Adaptive anomaly detection method, system and device based on working condition characteristics and medium

Abstract

The invention discloses a self-adaptive anomaly detection method, system and device based on working condition characteristics and a medium, and the method comprises the following steps: S1, obtaining working condition historical data, and constructing a time sequence of the working condition historical data; s2, obtaining the length of the time sequence through Fourier transform; if the length of the time sequence is greater than 1, entering a step S3, and if the length of the time sequence is equal to 1, entering a step S4; s3, performing anomaly detection on the time sequence with the length greater than 1 through the maximum average deviation, and outputting a result; and S4, performing anomaly detection on the time sequence with the length equal to 1 through a local outlier factor, and outputting a result. According to the method, the sequence length is determined through Fourier transform. Carrying out anomaly detection on the sequence with the length greater than 1 by adopting a maximum average deviation algorithm, and carrying out anomaly detection on the sequence with the length of 1 by adopting a local outlier factor algorithm. Therefore, the problem that the length of the anomaly detection sequence is always determined according to the empirical value in industrial production is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormality detection of operating condition characteristics, and in particular to an adaptive abnormality detection method, system, device and medium based on operating condition characteristics. Background Art

[0002] There are many scenarios for anomaly detection in industries such as chemicals, electricity, steel, papermaking, textiles, and semiconductors. Some anomalies may reduce product yields, or in severe cases, even cause equipment failures and damage.

[0003] Traditional anomaly detection methods often use fixed time windows or preset sequence lengths for data analysis, but these methods have significant limitations in complex scenarios across multiple industries. If the period is set too short, only fluctuations caused by sensor errors will be detected. If the period is set too long, transient faults may be missed, potentially causing irreversible damage to some precision instruments. Summary of the Invention

[0004] To address the above technical issues, the present invention aims to provide an adaptive anomaly detection method based on operating condition characteristics. This method can automatically select a time window or sequence length for data analysis based on the operating condition characteristics, thereby discovering hidden anomalies.

[0005] The present invention provides an adaptive anomaly detection method based on operating condition characteristics, comprising: S1, obtain historical working condition data and construct a sequence of historical working condition data; S2, obtain the length of the sequence through Fourier transform; if the length of the sequence is greater than 1, proceed to step S3; if the length of the sequence is equal to 1, proceed to step S4; S3, performs anomaly detection on sequences with a length greater than 1 by using the maximum mean deviation and outputs the results; S4, performs anomaly detection on sequences with a length of 1 using a local outlier factor and outputs the results.

[0006] Step S2 includes: S2.1, perform discrete Fourier transform on the sequence of historical data to satisfy:

[0007] in, It is a discrete time domain signal, that is, a sequence of original data, and N is the length of the sequence of original data; Is a discrete sequence in the frequency domain, indicating the signal at frequency The spectral component at , e is a natural constant, , i is the imaginary unit; S2.2, use the index value corresponding to the maximum value of the frequency domain signal modulus as the sequence length. If the index starts from 0, use the index value plus 1 as the length of the time window or sequence; S2.3, if the length of the sequence is equal to 1, proceed to step S4; if the length of the sequence is greater than 1, proceed to step S3.

[0008] Step S3 includes: S3.1, combine the data into a sequence according to the sequence length obtained in step S2. For each time point t, take the data from t-freq to t and combine them into a sequence, where freq is the sequence length obtained in step S2; S3.2, calculate the maximum average deviation of the sequence to be tested from all other sequences, satisfying:

[0009] Where, is the sequence to be detected, To remove One of the other sequences except , MMD is the maximum mean deviation, and m is the length of the sequence solved in S2.1; is the jth element in the sequence x to be detected, is the kth element in the sequence to be detected, For sequence The jth element in For sequence The kth element in ; is the kernel function; S3.3, the maximum average deviation between the sequence to be tested and the other sequences, and the median of the deviation is taken as the final result; S3.4, select the decision threshold by the length of the sequence , when the maximum average deviation exceeds the decision threshold When , it is determined that the sequence is abnormal, and the judgment threshold satisfy:

[0010] in, is the decision threshold, and m is the length of the sequence obtained in S2.1.

[0011] In step S3.4, the value of the maximum mean deviation satisfies the range [0, 1].

