WO2021074995A1 - 閾値取得装置、その方法、およびプログラム - Google Patents

閾値取得装置、その方法、およびプログラム Download PDF

Info

Publication number
WO2021074995A1
WO2021074995A1 PCT/JP2019/040654 JP2019040654W WO2021074995A1 WO 2021074995 A1 WO2021074995 A1 WO 2021074995A1 JP 2019040654 W JP2019040654 W JP 2019040654W WO 2021074995 A1 WO2021074995 A1 WO 2021074995A1
Authority
WO
WIPO (PCT)
Prior art keywords
threshold
abnormality
abnormal
candidate
degree
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2019/040654
Other languages
English (en)
French (fr)
Japanese (ja)
Inventor
村田　伸
悠馬 小泉
登 原田
翔一郎 齊藤
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
NTT Inc
Original Assignee
Nippon Telegraph and Telephone Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nippon Telegraph and Telephone Corp filed Critical Nippon Telegraph and Telephone Corp
Priority to PCT/JP2019/040654 priority Critical patent/WO2021074995A1/ja
Priority to JP2021552034A priority patent/JP7287481B2/ja
Priority to US17/769,295 priority patent/US20240152133A1/en
Publication of WO2021074995A1 publication Critical patent/WO2021074995A1/ja
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
    • G05B23/0224—Process history based detection method, e.g. whereby history implies the availability of large amounts of data
    • G05B23/0227—Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions
    • G05B23/0235—Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01M—TESTING STATIC OR DYNAMIC BALANCE OF MACHINES OR STRUCTURES; TESTING OF STRUCTURES OR APPARATUS, NOT OTHERWISE PROVIDED FOR
    • G01M99/00—Subject matter not provided for in other groups of this subclass
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
    • G05B23/0221—Preprocessing measurements, e.g. data collection rate adjustment; Standardization of measurements; Time series or signal analysis, e.g. frequency analysis or wavelets; Trustworthiness of measurements; Indexes therefor; Measurements using easily measured parameters to estimate parameters difficult to measure; Virtual sensor creation; De-noising; Sensor fusion; Unconventional preprocessing inherently present in specific fault detection methods like PCA-based methods
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751—Error or fault detection not based on redundancy
    • G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/81—Threshold

