JP7423898B2 - Information processing device, determination device, model learning method - Google Patents

Description

Article 30, Paragraph 2 of the Patent Act applies Publication date: September 11, 2018 Meeting name: SICE Annual Conference 2018 (SICE Annual Conference 2018) Publisher: Adamo Santana, Kenya Murakami, Tatsuya Iizaka, Tetsuro Matsui, Yoshikazu Fukuyama Details of the disclosed invention: Adamo Santana and four others disclosed anomaly detection technology for showcases.

The present invention relates to an information processing device, a determination device, and a model learning method.

When detecting abnormal values from a plurality of data, a model constructed using normal values and abnormal values as training data is sometimes used (for example, Patent Document 1).

JP 2019-16209 Publication

By the way, in order to use abnormal values as training data, it is necessary to collect many samples of abnormal values. However, since abnormal values are generally values that are output when a device or system is not operating normally, it is difficult to collect many samples of abnormal values.

The present invention has been made in view of the conventional problems as described above, and an object of the present invention is to provide a technique for detecting abnormal values without using samples of abnormal values for learning.

The main present invention for solving the above-mentioned problems includes: an allocation unit that allocates a first value or a second value to each of a plurality of data belonging to a predetermined attribute; to determine whether the input data belongs to the predetermined attribute using first data to which the value is assigned and second data to which the second value is assigned among the plurality of data as teacher data. The information processing apparatus includes a learning unit that performs learning of the model.

According to the present invention, it is possible to provide a technique for detecting abnormal values without using samples of abnormal values for learning.

1 is a diagram showing the configuration of an abnormality detection system 10. FIG. 2 is a diagram showing an example of a hardware configuration of a learning device 20. FIG. 4 is a diagram showing an example of a data set 41. FIG. 2 is a diagram showing an example of functional blocks implemented in the learning device 20. FIG. 3 is a flowchart illustrating an example of processing executed by the learning device 20. FIG. 4 is a diagram showing an example of a data set 43. FIG. FIG. 3 is a diagram for explaining a function y. FIG. 3 is a diagram for explaining a function y. 2 is a diagram showing an example of a hardware configuration of a determination device 21. FIG. 2 is a diagram showing an example of functional blocks implemented in a determination device 21. FIG. 3 is a flowchart illustrating an example of processing executed by the determination device 21. FIG. FIG. 6 is a diagram for explaining the content executed in determination processing S202. 3 is a diagram showing a demonstration example of abnormality detection of a showcase 300. FIG.

From the description of this specification and the attached drawings, at least the following matters will become clear.

=====This embodiment =====
<<<Configuration of anomaly detection system 10>>>
FIG. 1 is a diagram showing the configuration of an abnormality detection system 10 that is an embodiment of the present invention. The abnormality detection system 10 is, for example, a system for detecting an abnormality in a showcase 300 installed in a commercial facility, and includes a learning device 20 and a determination device 21.

The showcase 300 is, for example, a case for cooling and storing foods and the like. For example, ten sensors 310 are attached to the showcase 300 to observe the state of the showcase 300. Note that in FIG. 1, the ten sensors 310 are depicted as one block for convenience.

Then, the abnormality detection system 10 detects an abnormality in the showcase 300 when the values of data x1 to x10 output from each of the ten sensors become abnormal values. Here, examples of "abnormal values" include abnormal values caused by physical abnormalities, numerical abnormal values, abnormal values caused by sensor abnormalities, and abnormal values that are not determined to be abnormal. When applied to a system, it refers to values that represent unusual behavior. Further, hereinafter, data when the operation of the showcase 300 is normal is referred to as "normal data" or "normal data", and data when the operation of the showcase 300 is abnormal is referred to as "abnormal data" or "normal data". This is called "abnormal data."

The learning device 20 (information processing device) is a model for determining whether or not there is an abnormality in the showcase 300 based on normal data x1 to x10, that is, for detecting abnormal values of data x1 to x10. Build a model using machine learning.

The determination device 21 determines whether or not there is an abnormality in the showcase 300 based on data x1 to x10 output from the showcase 300 in operation and the model constructed by the learning device 20. Note that the learning device 20 and the determining device 21 are connected via a network 25.

