Abnormality detection device and abnormality detection method

Abstract

The purpose of the present invention is to be able to perform abnormality measure calculation, clustering and high-speed processing while maintaining abnormality detection sensitivity in abnormality detection based on multiple time series sensor signals. In order to achieve the above purpose, in an abnormality detection device, feature vectors in a specified learning period are clustered and feature vectors belonging to each cluster are adjusted to a fixed number, one cluster is selected based on the newly extracted feature vector, and the abnormality measure is calculated based on a reference vector calculated using all feature vectors belonging to the selected cluster.

Description

Technical Field

[0001] The present invention relates to an abnormality detection device and an abnormality detection method for detecting abnormalities in advance based on a plurality of time series sensor signals output by facilities or equipment. Background Art

[0002] In power companies, waste heat from gas turbines is used to supply hot water for district heating or to supply high-pressure steam or low-pressure steam to factories. In petrochemical companies, gas turbines are operated as power supply equipment. Thus, in various facilities and equipment using gas turbines, it is extremely important to detect equipment failures or signs of abnormalities in order to minimize damage to society.

[0003] Gas turbines, steam turbines, turbines in hydroelectric power plants, nuclear reactors in nuclear power plants, windmills in wind power plants, engines for aircraft or heavy machinery, railway vehicles or tracks, escalators, elevators, equipment and component levels, the deterioration and life of the batteries installed in them, etc., require preventive maintenance such as the above-mentioned equipment. It is impossible to list them all.

[0004] Therefore, a plurality of sensors for acquiring various physical information are installed in the target equipment or facilities, and it is determined whether the target equipment or facilities are normal or abnormal according to the monitoring criteria of each sensor.

[0005] As a prior art in this technical field, there is Patent Document 1. Patent Document 1 discloses the following abnormality detection method: extracting feature vectors from sensor signals, clustering the extracted feature vectors, accumulating the centers of each cluster and the data belonging to the clusters as learning data, selecting one or more clusters from these clusters based on newly observed feature vectors, selecting a predetermined number of learning data from the data belonging to the selected clusters based on the newly observed feature vectors, using the selected learning data to create a normal model, calculating an abnormality measure based on the newly observed feature vectors and the normal model, and determining whether it is abnormal or normal based on the calculated abnormality measure. Here, the abnormality measure refers to the offset of the vector value relative to the normal state when the measured values ​​of multiple sensors are expressed as one vector value.

[0006] Prior art literature

[0007] Patent Literature

[0008] Patent Document 1: Japanese Patent Application Publication No. 2014-32455 Summary of the invention

[0009] Problems to be solved by the invention

[0010] In the anomaly detection method described in Patent Document 1, when calculating the anomaly measure based on the newly observed feature vector, a predetermined number of neighboring data is searched from the data of one or more neighboring clusters belonging to the newly observed feature vector, so that the processing can be performed at a high speed compared to searching the predetermined number of neighboring data from all the learning data. However, the processing of searching the neighboring data is still very long. In addition, since clustering is performed during learning, the time required for learning is also long.

[0011] An object of the present invention is to provide an anomaly detection device and an anomaly detection method to solve the above-mentioned problems, which can perform anomaly measure calculation, clustering and high-speed processing while maintaining anomaly detection sensitivity in anomaly detection based on multiple time-series sensor signals.

[0012] Means for solving problems

[0013] The present invention is proposed in view of the above-mentioned background technology and problems. As an example, it is an anomaly detection device, comprising: a sensor signal input unit, which inputs sensor signals of multiple time series output from multiple sensors installed on the equipment; a feature vector extraction unit, which extracts feature vectors from the sensor signal at each moment; a clustering unit, which clusters the feature vectors of a specified learning period and adjusts the feature vectors belonging to each cluster to a fixed number; a cluster selection unit, which selects one or more clusters from the cluster based on the newly extracted feature vectors; an anomaly measure calculation unit, which uses all the feature vectors belonging to the selected clusters to create a baseline vector, and calculates the anomaly measure based on the created baseline vector and the newly extracted feature vector; and an anomaly detection unit, which determines whether the sensor signal at each moment is normal or abnormal by comparing the anomaly measure with a threshold.

[0014] Effects of the Invention

[0015] According to the present invention, it is possible to provide an abnormality detection device and an abnormality detection method capable of performing processing at high speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a functional structure block diagram of the abnormality detection device in this embodiment.

[0017] Figure 2 It is a block diagram of the hardware image of the abnormality detection device in this embodiment.

[0018] Figure 3 This is a diagram showing an example in which a plurality of sensor signals in this embodiment are listed and expressed in a table format.

[0019] Figure 4 This is a schematic flowchart of the overall processing performed by the abnormality detection device in this embodiment.

[0020] Figure 5 This is a flowchart of the clustering process during learning in this embodiment.

[0021] Figure 6 4 is a processing flow chart of the cluster initial position setting process in this embodiment.

[0022] Figure 7 It is a processing flow chart of k-means clustering processing in this embodiment.

[0023] Figure 8 This is a flowchart of the cluster member adjustment process in this embodiment.

[0024] Fig.9A It is a diagram illustrating the abnormality measure calculation process based on the preset method of neighboring data in this embodiment.

[0025] Fig. 9B It is a diagram for explaining the abnormality measure calculation process based on the neighboring data search method in this embodiment.

[0026] Fig. 10A 4 is a flowchart of the abnormality measure calculation process during learning in this embodiment.

[0027] Fig. 10B This is a flowchart of other abnormality measure calculation processing during learning in this embodiment.