[0012] In step S3.2, the kernel function satisfy:

[0013] in, is the width parameter of the Gaussian kernel function, >0.

[0014] Step S4 includes: S4.1, select neighborhood K; S4.2, calculate the distance between the point to be detected and the nearest neighbor of the Kth neighboring point, satisfying:

[0015] in, is the point to be tested, It's distance The Kth nearest neighboring point; S4.3, calculate the kth nearest neighbor point and the point to be detected The reachable distance satisfies:

[0016] in, is the jth nearest neighbor point, for The distance to the nearest neighbor of the Kth neighbor; S4.4, calculate the local reachability density, satisfying: in, Point to be tested and the jth nearest neighbor The accessible distance between S4.5, calculate the local outlier factor, satisfying: Among them, K is the size of the field, is the local reachable density of the point p to be detected; is the jth neighbor point The local reachable density of S4.6, determine the decision threshold , decision threshold satisfy:

[0017] S4.7, if LOF≈1, it indicates that the point to be detected If the density is close to that of the neighbors, it is judged to be normal data; if LOF>1, it indicates that the point to be detected If the density is lower than the neighbor density, it is considered to be abnormal data.

[0018] In step S4.1, the value range of the neighborhood K satisfies [10, 100].

[0019] Adaptive anomaly detection system based on operating condition characteristics, including: The acquisition module is used to obtain historical working condition data and construct a sequence of historical working condition data; The variation module is used to obtain the length of the sequence through Fourier transformation. If the length of the sequence is greater than 1, the maximum mean deviation is used to detect anomalies of the sequence with a length greater than 1. If the length of the sequence is equal to 1, the local outlier factor is used to detect anomalies of the sequence with a length equal to 1. The first detection module is used to perform anomaly detection on sequences with a length greater than 1 by using the maximum mean deviation and output the results; The second detection module is used to perform anomaly detection on a sequence with a length of 1 using a local outlier factor and output the result.

[0020] An adaptive anomaly detection device based on operating condition characteristics includes: a memory storing an adaptive anomaly detection method program based on operating condition characteristics and a processor for running the adaptive anomaly detection method program based on operating condition characteristics, wherein the adaptive anomaly detection method program based on operating condition characteristics is configured to implement the steps of the adaptive anomaly detection method.

[0021] A computer-readable storage medium stores a program of an adaptive abnormality detection method based on operating condition characteristics, and the program of an adaptive abnormality detection method based on operating condition characteristics is executed by a processor to perform steps of an adaptive abnormality detection method based on operating condition characteristics.

[0022] This invention uses Fourier transform to determine sequence length. It uses the maximum mean deviation algorithm for outlier detection when the sequence length is greater than 1, and the local outlier factor algorithm for outlier detection when the sequence length is 1. This solves the problem of anomaly detection sequence length being determined based on empirical values ​​in industrial production. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Other features, objects and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0024] Figure 1 This is a general flow chart of an adaptive anomaly detection method based on operating condition characteristics according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The adaptive anomaly detection method based on operating condition characteristics of the present invention is further described in detail below with reference to the accompanying drawings. In the following detailed description, only certain exemplary embodiments of the present invention are described by way of illustration. It goes without saying that those skilled in the art will recognize that the described embodiments may be modified in various ways without departing from the spirit and scope of the present invention. Therefore, the drawings and description are illustrative in nature and are not intended to limit the scope of protection of the claims.

[0026] Industrial production requires numerous anomaly detection scenarios. To address these scenarios, this paper proposes an adaptive anomaly detection method based on operating condition characteristics, including the following steps: ① Adaptively selecting a time window or sequence length using Fourier transform; ② Detecting anomalies in the sequence using maximum mean deviation; and ③ Detecting anomalies at each point using local outlier factors.

[0027] ① Adaptive selection of sequence length through Fourier transform The sequence length is adaptively selected via Fourier transform.

[0028] The discrete Fourier transform of the time series composed of the original data is expressed as follows:

[0029] in, It is a discrete time domain signal, that is, a time series composed of original data; is the corresponding frequency domain signal.

[0030] The index value corresponding to the maximum value of the frequency domain signal modulus is used as the sequence length. If the index starts from 0, the index value plus 1 is used as the time window or sequence length. If the sequence length is 1, point anomaly detection is performed, and if the sequence length is greater than 1, sequence anomaly detection is performed. ② Detect anomalies in the sequence by the maximum mean deviation The maximum mean deviation is used as a measure of sequence anomaly.

