomaly. For the purpose of detecting silent anomalies, there is a known technology in which a threshold is set for an event such as the success rate of a predetermined control process at a base station, and the occurrence of an abnormality is determined based on the event exceeding the threshold. (For example, see Patent Document 1).

JP2008-227618A

Silent abnormalities that do not appear in alarms appear in communication conditions such as packet loss and transfer delay during data transfer. Appropriately detecting abnormalities that do not appear in alarms, such as silent abnormalities, is very important in order to prevent the provision of communication services from stopping. In a method of detecting an abnormality by setting a threshold value for a predetermined event related to communication, as described in Patent Document 1, it is necessary to set an appropriate threshold value. However, trends in communication conditions vary greatly depending on region, time zone, etc., and it is extremely difficult to set an appropriate threshold value that takes these differences into account.

The present invention has been made in view of the above problems, and an object of the present invention is to appropriately detect abnormalities that do not appear in alarms issued from base stations.

In order to solve the above problems, an anomaly detection model learning device according to one embodiment of the present invention provides an anomaly detection model that uses machine learning to generate an anomaly detection model for detecting communication anomalies in a base station of a mobile communication network. The learning device includes an anomaly detection model that includes a dimensionality reduction algorithm, and is based on at least one item of communication state information indicating the communication state of each base station when communication at the base station is normal. A learning input data generation unit that generates input data, inputs the input data to a dimensionality reduction algorithm, updates the parameters of the dimensionality reduction algorithm based on the output data from the dimensionality reduction algorithm, and the input data, and creates an anomaly detection model. and a model learning section that performs learning.

According to the above configuration, dimension reduction allows detection of communication abnormalities through machine learning using learning input data generated based on communication status information for each base station when communication at the base station is normal. An anomaly detection model including an algorithm is generated. Since the anomaly detection model has learned the characteristics of input data when communication is normal, it can identify input data when an abnormality occurs in communication. By using the abnormality detection model generated in this way for abnormality detection processing, it becomes possible to appropriately detect abnormalities that do not appear in alarms issued from the base station.

An anomaly detection model learning device, an anomaly detection model, and an anomaly detection device capable of appropriately detecting an anomaly that does not appear in an alarm issued from a base station are realized.

FIG. 2 is a block diagram showing the functional configuration of the anomaly detection model learning device according to the present embodiment. FIG. 1 is a block diagram showing the functional configuration of an abnormality detection device according to the present embodiment. FIG. 2 is a hardware block diagram of an anomaly detection model learning device and an anomaly detection device. FIG. 2 is a block diagram showing the configuration of an abnormality detection model according to the present embodiment. 2 is a flowchart showing overall processing in a system including an anomaly detection model learning device and an anomaly detection device. 3 is a flowchart showing input data generation processing in the anomaly detection model learning device and the anomaly detection device. FIG. 3 is a diagram illustrating an example of a configuration of input data generated based on communication state information. 3 is a flowchart showing processing details of an anomaly detection model learning method in an anomaly detection model learning device. FIG. 3 is a diagram showing an example of a configuration of device alarm information. It is a flowchart which shows the processing content of the abnormality detection method in an abnormality detection apparatus. FIG. 7 is a diagram illustrating an example of time-series detection result information stored in an abnormality detection result storage unit. It is a flowchart which shows the initial measure process in the system containing an anomaly detection model learning device and an anomaly detection device. FIG. 13(a) is a diagram showing the configuration of the anomaly detection model learning program. FIG. 13(b) is a diagram showing the configuration of the abnormality detection program.

Embodiments of an anomaly detection model learning device, an anomaly detection device, and an anomaly detection model according to the present invention will be described with reference to the drawings. In addition, if possible, the same parts are given the same reference numerals and redundant explanations will be omitted.

FIG. 1 is a diagram showing the device configuration of an anomaly detection system including an anomaly detection model learning device and the functional configuration of the anomaly detection model learning device. The anomaly detection model learning device 1A(1) generates an anomaly detection model including a dimension reduction algorithm by machine learning. The anomaly detection model is a model for detecting a communication anomaly at base station b of the mobile communication network.

In the example shown in FIG. 1, the abnormality detection model learning device 1A acquires information from the base station b via the base station management device bc. The base station management device bc is a device that controls and manages a plurality of base stations b. The base station management device bc acquires communication status information indicating the communication status acquired from each base station b, and sends the acquired communication status information etc. to the abnormality detection model learning device 1A. Furthermore, the base station management device bc can remotely control the base station b, and can take measures such as resetting the base station b, for example. Note that the abnormality detection model learning device 1A may be able to acquire information from each base station b and control the base station b without going through the base station management device bc.

The base station management device bc acquires alarms issued from each base station b, and stores information regarding the acquired alarms in the device alarm storage section 30 as device alarm information. The device alarm storage section 30 is a storage means that stores device alarm information. An alarm is information issued by a base station when a predefined abnormal event is detected at each base station b, and is used to identify the base station b where the abnormal event has occurred and the content of the abnormal event. The abnormality detection model learning device 1A can refer to device alarm information stored in the device alarm storage section 30. The contents of the device alarm information will be described later with reference to FIG. 9.

The input data storage unit 20A (20) is a storage unit that stores learning input data used for learning the anomaly detection model. The contents of the input data will be described later with reference to FIG. 7.

The anomaly detection model storage unit 40 is a storage unit that stores the learned and generated anomaly detection model.

As shown in FIG. 1, the abnormality detection model learning device 1A includes a communication state information acquisition section 11, a learning input data generation section 12, a model learning section 13, and a model output section 14. Details of the functional units 11 to 14 will be described later.

