TW202215241A - Anomaly detection system and anomaly detection method - Google Patents

Abstract

An anomaly detection system and an anomaly detection method are provided. The anomaly detection method includes: obtaining sensed data through a communication device; inputting the sensed data to an model to generate anomaly score through a processor, wherein the model includes anomaly detection model or an energy-based model (EBM); setting a boundary according to the anomaly score through the processor; generating a health indicator according to the anomaly score and the boundary through the processor.

Description

Anomaly detection system and anomaly detection method

The present invention relates to an anomaly detection system and an anomaly detection method.

Anomaly detection algorithms are often used to detect anomalies in signals to determine whether an abnormal event occurs. For example, the financial field often uses anomaly detection algorithms to determine whether an abnormal transaction event occurs. Anomaly detection algorithms are often used in the industrial field to determine whether a machine failure event occurs. Generally, users can train anomaly detection models with normal data (that is, data collected when no anomalous events occur). A trained anomaly detection model can easily misjudge normal data with noise as abnormal data (that is, data collected when an abnormal event occurs), resulting in false alarms.

The "prior art" paragraph is only used to help understand the present disclosure, so the content disclosed in the "prior art" paragraph may contain some that do not constitute the prior art known to those with ordinary skill in the art. The content disclosed in the "prior art" paragraph does not represent the content or the problem to be solved by one or more embodiments of the present invention, and has been known or recognized by those with ordinary knowledge in the technical field before the application of the present invention.

The invention provides an abnormality detection system and abnormality detection method, which can reduce false alarms of abnormality detection.

An anomaly detection system of the present invention includes a communication device, a storage device and a processor. The communication device is used to obtain sensing data. The storage device is used for storing the model, wherein the model includes an abnormality detection model or an energy model. The processor is coupled to the storage device and the communication device, and inputs the sensing data into the model to generate an abnormal index, sets a limit according to the abnormal index, and generates a health index according to the abnormal index and the limit.

An anomaly detection method of the present invention includes: obtaining sensing data through a communication device; inputting the sensing data into a model through a processor to generate an anomaly index, wherein the model includes an anomaly detection model or an energy model; Setting a limit according to the abnormal index; and generating, by the processor, a health index according to the abnormal index and the limit.

Based on the above, the present invention can generate a health index for judging whether the sensing data is abnormal or not through the limit derived from the abnormal index. Health indicators can be used to predict whether an abnormal event occurs. Users can maintain equipment that has abnormal events in advance according to the prediction results based on health indicators.

In order to make the content of the present invention more comprehensible, the following specific embodiments are given as examples according to which the present invention can indeed be implemented. Additionally, where possible, elements/components/steps using the same reference numerals in the drawings and embodiments represent the same or similar parts.

FIG. 1 is a schematic diagram of an anomaly detection system 100 according to an embodiment of the present invention. The abnormality detection system 100 includes a processor 110 , a storage device 120 and a communication device 130 .

The processor 110 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processor (graphics processing unit, GPU), image signal processor (image signal processor, ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar elements or a combination of the above. The processor 110 may be coupled to the storage device 120 and the communication device 130 , and access and execute a plurality of modules and various application programs stored in the storage device 120 .

The storage device 120 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (ROM), flash memory (flash memory) , a hard disk drive (HDD), a solid state drive (SSD), or similar components or a combination of the above components for storing a plurality of modules or various application programs executable by the processor 110 .

The communication device 130 is, for example, a device that transmits and receives signals in a wireless or wired manner, such as Bluetooth, infrared, wired network, wireless network or mobile network.

In one embodiment, the storage device 120 can store an abnormality detection model and an energy-based model (EBM). An energy model can be used to restore the input data. For example, if the data disturbed by noise is input into the energy model, the energy model can remove the noise from the data disturbed by the noise, and output the restored data. The anomaly detection model and energy model can be trained based on the following algorithms: based on one-class support vector machine (one-class SVM), isolation tree, autoencoder ), variational autoencoder, or convolutional autoencoder.