[0028] Fig.11A 4 is a flowchart of the abnormality measure calculation process during abnormality detection in this embodiment.

[0029] Fig. 11B This is a flowchart of other abnormality measure calculation processing during abnormality detection in this embodiment.

[0030] Fig. 12A It is a diagram showing a GUI for setting off-line analysis conditions in this embodiment.

[0031] Fig. 12B It is a diagram showing a GUI for designating a display target of an online analysis result in this embodiment.

[0032] Fig.13A It is a diagram showing the entire analysis result display screen in this embodiment.

[0033] Fig. 13B It is a diagram showing an enlarged display screen of the analysis result in this embodiment. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0035] Example

[0036] Figure 1 FIG. 1 is a functional block diagram of the abnormality detection device in this embodiment. Figure 1 In the present invention, the abnormality detection device 100 obtains the sensor signal 102 output from the sensor installed in the device 101 as the detection object at predetermined time intervals (periodically). The obtained sensor signal 102 is temporarily accumulated in the sensor signal accumulation unit 103. The sensor signal input unit 104 directly inputs the sensor signal 102 from the sensor signal accumulation unit 103 or the sensor installed in the device 101, and sends it to the feature vector extraction unit 105. The feature vector extraction unit 105 extracts the feature vector at predetermined time intervals (hereinafter sometimes expressed as each moment) based on the sensor signal 102, and sends it to the clustering unit 106 and the cluster selection unit 108. The clustering unit 106 performs clustering using the feature vectors of the pre-specified learning period, and accumulates the center of the cluster and the feature vectors belonging to the cluster as learning data in the learning result accumulation unit 107. The cluster selection unit 108 selects a cluster based on the feature vector for each feature vector from among the clusters accumulated as the learning data, and the abnormality measure calculation unit 109 calculates the abnormality measure for each feature vector using all the feature vectors belonging to the selected cluster.

[0037] The threshold calculation unit 110 calculates a threshold based on the anomaly measure of the learning data generated by the anomaly measure calculation unit 109. The threshold calculated by the threshold calculation unit 110 is stored as a learning result in the learning result accumulation unit 107. The anomaly detection unit 111 compares the anomaly measure of each feature vector sent from the anomaly measure calculation unit 109 with the threshold calculated by the threshold calculation unit 110, thereby detecting anomalies of the device 101, and outputs the detection result 112 to the outside.

[0038] in addition, Figure 2 FIG. 1 is a block diagram of the hardware image of the abnormality detection device in this embodiment. Figure 2 In the embodiment, the abnormality detection device 100 is implemented by a device having a processing device (CPU), a storage device (memory), and an input / output interface (I / F) as a general information processing device. Figure 1 The sensor signal input unit 104, feature vector extraction unit 105, clustering unit 106, cluster selection unit 108, anomaly measurement calculation unit 109, threshold calculation unit 110, and anomaly detection unit 111 of the anomaly detection device 100 are processed by CPU 10 to store Figure 2 These processing programs in the memory 20 are executed by software processing. Figure 1 The sensor signal storage unit 103 and the learning result storage unit 107 in Figure 2The memory 20 in the memory 20 corresponds to the memory 20 in the memory 20. In addition, the sensor signal 102 is obtained through the input I / F 3 ... Figure 1 The abnormality detection signal of the abnormality detection unit 111 is output to an external display device or the like via the output I / F 40 .

[0039] In addition, regarding Figure 1 Each structure of the computer system may be partially or entirely implemented in hardware by, for example, designing it in an integrated circuit. In addition, when each structure is implemented by software, information such as programs, data, and files that implement each function can be stored not only in a memory, but also in a recording device such as a hard disk or a recording medium such as an IC card, and can also be downloaded and installed via a wireless network as needed. In addition, the processing performed by the CPU 10 may also be performed on a cloud via a wireless network.

[0040] Here, a brief description of the terms used below is given. A feature vector is a vector that represents the measured values ​​of multiple sensors as a single vector value. An abnormality measure refers to the offset of the feature vector of interest relative to the feature vector of a specified period. The device 101 that is the object of abnormality detection is, for example, a gas turbine, a steam turbine, or other equipment or facility.

[0041] Figure 3 This is an example in which a plurality of sensor signals 102 are tabulated and expressed in a table format. The sensor signal 102 is a multidimensional time series signal that acquires a plurality of physical information having different physical characteristics at predetermined intervals. Figure 3 The structure of the table shown shows information of date and time 201 in correspondence with sensor signal values ​​202 of a plurality of sensors. The number of sensors may be hundreds to thousands, and depending on their type, they may output, for example, the temperature of a cylinder, oil, cooling water, etc., the pressure of oil or cooling water, the rotation speed of a shaft, the room temperature, the operating time, etc. as sensor values. The sensor value not only indicates the output and state of equipment, facilities, etc., but may also be a control signal for controlling a certain state to a certain value (e.g., a target value).

[0042] Figure 4 This is a flowchart of the overall summary of the processing performed by the abnormality detection device 100 in this embodiment. Here, in the operation of the abnormality detection device 100, there are stages of "learning" processing for generating and saving learning data using the data accumulated in the sensor signal accumulation unit 103, and "abnormality detection" processing for detecting abnormalities based on input signals. Basically, "learning" is an offline process, and "abnormality detection" is an online process. However, "abnormality detection" can also be set as an offline process. In the following description, they are distinguished by terms such as "during learning" and "during abnormality detection".