FIG. 2 is a diagram showing the device configuration of an anomaly detection system including an anomaly detection device and the functional configuration of an anomaly detection model learning device. The anomaly detection device 1B(1) detects a communication anomaly at the base station b of the mobile communication network using a learned anomaly detection model.

In the example shown in FIG. 2, the abnormality detection device 1B acquires information from the base station b via the base station management device bc. The base station management device bc acquires communication status information indicating the communication status acquired from each base station b, and sends the acquired communication status information etc. to the abnormality detection device 1B. Note that the abnormality detection device 1B may be able to acquire information from each base station b and control the base station b without going through the base station management device bc.

The abnormality detection device 1B can refer to device alarm information stored in the device alarm storage section 30.

The input data storage unit 20B (20) is a storage unit that stores input data used for base station abnormality detection. The input data storage section 20B may be configured as the same storage section as the input data storage section 20A shown in FIG.

The anomaly detection result storage unit 50 is a storage unit that stores information on the anomaly detection result regarding the anomaly of the base station b detected by the anomaly detection model of the anomaly detection device 1B. Information on the abnormality detection results will be described later with reference to FIG. 11.

As shown in FIG. 2, the abnormality detection device 1B includes a communication state information acquisition section 15, an abnormality detection target input data generation section 16, an abnormality detection section 17, a determination section 18, and a treatment section 19. Details of the functional units 15 to 19 will be described later.

The anomaly detection system 1 includes an anomaly detection model learning device 1A that operates in a phase of learning an anomaly detection model, and an aspect of an anomaly detection device 1B that operates in a phase of detecting an anomaly using a learned anomaly detection model. . The anomaly detection model learning device 1A and the anomaly detection device 1B may be configured as separate devices, or may be configured integrally, as shown in FIGS. 1 and 2. Further, each of the functional units 11 to 19 included in the anomaly detection model learning device 1A and the anomaly detection device 1B may be configured in one device, or may be configured to be distributed in a plurality of devices. In addition, the input data storage units 20A (20), 20B (20), the device alarm storage unit 30, the anomaly detection model storage unit 40, and the anomaly detection result storage unit 50 are connected to the anomaly detection model learning device 1A and the anomaly detection device 1B, respectively. The anomaly detection model learning device 1A and the anomaly detection device 1B may be configured as separate devices configured to be able to communicate with each other.

Note that the block diagrams shown in FIGS. 1 and 2 show blocks in functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method for realizing each functional block is not particularly limited. That is, each functional block may be realized using one physically or logically coupled device, or may be realized using two or more physically or logically separated devices directly or indirectly (e.g. , wired, wireless, etc.) and may be realized using a plurality of these devices. The functional block may be realized by combining software with the one device or the plurality of devices.

Functions include judgment, decision, judgment, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, consideration, These include, but are not limited to, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assigning. I can't do it. For example, a functional block (configuration unit) that performs transmission is called a transmitting unit or a transmitter. In either case, as described above, the implementation method is not particularly limited.

For example, the anomaly detection model learning device 1A and the anomaly detection device 1B in one embodiment of the present invention may function as a computer. FIG. 3 is a diagram showing an example of the hardware configuration of the anomaly detection model learning device 1A(1) and the anomaly detection device 1B(1) according to the present embodiment. The anomaly detection model learning device 1A and the anomaly detection device 1B are each physically configured as a computer device including a processor 1001, a memory 1002, a storage 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc. It's okay.

In addition, in the following description, the word "apparatus" can be read as a circuit, a device, a unit, etc. The hardware configurations of the anomaly detection model learning device 1A and the anomaly detection device 1B may be configured to include one or more of each device shown in FIG. 3, or may be configured to include some devices not included. Good too.

Each function in the anomaly detection model learning device 1A and the anomaly detection device 1B is performed by loading predetermined software (programs) onto hardware such as the processor 1001 and memory 1002, so that the processor 1001 performs calculations and the communication device 1004 performs calculations. This is achieved by controlling communication and reading and/or writing of data in the memory 1002 and storage 1003.

The processor 1001, for example, operates an operating system to control the entire computer. The processor 1001 may be configured with a central processing unit (CPU) that includes interfaces with peripheral devices, a control device, an arithmetic device, registers, and the like. For example, each of the functional units 11 to 19 shown in FIGS. 1 and 2 may be implemented by the processor 1001.

Further, the processor 1001 reads programs (program codes), software modules, and data from the storage 1003 and/or the communication device 1004 to the memory 1002, and executes various processes in accordance with these. As the program, a program that causes a computer to execute at least part of the operations described in the above embodiments is used. For example, each of the functional units 11 to 19 of the anomaly detection model learning device 1A and the anomaly detection device 1B may be realized by a control program stored in the memory 1002 and operated by the processor 1001. Although the various processes described above have been described as being executed by one processor 1001, they may be executed by two or more processors 1001 simultaneously or sequentially. Processor 1001 may be implemented with one or more chips. Note that the program may be transmitted from a network via a telecommunications line.

The memory 1002 is a computer-readable recording medium, and includes at least one of ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. may be done. Memory 1002 may be called a register, cache, main memory, or the like. The memory 1002 can store executable programs (program codes), software modules, and the like to implement the anomaly detection model learning method and anomaly detection method according to an embodiment of the present invention.

The storage 1003 is a computer-readable recording medium, such as an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (such as a compact disk, a digital versatile disk, or a Blu-ray disk). (registered trademark) disk), smart card, flash memory (eg, card, stick, key drive), floppy disk, magnetic strip, etc. Storage 1003 may also be called an auxiliary storage device. The storage medium mentioned above may be, for example, a database including memory 1002 and/or storage 1003, a server, or other suitable medium.

