JP7526852B2 - Anomaly detection device and anomaly detection method - Google Patents

Description

The present invention relates to an anomaly detection device and an anomaly detection method.

Electric power companies use waste heat from gas turbines to supply hot water for district heating and high-pressure and low-pressure steam to factories. Petrochemical companies operate gas turbines as power supply equipment. In various plants and facilities that use gas turbines, anomaly detection to detect malfunctions or signs of malfunction in the equipment is extremely important in order to minimize damage to society.

The list of equipment that requires preventive maintenance is endless, including not only gas turbines and steam turbines, but also water wheels at hydroelectric power plants, nuclear reactors at nuclear power plants, wind turbines at wind power plants, engines for aircraft and heavy machinery, railway cars and tracks, escalators, elevators, and even deterioration and lifespan of on-board batteries at the equipment and component level.

For this reason, multiple sensors are installed in the target equipment or plant to obtain various physical information, and the target equipment or plant is judged to be normal or abnormal according to the monitoring criteria for each sensor.

Patent Document 1 discloses an anomaly detection method that detects the presence or absence of anomalies by comparing an anomaly measure calculated based on learning of past normal data with a threshold value. Furthermore, a method is disclosed for excluding sensors based on an evaluation value calculated based on a two-dimensional distribution of sensor signals, with the aim of excluding sensors that impair anomaly detection sensitivity. Here, the anomaly measure is the amount of deviation from the vector value in a normal state, with the measured values from multiple sensors expressed as a single vector value.

JP 2016-200949 A

In Patent Document 1, it is possible to appropriately remove sensors that impair sensitivity, thereby improving anomaly detection sensitivity. However, if the equipment has a large number of sensors, the effect of each sensor becomes smaller, resulting in a decrease in anomaly detection sensitivity. Reducing the number of sensors targeted for anomaly detection to around 30 improves the anomaly detection sensitivity of the targeted sensors. However, for example, if the original number of sensors is 100, around 70 will not be targeted for anomaly detection, and any anomalies that occur in these sensors will not be detected, resulting in a decrease in anomaly detection sensitivity.

The object of the present invention is to improve the anomaly detection sensitivity of an anomaly detection device even when the equipment has a large number of sensors.

The anomaly detection device according to one aspect of the present invention includes a first sensor signal input unit to which multiple time-series sensor signals output from multiple sensors attached to equipment are input; a sensor group setting unit that calculates a similarity between the multiple sensor signals input to the first sensor signal input unit and sets a sensor group based on the similarity; a second sensor signal input unit to which the multiple sensor signals output from the multiple sensors are input; a feature vector extraction unit that extracts a feature vector for each time from the multiple sensor signals input to the second sensor signal input unit for each sensor group; an anomaly measure calculation unit that calculates an anomaly measure for each time using the feature vector for a specified learning period as learning data for each sensor group; and an anomaly detection unit that determines whether the sensor signal at each time is normal or abnormal by comparing the anomaly measure with a predetermined threshold for each sensor group.

The anomaly detection method according to one aspect of the present invention is characterized in that it inputs multiple time-series sensor signals output from multiple sensors attached to equipment, calculates similarities between the multiple sensor signals, sets sensor groups based on the similarities, extracts feature vectors for each time from the multiple sensor signals for each sensor group, calculates an anomaly measure for each time using the feature vectors for a specified learning period as learning data for each sensor group, and determines whether the sensor signal at each time is normal or abnormal by comparing the anomaly measure with a predetermined threshold for each sensor group.

According to one aspect of the present invention, even if the equipment has a large number of sensors, it is possible to improve the sensitivity of anomaly detection for all sensors and detect anomalies that occur in the sensors.

1 is a diagram illustrating an example of a configuration of an anomaly detection device according to an embodiment; FIG. 11 is a diagram showing an example in which a plurality of sensor signals are listed in a table format. FIG. 2 is a diagram illustrating an overall processing flow performed by the anomaly detection device according to the embodiment. FIG. 11 is a diagram illustrating a flow of a sensor group setting process according to the first embodiment. FIG. 13 is a diagram showing a flow of a two-dimensional frequency distribution calculation process. 1A to 1C are diagrams illustrating a method for creating a two-dimensional frequency distribution image. FIG. 11 is a diagram illustrating a method for calculating a similarity between sensors. FIG. 13 is a diagram showing an example of a two-dimensional frequency distribution image. FIG. 13 is a diagram showing an example of a two-dimensional frequency distribution image. FIG. 13 is a diagram showing an example of a two-dimensional frequency distribution image. FIG. 11 is a diagram showing a flow of a sensor group setting process according to the second embodiment. FIG. 13 is a diagram showing a flow of a sensor group setting process according to the third embodiment. FIG. 13 is a diagram showing a flow of an anomaly measure calculation process during learning. 11A and 11B are diagrams illustrating an anomaly measure calculation process using a local subspace method; FIG. 13 is a diagram illustrating a flow of an abnormality detection process. FIG. 13 is a diagram illustrating an example of a GUI for setting a sensor group setting condition. FIG. 13 is a diagram showing an example of a distribution image display screen. FIG. 13 is a diagram showing an example of a sensor signal display screen. FIG. 13 is a diagram illustrating an example of a GUI for setting offline analysis conditions. FIG. 13 is a diagram showing an example of a GUI for specifying a display target of online analysis results. FIG. 13 is a diagram showing an example of an overall analysis result display screen. FIG. 13 is a diagram showing an example of an enlarged analysis result display screen.

The following describes the embodiment with reference to the drawings.

An example of the configuration of an anomaly detection device according to an embodiment will be described with reference to FIG.
The anomaly detection device 100 acquires sensor signals 102 output from a plurality of sensors attached to equipment 101 that is the detection target at predetermined time intervals (periodically). The acquired sensor signals 102 are temporarily stored in a sensor signal storage unit 103. A signal input unit (first sensor signal input unit) 104 inputs the sensor signals 102 from the sensor signal storage unit 103 and sends them to a sensor group setting unit 105. The sensor group setting unit 105 sets sensor groups based on the similarity (similarity) between the sensor signals, and stores the results in a group information storage unit 106.