[0043] Figure 4(a) is the abnormality measure calculation process during learning, which inputs the sensor signal during learning (S301), performs feature vector extraction (S302), clustering (S303), cluster selection (S304), abnormality measure calculation (S305) and threshold calculation (S306). Figure 4 (b) is the abnormality determination process during abnormality detection, which inputs the sensor signal of the detection object (S311), extracts the feature vector (S312), selects clusters (S313) and calculates the abnormality measure (S314). Then, the calculated abnormality measure is compared with the threshold value obtained in S306 to determine whether the equipment is normal or abnormal (S315).

[0044] The following, Figure 4 The details of (a) and (b) are explained below. Figure 4 The detailed process of (a) is in Figure 5 , Figure 6 , Figure 7 , Figure 8 , Fig. 10A , Fig. 10B In the description, Figure 4 The detailed process of (b) is in Fig.11A , Fig. 11B is described in.

[0045] First of all, Figure 4 The abnormality measure calculation process during learning of (a) is described. In step S302, the feature vector extraction unit 105 performs standardization of the input sensor signal and extraction of the feature vector. The standardization of the sensor signal is performed in order to similarly process multiple sensor signals of different units and scales. Specifically, the mean and standard deviation of each sensor signal during the learning period are used to transform each sensor signal in a manner such that the mean is 0 and the variance is 1. In order to be able to perform the same transformation during abnormality detection, the mean and standard deviation of each sensor signal are stored in the learning result accumulation unit 107. Alternatively, the maximum and minimum values ​​of each sensor signal during the learning period are used to transform each sensor signal in a manner such that the maximum is 1 and the minimum is 0. Alternatively, a pre-set upper limit value and lower limit value may be used instead of the maximum and minimum values. In this case, in order to be able to perform the same transformation during abnormality detection, the maximum and minimum values ​​or the upper limit value and lower limit value of each sensor signal are stored in the learning result accumulation unit 107.

[0046] In feature vector extraction, the normalized sensor signal is directly arranged as an element as a vector. Alternatively, a window of ±1, ±2, ... is set for a certain moment, and a feature vector of the window width (3, 5, ...) × the number of sensors is set, thereby extracting features representing the temporal changes of the sensor signal. In addition, a discrete wavelet transform (DWT) can be implemented to decompose it into frequency components.

[0047] Figure 5 Flowchart of clustering processing (S303) during learning in this embodiment. Figure 5 In the process, first, the feature vector of the learning period extracted by the feature vector extraction unit 105 is input (S401). Then, in the clustering unit 106, the learning period is divided into multiple intervals (S402). Preferably, one interval is of fixed length, for example, one day is set as one interval. Alternatively, it can be set as each batch in the case of batch processing such as a chemical plant, as each processing object individual in the case of a processing device, and as each inspection object in the case of a medical device such as MRI. Then, based on the input feature vector, the cluster center is initially configured (S403) and k-means clustering is performed (S404). Then, the members of each cluster are adjusted (S405). Here, the members of the cluster are the feature vectors belonging to the cluster. In S403, the similarity between the feature vectors of different intervals is regarded as 0. In addition, in the processing of step S404 and step S405, the feature vectors of different intervals are not mixed in one cluster. Then, in the learning result accumulation unit 107, the interval ID, center and cluster members of each cluster are recorded (S406). The following describes in detail the cluster center initial configuration ( S403 ), k-means clustering ( S404 ), and cluster member adjustment ( S405 ).

[0048] First, the cluster center initial configuration (S403) is described. Figure 6 FIG. 4 is a flowchart of the initial setting process of the cluster center position in this embodiment. Figure 6In the process, first, the maximum number of clusters and the initial configuration interruption reference value, i.e., the reference similarity, are input (S501). Next, the initial feature vector of the specified learning period is set as the initial cluster center (S502). Next, the processing of steps S504 to S507 is repeated until the maximum number of clusters is reached (S503). First, the similarity between the set cluster center and all feature vectors during the learning period is calculated (S504). The similarity is calculated by 1 / (1+distance). However, the similarity is set to 0 when the intervals are different. Next, the maximum value of the similarity with the cluster center is calculated for all feature vectors (S505). If the minimum value of the value is less than the interruption reference value (S506), the feature vector with the smallest maximum value of the similarity with the cluster center is used as the next cluster center (S507). That is, the feature vector farthest from the nearest cluster center is used as the cluster center. If the number of clusters reaches the maximum number, the loop is exited and the processing is ended (S508). In addition, if the minimum value of the maximum value of the similarity in step S506 is greater than the interruption reference value, the process is interrupted, that is, the loop is exited and the process is ended (S508). Through this interruption, the number of clusters can be suppressed to the necessary minimum, thereby shortening not only the calculation time of the cluster center initial configuration process, but also the calculation time of the overall clustering process and the abnormality measure calculation process.

[0049] The initial position of the cluster center is usually randomly configured in many cases, and it can also be randomly configured in this embodiment. However, in a device that switches between operation and stop, the data of the transition state is less than the data of the stable state, so if it is randomly selected, it is difficult to select it as the initial center position. Therefore, the influence of the data of the transition state on the calculation of the cluster center becomes relatively small. The method of the initial configuration processing of the cluster center described above is to initially configure the cluster centers at positions far away from each other, thereby increasing the clusters of the transition state.

[0050] Next, k-means clustering ( S404 ) will be described. Figure 7 is a flow chart of clustering processing based on the k-means method in this embodiment. Figure 7In, first, input the maximum number of repetitions and the interruption reference value (S601). Then, repeat the processing of steps S603 to S605 until the maximum number of repetitions is reached (S602). First, all feature vectors of the specified learning period are taken as objects to assign cluster members (S603). Specifically, each feature vector is set as a member of the cluster closest to the center. For each cluster, the mean of the feature vectors of all cluster members is set as the new cluster center vector (S604). When the movement of the cluster center is larger than the interruption reference value (S605), return to the initial processing of the loop (S603). If not, exit the loop and end the processing (S606). In addition, when the maximum number of repetitions is reached, exit the loop and end the processing (S606).