The communication device 1004 is hardware (transmission/reception device) for communicating between computers via a wired and/or wireless network, and is also referred to as, for example, a network device, network controller, network card, communication module, or the like.

The input device 1005 is an input device (eg, keyboard, mouse, microphone, switch, button, sensor, etc.) that accepts input from the outside. The output device 1006 is an output device (for example, a display, a speaker, an LED lamp, etc.) that performs output to the outside. Note that the input device 1005 and the output device 1006 may have an integrated configuration (for example, a touch panel).

Further, each device such as the processor 1001 and the memory 1002 is connected by a bus 1007 for communicating information. The bus 1007 may be configured as a single bus or may be configured as different buses between devices.

Further, the anomaly detection model learning device 1A and the anomaly detection device 1B include a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array). ), and a part or all of each functional block may be realized by the hardware. For example, processor 1001 may be implemented with at least one of these hardware.

FIG. 4 is a block diagram showing the configuration of the abnormality detection model of this embodiment. The anomaly detection model md includes a dimension reduction algorithm md1 and an error determination unit md2.
The dimension reduction algorithm md1 receives input data generated based on the communication status information of each base station b when the communication is normal, and determines whether the communication is normal based on the output data and input data from the dimension reduction algorithm md1. Parameters are adjusted and constructed using machine learning so that the characteristics of input data based on communication state information at the time of communication are learned.

The dimensionality reduction algorithm md1 can be configured by, for example, an autoencoder and principal component analysis. The dimensionality reduction algorithm md1 of this embodiment is configured by, for example, an autoencoder including a neural network.

An autoencoder consists of an encoder that encodes (compresses) the input data input to the input layer, and a decoder that decodes (restores) the encoded data, and the error of the output data output from the decoder with respect to the input data is small. It is constructed by machine learning that updates the parameters of two neural networks, an encoder and a decoder, using the error backpropagation method.

In the trained anomaly detection model md configured by an autoencoder, when input data based on communication status information when communication is normal is input, output data with a small error from the input data is output. , when input data based on communication status information when there is an abnormality in communication is input, output data having a large error from the input data is output.

The error determination unit md2 determines whether the error of the output data from the output layer of the dimension reduction algorithm md1 with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, the communication of the base station b is Outputs abnormality information indicating that there is an abnormality as a detection result. The predetermined threshold value is, for example, obtained by obtaining a predetermined number of input data generated based on communication status information when communication is normal, and inputting each of the obtained input data to the dimension reduction algorithm md1. The maximum value of each error of the output data with respect to the corresponding input data can be adopted.

The anomaly detection model md, which is a model including the learned dimension reduction algorithm md1, can be read or referenced by a computer, and can be regarded as a program that causes the computer to perform predetermined processing and realize a predetermined function.

That is, the learned anomaly detection model md of this embodiment is used in a computer equipped with a CPU and a memory. Specifically, the CPU of the computer uses learned weighting coefficients (parameters) and responds to the input data input to the dimensionality reduction algorithm md1 according to instructions from the learned anomaly detection model md stored in memory. It operates to perform calculations based on functions etc. and output the results (output data).

An example of the overall process in the anomaly detection system 1 including the anomaly detection model learning device 1A and the anomaly detection device 1B will be described with reference to FIG. 5.

In step S1, the abnormality detection system 1 determines whether n minutes, which is a preset time, has elapsed since the previous input data generation process. If it is determined that n minutes have elapsed, the process proceeds to step S2, and if it is not determined that n minutes have elapsed, the determination process of step S1 is repeated.

In step S2, input data generation processing is performed. The input data generation process is performed by the learning input data generation unit 12 or the abnormality detection target input data generation unit 16, and the details of the process will be described in detail later.

In step S3, the abnormality detection system 1 determines whether m minutes, which is a preset time, has elapsed since the previous model learning process or abnormality detection process. Note that m is set to a value greater than or equal to n. If it is determined that m minutes have elapsed, the process advances to step S4. If it is not determined that m minutes have elapsed, the process returns to step S1.

In step S4, the anomaly detection system 1 determines whether the anomaly detection model md has been generated and is stored in the anomaly detection model storage unit 40. If it is determined that the abnormality detection model md has been generated, the process proceeds to step S5. On the other hand, if it is not determined that the abnormality detection model md has been generated, the process proceeds to step S6.

In step S5, the abnormality detection system 1 performs an abnormality detection process as the abnormality detection device 1B, and then the process proceeds to step S7.

On the other hand, in step S6, the anomaly detection system 1 performs a model learning process as the anomaly detection model learning device 1A, and then the process returns to step S1.

In step S7, the abnormality detection device 1B determines whether or not there is an abnormality determination in the abnormality detection process. If there is an abnormality determination, the process proceeds to step S8. On the other hand, if there is no abnormality determination, the process returns to step S1.

In step S8, the abnormality detection device 1B performs initial measures processing. The initial measure process is a preset measure for the base station b in which an abnormality has been detected, and includes, for example, initialization of the base station b.

Referring again to FIG. 1 and the like, the functional units of the abnormality detection model learning device 1A will be described. The communication status information acquisition unit 11 acquires at least one item of communication status information indicating the communication status of each base station b. In this embodiment, the communication status information acquisition unit 11 acquires communication status information from the base station management device bc.

The learning input data generation unit 12 generates learning input data based on communication status information for each base station b when communication at the base station b is normal.

Acquisition of communication status information and generation of input data will be described with reference to FIGS. 6 and 7. FIG. 6 is a flowchart showing input data generation processing. FIG. 9 is a diagram showing an example of the structure of device alarm information. FIG. 7 is a diagram illustrating an example of the configuration of input data generated based on communication status information.