Definitions

  • the present invention relates to a threshold value acquisition device for acquiring an abnormality determination threshold value used in an abnormality detection system, a method thereof, and a program.
  • FIG. 1 is a configuration example of an abnormality detection system.
  • Some target data such as voice, video, and log are input, the degree of abnormality is obtained, normal abnormality is judged from the degree of abnormality using a threshold value, and the judgment result is output.
  • the target data obtained in the normal state is called normal data, and the target data obtained in the abnormal state is called abnormal data.
  • the degree of abnormality represents the degree of abnormality, for example, the degree of deviation from normal data.
  • abnormality judgment is performed based on the magnitude relationship between the degree of abnormality indicating the degree of abnormality and a certain threshold value. Therefore, determination of the threshold value is an important issue in the accuracy of abnormality detection. For example, when a value that increases as the degree of abnormality increases is used as the degree of abnormality, if the threshold value is set sufficiently small, the abnormal data is less likely to be overlooked, but the normal data is erroneously determined as abnormal data. On the contrary, if the threshold value is set large, the abnormal data is often overlooked at the cost of reducing the erroneous determination of the normal data as abnormal data. Therefore, it is necessary to set the threshold value to an appropriate size. At this time, the threshold value is generally set in advance (see Non-Patent Document 1).
  • An object of the present invention is to provide a threshold value acquisition device, a method thereof, and a program capable of automatically acquiring an appropriate threshold value for abnormality determination.
  • the threshold value acquisition device acquires a threshold value for determining whether the degree of abnormality acquired from the target sound is normal or abnormal.
  • the threshold value acquisition device ensures that the number of abnormalities determined to be abnormal in the set of abnormalities for each predetermined section length, which is a part of the time-series acoustic signal that does not include abnormal sounds, does not exceed the permissible number of times.
  • threshold candidates are selected so that the number of sections judged to be abnormal for each predetermined section length that is a part of the time-series acoustic signal meets a predetermined standard. It has a threshold value estimation unit for estimation, and a threshold value candidate is acquired as a threshold value.
  • a cumulative distribution calculation unit that models the number of times k at which anomalies are detected with a Poisson distribution and calculates the probability p (k> k a ; T ⁇ ( ⁇ ')) that the number of times k is larger than the permissible number of times k a, and the probability p ( k> k a ; T ⁇ ( ⁇ ')) is less than or equal to the predetermined significance level ⁇ .
  • An abnormality determination unit that determines that the acoustic signal to be output is abnormal, a performance index calculation unit that calculates the performance index FPR ( ⁇ p ) from the determination result a s ( ⁇ p) of the abnormality determination unit, and P threshold candidates ⁇ from among p, and a threshold estimator for selecting a threshold candidate theta p to achieve the desired performance index q by using the performance index FPR ( ⁇ p), and a threshold candidate theta ', the threshold candidate The process is repeated until the estimation converges, and the threshold candidate at the time of convergence is acquired as the threshold.
  • the threshold value acquisition device acquires a threshold value for determining whether the degree of abnormality acquired from the target data is normal or abnormal.
  • the threshold value acquisition device allows the number of abnormalities determined to be abnormal in the set of abnormalities for each predetermined section length, which is a part of time-series data not including abnormal data, to exceed the permissible number of times.
  • the threshold candidate is estimated so that the number of sections judged to be abnormal for each predetermined section length that is a part of the time series data satisfies a predetermined criterion. It has a threshold value estimation unit, and a threshold value candidate is acquired as a threshold value.
  • a cumulative distribution calculation unit that models the number of times k is detected by a Poisson distribution and calculates the probability p (k> k a ; T ⁇ ( ⁇ ')) that is larger than the permissible number of times k a, and the probability p (k).
  • An abnormality judgment unit that determines that the data is abnormal, a performance index calculation unit that calculates the performance index FPR ( ⁇ p ) from the judgment result a s ( ⁇ p ) of the abnormality judgment unit, and P threshold candidates ⁇ p .
  • the threshold candidate ⁇ p for achieving the desired performance index q is selected from the performance index FPR ( ⁇ p ), and the threshold candidate ⁇ 'is included as a certain threshold candidate ⁇ '. The process is repeated until convergence is performed, and the threshold candidate at the time of convergence is acquired as a threshold.