The signal input unit (second sensor signal input unit) 107 inputs the sensor signal 102 from the sensor signal storage unit 103 or directly from a sensor attached to the equipment 101, and sends it to the feature vector extraction unit 108. The feature vector extraction unit 108 inputs the sensor group information from the group information storage unit 106, extracts a feature vector based on the sensor signal 102 for each set group, and sends it to the anomaly measure calculation unit 109. The anomaly measure calculation unit 109 calculates an anomaly measure for each feature vector at each predetermined time (hereinafter sometimes referred to as each time) using the feature vector for a pre-specified learning period.

The threshold calculation unit 110 calculates a threshold based on the anomaly measure of the learning data calculated by the anomaly measure calculation unit 109. The feature vectors for the learning period extracted by the feature vector extraction unit 108, the threshold value calculated by the threshold calculation unit 110, and other data required for anomaly detection are stored as learning results in the learning result accumulation unit 111. The anomaly detection unit 112 detects anomalies in the equipment 101 by comparing the anomaly measures of each feature vector sent from the anomaly measure calculation unit 109 with the threshold value calculated by the threshold calculation unit 110. The detection results detected by the anomaly detection unit 112 are output to the output unit 113.

Here, we provide a brief explanation of the terms used below. A feature vector is a representation of measurement values from multiple sensors as a single vector value. An anomaly measure is the amount of deviation of a feature vector of interest from the feature vector for a specified period. In other words, an anomaly measure is the amount of deviation from the vector value in a normal state, when measurement values from multiple sensors are represented as a single vector value.

The equipment 101 that is the subject of anomaly detection is, for example, equipment or a plant such as a gas turbine or a steam turbine. The equipment 101 outputs a sensor signal 102 that represents its state. The sensor signal 102 is accumulated in a sensor signal accumulation unit 103.

FIG. 2 is an example in which a plurality of sensor signals 102 are listed and displayed in a table format.
The sensor signal 102 is a multidimensional time series signal in which multiple pieces of physical information with different physical properties are acquired at predetermined intervals. The table shown in Fig. 2 shows information on date and time 201 in correspondence with sensor values 202 of multiple sensors. The number of sensors may range from hundreds to thousands, and depending on the type of sensor, the sensor values output may include, for example, the temperature of cylinders, oil, cooling water, etc., the pressure of oil or cooling water, the rotation speed of a shaft, room temperature, and operation time. The sensor values may not only represent the output or state of equipment or a plant, but may also be control signals for controlling a state of something to a certain value (for example, a target value).

The operation of the anomaly detection device 100 has the following phases: a "sensor group setting" process that sets a sensor group using data accumulated in the sensor signal accumulation unit 103, a "learning" process that generates and saves learning data using the data accumulated in the sensor signal accumulation unit 103, and an "anomaly detection" process that detects anomalies based on an input signal. Essentially, "sensor group setting" and "learning" are offline processes, while "anomaly detection" is online. However, it is also possible to treat "anomaly detection" as an offline process. In the following explanation, these are distinguished by the terms "when setting a sensor group," "when learning," and "when detecting anomalies."

The operation of the anomaly detection device 100 according to the embodiment will be described with reference to the process flow of FIG.
Incidentally, FIG. 3 shows an outline of the process.

(a) is the sensor group setting process, in which sensor signals for a specified period are input (S301), the similarity between the sensor signals is calculated (S302), and a sensor group is set based on the similarity (S303).

(b) is the anomaly measure calculation process during learning, in which the sensor signal during the learning period is input (S311), and feature vectors are extracted (S312), the anomaly measure is calculated (S313), and a threshold value is calculated (S314).

(c) is the anomaly judgment process when an anomaly is detected, in which the sensor signal of the detection target is input (S321), a feature vector is extracted (S322), and an anomaly measure is calculated (S323). Then, the calculated anomaly measure is compared with the threshold value obtained in S314 to judge whether the equipment is normal or abnormal (S324). Note that (b) and (c) are processes for each group set in the sensor group setting unit 105.

The following will explain steps (a), (b), and (c) in that order, with detailed flows for each step explained in Figures 4, 5, 9A, 9B, 10A, and 11.

The sensor group setting process of the first embodiment will be described with reference to the flow of FIG.
First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal for a specified period among the sensor values stored in the sensor signal storage unit 103 (S401). Next, the sensor group setting unit 105 creates a two-dimensional frequency distribution image for every two sensors (S402). Next, the similarity between the sensor signals is calculated based on the two-dimensional frequency distribution image (S403).

Next, hierarchical clustering based on similarity is performed (S404). All input sensor signals are assigned to each cluster without duplication, which in turn becomes a sensor group. Finally, the group information is stored in the group information storage unit 106 (S405). The output format output to the output unit 113 is a list of the sensor names or numbers of sensors in use for each sensor group, or the sensor names or numbers of sensors not in use.

The two-dimensional frequency distribution calculation process (S402) will now be described with reference to Fig. 5. Fig. 5 is a diagram showing the flow of the two-dimensional frequency distribution calculation process.
First, a sensor signal for a specified period is input (S501). The processes from steps S503 to S506 are repeated for each sensor signal (S502, loop 1). First, the maximum value (MAX) and minimum value (MIN) of the data for the learning period are found (S503). Next, the interval S for dividing the range from the minimum value to the maximum value by the specified number N is calculated (S504). Note that S can be calculated as S = (MAX - MIN) / N. Next, the processing range for calculating the two-dimensional frequency distribution is calculated (S505), but in this case, the MIN to MAX calculated in step S503 is used as the processing range as is.