<<<About the learning device 20>>>
==Configuration of learning device 20==
FIG. 2 is a diagram showing an example of the hardware configuration of the learning device 20. The learning device 20 is a computer including a CPU (Central Processing Unit) 30, a memory 31, a storage device 32, an input device 33, a display device 34, and a communication device 35.

The CPU 30 implements various functions in the learning device 20 by executing programs stored in the memory 31 and the storage device 32.

The memory 31 is, for example, a RAM (Random-Acess Memory) or the like, and is used as a temporary storage area for programs, data, and the like.

The storage device 32 is a nonvolatile storage device that stores various data such as a control program 40 and a data set 41 that are executed or processed by the CPU 30.

The control program 40 is a general term for programs for realizing various functions of the learning device 20, and includes, for example, an OS (Operating System).

The data set 41, as shown in FIG. 3, is data x1 to x10 acquired from the showcase 300 by a sensor. Here, data x1 is, for example, an output from a temperature sensor attached to a predetermined location of showcase 300, and data x2 is an output from a pressure sensor that measures the pressure of a compressor inside showcase 300. . Furthermore, the data x10 is, for example, the output from a flow meter that measures the flow rate of refrigerant in the compressor. Note that the data x3 to x9 are also similar to x1, x2, etc., so a detailed explanation will be omitted here. Further, it is assumed that the data set 41 is stored in the storage device 32 in advance.

The learning model 42 is configured to include a discriminant or mathematical formula (hereinafter collectively referred to as "function y") for determining whether or not there is an abnormality in the showcase 300 from data x1 to x10. . When the learning model 42 is trained, the coefficients of the "function y" and the like are adjusted, and the accuracy of abnormality detection changes. Note that in this embodiment, the "function y" of the learning model 42 is expressed as y=f(x1, x2, ~, x10).

The input device 33 is a device that receives commands and data input by the user, and includes an input interface such as a keyboard and a touch sensor that detects a touch position on a touch panel display.

The display device 34 is, for example, a device such as a display, and the communication device 35 exchanges various programs and data with the determination device 21 and other computers via the network 25.

==Functional block==
FIG. 4 is a diagram showing an example of functional blocks implemented in the learning device 20. When the CPU 30 of the learning device 20 executes the control program 40, the learning device 20 implements an acquisition section 50, an allocation section 51, and a learning section 52.

The acquisition unit 50 acquires the data set 41 stored in the storage device 32, and the allocation unit 51 assigns “0 (first value)” or “1 (second value)” to the data included in the data set 41. )" are randomly assigned. Here, "0" or "1" corresponds to a "label" necessary for performing supervised machine learning. In other words, the allocation unit 51 generates the teacher data by randomly assigning a "label" of "0" or "1" to the data included in the data set 41.

The learning unit 52 uses the data D1 assigned with “0” by the assignment unit 51 and the data D2 assigned with “1” as teacher data, and performs learning of the learning model 42. Specifically, the learning unit 52 calculates the "function f" by performing support vector regression on the data D1 and D2, for example.

Although the learning unit 52 executes support vector regression here, other nonlinear regression analysis (for example, nonlinear least squares method, polynomial regression) may be used, and nonlinear classification (for example, support vector regression) may be used. vector machine). Further, for example, a neural network model may be used as the learning model 42, and in such a case, the learning unit 52 determines the parameters of the neural network model based on the teacher data (data D1, D2). As a result, the learning model 42 in this embodiment becomes a nonlinear regression model or a nonlinear classification model. An example of processing executed by each functional block will be described below with reference to FIG. 5.

<<Learning process S10>>
First, the acquisition unit 50 acquires the data set 41 stored in the storage device 32 (S20). Then, the allocation unit 51 randomly allocates "0" or "1" to the data included in the data set 41 (S21: allocation process). For example, the allocation unit 51 updates the data set 41 by storing “0” in association with the data (x1, to x10) at time t1 in the data set 41. As a result, as shown in FIG. 6, in the storage device 32, the data at time t1 of the data set 43 after the value is assigned is the data (x1, ~, x10, y )=(30.1,~,35.2,0).