[0031] Calculate the maximum average deviation between the sequence to be tested and all other sequences, which is expressed as follows:

[0032] Where, The sequence to be detected Represents One of the other sequences except ; m is the length of the sequence obtained in ①; 、 、 are the elements in the sequence respectively; As the kernel function, studies have shown that the Gaussian kernel function has a better effect, and its expression is: ,in >0 is the width parameter of the Gaussian kernel function.

[0033] right The median of the maximum mean deviation from the other n sequences is used as the final result. According to the calculation formula, the range of MMD (Maximum Mean Discrepancy) values ​​is [0, 1]. The longer the sequence, the more accurate the MMD calculation. Therefore, the decision threshold is selected based on the sequence length, as shown below:

[0034] in, When the MMD value exceeds the threshold, it is considered that the sequence with a length of m is abnormal.

[0035] ③ Detect anomalies of points through local outlier factors The local outlier factor is used as a measure of point anomaly.

[0036] Set the size of the neighborhood k, usually 20 to 100. For the point to be detected, calculate the distance between it and the kth nearest neighbor as the k distance, which is expressed as follows:

[0037] in, It is the point to be tested. It's distance The kth point closest to the point.

[0038] Calculate the k nearest neighbor points and point The reachable distance is expressed as follows:

[0039] in, is the i-th neighbor point, for The k distance.

[0040] Calculate the local reachability density, which is expressed as follows:

[0041] in, Point to be tested and the i-th neighbor point The accessible distance between.

[0042] Calculate the local outlier factor, which is expressed as follows:

[0043] LOF≈1, point to be detected The density is similar to that of the neighbors, which is normal data; LOF>1, the point to be detected If the value is lower than the neighbor density, it is considered abnormal data. At the same time, the larger the number of neighbors k is, the more accurate the calculation is. Therefore, the decision threshold is determined by the number of neighbors k, which is expressed as follows:

[0044] Example Figure 1 1 is a schematic diagram of the overall flow of the adaptive anomaly detection method based on operating condition characteristics in an embodiment of the present invention.

[0045] Step S1 obtains the historical data of each system to construct the real sequence of each indicator.

[0046] In this example, the data used for rationality verification is the usage count and change in usage count for a certain company's equipment in March 2015. Data collection begins at 0:02 and is performed every 5 minutes, resulting in 12 sampling points per hour and 288 sampling points per day. This dataset contains a total of 8,929 samples, of which 1,588 are abnormal. Specific data examples are shown in Table 1: Table 1 Specific sampling data table

[0047] In this embodiment, abnormality detection is performed on the number of times of use and the amount of change in the number of times of use according to the steps of the present invention.

[0048] Step S2: Determine the sequence length through Fourier transform.

[0049] The result of Fourier transform of the number of clicks is: [740863.00+0.00i,66295.07-89223.44i,121502.75+72859.18i,72995.86+56195.70i,159042.39-12103.33i,-58887.03+57787.34i,92486.94+196322.67i,88974.66+84872.11i,47012.68+1093 85.17i,-49531.90+188136.50i,82851.26+183753.88i,3297.49+7266.54i,-42667.93+75360.16 i,-74108.49+61372.73i,9468.58+92904.92i,-103946.69-52930.01i,-116705.69+125613.51i, -53143.34-633.81i,-55702.21+38512.06i,-90193.11-76840.04i,-60736.98+76929.15i, 54395.58-83637.52i,-14365.31-37729.65i,-18702.42-75558.04i,-13079.85-22249.19i ].

[0050] The corresponding amplitudes are: [740863.00,111156.91,141673.49,92121.41,159502.26,82504.90,217017.11,122962.45,119060.10,194547.55,201568.40,7979.73,86600.84,96222.04,93386.18,116646.91,171461.28,53147.12,67719.38,118487.09,98015.69,99770.31,40371.88,77838.29,25809.09].