Next, for all data in the learning period, the bin number (BNO) is calculated from the sensor signal value (F) using the following formula (S506).
BNO=INT(N*(F-MIN)/(MAX-MIN))
Here, the function INT(X) represents the integer part of X. By using the bin number (BNO), each signal value is converted into an integer value in (N+1) stages from a minimum value of 0 to a maximum value of N.

Next, two sensors are selected from the multiple sensors, and a two-dimensional frequency distribution is calculated based on the combination of the sensor signals. This process is repeated from steps S508 to S510 for all sensor combinations (S507, loop 2). Here, the combinations of two sensors include combinations of the same sensor. Therefore, the number of sensor combinations (number of repetitions) is (number of sensors) x (number of sensors + 1) / 2.

First, a two-dimensional array for calculating the two-dimensional distribution is secured, and all elements are set to 0 (S508). The size of the array is N. For all data in the learning period, 1 is added to the elements of the array that correspond to the bin numbers BNO of the two sensor signals (S509). That is, the bin number of one sensor signal corresponds to the column elements, and the bin number of the other sensor signal corresponds to the row elements. This process calculates a two-dimensional frequency distribution (histogram) of the signals from the two sensors. This frequency distribution is converted into an image and saved (S510). The conversion method will be described later. Figure 6 is a diagram showing the relationship between the time series sensor signals and the two-dimensional frequency distribution image.

An example of the image conversion method in step S510 will be described.
First, the maximum value of the array elements, i.e., the maximum frequency, is found. The image size is the same as the array size, and the pixel value of the coordinate corresponding to the value of each element is, for example, 255 x array element value/maximum frequency. The number 255 is the maximum value when the pixel value is expressed in 8 bits, and if this value is used, it can be saved as is in bitmap format. Alternatively, the pixel value is set to 255 x LOG (array element value + 1)/LOG (maximum frequency + 1), where the function LOG(X) represents the logarithm of X. By using such a conversion formula, it becomes possible to associate a non-zero pixel value with a non-zero frequency even when the maximum frequency is large.

The method for creating a frequency distribution image is not limited to the above method. For example, instead of a simple frequency distribution, a Gaussian distribution or other weighted filter may be assigned to one piece of data and then superimposed. Alternatively, the image obtained by the above method may be subjected to a maximum value filter of a specified size, an average filter, or other weighted filter. Also, the image may be converted to 16 bits instead of 8 bits. Also, it is not necessarily necessary to save in image format, and the two-dimensional array may be saved in binary or text format without conversion.

Next, the process of calculating the similarity between sensor signals (S403) will be described.
Here, the similarity between the sensor signals represents a quantification of whether the signal values affect each other. Therefore, the similarity is calculated using the two-dimensional frequency distribution image calculated in step S402.

Figure 7 is a diagram explaining the calculation of the similarity between sensors a and b. From the left, these are two-dimensional frequency distribution images of sensors a and b, sensors b and a and b.

These images obtained by the processing in Figure 5 are represented by high pixel values where the density is high in a two-dimensional feature space. Unlike normal grayscale images, these are grayscale images in which a pixel value of 0 is represented as white and 255 as black. First, the number of non-zero pixels in these images are counted and designated Count(a, a), Count(b, b), and Count(a, b), respectively. Similarity (a, b) is calculated using (Equation 1). However, if Count(b, b) > Count(a, a), a and b in the following equation are swapped for calculation.

This formula was designed based on the idea that when the value of the sensor with the greater number of states is determined, the smaller the range of the other sensor's value is, the higher the similarity; when there is only a diagonal line, the similarity is 1, and when the entire surface is filled in, the similarity is 0.

Figures 8A to 8C are diagrams showing some examples of two-dimensional frequency distribution images. The horizontal axis shows the signal value (bin number) of sensor a, and the vertical axis shows the signal value (bin number) of sensor b.

The image pattern of the two-dimensional frequency distribution image changes depending on the strength of the correlation between the two sensors. Figures 8A and 8B show cases where the correlation is strong, and in particular Figure 8A shows a case where there is a time lag in the state transition. Figure 8C shows a case where the correlation is weak. Here, the similarity in the two-dimensional frequency distribution image of Figure 8A is 0.893, the similarity in the two-dimensional frequency distribution image of Figure 8B is 0.838, and the similarity in the two-dimensional frequency distribution image of Figure 8C is 0.084.

The correlation coefficient is known as a numerical value that indicates the relationship between data, but it is a measure of linearity and cannot cover all cases where there is mutual influence. Figure 8A shows an example where the sensors have a strong mutual influence but a low correlation coefficient.

Next, the hierarchical clustering process (S404) will be described.
Hierarchical clustering starts by assigning each data to one cluster, and then recursively combines similar clusters. Depending on the criteria for selecting clusters to be combined, there are methods such as the shortest distance method, the longest distance method, and the group average method. In each method, the similarity between clusters is defined by the maximum, minimum, and average value of the similarity between data across clusters. Clusters are combined in order starting from the pair with the greatest similarity to form one cluster, and when the similarity between all clusters falls below a predetermined similarity reference value, the combination is stopped. However, if the total number of data included in two clusters of interest is greater than a predetermined maximum number of sensors, the similarity is considered to be 0, so that the number of data included in one cluster does not exceed the maximum number. The similarity reference value is a parameter and is specified as a real number between 0 and 1. The maximum number of sensors is also a parameter.

The sensor group setting process of the second embodiment will be described with reference to the flow in FIG. 9A. The second embodiment is a process in which sensors to be grouped together are designated in advance.

First, the signal input unit (first sensor signal input unit) 104 inputs a sensor signal for a specified period from among the sensor values stored in the sensor signal storage unit 103 (S901). Next, the sensor group setting unit 105 creates a two-dimensional frequency distribution image for every two sensors (S902). Next, the similarity between the sensor signals is calculated based on the two-dimensional frequency distribution image (S903). Next, instructions regarding sensor group setting are input (S904). The method can be anything, such as input from a GUI or reading a file, but it is assumed that sensors to be in the same sensor group are specified. Multiple combinations may be specified.