Further, the allocation unit 51 stores "1" in association with the data (x1, to x10) at time t2 of the data set 41, and updates the data set 41. Hereinafter, since the other times are similar to times t1 and t2, detailed explanation will be omitted.

Then, the learning unit 52 uses the data D1 (first data) to which “0” is assigned by the assignment unit 51 and the data D2 (second data) to which “1” is assigned as teacher data, and uses the learning model 42 as teacher data. is learned and the "function f" is determined (S22: learning process).

7 and 8 are diagrams for explaining the "function f". In this embodiment, the data at each time in the data set 41 includes 10 pieces of data (x1 to x10), but for convenience, the “function f” when there is only one piece of data x1 will be explained in FIG. However, in FIG. 8, the "function f" when there are two pieces of data x1 and x2 will be explained.

In FIG. 7, normal data of variable x1 is assumed to be included in range A from "a0" to "a1", for example. Also, among the data x1 in range A, data D1 to which "0" is assigned is plotted on the straight line of y = 0, and data D2 to which "1" is assigned is plotted on the straight line of y = 1. be done.

In such a case, when the learning unit 52 executes a nonlinear regression analysis (or nonlinear classification), for example, the output (value) y of the “function ff(x1)” is determined by the fact that the data x1 is “a0 ” to “a1”, it changes between “0” and “1”. Further, the output y of the "function f(x1)" becomes greater than "1" in a region where data x1 is smaller than "a0", and becomes smaller than "0" in a region where data x1 is larger than "a1".

In FIG. 8, normal data (x1, x2) is assumed to be included in region B of the x1-x2 plane including, for example, the x1 axis and the x2 axis. Among the data (x1, x2) in area B, data D1 to which "0" is assigned is plotted in area C of the x1-x2 plane where y=0, and data D2 to which "1" is assigned is plotted in y is plotted in area D of the x1-x2 plane where =1.

In such a case, when the learning unit 52 executes nonlinear regression analysis (or nonlinear separation), for example, the value changes between regions C and D between "0" and "1", In areas other than areas C and D, a "function f(x1, x2)" whose value changes greatly is determined.

In other words, the "function f(x1, ~, x10)" found in process S22 outputs a value between "0" and "1" when normal data is input, and when abnormal data is input. This is a function that outputs a value far away from "0" to "1". By using such a "function f", the "abnormal values" of the data x1 to x10 can be ascertained, making it possible to detect an abnormality in the showcase 300.

<<<About the determination device 21>>>
==Configuration of determination device 21==
FIG. 9 is a diagram showing an example of the hardware configuration of the determination device 21. The determination device 21 is a computer including a CPU 70, a memory 71, a storage device 72, an input device 73, a display device 74, and a communication device 75. Note that the hardware configuration of the determination device 21 is similar to the hardware configuration of the learning device 20, so a detailed explanation will be omitted here.

The storage device 72 (storage unit) stores the learning model 42, the determination program 80, and the determination data 81. The learning model 42 is a model constructed by the learning device 20.

Similar to the control program 40, the determination program 80 is a general term for programs for realizing various functions of the determination device 21.

The determination data 81 is data indicating the determination result of determining whether or not there is an abnormality in the showcase 300.

==Functional block==
FIG. 10 is a diagram showing an example of functional blocks implemented in the determination device 21. As shown in FIG. When the CPU 70 of the determination device 21 executes the determination program 80, the determination device 21 implements an acquisition unit 100, a calculation unit 101, and a determination unit 102.

The acquisition unit 100 acquires data x1 to x10 output from the sensor 310 at predetermined intervals (for example, every 30 seconds).

The calculation unit 101 calculates a “function f” indicating the learning model 42 based on the data acquired by the acquisition unit 100 (hereinafter referred to as “acquired data”) and the learning model 42 stored in the storage device 72. Calculate the output (value of function f).