  • the number of anomalies detected by the anomaly detection system is modeled by a probability distribution that takes the number of times such as Poisson distribution and binomial distribution as a random variable, and is determined by the user such as false positive rate, for example, a classification problem.
  • the threshold is automatically adjusted so that the performance index becomes an arbitrary value determined / preset by the user.
  • the Poisson distribution is a probability distribution that indicates that an event in a predetermined unit time has occurred k times, and its probability mass function is
  • FIG. 2 shows the probability density function of the Poisson distribution.
  • the broken line in the figure represents a probability of 0.95, and the probability that the number of abnormality detections is 13 or more is 0.05, which shows that it is almost impossible.
  • the Poisson distribution it is not that it is abnormal once it is detected, but it is verified whether the number of times the system detects it is different from the normal operation. be able to.
  • the abnormality detection system has a feature that it has only normal data at the initial stage of operation and abnormal data is collected in actual operation. Moreover, it is difficult to cover all the abnormal data even if it is operated for a long period of time.
  • the threshold value is automatically acquired using the false positive rate as an evaluation index as described above.
  • a predetermined evaluation index is calculated from the obtained small number of abnormal data and normal data, and the threshold value is automatically acquired from the evaluation index.
  • the anomalous data for example, the false positive rate, recall rate, precision rate and the like can be used as evaluation indexes.
  • FIG. 5 shows a functional block diagram of the threshold value acquisition device according to the first embodiment
  • FIG. 6 shows a processing flow thereof.
  • the threshold value acquisition device includes an allowable number of times setting unit 110, a threshold value estimation unit 120, and an end determination unit 130.
  • the target of abnormality detection by the abnormality detection system is a batch consisting of a set of a plurality of data, and the data set is a set of the batches.
  • the case of an acoustic data set is described below as an example.
  • the threshold value acquisition device of the present embodiment inputs an abnormality degree data set corresponding to the acoustic data set.
  • the acoustic data set, which is the target data of the abnormality detection system is a collection of batch data consisting of a plurality of frames (time lengths), and the final abnormality determination is performed not in frame units but in batch units.
  • s 1,2, ..., S.
  • Abnormality data y i, t , z s, t are calculated in frame units.
  • the same data set or the same type of data set as the data set of the degree of abnormality used in the abnormality detection system may be used.
  • an autoencoder is used for learning the threshold value
  • the reconstruction error is used as the degree of abnormality.
  • a false positive rate set by the user is used as a performance index included in the input of the threshold value acquisition device.
  • the desired false positive rate q is 0 ⁇ q ⁇ 1, and the tolerance ⁇ for detection is 0 ⁇ ⁇ 1.
  • False positive rate is the rate at which normal data is falsely detected as abnormal data.
  • setting the desired false positive rate low false positives are reduced and the number of missed abnormal data is increased, and by setting the desired false positive rate high, false positives are increased and the number of missed abnormal data is reduced.
  • setting the tolerance ⁇ low reduces the number of detections in the data batch, and setting it high increases the number of detections.
  • ⁇ 1- ⁇ , which is the tolerance ⁇ subtracted from 1, corresponds to the significance level in the statistical test. Therefore, it can be said that obtaining tolerance is equivalent to obtaining significance level.
  • the threshold value acquisition device is, for example, a special device configured by loading a special program into a known or dedicated computer having a central processing unit (CPU: Central Processing Unit), a main storage device (RAM: RandomAccessMemory), and the like.
  • the threshold value acquisition device executes each process under the control of the central processing unit, for example.
  • the data input to the threshold value acquisition device and the data obtained by each process are stored in the main storage device, for example, and the data stored in the main storage device is read out to the central processing unit as necessary. It is used for processing.
  • At least a part of each processing unit of the threshold value acquisition device may be configured by hardware such as an integrated circuit.
  • Each storage unit included in the threshold value acquisition device can be configured by, for example, a main storage device such as RAM (RandomAccessMemory) or middleware such as a relational database or a key-value store.
  • a main storage device such as RAM (RandomAccessMemory) or middleware such as a relational database or a key-value store.