The anomaly detection system 100 can collect sensing data and determine whether the sensing data is related to an abnormal event. Specifically, the communication device 130 can obtain sensing data, wherein the sensing data can be data measured under normal conditions (ie, no abnormal event occurs). The sensing data may be related to states such as vibration or temperature of mechanical equipment, but the invention is not limited thereto.

…(1) After acquiring the sensing data, the processor 110 may input the sensing data into the energy model to generate the restored sensing data. The processor 110 may calculate an anomaly score according to the sensing data and the restored sensing data. Specifically, the restoration of the sensing data is an attempt by the energy model to imitate the sensing data for the input to generate data similar to the sensing data at the output. The abnormal index can be, for example, the sensing data and the mean square error (MSE) of the restored sensing data, the absolute error, or other methods for calculating the error, and the present invention is not limited to this. In this embodiment, the mean square error is used as an example for illustration, as shown in equation (1), where x is the sensing data, x' is the restored sensing data, and z is the abnormality index.

…(1)

In one embodiment, before inputting the sensing data into the energy model, the processor 110 may smooth the sensing data. The smoothing process may be, for example, least squares, moving average, exponential smoothing, high-pass filtering or low-pass filtering. Then, the processor 110 may input the smoothed sensing data to the energy model to generate reduced sensing data. In one embodiment, before inputting the sensing data to the energy model, the processor 110 may first remove the noise higher than the intensity threshold in the sensing data to generate pre-processed sensing data. Next, the processor 110 may input the pre-processed sensing data into the energy model to generate reduced sensing data.

In one embodiment, after generating the restored sensing data, the processor 110 may first smooth the restored sensing data to generate smoothed restored sensing data. Then, the processor 110 may calculate the abnormality index according to the smoothed restored sensing data. In one embodiment, after generating the restored sensing data, the processor 110 may remove the noise higher than the intensity threshold in the restored sensing data to generate pre-processed restored sensing data. Next, the processor 110 may calculate the abnormality index according to the pre-processed restored sensing data.

The processor 110 can determine whether the sensing data is related to an abnormal event according to the abnormal index. Specifically, the storage device 120 may pre-store the normal range corresponding to the abnormal index. If the abnormality index calculated by the processor 110 according to the sensed data and the restored sensed data exceeds the normal range, the processor 110 may determine that the sensed data is related to an abnormal event. The processor 110 may issue an alert (Alert) through the communication device 130 when it is determined that the abnormality index exceeds the normal range. If the sensing data is related to a device, the administrator of the device can maintain the device in advance according to the alarm.

However, there are many disadvantages in detecting anomalous events based on anomaly indicators. For example, when the sensing data is disturbed by noise, even if the sensing data has nothing to do with abnormal events, the abnormality index calculated based on the sensing data will be significantly changed due to the influence of the noise, so that the abnormality The indicator is outside the normal range. As such, the processor 110 may issue a false alarm. When the sensing data is continuously disturbed by noise, the false alarms issued by the processor 110 will be very frequent. FIG. 2 is a schematic diagram of detecting abnormal events using abnormal indicators according to an embodiment of the present invention. The curve 20 is a curve of an abnormality index generated by the processor 110 according to a normal sensing data (ie, sensing data not related to abnormal events) disturbed by noise. The values of many abnormal indicators in the curve 20 are beyond the normal range 25 , but the sensing data corresponding to these abnormal indicators are not related to abnormal events. Therefore, the alarms issued by the processor 110 when the abnormal indicators exceed the normal range 25 are all false alarms.

In order to reduce the probability of false alarms, the anomaly detection system 100 can generate a health indicator that is less susceptible to noise. Detecting abnormal events based on health indicators can significantly reduce the chance of false alarms. Specifically, the processor 110 may generate a boundary according to the abnormality index, wherein the boundary may include an upper boundary or a lower boundary.