[0051] The result of Fourier transform on the difference of click times is: [155.00+0.00i,217.80 +46.63i,52.56+171.09i,36.51+154.24i,189.70+447.66i,-48.70-2206.85i,-673.15+392.28i,-262.02+439.34i,-460.10+266.41i,-1037.61-309.95i,-1136.12+587.62i,98.84+25.74i,-482.94 -357.64i,-409.58-675.43i,-759.88+97.79i,707.94-1100.23i,-1266.80-1306.13i,158.77-635.83i ,-337.31-702.51i,1174.37-1212.84i,-933.77-847.23i,1396.97+794.74i,737.41-226.92i,1375.51 -312.61i,528.91-224.08i] The corresponding amplitudes are: [155.00,222.74,178.98,158.50,486.19,2206.31,779.12,511.55,531.66,1082.91,1279.09492764102.14,600.95,789.91,766.15,1308.32,1819.55,655.35,779.29,1688.23,1260.85,1607.22,771.54,1410.59,574.42].

[0052] In this embodiment, after Fourier transform, the length of the usage count sequence is 1, and the length of the usage count variation sequence is 6. Therefore, step S4 is executed for abnormality detection of the usage count, and step S3 is executed for abnormality detection of the usage count variation.

[0053] Step S3: Perform anomaly detection for the case where the sequence length is greater than 1 by using the maximum mean deviation.

[0054] In this embodiment, this step is performed on the change in the number of times of use.

[0055] This step S3 includes 4 sub-steps.

[0056] Step S3.1, combine the data into sequences according to the sequence length obtained in step S2.

[0057] In this embodiment, the combined sequence is:

[0058] Because the sequence length is 6, the five times from 2015 / 3 / 1 00:02 to 2015 / 3 / 1 00:22 cannot form a sequence. Therefore, the sequence starts at 2015 / 3 / 1 00:27. The initial subscript is 0, so the subscript of the first sequence is 5.

[0059] Step S3.2: Calculate the maximum average deviation between the sequence to be detected and other sequences, which is expressed as follows:

[0060] Where, The sequence to be detected Represents One of the other sequences; m is the length of the sequence obtained in ①, which is 6 in this embodiment; 、 、 are the elements in the sequence respectively; As the kernel function, studies have shown that the Gaussian kernel function has a better effect, and its expression is: ,in >0 is the width parameter of the Gaussian kernel function.

[0061] In this embodiment, For the sequence to be detected, the calculated maximum average deviation value is [0.11,0.056,0.056,0.111,0.166,0.2,0.255,0.29,0.291,0.292,0.292,0.355,0.298,0.355,0.356,0.376,0.298,0.278,0.332, ,0.368, ,0.465] Step S3.3, The maximum average deviation value from the other n sequences is taken as the median as the final result.

[0062] In this embodiment, the final result is 0.368.

[0063] In step S3.4, according to the calculation formula, the range of the MMD value is [0, 1]. At the same time, the longer the sequence, the more accurate the MMD calculation. Therefore, the decision threshold is selected according to the sequence length, which is expressed as follows:

[0064] in, When the MMD value exceeds the threshold, it is considered that the sequence with a length of m is abnormal.

[0065] In this embodiment, the threshold is 0.267. Therefore, the sequence to be detected An abnormal sequence.

[0066] In this embodiment, in order to verify the effectiveness of the present invention, an experiment was conducted using actual data. The experiment was run on Python software.

[0067] In this embodiment, step S2 clearly indicates that the sequence length for abnormal detection of usage count changes is 6. Therefore, at each time point, data from the past 25 minutes must be collected. For example, at the time point 2015 / 3 / 10:27, six usage count changes from 2015 / 3 / 10:02 to 2015 / 3 / 10:27 must be collected to form a sequence.

[0068] There are two ways to conduct the test.

[0069] The first method is to test once if the data generated is less than 1000 sequences, for example, each new sequence needs to be tested once. Then the maximum average deviation between the sequence to be tested and the most recently generated 1000 sequences is calculated.

[0070] The second method is to perform a test only if the data generated is greater than 1,000. In this case, anomaly detection is performed by calculating the maximum average deviation of each sequence from all other sequences generated in the same time period.

[0071] In this embodiment, the data obtained exceeds 1000, so the second method is adopted for anomaly detection. The test results are shown in Table 2 below: Table 2 Test results

[0072] Step S4: Detect point anomalies with a sequence length of 1 using the local outlier factor.

[0073] In this embodiment, this step is performed on the change in the number of times of use.

[0074] This step S4 includes 6 sub-steps.

[0075] Step S4.1, set the size of the neighborhood k, usually 20 to 100.

[0076] Step S4.2: For the point to be detected, calculate the distance between it and its kth nearest neighbor as k distance, which is expressed as follows:

[0077] in, It is the point to be tested. It's distance The kth point closest to the point.

[0078] Step S4.3, calculate k nearest neighbor points and point The reachable distance is expressed as follows:

[0079] in, is the jth nearest neighbor point, for The k distance.

[0080] Step S4.4, calculate the local reachability density, which is expressed as follows:

[0081] in, Point to be tested and the jth nearest neighbor The accessible distance between.

[0082] Step S4.5, calculate the local outlier factor, which is expressed as follows:

[0083] Step S4.6, LOF≈1, point to be detected The density is similar to that of the neighbors, which is normal data; LOF>1, the point to be detected If the value is lower than the neighbor density, it is considered abnormal data. At the same time, the larger the number of neighbors k is, the more accurate the calculation is. Therefore, the decision threshold is determined by the number of neighbors k, which is expressed as follows:

[0084] In the embodiment of the present invention, the neighborhood K is set to 20, 50, and 100 respectively.

[0085] There are also two ways to conduct testing.

[0086] The first method is to detect once if the data generated is less than 10K. For example, each new data point needs to be detected once. Then the local outlier factor is calculated by comparing the sequence to be detected with the most recently generated 10K sequences.

[0087] The second method is to perform a detection only if the data generated is greater than 10K. In this case, anomaly detection is performed by calculating the local outlier factor of each point relative to all other points generated in the same time period.

[0088] In this embodiment, the data obtained exceeds 10K, so the second method is adopted to perform anomaly detection.

[0089] In this embodiment, when the field K is set to 20, based on the data at the 832nd point, that is, at 2015 / 3 / 3 21:22:53, the number of clicks at this time is 865 times.

[0090] The K points closest to it are [7416,2529,2523,4335,8570,4337,8880,8844,2515,4336,2498,2518,7665,4334,2524,8849,2510,2513,2526].

[0091] The distances are [7.0,9.0,19.0,19.0,21.0,27.0,37.0,38.0,43.0,48.0,68.0,85.0,85.0,92.0,111.0,112.0,114.0,116.0,131.0].

[0092] The reachable distance is [137.0,135.0,135.0,131.0,135.0,138.0,129.0,130.0,128.0,151.0,103.0,95.0,95.0,131.0,111.0,112.0,135.0,137.0,150.0].

[0093] The local reachability distance is 0.00786.

[0094] The local outlier factor is 0.9859.

[0095] The threshold is 0.95, so the data at this moment is abnormal data.

[0096] The test results are shown in Table 3 below: Table 3 Test results

[0097] Example Function and Effect This embodiment provides an adaptive anomaly detection method based on operating condition characteristics. This method uses Fourier transform to determine sequence length. For sequences with a length greater than 1, a maximum mean deviation algorithm is used for anomaly detection. For sequences with a length of 1, a local outlier factor algorithm is used for anomaly detection. This solves the problem of anomaly detection sequence length being determined based on empirical values ​​in industrial production.

[0098] The preferred embodiments of the present invention have been specifically described above, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention, and these equivalent modifications or substitutions are all included in the scope of this application.

Claims

1. An adaptive anomaly detection method based on working condition characteristics, characterized in that: include: S1, obtain historical working condition data and construct a sequence of historical working condition data; S2, adaptively selecting the length of the sequence through Fourier transform; if the length of the sequence is greater than 1, proceed to step S3; if the length of the sequence is equal to 1, proceed to step S4; S3, performs anomaly detection on sequences with a length greater than 1 by using the maximum mean deviation and outputs the results; S4, performs anomaly detection on sequences with a length of 1 using a local outlier factor and outputs the results.

2. The adaptive anomaly detection method based on operating condition characteristics according to claim 1, characterized in that: Step S2 includes: S2.1, perform discrete Fourier transform on the sequence of historical data to satisfy: in, It is a discrete time domain signal, that is, a sequence of original data, and N is the length of the sequence of original data; Is a discrete sequence in the frequency domain, indicating the signal at frequency The spectral component at , e is a natural constant, , i is the imaginary unit; S2.2, use the index value corresponding to the maximum value of the frequency domain signal modulus as the sequence length. If the index starts from 0, use the index value plus 1 as the length of the time window or sequence; S2.3, if the length of the sequence is equal to 1, proceed to step S4; if the length of the sequence is greater than 1, proceed to step S3.