  • middleware such as a relational database or a key-value store.
  • each storage unit does not necessarily have to be provided inside the threshold acquisition device, and is composed of an auxiliary storage device composed of semiconductor memory elements such as a hard disk, an optical disk, or a flash memory. It may be configured to be provided externally.
  • the permissible number setting unit 110 is a part that sets the maximum number of false detections (allowable number of times) that the detection system erroneously detects within a predetermined period during normal operation, and the threshold value estimation unit 120 sets a threshold value that satisfies a desired performance index in the set permissible number of times. This is the part to be estimated.
  • the end determination unit 130 determines whether or not the threshold value estimation has converged, and the threshold value acquisition device repeats the processes in the allowable number setting unit 110 and the threshold value estimation unit 120 until the threshold value estimation converges.
  • the final output of the threshold value acquisition device is a threshold value for determining an abnormality.
  • the number of abnormal degree is determined that an abnormality, sets the allowable number k a so as not to exceed the permissible number (S110), and outputs.
  • a normal data batch is a data set of the degree of abnormality in batch units obtained from normal data.
  • y i, t indicate the degree of anomaly corresponding to the target data in the t-th frame of the i-th batch.
  • the threshold candidate ⁇ ' is a value estimated by the threshold estimation unit 124 described later, and an appropriate value may be given as an initial value. Appropriate values include, for example, 0, the maximum value of the degree of abnormality in a normal data batch, and the mode value.
  • the permissible number setting unit 110 includes the parameter estimation unit 111, the cumulative distribution calculation unit 112, and the permissible number acquisition unit 113, and realizes the above-mentioned process S110.
  • the parameter estimation unit 111 obtains a histogram of the degree of abnormality from the data set Y (see FIG. 7). At this time, the average detection rate ⁇ ( ⁇ ') at the threshold candidate ⁇ 'is
  • the cumulative distribution calculation unit 112 takes the average detection rate ⁇ ( ⁇ ') as an input, and based on the average detection rate ⁇ ( ⁇ '), models the number of times k that an abnormality is detected in a predetermined section length T with a Poisson distribution.
  • the probability p (k> k a ; T ⁇ ( ⁇ ')) that the number of times k is larger than the permissible number of times k a is calculated (S112) and output.
  • the number of times k that anomalies are detected by the batch length is greater than the allowable number of times k a.
  • the probability can be calculated as follows.
  • the cumulative distribution calculation unit 112 includes the permissible number acquisition unit 113.
  • the permissible number acquisition unit 113 receives a plurality of probabilities p (k> k a ; T ⁇ ( ⁇ ')), and the minimum that the probabilities p (k> k a ; T ⁇ ( ⁇ ')) are equal to or less than a predetermined significance level ⁇ . Acquires the permissible number of times ka a (S113) and outputs it.
  • the threshold candidate ⁇ ' is estimated (S120) so that the number of sections determined to be abnormal for each predetermined section length T that is a part of the data set Z satisfies a predetermined criterion, and is output.
  • dataset Y may or may not include anomalous data
  • dataset Z may or may not include anomalous data.
  • the false positive rate is used as the performance index, and the information indicating the performance index indicates the false positive rate.
  • the threshold value estimation unit 120 includes a detection number counting unit 121, an abnormality determination unit 122, a performance index calculation unit 123, and a threshold value estimation unit 124, and realizes the above-mentioned process S120.
  • the frequency distribution of the degree of abnormality is calculated in a normal data batch, and the quantiles from the minimum value (or the theoretical minimum value of the degree of abnormality) to the maximum value are used as P threshold candidates ⁇ p. This is used without narrowing down the candidates in the iteration.
  • an abnormality is determined for each threshold candidate ⁇ p and each batch Z s given the permissible number of times k a. If the value exceeds the allowable number of times k a where detection frequency given, it is determined that the abnormality.
  • the judgment result a s ( ⁇ p ) for each batch is
  • a s ( ⁇ p ) 1 indicates that the sth batch is determined to be abnormal.
  • Performance index calculation unit 123 P ⁇ S number of determination results a s ( ⁇ p) as input, P ⁇ S number of determination results a s ( ⁇ p) of P pieces of performance index FPR (theta for each batch s p ) is calculated (S123) and output.
  • the false positive rate is used as a performance index and calculated as follows.
  • an appropriate one may be used according to the data set Z of the degree of abnormality.
  • a performance index on the premise that there is only normal data may be used, for example, a false positive rate is used.
  • a performance index on the premise that there are normal data and abnormal data may be used, and for example, a false positive rate, a precision rate, a recall rate, and the like are used. Select one of these indicators and replace the formula (8) with the definition of each performance indicator.
  • Threshold estimation unit 124 inputs the desired performance index q and P pieces of performance index FPR ( ⁇ p), from among the P number of threshold candidate theta p, desired using performance index FPR ( ⁇ p) performance
  • a threshold candidate ⁇ p for achieving the index q is selected, estimated as a certain threshold candidate ⁇ '(S124), and output. For example, among the threshold candidate theta p to achieve the desired false-positive rate q, and selects a threshold candidate theta p corresponding to the highest rate of false positives is estimated as a threshold candidate theta '.
  • the threshold candidate ⁇ ' is estimated by linear interpolation of a threshold that achieves the maximum false positive rate that does not exceed q and a threshold that achieves the minimum false positive rate that exceeds q among the threshold candidates that achieve the desired false positive rate. ..
  • ⁇ End determination unit 130 takes the threshold candidate ⁇ 'as an input, and repeats the processes S120 and S130 until the estimation of the threshold candidate converges. If it has not converged, the end determination unit 130 outputs the threshold candidate ⁇ 'to the parameter estimation unit 111, and if it has converged, the end determination unit 130 acquires the threshold candidate at the time of convergence as the threshold ⁇ (S130). It is output as the output value of the threshold value acquisition device.
  • the estimated new threshold candidate ⁇ ' is compared with the previous threshold candidate, and if it is within a certain error, it is considered to have converged. Further, for example, when the repetition reaches a predetermined number of times, it is considered to have converged.
  • the target data is an acoustic data set, but any other data set that is the target of abnormality detection may be targeted.
  • a video data set, a data set consisting of some kind of log, or the like may be the target data.
  • the reconstruction error is defined as the degree of abnormality, but the degree of abnormality may be any information as long as it indicates the degree of abnormality of the target data. Further, in the present embodiment, a value that increases as the degree of abnormality increases is used as the degree of abnormality, but a value that decreases as the degree of abnormality increases may be used as the degree of abnormality. In short, it suffices if the abnormal normality can be determined based on the magnitude relationship with the threshold value.
  • the program that describes this processing content can be recorded on a computer-readable recording medium.
  • the computer-readable recording medium may be, for example, a magnetic recording device, an optical disk, a photomagnetic recording medium, a semiconductor memory, or the like.
  • the distribution of this program is carried out, for example, by selling, transferring, renting, etc., a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Further, the program may be stored in the storage device of the server computer, and the program may be distributed by transferring the program from the server computer to another computer via a network.
  • a computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. Then, when the process is executed, the computer reads the program stored in its own recording medium and executes the process according to the read program. Further, as another execution form of this program, a computer may read the program directly from a portable recording medium and execute processing according to the program, and further, the program is transferred from the server computer to this computer. Each time, the processing according to the received program may be executed sequentially. In addition, the above processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition without transferring the program from the server computer to this computer. May be.
  • the program in this embodiment includes information to be used for processing by a computer and equivalent to the program (data that is not a direct command to the computer but has a property of defining the processing of the computer, etc.).
  • the present device is configured by executing a predetermined program on the computer, but at least a part of these processing contents may be realized by hardware.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Quality & Reliability (AREA)
  • General Engineering & Computer Science (AREA)
  • Testing Of Devices, Machine Parts, Or Other Structures Thereof (AREA)
  • Testing And Monitoring For Control Systems (AREA)
PCT/JP2019/040654 2019-10-16 2019-10-16 閾値取得装置、その方法、およびプログラム Ceased WO2021074995A1 (ja)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/JP2019/040654 WO2021074995A1 (ja) 2019-10-16 2019-10-16 閾値取得装置、その方法、およびプログラム
JP2021552034A JP7287481B2 (ja) 2019-10-16 2019-10-16 閾値取得装置、その方法、およびプログラム
US17/769,295 US20240152133A1 (en) 2019-10-16 2019-10-16 Threshold acquisition apparatus, method and program for the same