[0051] In cluster member allocation (S603), if the interval of the feature vector does not match the interval ID of the cluster recorded in step S406, the distance is considered to be infinite. Therefore, all members of a cluster become feature vectors of the same interval. This can greatly omit the distance calculation process.

[0052] Next, cluster member adjustment (S405) is described. The purpose of this process is to make the number of members of each cluster consistent with the number of neighboring data required for calculating the anomaly measure. Figure 8 This is a flowchart of the cluster member adjustment process in the present embodiment. First, input a specified value for the number of cluster members (S701). Then, for each cluster, repeat the process of steps S703 to S706 (S702). First, if the number of members in a cluster is less than the specified number (S703), members are added to the cluster to reach the specified number (S704). The additional members are determined in the order of the distance from the cluster center to the farthest point in the feature vector other than the members. If the number of members in the cluster is greater than the specified value in step S703, step S704 is skipped. Next, if the number of members in the cluster is greater than the specified value (S705), members are removed to reach the specified number (S706). The members to be removed can be randomly determined. This is because a large number of cluster members means that the density of the vectors in the feature space is high, and there is no big difference no matter which member is deleted.

[0053] Next, the cluster selection unit 108, the abnormality measure calculation unit 109, and the threshold value calculation unit 110 are described. Figure 4 (a) is the process of learning (S304 to S306). In addition, there are two methods for abnormality measure calculation processing, and one of them is selected in advance. In the following description, they are respectively called the neighboring data preset method and the neighboring data search method.

[0054] Fig.9AThe diagram is a diagram for explaining the abnormality measure calculation process based on the neighboring data preset method. The projection distance when the attention vector q is projected onto the k-1-dimensional affine subspace extending from the members of the nearest cluster of the attention vector q, i.e., k vectors, is measured. Fig.9A This is an example of the case where k = 3. The three vectors x1 to x3 form an affine subspace, i.e., a plane. The point Xb on the affine subspace closest to the focus vector q becomes the projection point (reference vector), and the distance from the focus vector q to the reference vector Xb is the anomaly measure. In addition, k can be arbitrary as long as it is sufficiently smaller than the dimension of the feature vector.

[0055] The specific calculation method is described below. Based on the evaluation data q and k vectors xi (i=1, ···, k), a matrix Q in which k qs are arranged and a matrix X in which xis are arranged are created, and the correlation matrix C of the two is obtained according to formula (1). Next, the coefficient vector b representing the weight of the neighboring vectors xi is calculated according to formula (2). The anomaly measure d is calculated by the norm of the vector (q-Xb) or its square.

[0056] [Formula 1]

[0057] C=(QX) T (QX) …(1)

[0058] [Formula 2]

[0059]

[0060] Fig. 9B This is a diagram illustrating the calculation process of the anomaly measure based on the neighboring data search method. Taking the members of one or more neighboring clusters of the attention vector q as the object, k neighboring vectors relative to the attention vector q are searched and selected, and the projection distance when the attention vector q is projected onto the k-1 dimensional affine subspace extending from the selected k neighboring vectors is measured. The selected k neighboring vectors are set as xi (i = 1, ···, k), and the vector b is calculated using equations (1) and (2), and the anomaly measure is calculated by the norm of the vector (q-Xb) or its square.

[0061] Fig. 10A 1 is a flowchart of the abnormality measure calculation process during learning when the neighboring data preset mode is selected. Fig. 10AIn the process, first, the feature vector of the learning period is input (S901), and the learning period is divided into multiple intervals (S902). The intervals are divided in the same way as step S402. Then, the following processing is repeated for all the extracted feature vectors (S903). First, the distance from the focus vector to the reference vector 1 time ago is calculated (S904). When the calculated distance is greater than the maximum value of the calculated anomaly measure of the processing object interval (S905), in the cluster selection unit 108, the nearest cluster closest to the focus vector in the cluster of the interval different from the focus vector is selected (S906). Then, in the anomaly measure calculation unit 109, all members of the nearest cluster are used to calculate the nearest cluster by Fig.9A The method shown calculates a reference vector (S907), and calculates the distance to the reference vector as an anomaly measure (S908). When the condition of step S905 is not met, that is, when the distance to the reference vector one moment ago is less than the maximum value of the anomaly measure calculated for the processing object interval, the processing of steps S906 to S908 is skipped. The maximum value of the anomaly measure is a candidate for the anomaly determination threshold. Considering that the distance calculated in step S908 is not greater than the distance calculated in step S904, the maximum value is not changed, so the calculation is interrupted. By interrupting the calculation, the calculation time for calculating the anomaly measure can be shortened. If the anomaly measure calculation process is completed for all feature vectors, the threshold is calculated in the threshold calculation unit 110 (S909). Specifically, the maximum value of the anomaly measure is set as the threshold.

[0062] In addition, in step S905, since the intention is to parallelize the entire loop of step S903 for each interval, it is compared with the maximum value of the processing object interval, but parallel processing is not necessarily required. When parallel processing is not performed, it is compared with the maximum value of the overall calculated abnormality measure.

[0063] Fig. 10B 1 is a flowchart of the abnormality measure calculation process during learning when the neighboring data search method is selected. Figure 5 In the clustering process described in , it is difficult for feature vectors of different intervals to be mixed in one cluster, so it is assumed that feature vectors of different intervals may be mixed in one cluster.

[0064] exist Fig. 10BIn the process, first, the feature vector of the learning period is input (S911), and the learning period is divided into multiple intervals by the same method as step S402 (S912). Then, the following processing is repeated for all the extracted feature vectors (S913). First, the distance from the focus vector to the reference vector one moment ago is calculated (S914). When the calculated distance is greater than the maximum value of the calculated anomaly measure of the processing object interval (S915), in the cluster selection unit 108, a specified number of neighboring clusters are selected from the side close to the focus vector (S916). Then, in the anomaly measure calculation unit 109, the vectors in the same interval as the focus vector are removed from the members of the selected cluster to extract the neighboring search object (S917). Fig. 9B As shown, a specified number of neighboring data is searched from the extracted neighboring search objects (S918), a reference vector is calculated using the searched neighboring data (S919), and the distance to the reference vector is calculated as an abnormality measure (S920). If the condition of step S915 is not satisfied, that is, if the distance to the reference vector one moment ago is less than the maximum value of the abnormality measure calculated for the processing object interval, the processing of steps S916 to S920 is skipped.

[0065] When the abnormality measure calculation process is completed for all feature vectors, a threshold is calculated in the threshold calculation unit 110 (S921). This threshold is compared with the abnormality measure input to the abnormality detection unit 113 to determine whether the device is normal or abnormal. The threshold calculation unit 110 calculates a threshold that does not determine normal learning data as abnormal. In other words, the maximum value of the abnormality measure obtained from the normal learning data is calculated as the threshold.

[0066] Fig. 10A The processing of does not require neighboring data search processing after cluster selection, so it is similar to Fig. 10B Compared with the processing of Fig. 10A Processing and Fig. 10B The processing of these two sides can be selected according to the data. This is because Fig. 10B In the treatment of Fig. 10A During the processing, the sensitivity may exceed the allowable range and decrease depending on the data.

[0067] In the learning process, the learning result is stored in the learning result storage unit 107. The data stored as the learning result include at least parameters for extracting feature vectors, parameters for calculating anomaly measures, parameters for sensor standardization, the number of clusters, the center position of each cluster, the ID and interval ID of the vector that becomes a member, all feature vector data that becomes a member of any cluster, and anomaly determination threshold. The parameters for extracting feature vectors and the parameters for calculating anomaly measures are the same as those specified during learning. The parameters for sensor standardization are the mean, standard deviation, maximum value, minimum value, etc. of each sensor signal calculated by the feature vector extraction unit 105 in the process of step S302.

[0068] exist Fig.9A as well as Fig. 9B The anomaly measure calculation process described in is a deformation of the local subspace method, but the projection distance method and Gaussian process can also be used.

[0069] The projection distance method is a method of creating an affine subspace (space with the largest variance) which is a subspace having a unique origin with respect to the selected eigenvector. A plurality of eigenvectors corresponding to the focus vector are selected by a certain method, and the affine subspace is calculated by the following method.

[0070] First, the mean μ and covariance matrix Σ of the selected eigenvectors are calculated, and then the eigenvalue problem of Σ is solved. The matrix U obtained by arranging the eigenvectors corresponding to the r eigenvalues ​​pre-specified from the larger value side is set as the standard orthogonal basis of the affine subspace. Let r be a number smaller than the dimension of the eigenvector and smaller than the number of selected data. Alternatively, r can be set not to a fixed number, but to a value when the cumulative contribution rate from the larger eigenvalue side exceeds a pre-specified ratio. The point on the affine subspace closest to the focus vector becomes the reference vector. In addition, the value obtained by subtracting the reference vector from the focus vector becomes the residual vector, and the norm of the residual vector or the square of the norm becomes the anomaly measure.

[0071] Here, regarding the method of selecting multiple feature vectors, if the feature vectors of the learning object are clustered in advance and the feature vectors included in the cluster closest to the focus vector are selected, it is possible to select the feature vectors in the cluster closest to the focus vector. Fig. 10A The anomaly measure is calculated using the process described in . The difference from the local subspace method is that an affine subspace with a dimension smaller than k-1 is calculated based on the k eigenvectors.

[0072] Next, Figure 4The abnormality determination processing during abnormality detection of (b) is described. In step S311, the sensor signal input unit 104 directly inputs the sensor signal 102 from the sensor signal storage unit 103 or from the sensor installed in the device 101. In step S312, the feature vector extraction unit 105 performs standardization of the input sensor signal and extraction of feature vectors in the same manner as step S302. The standardization of the sensor signal is performed using the mean and standard deviation or the maximum and minimum values ​​of each sensor signal calculated in step S302 and stored in the learning result storage unit 107.

[0073] The following describes in detail the cluster selection unit 108, the anomaly measure calculation unit 109, and the anomaly detection unit 111. Figure 4 Processing (S313~S315) when abnormality is detected in (b).