After setting the upper bound and the lower bound, the processor 110 may generate the health index according to the abnormal index and the bound (at least one of the upper bound and the lower bound). The processor 110 can determine whether the sensing data is related to an abnormal event according to the health index. Specifically, the storage device 120 may pre-store a preset range corresponding to the health index. If the health index calculated by the processor 110 according to the sensing data and the restored sensing data exceeds the preset range, the processor 110 may determine that the sensing data is related to an abnormal event. The processor 110 may issue an alarm through the communication device 130 when judging that the health index exceeds the preset range. If the sensing data is related to a device, the administrator of the device can maintain the device in advance according to the alarm.

Compared with detecting abnormal events based on abnormal indicators, detecting abnormal events based on health indicators is less likely to generate false alarms. FIG. 3 is a schematic diagram of detecting abnormal events using health indicators according to an embodiment of the present invention. The curve 30 is a curve of the health index generated by the processor 110 according to a normal sensing data (ie, sensing data irrelevant to abnormal events) disturbed by noise. Although the sensing data is disturbed by noise, the health indicators generated according to the sensing data do not exceed the preset range 35 . Therefore, the processor 110 that detects abnormal events according to the health indicators will not issue false alarms.

4 is a schematic diagram illustrating vibration data of a bearing of a device and a corresponding health index according to an embodiment of the present invention. Curve 40 is vibration data generated by sensing the vibration of a bearing of a device. The time point t1 is the time point when the bearing begins to age, and the time point t2 is the time point when the bearing fails. The processor 110 may calculate the corresponding health index according to the vibration data of the bearing. When the health index exceeds the preset range 45, the processor 110 may determine that an abnormal event occurs. As shown in FIG. 4 , the processor 110 may determine that the bearing is about to fail according to the health index at time t1 before the bearing fails (ie, time t2 ). Accordingly, the processor 110 can issue a warning through the communication device 130 to prompt the manager of the equipment to maintain the bearing of the equipment.

The processor 110 can also be used to train an energy model, and can define a predetermined range of health indicators. Specifically, the communication device 130 may obtain historical sensing data for training the energy model, wherein the historical sensing data may be data measured under normal conditions (ie, no abnormal event occurs). The historical sensing data may be associated with states such as vibration or temperature of mechanical equipment, but the present invention is not limited thereto.

…(2) The processor 110 may generate an energy model according to historical sensing data. For example, the processor 110 may train an energy model based on the following algorithms: single-class support vector machines, autoencoders, variational autoencoders, isolation forests, and autoencoder convolutional neural networks. The processor 110 may train the energy model according to a loss function as shown in equation (2), where y is the historical sensing data, f( ) is a function representing the energy model under training, y' is the output data of the energy model and MSE is the loss function. The processor 110 may complete the training of the energy model by minimizing the loss function MSE.

…(2)

…(3) After completing the training of the energy model, the processor 110 may input the historical sensing data to the energy model to generate restored historical sensing data. The processor 110 can generate the reference abnormality index according to the historical sensing data and the restored historical sensing data, as shown in equation (3), where y is the historical sensing data, F( ) is a function representing the energy model, and y'' is Restore historical sensing data and AS is the reference anomaly indicator.

…(3)

After generating the reference abnormality index, the processor 110 may generate a reference limit according to the reference abnormality index, wherein the reference limit may include a reference upper bound and a reference lower bound. In one embodiment, the value of the reference upper bound can be set as an upper bound of the value of the reference abnormality index, and the value of the reference lower bound can be set as a lower bound of the value of the reference abnormality index, but the invention is not limited thereto. After setting the reference upper bound and the reference lower bound, the processor 110 may generate the reference health index according to the reference abnormality index and the reference limit (at least one of the reference upper bound and the reference lower bound), and generate the preset range according to the reference health index. However, the present invention is not limited to this.