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2019/040654 WO2021074995A1 (ja) 2019-10-16 2019-10-16 閾値取得装置、その方法、およびプログラム

Publications (1)

Publication Number Publication Date
WO2021074995A1 true WO2021074995A1 (ja) 2021-04-22

Family

ID=75537525

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/040654 Ceased WO2021074995A1 (ja) 2019-10-16 2019-10-16 閾値取得装置、その方法、およびプログラム

Country Status (3)

Country Link
US (1) US20240152133A1 (https=)
JP (1) JP7287481B2 (https=)
WO (1) WO2021074995A1 (https=)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115080619A (zh) * 2022-06-24 2022-09-20 中国工商银行股份有限公司 数据异常阈值确定方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220413993A1 (en) * 2021-06-29 2022-12-29 Cox Communications, Inc. Anomaly detection of firmware revisions in a network
US20250284797A1 (en) * 2024-03-06 2025-09-11 Microsoft Technology Licensing, Llc Attacker-focused granular action disruption
CN121364240A (zh) * 2025-10-17 2026-01-20 中煤建设集团有限公司 一种井筒缺陷快速检测方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0625709B2 (ja) * 1987-06-03 1994-04-06 川崎製鉄株式会社 軸受の異常検出方法
JP2900864B2 (ja) * 1995-11-24 1999-06-02 新川電機株式会社 回転機器振動監視診断システムにおける警報値及び基準値の自動設定方法
WO2013105164A1 (ja) * 2012-01-13 2013-07-18 日本電気株式会社 異常信号判定装置、異常信号判定方法、および異常信号判定プログラム
CN110208019A (zh) * 2019-05-14 2019-09-06 北京博华信智科技股份有限公司 一种动设备状态监测动态阈值预警方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3022997B1 (fr) * 2014-06-25 2016-06-10 Snecma Procede de surveillance d'une degradation d'un dispositif embarque d'un aeronef incluant la determination d'un seuil de comptage
US20190178814A1 (en) * 2016-06-23 2019-06-13 Nec Corporation State assessing device, state assessing method, and storage medium for storing program
US20190303231A1 (en) * 2016-12-27 2019-10-03 Nec Corporation Log analysis method, system, and program
JP7304545B2 (ja) * 2018-07-06 2023-07-07 パナソニックＩｐマネジメント株式会社 異常予測システム及び異常予測方法
US10776196B2 (en) * 2018-08-29 2020-09-15 International Business Machines Corporation Systems and methods for anomaly detection in a distributed computing system
US11181894B2 (en) * 2018-10-15 2021-11-23 Uptake Technologies, Inc. Computer system and method of defining a set of anomaly thresholds for an anomaly detection model
US11353859B2 (en) * 2019-03-19 2022-06-07 Mitsubishi Electric Research Laboratories, Inc. System and method for anomaly detection in time-varying system operations
WO2021075039A1 (ja) * 2019-10-18 2021-04-22 日本電気株式会社 時系列データ処理方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0625709B2 (ja) * 1987-06-03 1994-04-06 川崎製鉄株式会社 軸受の異常検出方法
JP2900864B2 (ja) * 1995-11-24 1999-06-02 新川電機株式会社 回転機器振動監視診断システムにおける警報値及び基準値の自動設定方法
WO2013105164A1 (ja) * 2012-01-13 2013-07-18 日本電気株式会社 異常信号判定装置、異常信号判定方法、および異常信号判定プログラム
CN110208019A (zh) * 2019-05-14 2019-09-06 北京博华信智科技股份有限公司 一种动设备状态监测动态阈值预警方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115080619A (zh) * 2022-06-24 2022-09-20 中国工商银行股份有限公司 数据异常阈值确定方法及装置

Also Published As

Publication number Publication date
JPWO2021074995A1 (https=) 2021-04-22
US20240152133A1 (en) 2024-05-09
JP7287481B2 (ja) 2023-06-06

Similar Documents

Publication Publication Date Title
CN110413227B (zh) 一种硬盘设备的剩余使用寿命在线预测方法和系统
US10901628B2 (en) Method for operating storage drives, and system thereof
US10216558B1 (en) Predicting drive failures
CN108563548B (zh) 异常检测方法及装置
CN114528934A (zh) 时序数据异常检测方法、装置、设备及介质
CN111538642B (zh) 一种异常行为的检测方法、装置、电子设备及存储介质
WO2021056724A1 (zh) 异常检测方法、装置、电子设备及存储介质
WO2021074995A1 (ja) 閾値取得装置、その方法、およびプログラム
US20150269120A1 (en) Model parameter calculation device, model parameter calculating method and non-transitory computer readable medium
CN110164501B (zh) 一种硬盘检测方法、装置、存储介质及设备
CN112148768A (zh) 一种指标时间序列异常检测方法、系统及存储介质
WO2022001125A1 (zh) 一种存储系统的存储故障预测方法、系统及装置
JP6183449B2 (ja) システム分析装置、及び、システム分析方法
CN113778766B (zh) 基于多维特征的硬盘故障预测模型建立方法及其应用
CN112395179B (zh) 一种模型训练方法、磁盘预测方法、装置及电子设备
JP2019070965A (ja) 学習装置、学習方法、プログラム
CN112596964B (zh) 磁盘故障的预测方法及装置
CN115964211A (zh) 一种根因定位方法、装置、设备和可读介质
CN111783883A (zh) 一种异常数据的检测方法及装置
US12332755B1 (en) Managing data processing system failures using citations generated based on hidden knowledge from predictive models
US12602277B2 (en) Managing data processing system failures using hidden knowledge from predictive models for failure response generation
US11526162B2 (en) Method for detecting abnormal event and apparatus implementing the same method
US20140324409A1 (en) Stochastic based determination
CN114048085B (zh) 一种磁盘故障分析方法、装置、设备及可读存储介质
CN115982622B (zh) 核反应堆冷却剂系统运行瞬态快速识别方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19949363

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021552034

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 17769295

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19949363

Country of ref document: EP

Kind code of ref document: A1