[0074] Fig.11A This is a flowchart of the abnormality determination process during abnormality detection when the neighboring data preset method is selected. The selection method is the same as that during learning. Fig.11A In the process, the following processing is repeatedly performed for all feature vectors extracted in step S312 (S1001). First, the distance from the focus vector to the reference vector one moment ago is calculated (S1002). When the calculated distance is greater than the abnormality judgment threshold calculated in step S306 and stored in the learning result accumulation unit 107 (S1003), the cluster selection unit 108 selects the nearest cluster closest to the focus vector among the clusters stored in the learning result accumulation unit 107 (S1004). Next, the distance from the focus vector to the center of the nearest cluster is calculated (S1005). When this value is greater than the abnormality judgment threshold (S1005), in the abnormality measure calculation unit 109, all members of the nearest cluster are used to calculate the abnormality. Fig.9AThe method shown calculates a reference vector (S1006), and calculates the distance to the reference vector as an abnormality measure (S1007). In the abnormality detection unit 111, the abnormality measure is compared with the abnormality judgment threshold to determine whether it is normal or abnormal (S1008). Specifically, if the abnormality measure is below the threshold, the device is judged as "normal", and if the abnormality measure is greater than the threshold, the device is judged as "abnormal". When the condition of step S1003 is not met, that is, when the distance to the reference vector 1 moment ago is below the abnormality judgment threshold, it is immediately judged as normal (S1009) and the processing of the focus vector is terminated. In addition, when the condition of step S1005 is not met, that is, when the distance to the nearest cluster is below the abnormality judgment threshold, it is also immediately judged as normal (S1009) and the processing of the focus vector is terminated. Considering that the distance calculated in step S1007 is not greater than the distance calculated in step S1002 or step S1005, if any one of them is below the threshold, it is determined to be normal and the calculation is interrupted, so the calculation time can be shortened. In addition, after selecting a cluster, since there is no need to search for neighboring data, the calculation time when the calculation is not interrupted can also be shortened. That is, when calculating the anomaly measure based on the newly observed feature vector, one cluster is selected based on the newly observed feature vector, and a reference vector is made based on all the feature vectors belonging to the selected cluster, so there is no need to search for neighboring data, which can shorten the calculation time for calculating the anomaly measure.

[0075] Fig. 11B This is a flowchart of the abnormality determination process during abnormality detection when the neighboring data search method is selected. Fig. 11B In the process, the following processing is repeatedly performed for all feature vectors extracted in step S312 (S1011). First, the distance from the focus vector to the reference vector one moment ago is calculated (S1012). When the calculated distance is greater than the abnormality judgment threshold calculated in step S306 and stored in the learning result accumulation unit 107 (S1013), in the cluster selection unit 108, a specified number of neighboring clusters are selected from the clusters close to the focus vector in the clusters stored in the learning result accumulation unit 107 (S1014). Next, when the distance from the focus vector to the center of the nearest cluster is greater than the abnormality judgment threshold (S1015), in the abnormality measure calculation unit 109, all members of the selected cluster are extracted as neighboring search objects (S1016). Fig. 9BAs shown, a specified number of neighboring data is searched from the extracted neighboring search object (S1017), a baseline vector is calculated using the searched neighboring data (S1018), and the distance to the baseline vector is calculated as an abnormality measure (S1019). In the abnormality detection unit 111, the abnormality measure is compared with the abnormality judgment threshold to determine whether it is normal or abnormal (S1020). When the condition of step S1013 is not met, that is, when the distance to the baseline vector 1 moment ago is below the abnormality judgment threshold, it is immediately judged as normal (S1021) and the processing of the focus vector is terminated. In addition, when the condition of step S1015 is not met, that is, when the distance to the nearest cluster is below the abnormality judgment threshold, it is also immediately judged as normal (S1021) and the processing of the focus vector is terminated. Fig.11A Similarly, the calculation time can be shortened by interrupting the calculation process.

[0076] Next, an example of a user interface (GUI) of the abnormality detection device 100 for realizing the above-mentioned operation will be described.

[0077] Fig. 12A as well as Fig. 12B This is an example of a GUI for setting the learning period for offline analysis and analysis conditions including processing parameters. In this screen, the calculated learning results can also be registered as a plan. In addition, the past sensor signals 102 are associated with the device ID and time and stored in the database.

[0078] Fig. 12A is an example of choosing the neighboring data preset as the anomaly measure calculation method. Fig. 12B This is an example of selecting the neighboring data search method. In the offline analysis condition setting screen 1101, input the target device, learning period, test period, clustering parameters, and abnormality measure calculation parameters. In the device ID input window 1102, input the ID of the target device. By pressing the device list display button 1103, a list of device IDs of the data stored in the sensor signal storage unit 103 is displayed, and input is selected from the list. When there is only one device 101 connected to the abnormality detection device 100, the device ID input window 1102 is not displayed.

[0079] In the learning period input window 1104, input the start date and end date of the period for which you want to extract learning data. In the test period input window 1105, input the start date and end date of the period for which you want to analyze. In the sensor selection input window 1106, input the sensor to be used. By clicking the list display button 1107, a sensor list (not shown) is displayed, and input is selected from the list.

[0080] In the clustering parameter setting input window 1108, the number of clusters (1108a) and the number of cluster members (1108b) specified in the processing in the clustering unit 106, the value obtained by performing distance conversion on the interruption reference value of the initial configuration of the cluster center used in step S506 (1108c), and the clustering repetition interruption reference value used in step S605 (1108d) are input. In addition, the number of cluster selections specified in the processing in the cluster selection unit 108 is input (1108e). And, the neighboring data preset mode selection check button (1108f) is specified. Here, as shown in FIG. Fig. 12A As shown, when the check button 1108f is checked, the number of cluster members is fixed to the same value as the number of data k used in the reference vector generation, and the number of cluster selections is fixed to 1 and cannot be edited. Fig. 10A The processing flow shown in the figure is used for processing. When abnormality detection is performed, Fig.11A The larger the value of the initial configuration and repeated interruption reference value, the faster the interruption will be performed. If it is 0, no interruption will be performed. Fig. 12B As shown, when the check button 1108f is not checked, the number of cluster members (1108b) and the number of cluster selections (1108e) can be edited. Fig. 10B The processing flow shown in the figure is used for processing. When anomaly detection occurs, Fig. 11B The process is performed according to the process flow shown.

[0081] In the anomaly measure calculation parameter input window 1109, input the parameters to be used in the anomaly measure calculation. This figure is an example of a case where a local subspace is used as a method, and the number of neighboring vectors k (1109a) and the regularization parameter (1109b) used in the preparation of the reference vector are input. The regularization parameter is a small number added to the diagonal component to prevent the inverse matrix of the correlation matrix C from being unable to be obtained in equation (2). In addition, specify whether to execute the check button (1109c) for interrupting the anomaly measure calculation based on the distance to the reference vector 1 time ago, and whether to execute the check button (1109d) for interrupting the anomaly measure calculation based on the distance to the nearest cluster. If the check button 1109c is not checked, the processing of steps S904 to S905 or S914 to S915 and the processing of steps S1002 to S1003 or S1012 to S1013 are not executed. If the check button 1109d is not checked, the processing of step S1005 or S1015 is not performed.

[0082] When the above analysis condition information is confirmed, the off-line analysis is executed by pressing the execution button 1111 .

[0083] First, using the sensor signals during learning, follow Figure 4The learning is performed according to the processing flow of (a). As the learning result, the mean and standard deviation of each sensor signal calculated in step S302, the center position of each cluster calculated in step S303 and the ID and interval ID of the vector that becomes a member, the data that becomes a member of any cluster in the feature vector data extracted in step S302, and the threshold calculated in step S306 are saved. In addition, the anomaly measure calculated in step S305 is compared with the threshold to determine whether it is normal or abnormal, and the determination result, anomaly measure, and threshold are saved as time series data. Next, use the sensor signal during the test according to Figure 4 The processing flow of (b) calculates the anomaly measure, makes a judgment on whether it is normal or abnormal, and saves the judgment result, anomaly measure, and threshold as time series data.

[0084] After the analysis is completed, the result display screen described later is displayed. When the user's confirmation is completed, it returns to the offline analysis condition setting screen 1101. Enter the solution name in the solution name input window 1110, and by pressing the registration button 1112, the learning results and analysis results are saved corresponding to the device ID and the solution name, and the process ends. Here, in addition to the data saved by executing the learning, the learning results also include sensor selection information, clustering parameters, and anomaly measurement calculation parameters entered through input windows 1106, 1108, and 1109. When the end button 1113 is pressed, nothing is done and the process ends. In this case, the learning results saved by learning and the analysis results saved by the subsequent anomaly detection processing are deleted or overwritten by the next analysis performed.

[0085] The registered learning results are managed by adding active or inactive tags, and then online analysis is performed. In online analysis, the newly input data is analyzed using the information of the active learning results that match the device ID. Figure 4 The processing shown in (b) is performed by associating the result with the scheme name and the processing date and time and saving them. These processes are performed regularly, for example, every day. For devices with short sampling intervals and devices requiring real-time performance, the execution interval is further shortened.

[0086] 12C is an example of a GUI for specifying the display object of the online analysis results. The user specifies the device, scheme, and period of the display object from the display object specification screen 1121. First, select the device ID through the device ID selection window 1122. Next, select the scheme of the display object from the list of schemes with the device ID (1122) as the object through the scheme name selection window 1123. In the data recording period display unit 1124, the start date and end date of the period in which the input scheme is processed and the records remain are displayed. In the result display period specification window 1125, enter the start date and end date of the period in which you want to display the results. When the display button 1126 is pressed, the results of the abnormality detection processing are displayed. When the end button 1127 is pressed, the processing of the specified display object is ended.

[0087] Fig.13A and Fig. 13B This is an example of a GUI for showing the analysis result to the user. When the user selects a tab displayed at the top of each screen, the screen switches to either the analysis result entire display screen 1201 or the analysis result enlarged display screen 1202 .

[0088] Fig.13A This is an example of the analysis result overall display screen 1201. In the analysis result overall display screen 1201, the abnormality measure, threshold value, judgment result, and time series graph of the sensor signal for the specified period are displayed. In the period display window 1203, when the results of the offline analysis are displayed, Fig. 12A When displaying the result of the online analysis, although not shown in the figure, the result display period specified in FIG. 12C is displayed.

[0089] The abnormality measure display window 1204 displays an abnormality measure 1204a, a threshold value 1204b (dashed line), and a determination result 1204c for the specified learning period / test period or result display period. In addition, a circular mark 1204d is displayed in the interval used for learning. In the sensor signal display window 1205, a time series sensor signal 1205a is displayed for the specified sensor for the specified learning period / test period or result display period.

[0090] In the sensor selection window 1206, the sensor is specified by the user's input. However, before the user specifies, the first used sensor is selected. The cursor 1207 indicates the starting point of the enlarged display, and can be moved by the user's mouse operation. The number of days from the starting point to the end point of the enlarged display in the analysis result enlarged display screen 1202 is displayed in the display day designation window 1208, and input can also be made in this screen. The date at the cursor position is displayed in the date display window 1209. By pressing the end button 1210, the analysis result overall display screen 1201 and the analysis result enlarged display screen 1202 are deleted, and the display of the analysis result ends.

[0091] Fig. 13B This is an example of the analysis result enlarged display screen 1202. In the analysis result enlarged display screen 1202, the abnormality measure, threshold value, judgment result, and time series graph of the sensor signal during the period of the number of days specified by the display day designation window 1208 are displayed, starting from the date indicated by the cursor 1207 in the analysis result overall display screen 1201. That is, in the abnormality measure display window 1204 and the sensor signal display window 1205, the same information as that in the analysis result overall display screen 1201 is enlarged and displayed.