FIG. 5 is a flowchart illustrating an abnormality detection method according to an embodiment of the present invention, wherein the abnormality detection method can be implemented by the abnormality detection system 100 shown in FIG. 1 . In step S501, the sensing data is obtained through the communication device. In step S502, the sensor data is input into a model through the processor to generate an anomaly index, wherein the model includes an anomaly detection model or an energy model. In step S503, the processor is used to set the limit according to the abnormality index. In step S504, the processor generates the health index according to the abnormal index and the limit.

To sum up, the present invention can generate a health index for judging whether the sensing data is abnormal or not through the limit derived from the abnormal index. Compared with abnormal detection based on abnormal indicators, abnormal detection of equipment based on health indicators can reduce the probability of false alarms. In addition, the present invention can perform preprocessing or smoothing on the input data or output data of the energy model, so that the output data of the energy model is more accurate. Therefore, the health index generated based on the output data of the energy model can also be more accurate, so that the abnormality detection system can predict whether an abnormal event occurs through a more accurate health index, thereby alerting the user to maintain the equipment in advance.

However, the above are only preferred embodiments of the present invention, and should not limit the scope of the present invention, that is, any simple equivalent changes and modifications made according to the scope of the patent application of the present invention and the contents of the description of the invention, All still fall within the scope of the patent of the present invention. In addition, it is not necessary for any embodiment of the present invention or the claimed scope of the present invention to achieve all of the objects or advantages or features disclosed in the present invention. In addition, the abstract section and the title are only used to aid the search of patent documents and are not intended to limit the scope of the present invention. In addition, terms such as "first" and "second" mentioned in this specification or the scope of the patent application are only used to name the elements or to distinguish different embodiments or scopes, and are not used to limit the number of elements. upper or lower limit.

100: Anomaly Detection System 110: Processor 120: Storage Device 130: Communication device 20, 30, 40: Curves 25: normal range 35, 45: Preset range t1, t2: time point S501, S502, S503, S504: Steps

FIG. 1 is a schematic diagram of an anomaly detection system according to an embodiment of the present invention. FIG. 2 is a schematic diagram of detecting abnormal events using abnormal indicators according to an embodiment of the present invention. FIG. 3 is a schematic diagram of detecting abnormal events using health indicators according to an embodiment of the present invention. 4 is a schematic diagram illustrating vibration data of a bearing of a device and a corresponding health index according to an embodiment of the present invention. FIG. 5 is a flowchart illustrating an abnormality detection method according to an embodiment of the present invention.

S501, S502, S503, S504: Steps

Claims (22)