Next, the similarity between sensors designated as being in the same sensor group is set to 1 regardless of the value calculated in step S903 (S905). Next, hierarchical clustering based on similarity is performed (S906). Sensors designated as being in the same sensor group have a similarity of 1 and are therefore combined at the beginning of the hierarchical clustering process, while undesignated sensors are combined according to their similarity. As in step S404, a maximum number of sensors and a similarity reference value are designated in advance, and if the maximum number of sensors is exceeded, no combination is performed, and if the distance between all clusters falls below the similarity reference value, combination is stopped. Finally, the group information is stored in the group information storage unit 106 (S907).

The sensor group setting process of the third embodiment will be described with reference to the flow in FIG. 9B. The third embodiment is a process for grouping sensors similar to a sensor that has been designated in advance as the core of a group.

First, the sensor signal input (S911), the two-dimensional frequency distribution image creation (S912), and the calculation of the similarity between the sensor signals (S913) are the same as in Example 2.

Next, an instruction for setting a sensor group is input (S914). Here, a sensor group consisting of one or more sensors that are to be the core of the sensor group is specified. Multiple instructions may be input, and the following process is carried out independently for each instruction (S915).

First, a new cluster is created and the specified sensor group is placed in that cluster (S916). Next, the similarity between the unspecified sensor and the sensor group is calculated (S917). The similarity between the sensor and the cluster is set to, for example, the average similarity between the sensor of interest and the sensor group. Alternatively, it is set to the minimum or maximum value.

Next, the sensors are placed in the same cluster in descending order of calculated similarity (S918). However, this applies only if the number of sensors is within a pre-specified maximum number and is equal to or greater than a pre-specified reference value for similarity. Once the processing of steps S916 to S918 has been completed for the specified number of sensors, a new cluster is created and sensors that have not yet been placed in any cluster are placed therein (S919). Finally, the group information is saved in the group information storage unit 106 (S920).

We will now describe further variations in the sensor group setting process described in Figures 4, 9A, and 9B.

In the first example, the sensors to be included in all groups are specified in advance, and after the groups are set using one of the methods described above, a process is added in which the specified sensors are placed in the previous group. In the second example, after the sensor signal is input (S401), a data cleansing process is performed based on the sensor signal. This is a process to remove noise data such as missing values and error values that have a negative effect on the analysis. Specifically, data that falls outside the main distribution and has a low occurrence rate is deleted based on the histogram for each sensor. The data cleansing process can improve the accuracy of calculating the similarity between sensors.

Next, the anomaly measure calculation process during learning in FIG. 3(b) will be described with reference to the flow in FIG. 10A. This process is performed for each sensor group set in S303.

First, the signal input unit (second sensor signal input unit) 107 inputs sensor signals for a specified period (learning period) from the sensor values stored in the sensor signal storage unit 103 (S1001). The learning period is specified as the period during which the equipment was in a normal state. Next, the feature vector extraction unit 108 canonicalizes the input sensor signals (S1002). The feature vector extraction unit 108 obtains information on the sensors included in the group of interest from the group information storage unit 106, and the canonicalization and feature vector extraction described below are performed on the sensors included in the group.

Sensor signals are canonicalized to treat multiple sensor signals with different units and scales in the same way. Specifically, each sensor signal is converted using the average and standard deviation of the learning period so that the average is 0 and the variance is 1. The average and standard deviation of each sensor signal are stored so that the same conversion can be performed when an abnormality is detected. Alternatively, each sensor signal is converted using the maximum and minimum values of the learning period so that the maximum is 1 and the minimum is 0. Alternatively, preset upper and lower limit values may be used instead of the maximum and minimum values. In this case, the maximum and minimum values or upper and lower limit values of each sensor signal are stored in the learning result accumulation unit 109 so that the same conversion can be performed when an abnormality is detected.

Next, the feature vector extraction unit 108 extracts a feature vector for each time (S1003). The feature vector is the canonicalized sensor signal arranged as is as elements. Alternatively, a window of ±1, ±2, ... can be set for a certain time, and a feature vector of window width (3, 5, ...) x number of sensors can be used to extract features that represent changes in the sensor signal over time. Alternatively, a discrete wavelet transform (DWT) can be applied to break down the signal into frequency components.

Next, the anomaly measure calculation unit 109 calculates the anomaly measure for the learning period. First, the learning period is divided into multiple intervals (S1004), and the following process is repeated for all extracted feature vectors (S1005). A vector of interest, which is a feature vector selected sequentially corresponding to multiple intervals, and data for the learning period excluding the same interval as the vector of interest, are used as learning data (S1006). The anomaly measure is calculated using the vector of interest and the learning data (S1007). The intervals in step S1004 may be divided, for example, by day. Alternatively, the division may be by batch in the case of batch processing such as a chemical plant, by individual processed objects in the case of processing equipment, or by test subjects in the case of medical equipment such as MRI. The local subspace classifier (LSC) or the projection distance method (PDM) may be used for the anomaly measure calculation process in step S1007.

FIG. 10B is a diagram illustrating an anomaly measure calculation process using the local subspace method.
The local subspace method is a method of measuring the projection distance when k neighboring vectors for a vector of interest q are selected and the vector of interest q is projected onto a k-1-dimensional affine subspace spanned by the selected k neighboring vectors. In FIG. 10B, an affine subspace is formed with k=3 neighboring vectors x1 to x3. Then, the point Xb on the affine subspace closest to the vector of interest q becomes the projection point (reference vector), and the distance from the vector of interest q to the reference vector Xb is the anomaly measure.

