Abnormality detection apparatus, abnormality detection method, and abnormality detection program

Abstract

To allow proper setting of a threshold value for abnormality detection.SOLUTION: A threshold value specifying unit 22 specifies a threshold value by using a target value in extracted data extracted from an actual data. An abnormality detection unit 23 detects abnormal data whose object values among the data extracted by using the threshold value are abnormal values. A designation reception unit 24 indicates the abnormal data and accepts designation of outlier data whose object value among the abnormal data is an outlier value. The threshold value specifying unit 22 re-specifies the threshold value again by using the object value in the remaining data obtained by excluding the outlier data from the extracted data. The abnormality detection unit 23 uses the re-specified threshold value to detect the abnormal data whose object values among the remaining data are abnormal values.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to techniques for detecting anomalies in data. [Background technology]

[0002] Various performance data obtained during the manufacturing process of a product are visualized to support analysis from various perspectives. In this case, anomalies are detected from the performance data.

[0003] When detecting anomalies from performance data, a threshold is set as a criterion for determining whether or not there is an anomaly. The threshold may be set using an average value, variance, or the like calculated from past performance data. When setting a threshold from past performance data in this way, if the past performance data contains outliers, the threshold may not be set appropriately. An outlier here is a value that deviates from reality for some reason. If the threshold is not set appropriately, there is a possibility that anomalies will not be detected appropriately.

[0004] Patent Document 1 describes a method of removing noise from manufacturing performance data, such as missing data or abnormal data, to generate evaluation data. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2022-014878 Summary of the Invention [Problem to be solved by the invention]

[0006] In Patent Document 1, noise is uniformly removed using a formula. However, in the manufacturing process of a product, it is often difficult for anyone other than a person on-site to determine whether or not there is an outlier. Therefore, a method of uniformly removing noise as in Patent Document 1 cannot remove outliers appropriately. If outliers cannot be removed appropriately, the threshold value cannot be set appropriately, and there is a possibility that anomalies will not be detected appropriately. An object of the present disclosure is to make it possible to appropriately set a threshold value for detecting an anomaly. [Means for solving the problem]

[0007] The abnormality detection device according to the present disclosure comprises: a threshold value specification unit that specifies a threshold value by using a target value in extracted data extracted from the performance data; an anomaly detection unit that detects abnormal data in which the target value is an abnormal value from among the extracted data, using the threshold value specified by the threshold specification unit; a designation receiving unit that indicates the abnormal data detected by the abnormality detection unit and receives designation of outlier data of which the target value is an outlier among the abnormal data; Equipped with the threshold value specification unit specifies a threshold value again by using a target value in remaining data obtained by excluding the outlier data accepted by the designation acceptance unit from the extracted data; The anomaly detection unit detects, from the remaining data, abnormal data in which the target value is an abnormal value, by using the threshold value re-specified by the threshold value specification unit. Effect of the Invention

[0008] In the present disclosure, the abnormal data detected using a specified threshold is displayed to allow the user to specify the outlier data. After removing the outlier data, the threshold is respecified and the abnormal data is detected again. This makes it possible to set the threshold appropriately and to detect the abnormal data appropriately. [Brief description of the drawings]

[0009] [Figure 1]FIG. 1 is a configuration diagram of an anomaly detection system 100 according to a first embodiment. [Diagram 2] 1 is a configuration diagram of an abnormality detection device 10 according to a first embodiment. [Diagram 3] 3 is a flowchart of the overall processing of the abnormality detection device 10 according to the first embodiment. [Figure 4] FIG. 3 is an explanatory diagram of performance data 31 according to the first embodiment. [Diagram 5] FIG. 4 is an explanatory diagram of setting data 32 according to the first embodiment. [Figure 6] FIG. 4 is an explanatory diagram of extracted data 33 according to the first embodiment. [Figure 7] FIG. 4 is an explanatory diagram of abnormality data 36 according to the first embodiment. [Figure 8] FIG. 4 is an explanatory diagram of a designation acceptance process according to the first embodiment. [Figure 9] FIG. 4 is an explanatory diagram of a designation acceptance process according to the first embodiment. [Figure 10] FIG. 4 is an explanatory diagram of remaining data 35 according to the first embodiment. [Figure 11] 11 is a flowchart of the overall processing of the abnormality detection device 10 according to the third embodiment. [Figure 12] FIG. 13 is an explanatory diagram of a second designation receiving process according to the third embodiment. [Figure 13] FIG. 11 is a configuration diagram of an abnormality detection device 10 according to a third modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Embodiment 1 ***Configuration Description*** The configuration of an anomaly detection system 100 according to the first embodiment will be described with reference to FIG. The anomaly detection system 100 includes an anomaly detection device 10 and one or more user terminals 50. The anomaly detection device 10 is a computer that detects anomalies from performance data. The user terminal 50 is a computer such as a PC used by a user. PC is an abbreviation for Personal Computer. The anomaly detection device 10 and each user terminal 50 are connected via a network 90. ​​Specific examples of the network 90 include the Internet and a LAN. LAN is an abbreviation for Local Area Network.

[0011] The configuration of the abnormality detection device 10 according to the first embodiment will be described with reference to FIG. The abnormality detection device 10 is a computer. The abnormality detection device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls the other hardware components.

[0012] The processor 11 is an IC that performs processing. IC is an abbreviation for Integrated Circuit. Specific examples of the processor 11 include a CPU, a DSP, and a GPU. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0013] The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 include SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0014] The storage 13 is a storage device that stores data. A specific example of the storage 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. Another specific example of the storage 13 is an SSD. SSD is an abbreviation for Solid State Drive. The storage 13 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0015] The communication interface 14 is an interface for communicating with an external device. Specific examples of the communication interface 14 include Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition Multimedia Interface.

[0016] The abnormality detection device 10 includes, as functional components, a data extraction unit 21, a threshold identification unit 22, an abnormality detection unit 23, a designation receiving unit 24, and an output unit 25. The functions of the functional components of the abnormality detection device 10 are realized by software. Storage 13 stores programs that realize the functions of each functional component of anomaly detection device 10. These programs are loaded into memory 12 by processor 11 and executed by processor 11. In this way, the functions of each functional component of anomaly detection device 10 are realized.

[0017] The storage 13 stores performance data 31 and setting data 32. Note that the performance data 31 and the setting data 32 may be stored in a storage device external to the abnormality detection device 10, instead of in the storage 13.

[0018] 2 shows only one processor 11. However, there may be a plurality of processors 11, and the plurality of processors 11 may cooperate to execute programs that realize the respective functions.

[0019] ***Explanation of Operation*** The operation of the abnormality detection device 10 according to the first embodiment will be described with reference to FIGS. The operation procedure of the abnormality detection device 10 according to the embodiment 1 corresponds to the abnormality detection method according to the embodiment 1. Moreover, the program that realizes the operation of the abnormality detection device 10 according to the embodiment 1 corresponds to the abnormality detection program according to the embodiment 1.

[0020] The overall processing of the abnormality detection device 10 according to the first embodiment will be described with reference to FIG. The process shown in Fig. 3 may be executed at a fixed interval, such as weekly or monthly. Alternatively, the process shown in Fig. 3 may be executed when a certain amount of performance data has been accumulated. Alternatively, the process shown in Fig. 3 may be executed at any timing, such as when an execution instruction is received.

[0021] (Step S11: Data extraction process) The data extraction unit 21 extracts extracted data 33 for analysis from the performance data 31. The data extraction unit 21 stores the extracted data 33 in the memory 12.

[0022] As shown in Fig. 4, the performance data 31 is an accumulation of data obtained during the manufacturing process of a product. In Fig. 4, the performance data 31 includes data on the types of production results and man-hours. The performance data 31 shows items such as the performance value, work date, work category, line, and process for each data. The performance value is a value for the type of object. In other words, the performance value is the number actually produced in the case of production results, and is the actual number of man-hours required in the case of man-hours. The work date is the day on which the work was performed. The work category is either day shift or night shift. The line is the line used in production. The process is the production process.

[0023] The data extraction unit 21 refers to the setting data 32 and extracts the extraction data 33 . As shown in Fig. 5, the setting data 32 indicates a plurality of sets of designated items to be used as target values ​​in the performance data 31, comparison items to compare the designated items with, and extraction conditions to extract the extracted data 33 from the performance data 31. For example, in the set on the third line in Fig. 5, man-hours is indicated as the designated item. The number of working days is indicated as the comparison item. A line is indicated as the extraction condition. In other words, the set on the third line in Fig. 5 indicates that performance data 31 is extracted for each line as extracted data 33, and man-hours are compared between working dates. The data extraction unit 21 sets each group included in the setting data 32 as a group to be processed. The data extraction unit 21 extracts extracted data 33 corresponding to the group to be processed from the performance data 31 according to the extraction conditions for the group to be processed. At this time, the data extraction unit 21 extracts data for the most recent reference period as the extracted data 33. From the setting data 32, the extraction data 33 for calculating KPIs related to the manufacturing process is extracted based on the designated item and the comparison item. KPI is an abbreviation for Key Performance Indicator. For example, if the designated item is production volume and the comparison item is work date, the extraction data 33 in which the production volume is recorded for each work date is extracted, so that KPIs such as production volume per unit period can be calculated.

[0024] The comparison item may be specified not simply as the work date, but also as the same day of the week in each week. In other words, this means comparing the target values ​​for the same day of the week. Similarly, the work date may be specified as the same day in each month. The same day in each month means, for example, the 10th of each month. In other words, this means comparing the target values ​​for the 10th of each month.

[0025] For example, suppose that the group in the third row in Fig. 5 is set as the group to be processed. In this case, the data extraction unit 21 extracts the data shown in Fig. 6 as extracted data 33. That is, the data extraction unit 21 classifies by line and extracts data on the number of man-hours for each work date.

[0026] Next, the processing of loop 1 is executed with each pair included in the setting data 32 as a pair to be processed, and each classification of the pair to be processed as a classification to be processed. The processing of loop 1 includes the processing of steps S12 to S15. Each classification means each line when the pair in the third row of FIG. 5 is the pair to be processed.

[0027] (Step S12: Threshold determination process) The threshold value specification unit 22 specifies a threshold value for the set and classification to be processed using a target value in the extracted data 33 for the set and classification to be processed. The target value is the value of an item indicated by a specified item in the set to be processed. The threshold value specification unit 22 specifies a threshold value based on a statistical value such as the average or variance of the target value. The threshold value may be both an upper limit value and a lower limit value, or may be only an upper limit value or only a lower limit value. Whether to use the upper limit value and the lower limit value, only the upper limit value, or only the lower limit value is determined according to the contents of the target value, etc. As a specific example, the threshold value specification unit 22 may use the average value μ and standard deviation σ of the target value to set μ+2σ as a threshold value representing the upper limit, and μ-2σ as a threshold value representing the lower limit. The upper limit value and the lower limit value dynamically calculated in this way may be used to set a threshold value for the upper limit value or a threshold value for the lower limit value for each set of the setting data 32. The configuration may also be such that an appropriate range is set using both the upper limit value and the lower limit value. The upper limit value threshold, the lower limit value threshold, or the appropriate range is set according to the properties of each target value. Alternatively, to save labor, it may be configured to set an appropriate range for all target values. An upper limit or lower limit attribute is assigned to the threshold value. When two threshold values ​​with upper and lower limit attributes are set for an item indicated by one designated item, the appropriate range is between the upper limit and lower limit values. At this time, if outlier data 34 has been accepted in the designation acceptance process described below, the threshold value identifying unit 22 identifies the threshold value using a target value in remaining data 35 obtained by excluding the outlier data 34 from the extracted data 33. In other words, the threshold value identifying unit 22 does not use the outlier data 34 when identifying the threshold value, and identifies the threshold value from the remaining data.

[0028] 5 is the group to be processed, and line A is the target classification. Also, assume that there is no data accepted as outlier data 34. In this case, the threshold value is specified based on the man-hours in the extracted data 33 of line A shown in FIG.

[0029] (Step S13: Abnormality detection process) The anomaly detection unit 23 detects abnormal data 36 in which the target value is an abnormal value from the extracted data 33 corresponding to the group and classification to be processed. The anomaly detection unit 23 stores the detected abnormal data 36 in the memory 12 as the abnormal data 36 corresponding to the group and classification to be processed. For example, assume that the threshold value specified in step S12 is 23 hours. In this case, from the extracted data 33 for line A shown in FIG. 6, data with a work date of 2022 / 7 / 9 and data with a work date of 2022 / 7 / 10, in which the man-hours are greater than 23 hours, are detected as abnormal data 36, ​​as shown in FIG.

[0030] (Step S14: Designation acceptance process) The designation receiving unit 24 indicates the abnormal data 36 corresponding to the group and classification to be processed, and receives designation of the outlier data 34, of the abnormal data 36, ​​whose target value is an outlier. Specifically, as shown in FIG. 8, the designation receiving unit 24 displays the abnormal data 36 on the user terminal 50, and allows the user to designate the deviant data 34 from the abnormal data 36. In FIG. 8, the abnormal data 36 input as NG is the deviant data 34 that should not be used as original data for identifying a threshold value. The abnormal data 36 input as OK is data that can be used as original data for identifying a threshold value, although the target value is abnormal. Here, the user terminal 50 is a computer used by a user. The user is, for example, a worker at a site involved in the production of products. The worker at the site is aware of the situation for each working date, and knows that the actual results for a certain working date should be the deviant data 34 because an irregularity has occurred. Conversely, the user can determine that the data should not be the deviant data 34 because an irregularity has occurred. Therefore, the user can appropriately designate the deviant data 34, and can also appropriately designate the data not to be the deviant data 34. As shown in FIG. 9, when the designation receiving unit 24 displays the abnormal data 36 on the user terminal 50, the designation receiving unit 24 may also display a message indicating how the abnormal data 36 is abnormal.

[0031] (Step S15: End determination process) The designation receiving unit 24 determines whether or not the outlier data 34 was designated in step S14. If outlier data 34 is specified, the designation receiving unit 24 returns the process to step S12. On the other hand, if outlier data 34 is not specified, the designation receiving unit 24 ends the process of loop 1 for the group and classification to be processed. If outlier data 34 is not specified, the designation receiving unit 24 sets the abnormal data 36 last detected in step S13 as the final abnormal data 36 corresponding to the group and classification to be processed.

[0032] Assume that the group in the third row in Fig. 5 is the group to be processed, and line A is the target classification. Assume also that the data with the work date of 2022 / 7 / 9 is specified as outlier data 34, as shown in Fig. 8. In this case, the process returns to step S12, and as shown in Fig. 10, the threshold is specified based on the man-hours in the remaining data 35 obtained by removing the data with the work date of 2022 / 7 / 9, which is outlier data 34, from the extracted data 33 of line A shown in Fig. 6. This causes the specified threshold value to be different from the previously specified threshold value, which may result in detection of abnormal data 36 not previously detected in step S13. When abnormal data 36 not previously detected is detected, it may be newly designated as outlier data 34 in step S14.

[0033] (Step S16: Output process) The output unit 25 outputs the final abnormal data 36 for each group and each classification. Specifically, the output unit 25 displays the final abnormal data 36 on the user terminal 50. In addition, the output unit 25 stores the abnormal data 36 including the outlier data 34 for each group and each classification in a storage device such as the storage 13. In this embodiment, the purpose is to exclude the outlier data 34 specified by the user, re-specify the threshold value, and optimally detect the abnormal data 36. Therefore, the output of the abnormal data 36 to the user in step S16 can be omitted. Also, in step S16, it is possible to configure so that the outlier data 34 is also output as part of the abnormal data 36. In this case, as shown in Fig. 8, data designated by the user as the outlier data 34 is identified and displayed as NG, and data designated by the user as not being the outlier data 34 is identified and displayed as OK, so that the user can confirm the entire abnormal data 36 and the outlier data 34.

[0034] When the process shown in FIG. 3 is executed next time, in step S12, the threshold value is specified using remaining data 35 obtained by excluding outlier data 34 stored in the storage device from extracted data 33.

[0035] ***Advantages of the First Embodiment*** As described above, the abnormality detection device 10 according to the first embodiment indicates the abnormal data 36 detected using the threshold value once specified, and allows the user to specify the outlier data 34. Then, after excluding the outlier data 34, the threshold value is specified again, and the abnormal data 36 is detected again. This makes it possible to set the threshold value appropriately, and to appropriately detect the abnormal data 36. Here, in the manufacturing process of a product, it is often difficult for anyone other than a person on-site to judge whether or not something is an outlier. Therefore, by having a worker on-site determine whether or not abnormal data 36 is outlier data 34, it is possible to appropriately identify outlier data 34. As a result, it becomes possible to appropriately set the threshold value.

[0036] Embodiment 2 In the first embodiment, the remaining data 35 is generated by removing the previously specified outlier data 34 from the extracted data 33. The second embodiment differs from the first embodiment in that the target value in the previously specified outlier data 34 is used as a reference value, and the remaining data 35 is generated by removing the extracted data 33 whose target value is on the abnormal side of the reference value. In the second embodiment, this difference will be explained, and explanations of the same points will be omitted.

[0037] ***Explanation of Operation*** Among the processes in FIG. 3, the process in step S12 differs from that in the first embodiment. In step S12, the threshold value specifying unit 22 uses the target value in the previously specified outlier data 34 as a reference value, and generates remaining data 35 by excluding extracted data 33 whose target value is on the abnormal side of the reference value. The point that the threshold value is specified from the remaining data 35 is the same as in the first embodiment. Here, the target value being on the abnormal side of the reference value means that the target value is worse than the reference value. The target value being worse than the reference value means that the target value is higher than the reference value in the case of a type in which the smaller the value, the better. The target value being worse than the reference value means that the target value is lower than the reference value in the case of a type in which the larger the value, the better. For example, as shown in FIG. 8, assume that data with a work date of 2022 / 7 / 9 is specified as the outlier data 34. In this case, the fewer the man-hours in the outlier data 34, the better. Therefore, the remaining data 35 is generated excluding the extracted data 33 that is 29 hours or more, which is the man-hours in the outlier data 34. As described above in the first embodiment, the threshold is assigned an attribute of an upper limit or a lower limit, so whether or not the target value is abnormal compared to the reference value can be determined by the attribute of the threshold. In other words, if the threshold is the upper limit, the target value is excluded if it is the same as or larger than the reference value. Also, if the threshold is the lower limit, the target value is excluded if it is the same as or smaller than the reference value.

[0038] ***Effects of the second embodiment*** As described above, in the second embodiment, the target value in the previously designated outlier data 34 is set as the reference value, and the remaining data 35 is generated by excluding extracted data 33 whose target value is on the abnormal side of the reference value. Extracted data 33 whose target value is on the abnormal side of the target value in the outlier data 34 is likely to be determined as outlier data 34. This makes it possible to reduce the user's effort.

[0039] ***Other configurations*** <Variation 1> In the second embodiment, the extracted data 33 in which the target value is on the abnormal side of the reference value is treated as outlier data 34 to generate the remaining data 35. However, depending on the situation at the site, there are cases in which the target value cannot be uniformly determined as outlier data 34 just because it is on the abnormal side of the reference value. Therefore, it is not necessary to mechanically designate extracted data 33 whose target value is on the abnormal side of the reference value as outlier data 34. Instead, in step S14, the designation receiving unit 24 may display abnormal data 36 whose target value is on the abnormal side of the reference value in a manner that distinguishes it from other abnormal data 36. This makes it easier for the user to identify that the abnormal data 36 has a target value on the abnormal side of the reference value. Then, unless there are special circumstances, it becomes easy to designate abnormal data 36 whose target value is on the abnormal side of the reference value as outlier data 34. 8, when abnormal data 36 is displayed on the user terminal 50, the designation receiving unit 24 may initially display NG for abnormal data 36 whose target value is on the abnormal side of the reference value. In other words, the designation receiving unit 24 may initially display the data as being outlier data 34.

[0040] <Variation 2> As explained in the first modification, depending on the situation at the site, there may be cases where even if the target value is on the abnormal side of the reference value, it is not possible to uniformly determine the data as outlier data 34. Therefore, when the target value is not only on the abnormal side of the reference value but also satisfies a specified condition, the extracted data 33 may be set as outlier data 34 and the remaining data 35 may be generated. Specifically, in step S14, the designation receiving unit 24 causes a condition to be specified for the data designated as the outlier data 34. An example of the condition is that the data is the same day of the week. Then, in step S12, the threshold identifying unit 22 uses a target value in the outlier data 34 as a reference value, and generates remaining data 35 by excluding extracted data 33 that is extracted data whose target value is on the abnormal side of the reference value and that satisfies the condition associated with the outlier data 34. This makes it possible to prevent to some extent the extracted data 33 that should not be the outlier data 34 from becoming the outlier data 34.

[0041] Embodiment 3 In the first and second embodiments, abnormal data 36 is displayed for each group and classification to be processed, and designation of outlier data 34 is accepted. The third embodiment differs from the first and second embodiments in that abnormal data 36 is displayed across multiple groups or classifications, and designation of outlier data 34 is accepted. In the third embodiment, this difference will be explained, and explanation of the same points will be omitted.

[0042] ***Explanation of Operation*** The overall processing of the abnormality detection device 10 according to the third embodiment will be described with reference to FIG. The processes from step S21 to step S25 are the same as the processes from step S11 to step S15 in Fig. 3. The process from step S28 is the same as the process from step S16 in Fig. 3.

[0043] (Step S26: Second designation acceptance process) The designation receiving unit 24 treats each of the multiple groups as a group to be processed, and from the abnormal data 36 detected for each classification of the group to be processed as a classification to be processed, it shows all the abnormal data 36 that have a common value in any item, and accepts the designation of the outlier data 34. 12, the designation receiving unit 24 displays abnormal data 36 for the same work date together and receives the designation of the deviation data 34. Alternatively, the designation receiving unit 24 may display abnormal data 36 for the same line together and receive the designation of the deviation data 34. At this time, the user can designate a part or all of the abnormal data 36 as outlier data 34 .

[0044] (Step S27: Additional determination process) The designation receiving unit 24 determines whether or not the outlier data 34 was designated in step S26. When outlier data 34 is specified, the designation receiving unit 24 re-executes the process from step S22 for the group and classification of the abnormal data 36 specified as the outlier data 34. On the other hand, when outlier data 34 is not specified, the designation receiving unit 24 advances the process to step S28.

[0045] ***Effects of the Third Embodiment*** As described above, the abnormality detection device 10 according to the third embodiment displays abnormal data 36 having a common value across multiple groups or classifications and accepts the designation of outlier data 34. By displaying all abnormal data 36 having a common value together, it becomes easier for the user to make an appropriate decision. This makes it possible to set an appropriate threshold value and to appropriately detect abnormal data 36.

[0046] <Modification 3> In the first to third embodiments, each functional component is realized by software. However, as a third modification, each functional component may be realized by hardware. The following describes the third modification in terms of differences from the first to third embodiments.

[0047] The configuration of an abnormality detection device 10 according to the third modification will be described with reference to FIG. When each functional component is realized by hardware, the anomaly detection device 10 includes an electronic circuit 15 instead of the processor 11, the memory 12, and the storage 13. The electronic circuit 15 is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13.

[0048] The electronic circuit 15 may be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit 15, or each functional component may be distributed across multiple electronic circuits 15.

[0049] <Modification 4> As a fourth modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0050] The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0051] Furthermore, the term "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0052] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) a threshold value specification unit that specifies a threshold value by using a target value in extracted data extracted from the performance data; an anomaly detection unit that detects abnormal data in which the target value is an abnormal value from among the extracted data, using the threshold value specified by the threshold specification unit; a designation receiving unit that indicates the abnormal data detected by the abnormality detection unit and receives designation of outlier data of which the target value is an outlier among the abnormal data; Equipped with the threshold value specification unit specifies a threshold value again by using a target value in remaining data obtained by excluding the outlier data accepted by the designation acceptance unit from the extracted data; The anomaly detection unit detects abnormal data, in which the target value is an abnormal value, from the remaining data by using the threshold value re-specified by the threshold value specifying unit. (Appendix 2) The designation receiving unit stores the losing data in a storage device, The threshold specification unit specifies a new threshold from the newly extracted data by using a target value in remaining data excluding the outlier data stored in the storage device; The anomaly detection unit detects abnormal data in which the target value is an abnormal value from among the remaining data, using the new threshold value. 2. The anomaly detection apparatus according to claim 1. (Appendix 3) the threshold value specification unit specifies a new threshold value from the new extracted data by using a target value in the remaining data excluding extracted data whose target value is on the abnormal side of the reference value, the target value in the outlier data stored in the storage device being a reference value; The anomaly detection unit detects abnormal data in which the target value is an abnormal value from among the remaining data, using the new threshold value. The anomaly detection device according to claim 2. (Appendix 4) The designation reception unit sets a target value in the outlier data stored in the storage device as a reference value, among the abnormal data detected by the abnormality detection unit, and displays abnormal data whose target value is on the abnormal side of the reference value in a manner distinguished from other abnormal data. 3. The anomaly detection apparatus according to claim 2. (Appendix 5) The designation receiving unit stores the losing data in a storage device in association with a condition, The threshold specification unit specifies a new threshold using a target value in the remaining data obtained by excluding extracted data, which satisfies the condition associated with the outlier data and which has a target value on the abnormal side of the reference value, from the new extracted data, using a target value in the remaining data. 3. The anomaly detection apparatus according to claim 2. (Appendix 6) The abnormality detection device further comprises: a data extraction unit that refers to setting data indicating a plurality of pairs of a designated item to be the target value in the performance data and an extraction condition that is a condition for extracting the extracted data from the performance data, and extracts the extracted data corresponding to the group to be processed from the performance data according to the extraction condition for the group to be processed, with each group included in the setting data being a processing target; Equipped with the threshold value specification unit specifies the threshold value corresponding to the processing target group by using the target value indicated by the designated item in the processing target group in the extracted data corresponding to the processing target group; the anomaly detection unit detects, using the threshold value corresponding to the processing target pair, the abnormal data corresponding to the processing target pair, in which the target value indicated by the designated item in the processing target pair is an abnormal value, from the extracted data corresponding to the processing target pair; The designation receiving unit indicates the abnormal data corresponding to the set to be processed and receives a designation of the outlier data. 6. The anomaly detection device according to claim 1 . (Appendix 7) The designation receiving unit collectively displays the abnormal data having a common value in any item from the abnormal data detected as the processing target set for each of the plurality of sets, and receives the designation of the outlier data. 7. The anomaly detection apparatus according to claim 6. (Appendix 8) The computer specifies a threshold value using a target value in the extracted data extracted from the performance data; a computer detects abnormal data in which the target value is an abnormal value from among the extracted data by using the threshold value; The computer indicates the abnormal data and accepts designation of outlier data in which the target value is an outlier among the abnormal data; The computer re-specifies the threshold value using a target value in the remaining data obtained by excluding the outlier data from the extracted data; An anomaly detection method in which a computer detects, from the remaining data, abnormal data in which the target value is an abnormal value, by using the respecified threshold value. (Appendix 9) A threshold value specification process for specifying a threshold value using a target value in extracted data extracted from the performance data; an anomaly detection process for detecting abnormal data in which the target value is an abnormal value from among the extracted data, using the threshold value identified by the threshold identification process; a designation receiving process for indicating the abnormal data detected by the abnormality detection process and receiving designation of outlier data, the target value of which is an outlier, among the abnormal data; The computer functions as an anomaly detection device that performs the following: In the threshold value specification process, a threshold value is specified again by using a target value in remaining data obtained by excluding the outlier data accepted by the designation acceptance process from the extracted data; The anomaly detection program detects, in the anomaly detection process, anomaly data in which the target value is an anomaly value among the remaining data, using the threshold value re-specified by the threshold value specification process.

[0053] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0054] 100 Anomaly detection system, 10 Anomaly detection device, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 15 Electronic circuit, 21 Data extraction unit, 22 Threshold determination unit, 23 Anomaly detection unit, 24 Designation reception unit, 25 Output unit, 31 Actual data, 32 Setting data, 33 Extracted data, 34 Outlier data, 35 Remaining data, 36 Anomaly data, 50 User terminal, 90 Network.

Claims

1. a threshold value specification unit that specifies a threshold value by using a target value in extracted data extracted from the performance data; an anomaly detection unit that detects abnormal data in which the target value is an abnormal value from among the extracted data, using the threshold value specified by the threshold specification unit; a designation receiving unit that indicates the abnormal data detected by the abnormality detection unit and receives designation of outlier data of which the target value is an outlier among the abnormal data; Equipped with the threshold value specification unit specifies a threshold value again by using a target value in remaining data obtained by excluding the outlier data accepted by the designation acceptance unit from the extracted data; The anomaly detection unit detects abnormal data, in which the target value is an abnormal value, from the remaining data by using the threshold value re-specified by the threshold value specifying unit.

2. The designation receiving unit stores the losing data in a storage device, The threshold value specification unit specifies a new threshold value from the newly extracted data by using a target value in remaining data excluding the outlier data stored in the storage device; The anomaly detection unit detects abnormal data in which the target value is an abnormal value from among the remaining data, using the new threshold value. The abnormality detection device according to claim 1 .

3. the threshold value specification unit specifies a new threshold value from the new extracted data by using a target value in the remaining data excluding extracted data whose target value is on the abnormal side of the reference value, the target value in the outlier data stored in the storage device being a reference value; The anomaly detection unit detects abnormal data in which the target value is an abnormal value from among the remaining data, using the new threshold value. The abnormality detection device according to claim 2 .

4. The designation reception unit sets a target value in the outlier data stored in the storage device as a reference value, among the abnormal data detected by the abnormality detection unit, and displays abnormal data whose target value is on the abnormal side of the reference value in a manner distinguished from other abnormal data. The abnormality detection device according to claim 2 .

5. The designation receiving unit stores the losing data in a storage device in association with a condition, The threshold specification unit specifies a new threshold using a target value in the remaining data obtained by excluding extracted data, which satisfies the condition associated with the outlier data and which has a target value on the abnormal side of the reference value, from the new extracted data, using a target value in the remaining data. The abnormality detection device according to claim 2 .

6. The abnormality detection device further comprises: a data extraction unit that refers to setting data indicating a plurality of pairs of a designated item to be the target value in the performance data and an extraction condition that is a condition for extracting the extracted data from the performance data, and extracts the extracted data corresponding to the group to be processed from the performance data according to the extraction condition for the group to be processed, with each group included in the setting data being a processing target; Equipped with the threshold value specification unit specifies the threshold value corresponding to the processing target group by using the target value indicated by the designated item in the processing target group in the extracted data corresponding to the processing target group; the anomaly detection unit detects, using the threshold value corresponding to the processing target pair, the abnormal data corresponding to the processing target pair, in which the target value indicated by the designated item in the processing target pair is an abnormal value, from the extracted data corresponding to the processing target pair; The designation receiving unit indicates the abnormal data corresponding to the set to be processed and receives a designation of the outlier data. The abnormality detection device according to claim 1 .

7. The designation receiving unit collectively displays the abnormal data having a common value in any item from the abnormal data detected as the processing target set for each of the plurality of sets, and receives the designation of the outlier data. The abnormality detection device according to claim 6.

8. The computer specifies a threshold value using a target value in the extracted data extracted from the performance data; a computer detects abnormal data in which the target value is an abnormal value from among the extracted data by using the threshold value; The computer indicates the abnormal data and accepts designation of outlier data in which the target value is an outlier among the abnormal data; The computer re-specifies the threshold value using a target value in the remaining data obtained by excluding the outlier data from the extracted data; An anomaly detection method in which a computer detects, from the remaining data, abnormal data in which the target value is an abnormal value, by using the respecified threshold value.

9. A threshold value specification process for specifying a threshold value using a target value in extracted data extracted from the performance data; an anomaly detection process for detecting abnormal data in which the target value is an abnormal value from among the extracted data, using the threshold value identified by the threshold identification process; a designation receiving process for indicating the abnormal data detected by the abnormality detection process and receiving a designation of outlier data, the target value of which is an outlier, among the abnormal data; The computer functions as an anomaly detection device that performs the following: In the threshold value specification process, a threshold value is specified again by using a target value in remaining data obtained by excluding the outlier data accepted by the designation acceptance process from the extracted data; The anomaly detection program detects, in the anomaly detection process, anomaly data in which the target value is an anomaly value among the remaining data, using the threshold value re-specified by the threshold value specification process.

Images