An anomaly detection system, comprising: a communication device for obtaining sensing data; a storage device for storing a model, wherein the model includes an anomaly detection model or an energy model; and a processor, coupled to the storage device and the communication device, and inputting the sensing data into the model to generate an abnormality index, setting a limit according to the abnormality index, and generating health according to the abnormality index and the limit index. The anomaly detection system of claim 1, wherein the bound includes at least one of an upper bound and a lower bound, wherein the processor further generates according to the at least one of the upper bound and the lower bound the health indicators. The anomaly detection system of claim 1, wherein the processor further inputs the sensing data into the energy model in the model to generate reduced sensing data, and according to the sensing data and The restored sensing data calculates the abnormality index. The abnormality detection system according to claim 3, wherein the processor further issues an alarm through the communication device after judging that the health index exceeds a preset range. The abnormality detection system of claim 1, wherein the abnormality indicator is the difference between the sensing data and the restored sensing data. The abnormality detection system according to claim 4, wherein the processor is further configured to obtain historical sensing data through the communication device, generate the energy model according to the historical sensing data, and use the historical sensing data to generate the energy model. Data is input to the energy model to generate restored historical sensing data, a reference abnormality index is generated according to the historical sensing data and the restored historical sensing data, a reference limit is generated according to the reference abnormality index, and a reference abnormality is generated according to the reference abnormality The index and the reference limit generate a reference health index, and the preset range is generated according to the reference health index. The anomaly detection system of claim 6, wherein the processor generates the anomaly detection model and the energy model based on one of the following algorithms: Single-Class Support Vector Machines, Isolation Forests, Autoencoders, Variational Autoencoders, and Autoencoder Convolutional Neural Networks. The anomaly detection system of claim 3, wherein the processor is further configured to smooth the sensing data to generate the smoothed sensing data, and convert the smoothed sensing data input to the energy model to generate the reduction sensing data. The anomaly detection system as claimed in claim 3, wherein the processor is further configured to remove noise higher than an intensity threshold in the sensing data to generate the pre-processed sensing data, and The processed sensed data is input to the energy model to generate the reduced sensed data. The anomaly detection system of claim 3, wherein the processor is further configured to smooth the restored sensing data to generate the smoothed restored sensing data, and generate the smoothed restored sensing data according to the smoothed restored sensing data. The abnormality index is calculated from the sensing data. The anomaly detection system of claim 3, wherein the processor is further configured to remove noise higher than an intensity threshold in the restored sensing data to generate the pre-processed restored sensing data, and according to The abnormality index is calculated from the preprocessed restored sensing data. An anomaly detection method, comprising: Obtain sensory data through a communication device; inputting the sensing data into a model through a processor to generate anomaly indicators, wherein the model includes an anomaly detection model or an energy model; setting, by the processor, a limit based on the anomaly indicator; and A health indicator is generated based on the abnormality indicator and the boundary by the processor. The abnormality detection method of claim 12, wherein the bound includes at least one of an upper bound and a lower bound, and wherein the step of generating the health index according to the abnormality index and the bound by the processor include: The health indicator is generated by the processor according to the at least one of the upper bound and the lower bound. The anomaly detection method according to claim 12, further comprising: Inputting the sensing data into the energy model in the model through the processor to generate restored sensing data, and calculating the abnormality index according to the sensing data and the restored sensing data. The anomaly detection method according to claim 12, further comprising: After the processor determines that the health index exceeds a preset range, an alarm is sent through the communication device. The abnormality detection method of claim 12, wherein the abnormality indicator is the difference between the sensing data and the restored sensing data. The anomaly detection method as claimed in claim 15, further comprising: obtaining historical sensing data through the communication device; generating, by the processor, the energy model according to the historical sensing data; inputting the historical sensing data to the energy model through the processor to generate restored historical sensing data; generating, through the processor, a reference abnormality index according to the historical sensing data and the restored historical sensing data; generating, by the processor, a reference limit based on the reference anomaly indicator; generating, by the processor, a reference health indicator based on the reference abnormality indicator and the reference limit; and The predetermined range is generated by the processor according to the reference health index. The abnormality detection method of claim 17, wherein the step of generating the energy model according to the historical sensing data by the processor comprises: The anomaly detection model or the energy model is generated based on one of the following algorithms: single-class support vector machine, isolated forest method, autoencoder, variational autoencoder, and autoencoder convolutional neural network. The abnormality detection method of claim 14, wherein the step of inputting the sensing data into the energy model through the processor to generate the restored sensing data comprises: smoothing the sensed data by the processor to generate the smoothed sensed data; and The smoothed sensing data is input to the energy model by the processor to generate the reduced sensing data. The abnormality detection method of claim 14, wherein the step of inputting the sensing data into the energy model through the processor to generate the restored sensing data comprises: by the processor to remove noise above an intensity threshold in the sensed data to generate the preprocessed sensed data; and Inputting the pre-processed sensing data into the energy model through the processor to generate the reduced sensing data. The abnormality detection method according to claim 14, wherein the step of calculating the abnormality index according to the sensing data and the restored sensing data comprises: smoothing the reduced sensing data by the processor to generate the smoothed reduced sensing data; and The abnormality index is calculated by the processor according to the smoothed restored sensing data. The abnormality detection method according to claim 14, wherein the step of calculating the abnormality index according to the sensing data and the restored sensing data comprises: by the processor to remove noise above an intensity threshold in the restored sensing data to generate the preprocessed restored sensing data; and The abnormality index is calculated by the processor according to the preprocessed restored sensing data.

Images