The specific calculation method will be explained. From the evaluation data q and its k neighboring vectors xi (i = 1, ..., k), a matrix Q with k qs arranged and a matrix X with xis arranged are created, and the correlation matrix C between the two is found from (Equation 2). Next, a coefficient vector b representing the weighting of the neighboring vector xi is calculated from (Equation 3). The anomaly measure d is calculated from the norm of the vector (q-Xb) or its square.

Note that while Figure 10B illustrates the case where k = 3, any number is acceptable as long as it is sufficiently smaller than the number of dimensions of the feature vector. When k = 1, the process is equivalent to the nearest neighbor method.

The projected distance method is a method of creating a subspace with its own origin for the selected feature vector, i.e., an affine subspace (a space with maximum variance). Select multiple feature vectors that correspond to the vector of interest in some way, and calculate the affine subspace using the following method.

First, the mean μ and covariance matrix Σ of the selected feature vector are found, then the eigenvalue problem of Σ is solved, and the matrix U in which the eigenvectors corresponding to the r pre-specified eigenvalues starting from the largest value are arranged is defined as the orthonormal basis of the affine subspace. r is a number smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, r may not be a fixed number, but may be the value when the cumulative contribution rate starting from the largest eigenvalue exceeds a pre-specified ratio. The point in the affine subspace closest to the vector of interest becomes the reference vector. Furthermore, the residual vector is obtained by subtracting the reference vector from the vector of interest, and the norm of the residual vector or the square of the norm becomes the anomaly measure.

Here, the method of selecting multiple feature vectors includes a method of selecting a predetermined number of tens to hundreds of feature vectors in order of proximity to the vector of interest. Alternatively, the feature vectors to be learned may be clustered in advance, and a feature vector included in the cluster closest to the vector of interest may be selected. Alternatively, a local average distance method in which the distance to the average vector of the k-nearest vectors of the vector of interest q is used as an anomaly measure, or a Gaussian process may be used.

After the anomaly measure calculation process for all feature vectors, the threshold calculation unit 110 calculates a threshold (S1008). This threshold is compared with the anomaly measure input to the anomaly detection unit 113 and is used to determine whether the equipment is normal or abnormal. The threshold calculation unit 107 calculates a threshold value that does not determine normal learning data as abnormal. In other words, the maximum value of the anomaly measure obtained from normal learning data is calculated as the threshold value.

Alternatively, a threshold value may be calculated that determines that more than a predetermined percentage of normal learning data is normal. In this case, the anomaly measures obtained from normal learning data are sorted, and the anomaly measure that reaches the aforementioned predetermined percentage from the lowest anomaly measure is used as the threshold value.

In the learning process of FIG. 10A, the learning results are stored in the learning result storage unit 111. The data stored as the learning results includes at least the parameters for extracting feature vectors, the parameters for calculating anomaly measures, the parameters for sensor canonicalization, all extracted feature vector data, the anomaly determination threshold, the parameters for extracting feature vectors, and the parameters for calculating anomaly measures, which are the same as those specified during learning. The parameters for sensor canonicalization are the average, standard deviation, maximum value, minimum value, etc. of each sensor signal calculated by the sensor signal input unit 107 in the process of step S1002.

Next, referring to FIG. 11, the anomaly determination process when an anomaly is detected in FIG. 3(c) will be described. FIG. 11 is a diagram showing the flow of anomaly detection process (S321 to S324) by the anomaly detection unit 112. Here, for data stored in the sensor signal storage unit 103 for a specified period or newly observed data, feature vectors are extracted (feature vector extraction unit 108) and anomaly measure is calculated (anomaly measure calculation unit 109), which are then compared with a threshold value (threshold calculation unit 111) to determine whether the data is normal or abnormal in the anomaly detection unit 112.

The anomaly detection unit 110 reads out the learning results saved during learning from the database (S1101). At that time, the user selects an appropriate processing number based on the anomaly measure and threshold value used during learning, and the learning result associated with the processing number is used. The signal input unit (second sensor signal input unit) 107 inputs the sensor signal 102 from the sensor signal storage unit 103 or the equipment 101 (S1102), and performs canonicalization for each sensor signal (S1103). At this time, the parameters used in the canonicalization process in step S1002 are used. Next, the feature vector extraction unit 108 extracts feature vectors from the selected sensor signal in the same manner as in the process in step S1003 (S1104).

Next, steps S1106 and S1107 are performed for all feature vectors (S1105, loop). The anomaly measure calculation unit 109 calculates the anomaly measure using the vector of interest and the learning data (S1106). This process is performed in the same manner as step S1007 in FIG. 10A, but all the learning data is used. The anomaly detection unit 112 compares the threshold value read in step S1101 with the anomaly measure calculated in step S1106. If the anomaly measure is equal to or less than the threshold value, the equipment is judged to be "normal," and if the anomaly measure is greater than the threshold value, the equipment is judged to be "abnormal" (S1107).

Next, we will explain an example of a user interface (GUI) of the anomaly detection device 100 to realize the above operations.

Figure 12 shows an example of a GUI for setting analysis conditions including a target period and processing parameters for implementing sensor group setting. It is assumed that past sensor signals 102 are stored in the sensor signal storage unit 103 in association with a facility ID and time.

In the sensor group setting screen 1201, the target equipment, target period, data cleansing parameters, sensor group setting parameters, sensor group setting method, group instruction file name, and recipe name are input. In the equipment ID input window 1202, the ID of the target equipment is input. Pressing the equipment list display button 1203 displays a list of device IDs of the data stored in the sensor signal accumulation unit 103, and inputs a selection from the list. If there is only one piece of equipment 101 connected to the anomaly detection device 100, the equipment ID input window 1202 is not displayed. Here, the sensor group setting screen 1201 is displayed, for example, on the output unit 113 in FIG. 1.

In the target period input window 1204, enter the start date and end date of the processing target period. If you want to perform data cleansing processing before the sensor group setting process, check the data cleansing checkbox 1205. In that case, enter a cleansing ratio in the cleansing ratio input window 1206. If the sensor signal value is far from the main distribution and the occurrence ratio is lower than the entered value, the data will be subject to deletion.