3. The adaptive anomaly detection method based on operating condition characteristics according to claim 1, characterized in that: Step S3 includes: S3.1, combine the data into a sequence according to the sequence length obtained in step S2. For each time point t, take the data from t-freq to t and combine them into a sequence, where freq is the sequence length obtained in step S2; S3.2, calculate the maximum average deviation of the sequence to be tested from all other sequences, satisfying: Where, is the sequence to be detected, To remove One of the other sequences except , MMD is the maximum mean deviation, and m is the length of the sequence solved in S2.1; is the jth element in the sequence x to be detected, is the kth element in the sequence to be detected, For sequence The jth element in For sequence The kth element in ; is the kernel function; S3.3, the maximum average deviation between the sequence to be tested and the other sequences, and the median of the deviation is taken as the final result; S3.4, select the decision threshold by the length of the sequence , when the maximum average deviation exceeds the decision threshold When , it is determined that the sequence is abnormal, and the judgment threshold satisfy: in, is the decision threshold, and m is the length of the sequence obtained in S2.

1.

4. The adaptive anomaly detection method based on operating condition characteristics according to claim 3 is characterized in that: In step S3.4, the value of the maximum mean deviation satisfies the range [0, 1].

5. The adaptive anomaly detection method based on operating condition characteristics according to claim 3 is characterized in that: In step S3.2, the kernel function satisfy: in, is the width parameter of the Gaussian kernel function, >

0.

6. The adaptive anomaly detection method based on operating condition characteristics according to claim 1, characterized in that: Step S4 includes: S4.1, select neighborhood K; S4.2, calculate the distance between the point to be detected and the nearest neighbor of the Kth neighboring point, satisfying: in, is the point to be tested, It's distance The Kth nearest neighboring point; S4.3, calculate the kth nearest neighbor point and the point to be detected The reachable distance satisfies: in, is the jth nearest neighbor point, for The distance to the nearest neighbor of the Kth neighbor; S4.4, calculate the local reachability density, satisfying: in, Point to be tested and the jth nearest neighbor The accessible distance between S4.5, calculate the local outlier factor, satisfying: Among them, K is the size of the field, is the local reachable density of the point p to be detected; is the jth neighbor point The local reachable density of S4.6, determine the decision threshold , decision threshold satisfy: S4.7, if LOF≈1, it indicates that the point to be detected If the density is close to that of the neighbors, it is judged to be normal data; if LOF>1, it indicates that the point to be detected If the density is lower than the neighbor density, it is considered to be abnormal data.

7. The adaptive anomaly detection method based on operating condition characteristics according to claim 6, characterized in that: In step S4.1, the value range of the neighborhood K satisfies [10, 100].

8. The adaptive anomaly detection system based on working condition characteristics is characterized by: include: The acquisition module is used to obtain historical working condition data and construct a sequence of historical working condition data; The change module is used to obtain the length of the sequence through Fourier transformation; If the length of the sequence is greater than 1, the maximum mean deviation is used to detect anomalies of the sequence with a length greater than 1. If the length of the sequence is equal to 1, the local outlier factor is used to detect anomalies of the sequence with a length equal to 1. The first detection module is used to perform anomaly detection on sequences with a length greater than 1 by using the maximum mean deviation and output the results; The second detection module is used to perform anomaly detection on a sequence with a length of 1 using a local outlier factor and output the result.

9. An adaptive anomaly detection device based on working condition characteristics, characterized in that: include: A memory storing a program of an adaptive anomaly detection method based on operating condition characteristics and a processor for running the program of an adaptive anomaly detection method based on operating condition characteristics, wherein the program of the adaptive anomaly detection method based on operating condition characteristics is configured to implement the steps of the adaptive anomaly detection method based on operating condition characteristics as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer-readable storage medium stores a program for an adaptive anomaly detection method based on operating condition characteristics. When the program for an adaptive anomaly detection method based on operating condition characteristics is executed by a processor, the steps of the adaptive anomaly detection method based on operating condition characteristics as described in any one of claims 1 to 7 are implemented.

Images