[0092] In addition, a scroll bar 1211 and a scroll bar area 1212 are additionally displayed in the analysis result enlarged display screen 1202. The length of the scroll bar 1211 corresponds to the number of days specified in the display day designation window 1208, and the entire length of the scroll bar area 1212 corresponds to the period displayed in the analysis result overall display screen 1201. In addition, the left end of the scroll bar 1211 corresponds to the starting point of the enlarged display. The user can also change the starting point of the display by operating the scroll bar 1211, and the change is reflected in the position of the cursor 1207 in the analysis result overall display screen 1201 and the display of the date display window 1209.

[0093] As described above, according to the present embodiment, it is possible to provide an abnormality detection device and an abnormality detection method that can perform processing at a high speed.

[0094] Description of Reference Numerals

[0095] 100: anomaly detection device, 101: equipment, 102: sensor signal, 103: sensor signal storage unit, 104: sensor signal input unit, 105: feature vector extraction unit, 106: clustering unit, 107: learning result storage unit, 108: cluster selection unit, 109: anomaly measure calculation unit, 110: threshold calculation unit, 111: anomaly detection unit, 1101: offline analysis condition setting screen, 1121: display object designation screen, 1201: analysis result overall display screen, 1202: analysis result enlarged display screen.

Claims

1. An abnormality detection device, characterized in that: have: a sensor signal input unit that inputs a plurality of time-series sensor signals output from a plurality of sensors installed in the device; a feature vector extraction unit, which extracts a feature vector from the sensor signal at each moment; a clustering unit that clusters the feature vectors during a specified learning period and adjusts the feature vectors belonging to each cluster to a fixed number; A cluster selection unit, which selects one or more clusters from the clusters according to the newly extracted feature vector; an abnormality measure calculation unit, which selects a predetermined number of feature vectors from the feature vectors belonging to the selected cluster according to the newly extracted feature vector, uses all the selected feature vectors to create a reference vector, and calculates an abnormality measure based on the created reference vector and the newly extracted feature vector; as well as an abnormality detection unit, which determines whether the sensor signal at each moment is normal or abnormal by comparing the abnormality measure with a threshold value, Before the cluster selection unit selects a cluster, the anomaly measure calculation unit calculates a temporary anomaly measure based on the newly extracted feature vector and the reference vector of the feature vector one moment ago. During learning, when the temporary anomaly measure is less than the maximum value of the anomaly measure calculated in the processing object interval, the temporary anomaly measure is used as the anomaly measure. During anomaly detection, when the temporary anomaly measure is less than the threshold, the temporary anomaly measure is used as the anomaly measure.

2. The abnormality detection device according to claim 1, characterized in that: The clustering unit sequentially adds one cluster so that the similarity between the initial arrangements of the cluster center positions decreases, and stops adding when the similarity between the initial arrangements exceeds a specified reference similarity or exceeds a specified maximum number.

3. The abnormality detection device according to claim 1, characterized in that: The clustering unit divides the learning period into a plurality of intervals in advance and performs clustering so that the intervals of feature vectors belonging to one cluster are the same. During learning, the cluster selection unit selects one cluster from the clusters in a different interval from the newly extracted feature vector based on the newly extracted feature vector, and during abnormality detection, the cluster selection unit selects one cluster from the clusters based on the newly extracted feature vector. The abnormality measure calculation unit creates a reference vector using all feature vectors belonging to the selected cluster.

4. An anomaly detection method, characterized in that: Perform the following processing: Input multiple time series sensor signals and extract feature vectors at each moment; Clustering the feature vectors during the specified learning period, and adjusting the feature vectors belonging to each cluster to a fixed number; The centers of the clusters and the feature vectors belonging to the clusters are accumulated as learning data, and one or more clusters are selected from the clusters accumulated as learning data based on the newly extracted feature vectors; According to the newly extracted feature vector, a predetermined number of feature vectors are selected from the feature vectors belonging to the selected cluster, and a reference vector is prepared using the selected feature vectors; Calculating an anomaly measure based on the newly extracted feature vector and the produced reference vector; Determining whether the sensor signal at each moment is abnormal or normal by comparing the abnormality measure with a threshold; In the calculation of the anomaly measure, before selecting the cluster, a temporary anomaly measure is calculated based on the newly extracted feature vector and the reference vector of the feature vector one moment ago. During learning, when the temporary anomaly measure is less than the maximum value of the anomaly measure calculated in the processing object interval, the temporary anomaly measure is used as the anomaly measure. During anomaly detection, when the temporary anomaly measure is less than the threshold, the temporary anomaly measure is used as the anomaly measure.

5. The anomaly detection method according to claim 4, characterized in that: In the clustering, one cluster is added one by one so that the similarity between the initial arrangements of the cluster center positions becomes lower, and when the similarity between the initial arrangements exceeds a specified reference similarity or exceeds a specified maximum number, the addition is stopped.

6. The anomaly detection method according to claim 4, characterized in that: In the clustering, the learning period is pre-divided into a plurality of intervals, and clustering is performed so that the intervals of feature vectors belonging to one cluster are the same. In the selection of the cluster, during learning, one cluster is selected from the clusters in a different interval from the newly extracted feature vector according to the newly extracted feature vector, and during abnormality detection, one cluster is selected from the clusters according to the newly extracted feature vector, In the calculation of the anomaly measure, all feature vectors belonging to the selected cluster are used to create a reference vector.

Images