In the maximum sensor number input window 1207 and the similarity reference value input window 1208, the sensor group setting parameters referenced in step S404 in FIG. 4, step S906 in FIG. 9A, and S918 in FIG. 9B are input. One of the methods is selected with the sensor group setting method selection button 1209. In the example in this figure, the methods correspond to the processing flows in FIG. 4, FIG. 9A, and FIG. 9B. If "Same group instruction" or "Core sensor instruction" is selected, an instruction file name is input in the instruction file input window 1210. The instruction file contains, for example, a set of sensor names to be grouped together, or one or more sensor names to be the core of a group.

Once the above condition information has been finalized, the execute button 1211 is pressed to execute the sensor group setting process. First, if the data cleansing checkbox 1205 is checked, data cleansing processing is performed on the sensor signals for the target period. Next, in accordance with the selection made with the sensor group setting method selection button 1209, a sensor group is set using one of the processing flows shown in FIG. 4, FIG. 9A, or FIG. 9B, and the group information is saved.

After processing is complete, the results display screen, described below, is displayed. Once the user has finished checking, the screen returns to the sensor group setting screen 1201. The results display screen can also be displayed on the side by pressing the redisplay button 1212. By entering a registration name in the registration name input window 1213 and pressing the registration button 1214, the sensor group information is saved in association with the facility ID and registration name, and the process ends. If the exit button 1215 is pressed, the process ends without doing anything. In this case, the sensor group information that was once saved is deleted.

Figures 13A and 13B are examples of GUIs for showing sensor group results to a user. When a user selects a tab displayed at the top of each screen, the screen switches to either a distribution image display screen 1301 or a sensor signal display screen 1302. Here, the distribution image display screen 1301 and the sensor signal display screen 1302 are displayed, for example, on the output unit 113 in Figure 1.

Figure 13A is an example of a distribution image display screen. In the distribution image display screen 1301, for a group selected in the group selection window 1303, a distribution image between sensors belonging to the group is displayed according to the display order selected in the display order selection window 1304.

In the group selection window 1303, a list consisting of the sensor group number set by pressing the list display button and "Other" is displayed, and selecting either one specifies the group to be displayed. Before the user makes a selection, group 1 is selected. In the display order selection window 1304, either "Sensor number" or "Similarity" can be selected by pressing the list display button. If "Sensor number" is selected, the sensors are displayed in order from the smallest sensor number, and if "Similarity" is selected, the sensors are displayed in order from the largest average similarity. The average similarity is the average value of the similarity between a sensor and another sensor in the group.

The sensor number column 1305 and the sensor name column 1306 display the sensor number and the corresponding sensor name. A destination selection window 1307 and a move button 1308 are displayed in each row. The operation will be described later. A distribution image display window 1309 displays a matrix of two-dimensional frequency distribution images and similarities of the sensors corresponding to the rows and the sensors corresponding to the columns. Even if the vertical and horizontal axes of the sensor numbers are swapped, the distribution image only changes symmetrically and the similarity will have the same value. Therefore, in this embodiment, the distribution image is displayed on the lower left side of the matrix and the similarity on the upper right side. When the display order is switched in the display order selection window 1304, if the similarity is on the lower left side after swapping both the rows and columns, it is swapped with the distribution image on the opposite side. An image with the vertical and horizontal axes swapped is created from that image and replaced.

Groups can also be edited on this screen. By selecting a destination in the destination selection window 1307 and pressing the move button 1308, the sensor in the corresponding row can be moved to another group. The destination can be selected from a group other than the current group or "Other." The corresponding sensor is deleted from the group being displayed, and the corresponding row and column are also deleted and displayed shifted up and to the left. The average similarity is recalculated.

In the operation selection window 1310, select whether to register or discard the group. After making selections for all groups, pressing the OK button 1311 saves the group information for the group selected for registration and returns to the sensor group setting screen 1201. If the Cancel button 1311 is pressed, the sensor group is returned to its state before editing and the screen returns to the sensor group setting screen 1201. As long as the OK button 1311 has not been pressed even once, the Register button 1214 cannot be pressed on the sensor group setting screen 1201.

The results of group selection, display order selection, sensor group movement, and operation selection performed on the distribution image display screen 1301 are all reflected on the sensor signal display screen 1302. In addition, the results of moving a sensor group are also reflected on the display screen when another group is selected.

Figure 13B is an example of a sensor signal display screen 1302. For a group selected in a group selection window 1303, the sensor signal display screen 1302 displays a time series sensor signal graph of sensors belonging to the group according to the display order selected in a display order selection window 1304. The display period can be changed by inputting into a period input window 1312. This change is made for all sensors at once. The sensor signal display window 1313 displays a time series graph of the sensor signal corresponding to each row.

On the sensor signal display screen 1302, you can select a group, select the display order, move the sensor group, and select an operation in the same way as on the distribution image display screen 1301, and the results are reflected on the distribution image display screen 1301. You can also press the OK button 1311 and the cancel button 1311.

Figure 14A shows an example of a GUI for setting the learning period for performing offline analysis and analysis conditions including processing parameters. On this screen, it is also possible to register the calculated learning results as a recipe. In addition, past sensor signals 102 are stored in a database in association with the equipment ID and time.

In the offline analysis condition setting screen 1401, the target equipment, learning period, test period, and anomaly measure calculation parameters are input. In the equipment ID input window 1402, the ID of the target equipment is input. Pressing the equipment list display button 1403 displays a list of device IDs of the data stored in the sensor signal accumulation unit 103, and inputs a selection from the list. If there is only one piece of equipment 101 connected to the anomaly detection device 100, the equipment ID input window 1402 is not displayed. Here, the offline analysis condition setting screen 1401 is displayed, for example, on the output unit 113 in Figure 1.

In the learning period input window 1404, enter the start date and end date of the period for which you want to extract learning data.In the test period input window 1405, enter the start date and end date of the period for which you want to analyze.

In the anomaly measure calculation parameter input window 1406, input the parameters used in anomaly measure calculation. The figure shows an example in which a local subspace method is used, and the number of nearby vectors and a regularization parameter are input. The regularization parameter is a small number added to the diagonal components to prevent the inverse matrix of the correlation matrix C from being unable to be found in equation (2).

In the sensor group registration name input window 1407 and group number input window, enter the registration name and group number of the sensor group that was set and registered on the screens of Figures 13A and 13B. Once the above analysis condition information has been confirmed, press the execute button 1409 to execute the offline analysis.

First, learning is performed according to the process flow of FIG. 10A using the sensor signals from the learning period. As the learning results, the average and standard deviation for each sensor signal calculated in step S1002, all feature vector data for the learning period extracted in step S1003, and the threshold value calculated in step S1008 are saved.

Furthermore, using the sensor signals from the learning period and the test period, an anomaly measure is calculated according to the processing flow of FIG. 11, a normality/abnormality determination is made, and the determination result is stored together with the anomaly measure and a threshold value. However, for data from the learning period, a normality/abnormality determination is made using the anomaly measure calculated in step S1007.

After the analysis is completed, a results display screen, which will be described later, is displayed. After the user has finished checking, the screen returns to the offline analysis condition setting screen 1401. By inputting a recipe name in the recipe name input window 1410 and pressing the register button 1411, the learning results and analysis results are saved in association with the equipment ID and recipe name, and the process ends. Here, the learning results include the data created and saved by executing the learning, as well as the anomaly measure calculation parameters, sensor group registration name, and group number entered in the input windows 1406 to 1408. If the end button 1412 is pressed, the process ends without doing anything. In this case, the learning results created and saved by the learning and the analysis results created and saved by the subsequent anomaly detection process are deleted or overwritten by the analysis to be executed next.

The registered learning results are managed with a label indicating whether they are active or inactive, and online analysis is then performed. In online analysis, the process shown in FIG. 11 is performed on newly entered data using information on active learning results with matching equipment IDs, and the results are stored in association with the recipe name and processing date and time. These processes are performed periodically, for example once a day. For equipment with short sampling intervals or equipment that requires real-time performance, the execution intervals are made shorter.

FIG. 14B is an example of a GUI for specifying the display target of the online analysis results.
The user specifies the equipment, recipe, and period to be displayed from the display target specification screen 1421. First, the equipment ID is selected from the equipment ID selection window 1422. Next, the recipe to be displayed is selected from the list of recipes targeted for the equipment ID 1422 from the recipe name selection window 1423. The data recording period display section 1424 displays the start date and end date of the period during which the input recipe is used for processing and records are left. The result display period specification window 1425 is used to input the start date and end date of the period for which the results are to be displayed. When the display button 1426 is pressed, the result of the anomaly detection process is displayed. When the end button 1427 is pressed, the process of specifying the display target is terminated. Here, the display target specification screen 1421 is displayed, for example, on the output unit 113 in FIG. 1.

Figures 15A and 15B are examples of GUIs for showing the analysis results to the user. When the user selects a tab displayed at the top of each screen, the screen switches to either the full analysis result display screen 1501 or the enlarged analysis result display screen 1502. Here, the full analysis result display screen 1501 and the enlarged analysis result display screen 1502 are displayed, for example, on the output unit 113 in Figure 1.

Figure 15A is an example of an overall analysis result display screen 1501. The overall analysis result display screen 1501 displays the anomaly measures, thresholds, and judgment results for a specified period, as well as a time series graph of the sensor signal. When displaying the results of an offline analysis, the period display window 1503 displays the learning period and test period specified in Figure 14A. When displaying the results of an online analysis, the result display period specified in Figure 14B is displayed, although not shown.

The anomaly measure display window 1504 displays the anomaly measure 1504a, threshold value 1504b (dashed line), and judgment result 1504c for the specified learning period, test period, or result display period. A circle 1504d is also displayed on the section used for learning. The sensor signal display window 1505 displays a time series sensor signal 1505a for the specified sensor for the specified learning period, test period, or result display period.

In the sensor selection window 1506, the user specifies a sensor by input. However, before the user specifies a sensor, the first sensor in use is selected. The cursor 1507 indicates the starting point for the enlarged display, and can be moved by the user using the mouse. The number of days to display specification window 508 displays the number of days from the starting point to the end point of the enlarged display on the enlarged analysis result display screen 1502, and can also be entered on this screen. The date display window 1509 displays the date at the cursor position. Pressing the end button 1510 clears both the full analysis result display screen 1501 and the enlarged analysis result display screen 1502, and ends the display of the analysis results.

FIG. 15B is an example of an enlarged analysis result display screen 1502. The enlarged analysis result display screen 1502 displays time series graphs of anomaly measures, thresholds, judgment results, and sensor signals for a period of days specified in a display number of days specification window 1509, starting from the date indicated by cursor 1507 on the entire analysis result display screen 1501. That is, the anomaly measure display window 1504 and the sensor signal display window 1505 display the same information as that on the entire analysis result display screen 1501, but in an enlarged form.

In addition, the enlarged analysis result display screen 1502 additionally displays a scroll bar 1511 and scroll bar area 1512. The length of the scroll bar 1511 corresponds to the number of days specified in the display days specification window 1508, and the overall length of the scroll bar area 1511 corresponds to the period displayed on the entire analysis result display screen 1501. The left end of the scroll bar 1511 corresponds to the starting point of the enlarged display. The user can also change the starting point of the display by operating the scroll bar 1511, and this change is reflected in the position of the cursor 1507 on the entire analysis result display screen 1501 and the display of the date display window 1509.

In the above embodiment, in anomaly detection based on multiple time-series sensor signals, all sensors are divided into appropriate sensor groups to improve sensitivity, and anomalies are detected for each sensor group. According to the above embodiment, all sensors are divided into an appropriate number of sensor groups based on the similarity (similarity) between the sensor signals, so that anomaly detection sensitivity can be improved and anomalies occurring in any sensor can be detected.

100 Anomaly detection device 101 Equipment 102 Sensor signal 103 Sensor signal storage unit 104 Signal input unit (first sensor signal input unit)
105 Sensor group setting unit 106 Group information storage unit
107 signal input unit (second sensor signal input unit)
108 Feature vector extraction unit 109 Anomaly measure calculation unit 110 Threshold calculation unit 111 Learning result storage unit 112 Anomaly detection unit 113 Output unit

Claims (9)

An anomaly detection device that performs a sensor group setting process, a learning process, and an anomaly determination process,
a first sensor signal input unit to which a plurality of time-series sensor signals output from a plurality of sensors attached to the facility are input;
a sensor group setting unit that is used in the sensor group setting process, and that displays on an output unit a screen for inputting sensor group setting conditions, obtains a similarity between the plurality of sensor signals inputted to the first sensor signal input unit, and sets a sensor group based on the similarity and the sensor group setting conditions inputted via the screen;
a second sensor signal input unit to which a plurality of the sensor signals output from the plurality of sensors are input;
a feature vector extraction unit that is used in the abnormality determination process and the learning process and that extracts, for each sensor group, a feature vector at each time from the plurality of sensor signals input to the second sensor signal input unit;
an anomaly measure calculation unit that is used in the anomaly determination process and the learning process and that calculates an anomaly measure at each time for each of the sensor groups by using the feature vector;
a threshold calculation unit used in the learning process and calculating a predetermined threshold based on the anomaly measure;
an abnormality detection unit that is used in the abnormality determination process and determines whether the sensor signal at each time point is normal or abnormal for each sensor group ;
having
In the learning process,
The anomaly measure calculation unit is
Calculating an anomaly measure during learning for each of the sensor groups using the feature vectors for a designated learning period as learning data;
The threshold calculation unit
Calculating the predetermined threshold value based on the anomaly measure during the learning process;
In the abnormality determination process,
The anomaly measure calculation unit is
Calculating an anomaly measure when an anomaly is detected, for each of the sensor groups, using the feature vector;
The abnormality detection unit
determining whether the sensor signal is normal or abnormal by comparing the anomaly measure at the time of detecting the anomaly with the predetermined threshold value for each of the sensor groups;
The feature vector extraction unit performs any one of the following processes to obtain values that are elements of the feature vector:
normalizing the sensor signal;
applying a discrete wavelet transform to the sensor signals;
The anomaly measure is
is a distance between a reference vector obtained from the feature vector as the learning data and the feature vector to be calculated,
The predetermined threshold value is
the maximum value of the anomaly measure obtained from the normal training data;
A value adjusted so that a predetermined proportion of normal learning data is determined to be normal;
An anomaly detection device that is either The anomaly detection device according to claim 1, characterized in that the sensor group setting conditions include at least the maximum number of sensors per sensor group. the sensor group setting unit sets the sensor group using a hierarchical clustering process involving temporarily creating a plurality of clusters each including one or more sensors;
2 . The anomaly detection device according to claim 1 , wherein the sensor group setting conditions include at least a similarity reference value for determining whether or not the first cluster and the second cluster need to be combined. The sensor group setting conditions include at least a designation of a core sensor of the sensor group,
2. The anomaly detection device according to claim 1, wherein the sensor group set using the sensor group setting conditions includes at least the core sensor and a sensor selected based on a similarity with the core sensor. The anomaly detection device according to claim 1, characterized in that the sensor group setting conditions include at least the specification of sensors to be included in all of the sensor groups. The anomaly detection device according to claim 1, characterized in that the sensor group setting conditions include at least conditions for a data cleansing process that removes outliers that are outside the distribution of the histogram of the sensor signals. The anomaly detection device according to claim 1, characterized in that the anomaly detection unit displays the similarity for each of the sensors included in the sensor group on the output unit. The anomaly detection device according to claim 1, characterized in that the anomaly detection unit displays, on the output unit, a distribution image of the sensor signal for each of the sensors included in the sensor group. An anomaly detection method that performs a sensor group setting process, a learning process, and an anomaly determination process,
Inputting multiple time series sensor signals output from multiple sensors attached to the equipment,
In the sensor group setting process, a similarity between a plurality of the sensor signals is calculated, and a sensor group is set based on the similarity.
In the abnormality determination process and the learning process, a feature vector is extracted for each sensor group at each time from the plurality of sensor signals;
In the abnormality determination process and the learning process, an abnormality measure is calculated for each sensor group at each time using the feature vector;
In the learning process, a predetermined threshold value is calculated based on the anomaly measure;
In the abnormality determination process, it is determined whether the sensor signal at each time is normal or abnormal for each sensor group;
In the learning process,
Calculating an anomaly measure during learning for each of the sensor groups using the feature vectors for a designated learning period as learning data;
Calculating the predetermined threshold value based on the anomaly measure during the learning process;
In the abnormality determination process,
Calculating an anomaly measure when an anomaly is detected, for each of the sensor groups, using the feature vector;
determining whether the sensor signal is normal or abnormal by comparing the anomaly measure at the time of detecting the anomaly with the predetermined threshold value for each of the sensor groups;
The extraction of the feature vector involves performing any one of the following processes to obtain values that are elements of the feature vector:
normalizing the sensor signal;
applying a discrete wavelet transform to the sensor signals;
The anomaly measure is
is a distance between a reference vector obtained from the feature vector as the learning data and the feature vector to be calculated,
The predetermined threshold value is
The maximum value of the anomaly measure obtained from the normal learning data,
A value adjusted so that a predetermined proportion of normal learning data is determined to be normal;
An anomaly detection method that is either