The determination unit 102 determines whether the value of the “function f” calculated by the calculation unit 101 is between, for example, a threshold T1 (first threshold) smaller than “0” and a threshold T2 (second threshold) larger than “1”. If it falls within range F, it is determined that the acquired data is normal data, and if it does not fall within range F, it is determined that the acquired data is abnormal data. The details of each functional block will be explained below along with the determination process executed by the determination device 21.

<<Determination process S100>>
First, as shown in FIG. 11, the acquisition unit 100 acquires data x1 to x10 from the sensor 310 (S200). Then, the calculation unit 101 calculates the output y of the “function f” based on the acquired data (x1, ~, x10) and the function f (x1, ~, x10)) obtained as the learning model 42. (S201).

The determining unit 102 determines whether the value of "output y" falls within the range F of threshold values T1 to T2 (S202). FIG. 12 is a diagram for explaining the contents executed in process S202. Note that although the value of the "function f" is determined based on ten pieces of data x1 to x10, one variable (data x1) is used for explanation in FIG. 12 for convenience.

If the calculated "output y" value is, for example, "P1 (T1<P1<T2)" in FIG. 12, that is, if the value of "output y" falls within range F (S202: Yes), the determination unit 102 determines that the acquired data is normal data (S203).

On the other hand, if the calculated "function f" value is, for example, "P2 (T1>P2") in FIG. 12, that is, if the value of "output y" does not fall within range F (S202: No), the judgment The unit 102 determines that the acquired data is abnormal data (S204). Then, the determination unit 102 stores the determination results of processes S203 and 204 in the storage device 72, and updates the determination data 81 (S205).

＜＜Demonstration results＞＞
FIG. 13 is an example of the determination result of the determination device 21 when a failure (for example, refrigerant leak) actually occurs in the showcase 300.

First, in January and February, the showcase 300 operates normally, so the value of "output y", which is the calculation result of the calculation unit 101, basically falls within the range F. Therefore, during this period, the determination result that the acquired data (x1 to x10) is abnormal data is basically not output. Note that the value of "output y" reached the threshold value T1 only once between January and February, and an abnormality was detected, but this was due to the influence of noise and the like.

Then, in February, when refrigerant leaks from the compressor (not shown) of the showcase 300, the number of times the calculation result of the calculation unit 101 exceeds the range F increases. As a result, especially after mid-February, the number of times the determination unit 102 outputs a determination result that the acquired data (x1 to x10) is abnormal data also increases.

When the refrigerant leak is repaired at the end of February, the showcase 300 operates normally again, so the calculation result of the calculation unit 101 falls within range F. As a result, the determination unit 102 outputs a determination result that the acquired data (x1 to x10) is normal data.

===Summary===
The abnormality detection system 10 of this embodiment has been described above. The allocation unit 51 of the learning device 20 allocates "0" or "1" to a dataset containing normal data (a plurality of data belonging to a predetermined attribute) to generate teacher data (for example, in step S21 ). Then, the learning unit 52 uses the teacher data to perform the learning of the learning model 42 to determine whether the input data x1 to x10 (input data) is normal data (data with a predetermined attribute). (for example, processing S22). Therefore, in this embodiment, the learning model 42 for detecting abnormal data (abnormal values) can be constructed without using abnormal sample data. Furthermore, in this embodiment, various regressions and classifications can be used when learning the learning model 42. Therefore, compared to the case where a general abnormal value detection method (for example, One Class SVM) is used, an optimal learning model 42 can be constructed according to the field to which the learning model 42 is applied.

Further, for example, when assigning "0" or "1" to the data included in the data set 41, the assigning unit 51 may assign binary values according to a predetermined pattern. Note that the "predetermined pattern" refers to the assignment after determining the number and order of the values to be assigned, such as assigning 100 "0"s and then assigning 100 "1s". Generally, the data included in the data set 41 is often data acquired in time series, for example. Therefore, when the number and order of values to be assigned are determined, the same value may be assigned to much of the data affected by noise or the like. In this embodiment, the allocation unit 51 randomly allocates binary values, so that data can be prevented from being influenced by noise.