In step S11, the communication status information acquisition unit 11 acquires communication status information of all base stations to be monitored. The communication status information includes, for example, information well known to those skilled in the art such as the amount of data transferred at the base station b, the number of connected terminals, and the communication success rate.

In step S12, the learning input data generation unit 12 aggregates the communication state information by predetermined statistical processing. The communication status information is compiled by, for example, calculating an average value for each sector and hourly, calculating a total value, and counting the appearance frequency of predetermined data.

In step S13, the learning input data generation unit 12 generates input data by adding date and time information and holiday/holiday information to the aggregated communication state information as necessary.
The date and time information is information indicating the time and day when the communication state indicated in the communication state information occurs. Holiday information is information indicating an attribute indicating whether the date of occurrence of the communication state indicated in the communication state information corresponds to a holiday or a public holiday.

In step S14, the learning input data generation unit 12 stores the generated input data in the input data storage unit 20A as learning input data. As shown in FIG. 7, the input data includes a base station ID that identifies base station b, holiday information, date and time information, and communication status information. The communication state information included in the input data is not limited to that illustrated in FIG. 7 .

As explained with reference to FIG. 5, the communication status information is information acquired every predetermined time (for example, n minutes), and the communication status information itself does not include information such as the date, time, day of the week, etc. . In this embodiment, the learning input data generation unit 12 generates input data by adding date and time information and holiday information to the communication status information, so anomalies are detected using the concepts of day, time, and day of the week as characteristics of the communication status. It becomes possible to train the model.

The model learning unit 13 inputs the input data to the dimensionality reduction algorithm md1, updates the parameters of the dimensionality reduction algorithm md1 based on the output data and input data output from the dimensionality reduction algorithm md1, and learns the anomaly detection model. I do. The model learning process will be described in detail with reference to FIGS. 8 and 9. FIG. 8 is a flowchart showing the processing details of the anomaly detection model learning method in the anomaly detection model learning device. FIG. 9 is a diagram showing an example of the structure of device alarm information.

In step S21, a variable count for setting the period to which the input data to be acquired belongs is set to "0".

In step S22, the model learning unit 13 refers to the input data storage unit 20A and attempts to acquire input data belonging to a period from the day before the execution date of the model learning process to (count+1)*x days ago.

In step S23, the model learning unit 13 determines whether there is input data that was attempted to be acquired in step S22. If it is determined that there is input data, the process advances to step S24. On the other hand, if it is not determined that there is input data, the process ends.

In step S24, the model learning unit 13 extracts input data that does not correspond to a predetermined abnormal state. In other words, the model learning unit 13 extracts input data based on communication state information when communication at the base station is normal. , used for training an anomaly detection model. For example, the model learning unit 13 refers to the device alarm information stored in the device alarm storage unit 30, acquires the occurrence status of a predefined alarm at the base station b, and communicates the situation during a period other than when the alarm occurs. Obtain input data based on state information as learning input data.

As shown in FIG. 9, the device alarm information includes a base station ID that identifies base station b, a failure start time, a failure end time, an abnormality detection flag, and the like. The failure start time and failure end time are the occurrence time and end time of a failure acquired as a predetermined alarm or an abnormality detected by the abnormality detection device 1B in the base station identified by the base station ID, and It is recorded by the management device bc or the abnormality detection device 1B. The abnormality detection flag is a flag indicating that the device alarm information is caused by an abnormality detected by the abnormality detection device 1B.

The model learning unit 13 recognizes the period during which each base station b was in a failure state based on the failure start time and failure end time of the equipment alarm information of each base station b, and Input data based on communication status information that does not correspond to the status is acquired as input data for learning when communication is normal.

The model learning unit 13 determines whether or not input data for x days or more can be used for model creation as a result of the extraction in step S24. If the input data available for model creation is sufficient, the process proceeds to step S27. On the other hand, if there is not enough input data available for model creation, the process proceeds to step S26.

In step S26, the model learning unit 13 increments the variable count.

In step S27, the model learning unit 13 uses the input data to perform a learning process on the abnormality detection model md. When the anomaly detection model md is configured by an autoencoder, the model learning unit 13 updates the parameters of the dimension reduction algorithm md1 configured by the autoencoder based on the error of output data with respect to input data. Specifically, the model learning unit 13 inputs the input data to the input layer of the neural network that constitutes the dimension reduction algorithm md1, calculates the restoration error between the output data output from the output layer and the input data, and determines whether the error is The parameters (weights) of the neural network constituting the dimensionality reduction algorithm md1 are adjusted by the error backpropagation method so that the error becomes smaller.

The model output unit 14 stores the anomaly detection model md learned by the model learning unit 13 in the anomaly detection model storage unit 40.

Referring again to FIG. 2 and the like, each functional unit of the abnormality detection device 1B will be described. The communication status information acquisition unit 15 acquires at least one item of communication status information indicating the communication status of each base station b. In this embodiment, the communication status information acquisition unit 15 acquires communication status information from the base station management device bc.

The abnormality detection target input data generation unit 16 generates input data to be detected as an abnormality based on the communication state information. The input data generation process in the abnormality detection target input data generation unit 16 is similar to the input data generation process in the learning input data generation unit 12. That is, the abnormality detection target input data generation unit 16 performs predetermined statistical processing on the communication status information acquired by the communication status information acquisition unit 15 as necessary, and adds date and time information, holiday information, etc. input data is generated and stored in the input data storage section 20B.

The anomaly detection unit 17 inputs the input data of the anomaly detection target to the anomaly detection model md, and acquires the detection result output from the anomaly detection model md. The determining unit 18 determines that there is an abnormality in the corresponding base station b based on the abnormality information in the detection result. Hereinafter, with reference to FIGS. 10 and 11, the abnormality detection processing in the abnormality detection section 17 and determination section 18 will be described.

In step S31, the anomaly detection unit 17 acquires the learned anomaly detection model md generated for the base station b that is the anomaly detection target from the anomaly detection model storage unit 40. Further, the abnormality detection unit 17 acquires input data generated based on the communication state information of the base station b that is the target of abnormality detection from the input data storage unit 20B.

In step S32, the abnormality detection unit 17 inputs the input data to the abnormality detection model md.

In step S33, the abnormality detection unit 17 determines whether there is an abnormality based on the detection result output from the abnormality detection model md. Specifically, the error determination unit md2 of the anomaly detection model md determines whether the error of the output data with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, the error determination unit md2 of the anomaly detection target Abnormality information indicating that there is an abnormality in the communication of base station b is output as a detection result. The abnormality detection unit 17 records detection result information indicating the detection result in the abnormality detection result storage unit 50.

FIG. 11 is a diagram showing an example of detection result information recorded in the abnormality detection result storage unit 50. As shown in FIG. 11, the detection result information includes items such as time, base station ID, and abnormality detection result. The abnormality detection result is a flag indicating the detection result as abnormality information.

In step S34, the abnormality detection unit 17 determines whether the detection result indicates that there is an abnormality in the input data. If it is determined that there is an abnormality, the process proceeds to step S35. On the other hand, if it is determined that there is no abnormality, the process proceeds to step S38.

In step S35, the determining unit 18 determines (final determination) that there is an abnormality in the base station b targeted for abnormality detection, based on the abnormality information in the detection result. Specifically, the determination unit 18 determines that there is an abnormality in the corresponding base station b when a detection result including abnormality information is obtained a predetermined number of times. The predetermined number of times for acquiring detection results including abnormality information can be, for example, two times, three times, etc., but this number is not limited.

Specifically, the determination unit 18 refers to the detection result information recorded in the abnormality detection result storage unit 50. In the case where the predetermined number of times for acquiring detection results including abnormality information for determining whether there is an abnormality in base station b is three times, when the detection result information shown in FIG. 11 is referenced, the determination unit 18 makes a final determination that an abnormality has occurred in the base station "b1" when a detection result including three consecutive abnormality information from times t3 to t5 is obtained at time t5.

In this way, if the abnormality detection model md detects an abnormality less than the predetermined number of times, it is not determined that there is an abnormality in the base station b, so that erroneous detection of an abnormality is prevented.

Further, the determination unit 18 determines that if the number of detection result information including abnormality information in the total number of detection result information within a predetermined time exceeds a preset ratio, the corresponding base station has an abnormality. determine something. The predetermined ratio regarding the acquisition of detection results including abnormality information may be, for example, 50%, but is not limited to this ratio. As a result, if the number of abnormalities detected by the abnormality detection model md is less than a predetermined ratio, it is not determined that there is an abnormality in the base station b, so that erroneous detection of an abnormality is prevented.

In step S36, the determining unit 18 determines whether or not there is an abnormality in the base station b that is the target of abnormality detection. If it is determined that there is an abnormality, the process proceeds to step S37. On the other hand, if it is determined that there is no abnormality, the process proceeds to step S38.

In step S37, the measure unit 19 implements initial measures for the base station b where the abnormality has been detected. The initial measure processing by the measure unit 19 will be described later with reference to FIG.

In step S38, the abnormality detection unit 17 refers to the device alarm information (see FIG. 9) regarding the base station b targeted for abnormality detection. In step S39, the abnormality detection unit 17 determines whether there is device alarm information in which the abnormality detection flag is ON and the failure end time is blank. If it is determined that such device alarm information exists, the process proceeds to step S40. On the other hand, if it is not determined that such device alarm information exists, the process ends.

If it is determined that there is no abnormality in step S34 or step S36, it means that no abnormality has occurred in the base station b that is the target of abnormality detection, so in step S40, the abnormality detection unit 17 detects the The current time is set in the failure end time of the device alarm information of base station b.

In step S37, the measures unit 19 implements initial measures for the base station b where the abnormality has been detected, as described above. FIG. 12 is a flowchart showing the contents of the initial measure processing.

In step S51, the action unit 19 refers to the device alarm information of the target base station b.

In step S52, the action unit 19 determines whether there is any device alarm information in which the abnormality detection flag is ON and the failure end time is blank. If it is determined that there is no such device alarm information, the process proceeds to step S53. On the other hand, if it is not determined that there is no such device alarm information, the process ends.

In step S53, the measure unit 19 implements a predetermined measure against the target base station b. The predetermined measure is a measure for recovering from an abnormality, and is set in advance for each base station, such as resetting (initializing) the base station. Note that in this embodiment, initial measures for each base station b are implemented via the base station management device bc.

In step S54, the action unit 19 newly stores the device alarm information in which the abnormality detection flag is ON and the current time is the failure start time in the device alarm storage along with the base station ID indicating the target base station b. Register on 30th.

Next, with reference to FIG. 13, an anomaly detection model learning program for causing a computer to function as the anomaly detection model learning device 1A of this embodiment and an anomaly detection program for causing the computer to function as the anomaly detection device 1B will be explained. do.

FIG. 13(a) is a diagram showing the configuration of the anomaly detection model learning program. The anomaly detection model learning program P1A includes a main module m10A that centrally controls the anomaly detection model learning process in the anomaly detection model learning device 1A, a communication status information acquisition module m11, a learning input data generation module m12, a model learning module m13, and It is configured to include a model output module m14. Each module m11 to m14 realizes each function for the communication state information acquisition section 11, the learning input data generation section 12, the model learning section 13, and the model output section 14.

The abnormality detection model learning program P1A may be transmitted via a transmission medium such as a communication line, or may be stored in the recording medium M1A as shown in FIG. 13(a). There may be.

FIG. 13(b) is a diagram showing the configuration of the abnormality detection program. The anomaly detection program P1B includes a main module m10B that comprehensively controls anomaly detection processing in the anomaly detection device 1B, a communication status information acquisition module m15, an anomaly detection target input data generation module m16, an anomaly detection module m17, a determination module m18, and measures. It is configured with a module m19. Each of the modules m15 to m19 implements the functions of the communication state information acquisition unit 15, the abnormality detection target input data generation unit 16, the abnormality detection unit 17, the determination unit 18, and the action unit 19.

Note that the abnormality detection program P1B may be transmitted via a transmission medium such as a communication line, or may be stored in the recording medium M1B as shown in FIG. 13(b). Good too.

According to the anomaly detection model learning device 1A, the anomaly detection model learning method, the anomaly detection device 1B, the anomaly detection method, the anomaly detection model md, the anomaly detection model learning program P1A, and the anomaly detection program P1B of this embodiment described above, the base Anomaly detection including dimension reduction algorithm md1 that can detect communication abnormalities by machine learning using learning input data generated based on communication status information for each base station b when communication at station b is normal. A model md is generated. Since the abnormality detection model md has learned the characteristics of input data when communication is normal, it is possible to determine input data when an abnormality occurs in communication. By subjecting the abnormality detection model md generated in this way to abnormality detection processing, it becomes possible to appropriately detect abnormalities that do not appear in the alarm issued from the base station b.

Furthermore, in the anomaly detection model learning device according to another embodiment, the learning input data generation unit may include date and time information indicating the time corresponding to the occurrence of the communication state indicated in the communication state information in the input data. .

According to the above embodiment, since the input data for learning includes the date and time information, it is possible to generate an anomaly detection model that takes into account the state of communication that shows a tendency that varies depending on the date and time.

Further, in the anomaly detection model learning device according to another embodiment, the learning input data generation unit generates holiday information indicating whether the day of occurrence of the communication state indicated in the communication state information corresponds to a holiday or a public holiday. It may also be included in the input data.

According to the above embodiment, since holiday information is included in the learning input data, it is possible to generate an anomaly detection model that takes into account communication states that exhibit different trends depending on daily attributes such as holidays and public holidays.

Further, in an anomaly detection model learning device according to another embodiment, the learning input data generation unit refers to failure information indicating a period during which each base station has been in a predetermined failure state, and determines whether each base station has fallen into a failure state. The input data for learning may be generated based on the communication state information during the period when the communication status information was not used.

According to the above embodiment, communication status information for each base station when communication at the base station is normal is extracted based on failure information for each base station, and input data for learning is generated based on the extracted communication status information. is generated. As a result, the function is to generate input data suitable for learning an anomaly detection model.

Furthermore, in an anomaly detection model learning device according to another embodiment, the anomaly detection model is configured by an autoencoder including a neural network, and the model learning section adjusts the parameters of the neural network based on the error of output data with respect to input data. It may also be updated.

According to the above embodiment, it is possible to configure an abnormality detection model in which characteristics of input data when communication is normal are learned, without requiring a correct label as learning data.

In another embodiment of the anomaly detection model learning device, the input data may include at least one of the amount of communication data at the base station, the number of connected terminals, and the communication success rate.

According to the above embodiment, it is possible to obtain input data that appropriately represents the communication state at the base station.

In order to solve the above problems, an anomaly detection model according to an embodiment of the present invention is an anomaly detection model that has been trained by machine learning by making a computer function to detect communication anomalies in base stations of a mobile communication network. includes a dimension reduction algorithm and an error determination unit, the dimension reduction algorithm is generated based on at least one item of communication state information indicating the communication state of each base station when communication is normal. It is constructed by machine learning that uses input data as input to the dimension reduction algorithm and updates the parameters of the dimension reduction algorithm based on the output data and input data from the dimension reduction algorithm. It is determined whether the error exceeds a predetermined threshold, and when the error exceeds the predetermined threshold, abnormality information indicating that there is an abnormality in communication of the base station is output as a detection result.

According to the above configuration, dimension reduction allows detection of communication abnormalities through machine learning using learning input data generated based on communication status information for each base station when communication at the base station is normal. An anomaly detection model including an algorithm is provided. Since the anomaly detection model has learned the characteristics of input data when communication is normal, it can identify input data when an abnormality occurs in communication. By using the abnormality detection model generated in this way for abnormality detection processing, it becomes possible to appropriately detect abnormalities that do not appear in alarms issued from the base station.

In order to solve the above problems, an anomaly detection device according to one embodiment of the present invention is an anomaly detection device that detects a communication anomaly in a base station of a mobile communication network using a trained anomaly detection model. , the anomaly detection model is a model for operating a computer, and includes a dimension reduction algorithm and an error determination unit, and the dimension reduction algorithm is at least a model that indicates the communication state of each base station when communication is normal. Through machine learning, input data generated based on one or more items of communication status information is input to the dimension reduction algorithm, and parameters of the dimension reduction algorithm are updated based on the output data and input data from the dimension reduction algorithm. The error determination unit determines whether the error of the output data with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, an error is detected indicating that there is an abnormality in the communication of the base station. an anomaly detection target input data generation unit that outputs information as a detection result, and the anomaly detection device generates input data for anomaly detection based on at least one item or more of communication state information indicating a communication state at each base station; An anomaly detection unit that inputs input data for anomaly detection into an anomaly detection model and obtains detection results output from the anomaly detection model, and detects that there is an anomaly in the corresponding base station based on the anomaly information in the detection results. and a determination unit that determines.

According to the above configuration, dimension reduction allows detection of communication abnormalities through machine learning using learning input data generated based on communication status information for each base station when communication at the base station is normal. An anomaly detection model including an algorithm is provided. Since the anomaly detection model has learned the characteristics of input data when communication is normal, it can identify input data when an abnormality occurs in communication. By using the abnormality detection model generated in this way for abnormality detection processing, it becomes possible to appropriately detect abnormalities that do not appear in alarms issued from the base station.

In the anomaly detection device according to another embodiment, the determination unit may determine that there is an anomaly in the corresponding base station when the detection result including the anomaly information is acquired a predetermined number of times. good.

According to the above embodiment, if the abnormality detection model detects an abnormality less than a predetermined number of times, it is not determined that there is an abnormality in the base station, so that erroneous detection of an abnormality is prevented.

Furthermore, in the anomaly detection device according to another embodiment, the determination unit determines that if the number of detection result information including abnormality information in the total number of detection result information within a predetermined time period exceeds a preset ratio. Alternatively, it may be determined that there is an abnormality in the corresponding base station.

According to the above embodiment, if the number of abnormalities detected by the abnormality detection model is less than a predetermined ratio, it is not determined that there is an abnormality in the base station, so that erroneous detection of an abnormality is prevented.

Although this embodiment has been described in detail above, it is clear for those skilled in the art that this embodiment is not limited to the embodiment described in this specification. This embodiment can be implemented as modifications and changes without departing from the spirit and scope of the present invention as defined by the claims. Therefore, the description in this specification is for the purpose of illustrative explanation and does not have any restrictive meaning with respect to this embodiment.

Each aspect/embodiment described herein applies to LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G, 5G, FRA (Future Radio Access), W-CDMA. (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, UWB (Ultra-WideBand), The present invention may be applied to systems utilizing Bluetooth (registered trademark), other suitable systems, and/or next-generation systems extended based thereon.

The order of the processing procedures, sequences, flowcharts, etc. of each aspect/embodiment described in this specification may be changed as long as there is no contradiction. For example, the methods described herein present elements of the various steps in an exemplary order and are not limited to the particular order presented.

The input/output information may be stored in a specific location (eg, memory) or may be managed in a management table. Information etc. to be input/output may be overwritten, updated, or additionally written. The output information etc. may be deleted. The input information etc. may be transmitted to other devices.

Judgment may be made using a value expressed by 1 bit (0 or 1), a truth value (Boolean: true or false), or a comparison of numerical values (for example, a predetermined value). (comparison with a value).

Each aspect/embodiment described in this specification may be used alone, may be used in combination, or may be switched and used in accordance with execution. In addition, notification of prescribed information (for example, notification of "X") is not limited to being done explicitly, but may also be done implicitly (for example, not notifying the prescribed information). Good too.

Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described in the present disclosure. The present disclosure can be implemented as modifications and variations without departing from the spirit and scope of the present disclosure as determined by the claims. Therefore, the description of the present disclosure is for the purpose of illustrative explanation and is not intended to have any limiting meaning on the present disclosure.

Software includes instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, whether referred to as software, firmware, middleware, microcode, hardware description language, or by any other name. , should be broadly construed to mean an application, software application, software package, routine, subroutine, object, executable, thread of execution, procedure, function, etc.

Additionally, software, instructions, etc. may be sent and received via a transmission medium. For example, if the software uses wired technologies such as coaxial cable, fiber optic cable, twisted pair and digital subscriber line (DSL) and/or wireless technologies such as infrared, radio and microwave to When transmitted from a remote source, these wired and/or wireless technologies are included within the definition of transmission medium.

The information, signals, etc. described in this disclosure may be represented using any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc., which may be referred to throughout the above description, may refer to voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, light fields or photons, or any of these. It may also be represented by a combination of

Note that terms explained in this disclosure and/or terms necessary for understanding this specification may be replaced with terms having the same or similar meanings.

As used herein, the terms "system" and "network" are used interchangeably.

Further, the information, parameters, etc. described in this specification may be expressed as absolute values, relative values from a predetermined value, or other corresponding information. .

As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of operations. "Judgment" and "decision" include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, search, and inquiry. (e.g., searching in a table, database, or other data structure), and regarding an ascertaining as a "judgment" or "decision." In addition, "judgment" and "decision" refer to receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, and access. (accessing) (e.g., accessing data in memory) may include considering something as a "judgment" or "decision." In addition, "judgment" and "decision" mean that resolving, selecting, choosing, establishing, comparing, etc. are considered to be "judgement" and "decision." may be included. In other words, "judgment" and "decision" may include regarding some action as having been "judged" or "determined." Further, "judgment (decision)" may be read as "assuming", "expecting", "considering", etc.

As used in this disclosure, the phrase "based on" does not mean "based solely on" unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

Any reference to the elements herein, such as "first", "second", etc., does not generally limit the amount or order of those elements. These designations may be used herein as a convenient way of distinguishing between two or more elements. Thus, reference to a first and second element does not imply that only two elements may be employed therein or that the first element must precede the second element in any way.

To the extent that the words "include," "including," and variations thereof are used in this specification or in the claims, these terms are synonymous with the term "comprising." is intended to be comprehensive. Furthermore, the term "or" as used in this specification or in the claims is not intended to be exclusive or.

In this specification, a plurality of devices is also included unless it is clear from the context or technology that only one device exists.

Throughout this disclosure, the plural is intended to be included unless the context clearly dictates otherwise.

DESCRIPTION OF SYMBOLS 1... Anomaly detection system, 1A... Anomaly detection model learning device, 1B... Anomaly detection device, 11... Communication state information acquisition part, 12... Learning input data generation part, 13... Model learning part, 14... Model output part, 15 ...Communication status information acquisition section, 16...Anomaly detection target input data generation section, 17...Anomaly detection section, 18...Judgment section, 19...Measurement section, 20, 20A, 20B...Input data storage section, 30...Device alarm storage section , 40...Anomaly detection model storage unit, 50...Anomaly detection result storage unit, b...Base station, bc...Base station management device, m11...Communication status information acquisition module, m12...Learning input data generation module, m13...Model learning Module, m14...model output module, m15...communication state information acquisition module, m16...abnormality detection target input data generation module, m17...abnormality detection module, m18...judgment module, m19...measure module, M1A, M1B...recording medium, md ...Anomaly detection model, md1...Dimension reduction algorithm, md2...Error determination section, P1A...Anomaly detection model learning program, P1B...Anomaly detection program.

Claims (8)

An anomaly detection model learning device that uses machine learning to generate an anomaly detection model for detecting communication anomalies in a base station of a mobile communication network,
The anomaly detection model includes a dimensionality reduction algorithm;
a learning input data generation unit that generates learning input data based on at least one item or more of communication status information indicating a communication status of each base station when communication in the base station is normal;
a model learning unit that inputs the input data to the dimensionality reduction algorithm, updates parameters of the dimensionality reduction algorithm based on output data from the dimensionality reduction algorithm and the input data, and learns the anomaly detection model; and,
Equipped with
The learning input data generation unit refers to failure information indicating a period in which each base station was in a predetermined failure state, and based on the communication state information in a period in which the base station was not in a failure state, generating input data for said learning;
Anomaly detection model learning device. The learning input data generation unit causes the input data to include date and time information indicating a time corresponding to the occurrence of the communication state indicated in the communication state information.
The anomaly detection model learning device according to claim 1. The learning input data generation unit causes the input data to include holiday information indicating whether the date of occurrence of the communication state indicated in the communication state information corresponds to a holiday or a public holiday.
The anomaly detection model learning device according to claim 1 or 2. The anomaly detection model is configured by an autoencoder including a neural network,
The model learning unit updates parameters of the neural network based on an error of the output data with respect to the input data.
The anomaly detection model learning device according to any one of claims 1 to 3 . The input data includes at least one of the amount of communication data at the base station, the number of connected terminals, and the communication success rate.
The anomaly detection model learning device according to any one of claims 1 to 4 . An anomaly detection model that is trained by machine learning and uses a computer to detect communication anomalies in base stations of mobile communication networks,
including a dimension reduction algorithm and an error determination unit,
The dimension reduction algorithm uses input data generated based on at least one item of communication state information indicating the communication state of each base station when communication is normal as input to the dimension reduction algorithm. constructed by machine learning that updates parameters of the dimensionality reduction algorithm based on output data from and the input data,
The error determination unit determines whether an error of the output data with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, it is determined that there is an abnormality in communication of the base station. Outputs abnormality information indicating this as a detection result,
The input data is generated based on the communication state information during a period in which each base station was not in a fault state by referring to fault information indicating a period in which each base station was in a predetermined fault state.
Trained anomaly detection model. An anomaly detection device that detects a communication anomaly in a base station of a mobile communication network using a learned anomaly detection model,
The anomaly detection model is a model for making a computer function,
including a dimension reduction algorithm and an error determination unit,
The dimension reduction algorithm uses input data generated based on at least one item of communication state information indicating the communication state of each base station when communication is normal as input to the dimension reduction algorithm. constructed by machine learning that updates parameters of the dimensionality reduction algorithm based on output data from and the input data,
The error determination unit determines whether an error of the output data with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, it is determined that there is an abnormality in communication of the base station. Outputs abnormality information indicating this as a detection result,
The abnormality detection device includes:
an abnormality detection target input data generation unit that generates input data for abnormality detection based on at least one item or more of communication status information indicating the communication status at each base station;
an anomaly detection unit that inputs the input data of the anomaly detection target to the anomaly detection model and obtains the detection result output from the anomaly detection model;
a determination unit that determines that there is an abnormality in the corresponding base station based on abnormality information in the detection result,
The determination unit determines that there is an abnormality in the corresponding base station when the detection result including the abnormality information is obtained a preset number of times.
Anomaly detection device. An anomaly detection device that detects a communication anomaly in a base station of a mobile communication network using a learned anomaly detection model,
The anomaly detection model is a model for making a computer function,
dimensionality reduction algorithm, and
including an error determination section;
The dimension reduction algorithm uses input data generated based on at least one item of communication state information indicating the communication state of each base station when communication is normal as input to the dimension reduction algorithm. constructed by machine learning that updates parameters of the dimensionality reduction algorithm based on output data from and the input data,
The error determination unit determines whether an error of the output data with respect to the input data exceeds a predetermined threshold, and if the error exceeds the predetermined threshold, it is determined that there is an abnormality in communication of the base station. Outputs abnormality information indicating this as a detection result,
The abnormality detection device includes:
an abnormality detection target input data generation unit that generates input data for abnormality detection based on at least one item or more of communication status information indicating the communication status at each base station;
an anomaly detection unit that inputs the input data of the anomaly detection target to the anomaly detection model and obtains the detection result output from the anomaly detection model;
a determination unit that determines that there is an abnormality in the corresponding base station based on abnormality information in the detection result,
The determination unit is configured to determine whether the detection result information including the abnormality information exceeds a preset ratio to the total number of detection result information within a predetermined time period. determine that there is an abnormality,
Anomaly detection device.

Images