Further, the learning model 42 may be a linear classification model or a linear regression model. However, when a linear model is used, the difference between the "output y" value when normal data is input and the "output y" value when abnormal data is input is generally small. Become. In this embodiment, a nonlinear classification model or a nonlinear regression model is used as the learning model 42. Therefore, in general, the difference between the value of "output y" when normal data is input and the value of "output y" when abnormal data is input is large, so abnormal data (abnormal value) can be detected.

Moreover, the determination device 21 can determine the presence or absence of abnormal data by using the learning model 42 constructed using normal data. Therefore, even if it is difficult to collect a large amount of abnormal data, abnormal data can be detected.

The above-described embodiments are provided to facilitate understanding of the present invention, and are not intended to be interpreted as limiting the present invention. Further, the present invention can be modified and improved without departing from the spirit thereof, and it goes without saying that the present invention includes equivalents thereof.

For example, the data in this embodiment is data x1 to x10 output from the sensor 310 of the showcase 300, but is not limited thereto. For example, the data to which binary values are assigned may be data such as the output of a sensor provided in another device or an access log of a server. Even with such data, abnormal values can be detected by learning the model.

Further, although the allocation unit 51 allocates "0" or "1" to the data included in the data set 41, the allocation unit 51 is not limited to these values. For example, the allocation unit 51 may allocate two different values, such as "-1" or "1", to the data.

Further, although the threshold value T1 that defines the range F is smaller than "0" and the threshold value T2 is larger than "1", the present invention is not limited to this. For example, the threshold value T1 may be greater than or equal to "0", and the threshold value T2 may be less than or equal to "1". Even in such a case, it is possible to detect abnormal values.

10 Anomaly detection system 20 Learning device 21 Determination device 25 Network 30, 70 CPU
31, 71 Memory 32, 72 Storage device 33, 73 Input device 34, 74 Display device 35, 75 Communication device 40 Control program 41, 43 Data set 42 Learning model 50, 100 Acquisition unit 51 Allocation unit 52 Learning unit 80 Judgment program 81 Judgment data 101 Calculation section 102 Judgment section

Claims (5)

an assignment unit that assigns a first value or a second value less than or equal to the first value to each of the plurality of data belonging to an attribute indicating normal data;
The first data to which the first value is assigned among the plurality of data and the second data to which the second value is assigned among the plurality of data are used as training data, and the input data is set to the normal state. If the input data belongs to an attribute indicating normal data, a value included in a predetermined range of less than or equal to the first value and greater than or equal to the second value is output, and if the input data does not belong to the attribute indicating normal data, the a learning unit that trains the model to output values that are not included in a predetermined range;
An information processing device comprising: The information processing device according to claim 1,
The allocation department is
Randomly assigning the first value or the second value to each of the plurality of data;
An information processing device characterized by: The information processing device according to claim 1 or 2,
the model is a non-linear classification model or a non-linear regression model;
An information processing device characterized by: The computer is
an assignment process of assigning a first value or a second value less than or equal to the first value to each of a plurality of data belonging to an attribute indicating normal data;
The first data to which the first value is assigned among the plurality of data and the second data to which the second value is assigned among the plurality of data are used as training data, and the input data is set to the normal state. If the input data belongs to an attribute indicating normal data, a value included in a predetermined range of less than or equal to the first value and greater than or equal to the second value is output, and if the input data does not belong to the attribute indicating normal data, the a learning process that trains the model to output values that are not included in a predetermined range;
A method for training the model to perform. Learning using first data to which a first value is assigned among a plurality of data belonging to an attribute indicating normal data, and second data to which a second value is assigned from among the plurality of data as training data. a storage unit that stores a model for determining whether the input data belonging to the attribute indicating the normal data;
a calculation unit that calculates a value for determining whether the input data belongs to the attribute indicating the normal data, based on the input data and the model;
If the value is included in a predetermined range determined by a first threshold value that is less than or equal to the first value and a second threshold value that is greater than or equal to the second value, the input data belongs to the attribute indicating the normal data. a determining unit that determines that the input data does not belong to the attribute indicating the normal data if the value is not included in the predetermined range;
A determination device comprising: