System and method for detecting abnormality

Abstract

To provide a technique capable of achieving both sufficient confidentiality of data and high abnormality detection accuracy in an abnormality detection system using federated learning.SOLUTION: An abnormality detection system detects an abnormality in an apparatus using a machine learning model constructed by federated learning. Multiple computers including at least a processor and a storage unit include: an initial model learning unit configured to construct an initial learning model based on input data; a device ID generation unit configured to generate a device ID for uniquely identifying each computer; a latent variable generation unit configured to generate a latent variable to be input to a model; a pseudo data generation unit configured to generate pseudo data for each of the plurality of computers; and a shared model learning unit configured to construct a shared model which is a conditional generative model based on the pseudo data. The multiple computers also include multiple abnormality detection devices configured to detect the abnormality in the apparatus by calculating an abnormality degree of the apparatus based on the input data.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an anomaly detection system using associative learning. [Background technology]

[0002] In today's world where the business environment is becoming increasingly digitalized, it is essential for various business operators, such as companies and government agencies, to quickly and accurately detect anomalies that occur in their owned devices, equipment, facilities, etc. (hereinafter collectively referred to as "devices") in order to stably carry out their business. One of the technologies useful for detecting anomalies in such devices is a computer system (hereinafter also referred to as an "anomaly detection system") that uses a machine learning model to detect various anomalies that occur in the devices. Currently, services (hereinafter also referred to as "anomaly detection services") that use anomaly detection systems to detect anomalies in the devices owned by various business operators as customers are becoming more widespread.

[0003] In general, when a service provider (hereinafter simply referred to as "provider") providing an anomaly detection service using the same anomaly detection system to multiple business customers, the provider must ensure sufficient confidentiality of the data handled in the anomaly detection service so that data held by each business is not exposed to the eyes of other business customers. Federated learning is known as one of the technologies that can effectively solve such problems faced by providers when providing anomaly detection services (e.g., Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2022-171603 A Summary of the Invention [Problem to be solved by the invention]

[0005] When an anomaly detection service provider provides anomaly detection services using the same anomaly detection system to multiple business operators, as described above, it is necessary to sufficiently ensure the confidentiality of the data held by each business operator. Furthermore, for an anomaly detection service provider, it is essential that the anomaly detection system they use has high anomaly detection accuracy in order to provide high-quality anomaly detection services to their business operators, who are their clients.

[0006] In this regard, an anomaly detection system using federated learning is usually configured to include a central processing unit for performing federated learning, and a plurality of anomaly detection devices connected to the central processing unit so that data can be communicated with each other. In such an anomaly detection system with a general configuration, when the distribution of data handled by each anomaly detection device is different, the weights of the machine learning models constructed based on the data obtained from each anomaly detection device are different, making it difficult to integrate the weights of each machine learning model, and therefore difficult to achieve high anomaly detection accuracy. This problem also exists in the technology described in Patent Document 1. Therefore, even if the technology described in Patent Document 1 is applied to an anomaly detection system using federated learning, high anomaly detection accuracy cannot be achieved.

[0007] As such, in an anomaly detection system using federated learning, it is difficult to achieve both sufficient data confidentiality and high anomaly detection accuracy using existing technologies, and the development of new technology has been awaited.

[0008] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a technology that can achieve both sufficient data confidentiality and high anomaly detection accuracy in an anomaly detection system using federated learning. [Means for solving the problem]

[0009] The anomaly detection system according to the present invention is a system that detects anomalies in equipment using a machine learning model constructed by federated learning, and includes a plurality of computers each having at least a processor and a storage device, and includes an initial model learning unit that constructs an initial learning model based on input data, a device ID generation unit that generates a device ID that uniquely identifies each computer, a latent variable generation unit that generates latent variables to be input into the model, a pseudo data generation unit that generates pseudo data for each of the plurality of computers, and a shared model learning unit that constructs a shared model, which is a conditional generative model, based on the pseudo data, and the plurality of computers include a plurality of anomaly detection devices that detect anomalies in the equipment by calculating the degree of anomaly of the equipment from the input data.

[0010] Other problems and solutions disclosed in the present application will be made clear in the description of the preferred embodiment and the drawings. Effect of the Invention

[0011] According to the present invention, in an anomaly detection system using federated learning, it is possible to achieve both sufficient assurance of data confidentiality and high anomaly detection accuracy. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of an entire system including an anomaly detection system. [Diagram 2] 4 is a diagram illustrating an example of an operation of each functional unit in the anomaly detection system according to the first embodiment. FIG. [Diagram 3] FIG. 13 is a diagram illustrating an example of a learning procedure for an initial model. [Figure 4] FIG. 11 is a diagram illustrating a method for generating pseudo data. [Diagram 5] FIG. 13 is a diagram illustrating a mechanism by which information is concealed by pseudo data. [Figure 6] FIG. 13 is a diagram illustrating a learning procedure for a shared model. [Figure 7] 3 is a diagram illustrating an example of an operation feature of the anomaly detection system according to the first embodiment. [Figure 8] 1 is a diagram illustrating an example of a mechanism for calculating the degree of abnormality of a device with high accuracy using a shared model. [Figure 9] 11 is a flowchart showing an example of the flow of an initial model learning process in the first embodiment. [Figure 10] 11 is a flowchart illustrating an example of the flow of a shared model learning process in the first embodiment. [Figure 11] 11 is a flowchart showing an example of the flow of an abnormality degree calculation process in the first embodiment. [Figure 12] FIG. 11 is a diagram illustrating an example of an operation of each functional unit in the anomaly detection system according to the second embodiment. [Figure 13] 13 is a flowchart showing an example of the flow of a host device model learning process in the second embodiment. [Figure 14] 13 is a flowchart showing an example of the flow of an abnormality degree calculation process in the second embodiment. [Figure 15] 11 is a diagram illustrating an example of an operation feature of the anomaly detection system according to the second embodiment. FIG. [Figure 16] FIG. 11 is a diagram illustrating an example of an operation of each functional unit in the anomaly detection system according to the third embodiment. [Figure 17] 13 is a flowchart showing an example of the flow of a shared model learning process in the third embodiment. [Figure 18] 13 is a flowchart showing an example of the flow of an abnormality degree calculation process in the third embodiment. [Figure 19] 13 is a diagram illustrating an example of an operation feature of the anomaly detection system according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] In the following description, an "interface unit" may refer to one or more interface devices. The one or more interface devices may be at least one of the following: One or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices to at least one of the I / O devices and a remote display computer. The I / O interface device to the display computer may be a communications interface device. The at least one I / O device may be a user interface device, e.g., either an input interface device such as a keyboard and pointing device, or an output interface device such as a display device. One or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0014] In the following description, a "primary storage device" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the primary storage device may be a volatile memory device or a non-volatile memory device.

[0015] In the following description, an "auxiliary storage device" may be one or more auxiliary storage devices, which are an example of one or more storage devices. The auxiliary storage device may typically be a non-volatile storage device (e.g., a persistent storage device), and more specifically, may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0016] In the following description, the "storage device" may be at least a main storage device, including a main storage device and an auxiliary storage device.

[0017] Furthermore, in the following description, a "processor" may be one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may be a processor core. The at least one processor device may also be a broader processor device such as a circuit that is a collection of gate arrays written in a hardware description language that performs part or all of the processing (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0018] In the following description, functions may be described using the expression "xxx unit", but the functions may be realized by one or more computer programs being executed by a processor, or by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. When a function is realized by a program being executed by a processor, the function may be at least a part of the processor, since the specified processing is performed using a storage device and / or an interface device, etc., as appropriate. Processing described with a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium (e.g., a non-transitory recording medium). The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0019] In the following description, information that provides an output for an input may be described using expressions such as "yyy table", but the information may be a table of any structure, or may be a neural network that generates an output for an input, or a learning model such as a genetic algorithm or random forest. Therefore, the "yyy table" may be called "yyy information". In the following description, the structure of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

[0020] In the following description, a process may be described with a "program" as the subject, but the process described with a program as the subject may be a process performed by a processor or a device having the processor. Two or more programs may be realized as one program, and one program may be realized as two or more programs.

[0021] Furthermore, in the following description, the "anomaly detection system" may be a system (e.g., a cloud computing system) realized on a group of physical computing resources (e.g., a cloud platform), or a system (e.g., an on-premise system) composed of one or more physical computers. When the anomaly detection system "displays" the display information, it may mean displaying the display information on a display device possessed by the computer, or the computer may transmit the display information to a display computer (in the latter case, the display information is displayed by the display computer).

[0022] Various embodiments will now be described in detail with reference to the drawings.

[0023] In the following description, the same or similar components will be denoted by common reference symbols, and redundant description may be omitted.

[0024] In addition, when there are multiple elements having the same or similar functions, the multiple elements may be described by using the same reference numerals with different subscripts in order to distinguish between them. On the other hand, when there is no need to distinguish between the multiple elements, the subscripts may be omitted. EXAMPLES

[0025] <Configuration example of anomaly detection system 100a> First, a configuration example of an anomaly detection system 100a according to a first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating an example of the overall configuration of a system including the anomaly detection system 100a.

[0026] (Example of the overall system configuration) Anomaly detection system 100a is a computer system capable of accurately detecting various anomalies that occur in equipment owned by each business operator who is a customer of the provider of anomaly detection service related to anomaly detection system 100a, i.e., a user of anomaly detection system 100a, by using a machine learning model constructed through federated learning, and is realized by multiple computer devices or server devices, each of which has the components described below.

[0027] As shown in FIG. 1, this anomaly detection system 100a is configured to include at least a plurality of anomaly detection devices 20a, 20b, 20c,..., 20n (hereinafter collectively referred to as "anomaly detection device 20" when referred to collectively or when no distinction is made) that are installed within the business locations of each business operator that is a user of the anomaly detection system 100a and detect anomalies that occur in equipment within the business locations, and a central processing unit 10 that is connected to each of the plurality of anomaly detection devices 20 so that they can communicate data with each other via an appropriate communications network such as the Internet or a dedicated line (hereinafter simply referred to as "network 50") and acquires various types of data from each anomaly detection device 20 to perform federated learning.

[0028] The central processing unit 10 and each anomaly detection device 20 are connected to the network 50 by wires via well-known communication devices (not shown), but may be connected wirelessly.

[0029] In addition, various sensor terminals 30a, 30b, 30c...30n (hereinafter collectively referred to as "sensor terminals 30" when referring to them collectively or when no distinction is made) that acquire necessary data from various devices that are the targets of anomaly detection by the anomaly detection device 20 are each connected to each anomaly detection device 20 so as to be able to communicate data via network 50.

[0030] Similarly, computers 40a, 40b, 40c...40n (hereinafter collectively referred to as "computers 40" when referring to them collectively or when no particular distinction is made) included in the above-mentioned equipment are connected to each anomaly detection device 20 so that they can communicate data with each other via network 50.

[0031] Moreover, various storage media (1600, 2600) capable of reading and writing various data are connected to the central processing unit 10 and each of the multiple anomaly detection devices 20 constituting this anomaly detection system 100a.

[0032] In this embodiment, the central processing unit 10 and each anomaly detection device 20 constituting the anomaly detection system 100a are each described as being composed of a single device as shown in Fig. 1. However, for example, the central processing unit 10 and / or each anomaly detection device 20 may be composed of multiple devices.

[0033] In the present embodiment, the central processing unit 10 and the anomaly detection device 20 are described as being separate devices as shown in FIG. 1. However, any one of the multiple anomaly detection devices 20 constituting the anomaly detection system 100a and the central processing unit 10 may be configured as the same device. In this case, for example, any one of the anomaly detection devices 20 may be configured to include a part or all of the functions performed by the central processing unit 10. Also, for example, the central processing unit 10 may be configured to include a part or all of the functions performed by the anomaly detection device 20. Details of the anomaly detection system 100b in this way, in which any one of the anomaly detection devices 20 and the central processing unit 10 are configured as the same device, will be described later as a second embodiment.

[0034] Further, other computer devices, server devices, etc. (hereinafter also referred to as "other devices") may be connected to each of the central processing unit 10 and the multiple anomaly detection devices 20 constituting this anomaly detection system 100a so as to be capable of data communication via a network 50. In this case, the other devices and the network 50 may be connected by wire or wirelessly via well-known communication equipment (not shown).

[0035] (Example of Hardware Configuration of Central Processing Unit 10 and Anomaly Detection Device 20) Next, an example of the hardware configuration of the central processing unit 10 and each of the anomaly detection devices 20 that constitute the anomaly detection system 100a will be described.

[0036] In the first embodiment, the central processing unit 10 and each anomaly detection device 20 constituting the anomaly detection system 100a are each realized by a single general-purpose computer device. The following description will be given on the assumption that the central processing unit 10 and each anomaly detection device 20 are realized by a single general-purpose computer device including one or more processors, one or more storage devices, one or more interface devices, and wired or wireless communication lines (none of which are shown) connecting them.

[0037] That is, the central processing unit 10 and each anomaly detection device 20 have a storage device (not shown) consisting of a main storage device (1201, 2201) and an auxiliary storage device (1202, 2202), an interface device (not shown), and a processor (not shown) connected thereto.

[0038] The auxiliary storage devices (1202, 2202) are auxiliary storage devices made of non-volatile storage elements such as flash memories. Specific examples of the auxiliary storage devices (1202, 2202) include solid state drives (SSDs) and hard disk drives (HDDs). The auxiliary storage devices (1202, 2202) store at least an anomaly detection program. The anomaly detection program is a computer program for implementing functions required for the anomaly detection system 100a.

[0039] That is, the abnormality detection program is executed by the processor, thereby performing various processes described below.

[0040] The anomaly detection program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium. The anomaly detection program may be configured by a device driver, an operating system, various application programs located at higher layers thereof, and a library that provides common functions to these programs. Furthermore, two or more programs may be realized as one anomaly detection program, and one anomaly detection program may be realized as two or more programs.

[0041] The primary storage device (1201, 2201), i.e., the memory, is a primary storage device mainly consisting of volatile memory elements such as RAM (Random Access Memory). This primary storage device (1201, 2201) temporarily stores data representing various information read from the secondary storage device (1202, 2202) and various data acquired from other devices, terminals, etc.

[0042] The processor is a processor device such as a CPU (Central Processing Unit) and various co-processors. This processor calls up an anomaly detection program into a main storage device (1201, 2201) and executes it, thereby controlling the anomaly detection system 100a itself and managing the calculation unit (11, 21) that performs various processes such as calculation processing and judgment processing.

[0043] The interface devices include a communication interface device that connects to the network 50 and communicates with other devices, terminals, etc., and an I / O interface device.

[0044] (Example of functional block of central processing unit 10) Next, an example of various functional blocks included in the central processing unit 10 will be described with reference to Figs. 1 and 2. Fig. 2 is a diagram showing an example of the operation of each functional unit in the anomaly detection system 100a according to the first embodiment. Note that each block described below does not represent a hardware-based configuration, but represents a functional block.

[0045] The central processing unit 10 is configured with the following functional blocks: an arithmetic unit 11, a memory unit (not shown) realized by a main memory unit 1201 and an auxiliary memory unit 1202, a communication unit 13, and a user interface unit (not shown) consisting of an input unit 14 and an output unit 15.

[0046] The calculation unit 11 executes various data processing operations based on the programs and data stored in the storage unit and the data acquired by the communication unit 13. The calculation unit 11 also functions as an interface between the storage unit and the communication unit 13.

[0047] As shown in FIG. 1, the calculation unit 11 has the following functional blocks: a latent variable generation unit 1101, a pseudo data generation unit 1102, and a shared model learning unit 1103.

[0048] The latent variable generation unit 1101 executes a process of randomly setting and generating latent variables D1 of a generation model by random sampling (hereinafter also referred to as a "latent variable generation process"). Details of the latent variable generation process will be described later with reference to FIGS. 2 and 10.

[0049] The pseudo data generating unit 1102 executes a process for generating pseudo data D2 (hereinafter, also referred to as a "pseudo data generating process"). Details of the pseudo data generating process will be described later with reference to FIGS.

[0050] 2, the shared model learning unit 1103 executes a process (hereinafter also referred to as a "shared model learning process") of constructing a conditional latent space model MC (hereinafter also referred to as a "shared model MC") using the device ID of each anomaly detection device 20 as a condition, by supervised learning using the pseudo data D2 as learning data. Details of the shared model learning process will be described later with reference to FIGS. 6 to 8 and 10.

[0051] The calculation unit 11 is configured using a processor, and can realize these functional blocks by executing a predetermined anomaly detection program. Note that instead of a processor, the calculation unit 11 may be configured using a logic circuit such as an FPGA (Field Programmable Gate Array). The calculation unit 11 may also be configured by combining a processor and a logic circuit.

[0052] The memory unit is configured using a memory device, for example, consisting of a main memory device 1201 (memory) and an auxiliary memory device 1202 (persistent memory device), and stores programs that supply various processing instructions to the calculation unit 11, and data representing various information used in the processing executed by the calculation unit 11.

[0053] The storage unit has at least the functional blocks of an initial model database 1300 and a pseudo data database 1400 .

[0054] The initial model database 1300 is a database that stores the initial learning model M acquired from each anomaly detection device 20.

[0055] The pseudo data database 1400 is a database that stores the pseudo data D2 generated by the pseudo data generation process.

[0056] The calculation unit 11 can execute various processes by reading and writing this information in the storage unit.

[0057] The communication unit 13 is responsible for communication processing with each anomaly detection device 20 via the Internet (an example of the network 50). The communication unit 13 is configured using, for example, a network interface card (NIC) or a host bus adapter (HBA).

[0058] The user interface unit (not shown) includes the functional blocks of an input unit 14 and an output unit 15.

[0059] The input unit 14 is responsible for input-related processing such as accepting input operations from the user among the processing related to the user interface. The input unit 14 is configured using, for example, a keyboard, a pointing device, a touch panel, etc., and detects various operations from the user.

[0060] Among the processes related to the user interface, the output unit 15 is responsible for output-related processes such as displaying various screens on a display device, outputting audio, etc. The output unit 15 is configured using, for example, a liquid crystal display, a touch screen, or the like.

[0061] In other words, each component of the central processing unit 10 is realized by hardware including a processor, storage devices such as a main storage device 1201 (memory) and an auxiliary storage device 1202 (persistent storage device), wired or wireless communication lines and interface devices that connect them, and software that is stored in the storage devices and supplies processing instructions to the arithmetic units.

[0062] In this embodiment, the functions of the central processing unit 10 are described as being integrally realized by one computer device. However, these functions may be realized by a plurality of computers or server devices connected to each other. The central processing unit 10 may be configured to include a general-purpose computer device such as a laptop PC and a web browser installed thereon, or may be configured to include a web server and various portable devices.

[0063] Furthermore, the above description of each function is merely an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0064] Furthermore, the central processing unit 10 may have other functions in addition to the various functions described above. For example, the central processing unit 10 may be configured to include some of the various functions of the anomaly detection device 20, as described above.

[0065] (Example of functional block of anomaly detection device 20) Next, an example of various functional blocks included in each anomaly detection device 20 will be described with reference to Figures 1 and 2. Note that each block described below does not represent a hardware-based configuration, but represents a functional block.

[0066] The abnormality detection device 20 is configured with the following functional blocks: a calculation unit 21, a memory unit (not shown) realized by a main memory unit 2201 and an auxiliary memory unit 2202, a communication unit 23, and a user interface unit (not shown) consisting of an input unit 24 and an output unit 25.

[0067] The calculation unit 21 executes various data processing operations based on the programs and data stored in the storage unit and the data acquired by the communication unit 23. The calculation unit 21 also functions as an interface between the storage unit and the communication unit 23.

[0068] As shown in FIG. 1, the calculation unit 21 has the following functional blocks: an initial model learning unit 2101, a device ID generation unit 2102, and an abnormality degree calculation unit 2103.

[0069] The initial model learning unit 2101 executes a process (hereinafter also referred to as an "initial model learning process") of constructing an initial learning model M by supervised learning using data D0 acquired from the system as learning data, as exemplified in Fig. 2. Details of the initial model learning process will be described later with reference to Figs. 3 and 9.

[0070] The device ID generating unit 2102 executes a process (hereinafter also referred to as a "device ID generating process") for generating a device ID for uniquely identifying the anomaly detection device 20. The details of the device ID generating process will be described later with reference to FIGS.

[0071] The anomaly degree calculation unit 2103 executes a process (hereinafter also referred to as an "anomaly degree calculation process") to calculate an anomaly degree D3 for each of the device in which the sensor terminal 30 is installed and the computer 40. The details of the anomaly degree calculation process will be described later with reference to FIG.

[0072] The calculation unit 21 is configured using a processor, and can realize these functional blocks by executing a predetermined anomaly detection program. Note that instead of a processor, the calculation unit 21 may be configured using a logic circuit such as an FPGA (Field Programmable Gate Array). The calculation unit 21 may also be configured by combining a processor and a logic circuit.

[0073] The memory unit is configured using a memory device, for example, consisting of a main memory device 2201 (memory) and an auxiliary memory device 2202 (persistent memory device), and stores programs that supply various processing instructions to the calculation unit 21, and data representing various information used in the processing executed by the calculation unit 21.

[0074] The storage unit has at least the functional blocks of a learning database 2300 and a shared model database 2400.

[0075] The training database 2300 is a database that stores training data D0.

[0076] The shared model database 2400 is a database that stores the shared model MC.

[0077] The calculation unit 21 can execute various processes by reading and writing this information in the storage unit.

[0078] The communication unit 23 is responsible for communication processing with the central processing unit 10, each sensor terminal 30, each computer 40, etc., performed via the Internet (an example of the network 50). The communication unit 23 is configured using, for example, a NIC (Network Interface Card), an HBA (Host Bus Adapter), etc.

[0079] The user interface unit (not shown) includes the functional blocks of an input unit 24 and an output unit 25.

[0080] The input unit 24 is responsible for input-related processing such as accepting input operations from the user among the processing related to the user interface. The input unit 24 is configured using, for example, a keyboard, a pointing device, a touch panel, etc., and detects various operations from the user.

[0081] Among the processes related to the user interface, the output unit 25 is responsible for output-related processes such as displaying various screens on a display device, outputting audio, etc. The output unit 25 is configured using, for example, a liquid crystal display, a touch screen, or the like.

[0082] That is, each component of the anomaly detection device 20 is realized by hardware including a processor, storage devices such as a main storage device 2201 (memory) and an auxiliary storage device 2202 (persistent storage device), wired or wireless communication lines and interface devices that connect them, and software that is stored in the storage devices and supplies processing instructions to the computing unit.

[0083] In this embodiment, the functions of the anomaly detection device 20 have been described as being integrally realized by one computer device. However, these functions may be realized by a plurality of computers or server devices connected to each other. In addition, the anomaly detection device 20 may be configured to include a general-purpose computer device such as a laptop PC and a web browser installed thereon, or may be configured to include a web server and various portable devices.

[0084] Furthermore, the above description of each function is merely an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0085] Furthermore, the anomaly detection device 20 may have other functions in addition to the various functions described above. For example, the anomaly detection device 20 may be configured to include some of the various functions of the central processing unit 10, the sensor terminal 30, and the computer 40 (described in detail later in relation to the second embodiment).

[0086] <Example of Operation of Each Functional Unit in Anomaly Detection System 100a> The anomaly detection system 100a is a system that performs anomaly detection using a machine learning model constructed by federated learning, and by being provided with the above-mentioned configuration, it is possible to achieve high anomaly detection accuracy while sufficiently ensuring data confidentiality. Next, how each of the above-mentioned functional units in the anomaly detection system 100a operates will be described with reference to FIGS.

[0087] (Example of operation of the initial model learning unit 2101) 2, the calculation unit 21 of each anomaly detection device 20 constituting the anomaly detection system 100a acquires data D0 acquired from the system as learning data from the learning database 2300, and executes an initial model learning process by the initial model learning unit 2101. This data D0 is various data representing the state of equipment connected to the anomaly detection device 20.

[0088] The initial learning model M constructed by this initial model learning process is a decoder portion of a conditional generative model including an encoder and a decoder, such as a Conditional Variational AutoEncoder (CVAE) decoder model, as illustrated in FIG. 3. In the encoder-decoder model illustrated in FIG. 3, data D0 acquired from the system becomes a latent variable D1 by the encoder. Then, this latent variable D1 becomes reconstructed data D0R by the initial learning model M, which is a decoder. Learning of the initial learning model M is performed by repeating this process.

[0089] The detailed procedure of the initial model learning process will be described later with reference to FIG.

[0090] The initial learning model M of the anomaly detection device 20 constructed by the initial model learning process is transmitted to the central processing unit 10 via the communication unit 23, as illustrated in Fig. 2. The calculation unit 11 of the central processing unit 10 constituting the anomaly detection system 100a acquires the initial learning model M from each anomaly detection device 20 via the communication unit 13, and stores it in the initial model database 1300.

[0091] Furthermore, as illustrated in FIG. 2, the calculation unit 21 of each anomaly detection device 20 executes a device ID generation process using the device ID generation unit 2102 to generate a device ID for the anomaly detection device 20 and transmits it to the central processing unit 10.

[0092] (Example of operation of the pseudo data generating unit 1102) The calculation unit 11 of the central processing unit 10 acquires the initial learning model M acquired from each anomaly detection device 20 and stored in the initial model database 1300. In the example shown in Fig. 2, the initial learning model M1 acquired from the anomaly detection device 20a, the initial learning model M2 acquired from the anomaly detection device 20b,..., the initial learning model MN acquired from the anomaly detection device 20n are acquired. Then, the calculation unit 11 executes a pseudo data generation process by the pseudo data generation unit 1102 using the acquired initial learning model M for each anomaly detection device 20 and the latent variable D1 generated by the latent variable generation unit 1101.

[0093] 4, in this pseudo data generation process, when a latent variable D1 is input to the initial learning model M of each anomaly detection device 20, which is a decoder, pseudo data D2 corresponding to that anomaly detection device 20 is generated. Each of the generated pseudo data D2 is stored in pseudo data database 1400.

[0094] 5, by generating this pseudo data D2, it is possible to conceal various pieces of information contained in the original data. In the anomaly detection system 100a, the central processing unit 10 does not directly use data representing various pieces of information acquired from each anomaly detection device 20, but executes a shared model learning process using this pseudo data D2 generated from the data, thereby making it possible to sufficiently ensure the confidentiality of the information represented by the data.

[0095] (Example of operation of the shared model learning unit 1103) As illustrated in FIG. 2, the calculation unit 11 of the central processing unit 10 acquires each piece of pseudo data D2 stored in the pseudo data database 1400 as learning data, and executes a shared model learning process by the shared model learning unit 1103.

[0096] The shared model MC constructed by this shared model learning process is a conditional latent space model including an encoder and a decoder, such as a Conditional Variational AutoEncoder (CVAE) decoder model, and conditioned on the device ID of each anomaly detection device 20, as illustrated in FIG. 6. As illustrated in FIG. 6, the pseudo data D2 generated by the pseudo data generating unit 1102 for the anomaly detection device 20 is weighted by the device ID of the anomaly detection device 20, and becomes a combination of the latent variable D1 and the device ID of the anomaly detection device 20 by the encoder. This combination becomes reconstructed data D2R by the decoder. The learning of the shared model MC is performed by repeating this process so that the reconstruction error between the pseudo data D2, which is the input, and the reconstructed data D2R, which is the output, is reduced.

[0097] The detailed procedure of the shared model learning process will be described later with reference to FIG.

[0098] The shared model MC constructed by the shared model learning process is transmitted to each anomaly detection device 20 via the communication unit 13, as illustrated in Fig. 2. The calculation unit 21 of each anomaly detection device 20 acquires the shared model MC from the central processing unit 10 via the communication unit 23, and stores it in the shared model database 2400.

[0099] The calculation unit 21 of each anomaly detection device 20 executes an anomaly degree calculation process, which will be described later, using this shared model MC by the anomaly degree calculation unit 2103. In this anomaly degree calculation process, the data D0 acquired from each system and the device ID of the anomaly detection device 20 are used as inputs to the shared model MC. The shared model MC is constructed using the pseudo data D2 generated by the initial learning model M constructed in the other anomaly detection devices 20 constituting the anomaly detection system 100a, and therefore can calculate the anomaly degree D3 of the device with high accuracy compared to a Conditional Variational AutoEncoder (CVAE) decoder model constructed exclusively within one anomaly detection device. This allows the anomaly detection system 100a to calculate the anomaly degree D3 of each device with high accuracy in each anomaly detection device 20.

[0100] 7 and 8, the anomaly detection system 100a can cause the shared model MC to learn different weights for each anomaly detection device 20 in the shared model learning process by adding the device ID of each anomaly detection device 20 as an input. As a result, the constructed shared model MC can appropriately assign different weights to each anomaly detection device 20, and therefore can calculate the anomaly degree D3 of the equipment with high accuracy in the anomaly degree calculation process executed in each anomaly detection device 20.

[0101] When the abnormality degree D3 of a device calculated as a result of the abnormality degree calculation process exceeds a predetermined threshold value, the calculation unit 21 of each abnormality detection device 20 determines that the state of the device is abnormal.

[0102] In this manner, the anomaly detection system 100a can detect various anomalies occurring in devices with high accuracy.

[0103] <Processing flow example> Next, each of the above-mentioned processes executed in the anomaly detection system 100a will be described with reference to FIGS.

[0104] (Initial model learning process) 9 is a flowchart 900 showing an example of the flow of the initial model learning process. As described above, this initial model learning process is a process executed in each anomaly detection device 20 constituting the anomaly detection system 100a to construct the initial learning model M during learning of the anomaly detection system 100a.

[0105] In step S101, the calculation unit 21 of each anomaly detection device 20 executes a process of acquiring input data D0 from the system by the initial model learning unit 2101. As a result, the input data D0 is acquired from the system in each anomaly detection device 20. When the calculation unit 21 of each anomaly detection device 20 completes the process in step S101, the calculation unit 21 proceeds to step S102.

[0106] In step S102, the calculation unit 21 of each anomaly detection device 20 executes a device ID generation process using the device ID generation unit 2102. As a result, a device ID that uniquely identifies each anomaly detection device 20 is created in each anomaly detection device 20. When the process in step S102 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S103.

[0107] In step S103, the calculation unit 21 of each anomaly detection device 20 executes a process of converting the feature quantities of the input data D0 acquired in step S101 by the initial model learning unit 2101. As a result, the feature quantities of the input data D0 are converted in each anomaly detection device 20. When the process in step S103 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S104.

[0108] In step S104, the calculation unit 21 of each anomaly detection device 20 executes a process in which the initial model learning unit 2101 stores the input data D0 whose features have been converted in step S103 in the learning database 2300. As a result, in each anomaly detection device 20, the input data D0 after the feature conversion is stored in the learning database 2300. When the process in step S104 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S105.

[0109] In step S105, the calculation unit 21 of each anomaly detection device 20 executes a process of calculating a loss by the initial model learning unit 2101. As a result, a loss is calculated in each anomaly detection device 20. When the calculation unit 21 of each anomaly detection device 20 completes the process in step S105, the process proceeds to step S106.

[0110] In step S106, the calculation unit 21 of each anomaly detection device 20 executes a process of determining whether the convergence condition is satisfied and whether C1 is greater than ThC by the initial model learning unit 2101. If it is determined in step S106 that the convergence condition is not satisfied or that C1 is not greater than ThC (step S106: NO), the process proceeds to step S107 to update the parameters of the initial learning model M. On the other hand, if it is determined in step S106 that the convergence condition is satisfied and that C1 is greater than ThC (step S106: YES), the process proceeds to step S110 to save the parameters of the initial learning model M.

[0111] In step S107, the calculation unit 21 of each anomaly detection device 20 executes a process of updating the parameters of the initial learning model M by the initial model learning unit 2101. As a result, the parameters of the initial learning model M are updated in each anomaly detection device 20. When the process in step S107 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S108.

[0112] In step S108, the calculation unit 21 of each anomaly detection device 20 executes a process of calculating a convergence condition by the initial model learning unit 2101. As a result, the convergence condition is calculated in each anomaly detection device 20. When the calculation unit 21 of each anomaly detection device 20 completes the process in step S108, the process proceeds to step S109.

[0113] In step S109, the calculation unit 21 of each anomaly detection device 20 executes a process of adding 1 to the value of C1 by the initial model learning unit 2101. As a result, 1 is added to the value of C1 in each anomaly detection device 20. When the process in step S109 is completed, the calculation unit 21 of each anomaly detection device 20 returns to step S106 again.

[0114] In step S110, the calculation unit 21 of each anomaly detection device 20 executes a process of saving the parameters of the initial learning model M by the initial model learning unit 2101. As a result, the parameters of the initial learning model M are saved in each anomaly detection device 20. When the calculation unit 21 of each anomaly detection device 20 completes the process in step S110, the process proceeds to step S111.

[0115] In step S111, the calculation unit 21 of each anomaly detection device 20 executes a process of transmitting the initial learning model M, which is a decoder, and the device ID, by the initial model learning unit 2101. As a result, the initial learning model M, which is a decoder, and the device ID are transmitted in each anomaly detection device 20. Upon completing the process in step S111, the calculation unit 21 of each anomaly detection device 20 ends the initial model learning process shown in the flowchart 900 in FIG. 9.

[0116] (Shared model learning process) 10 is a flowchart 1000 showing an example of the flow of the shared model learning process. As described above, this shared model learning process is a process executed in the central processing unit 10 constituting the anomaly detection system 100a to construct the shared model MC during learning of the anomaly detection system 100a.

[0117] In step S201, the calculation unit 11 of the central processing unit 10 executes a process of acquiring an initial learning model M and a device ID from each anomaly detection device 20 by the shared model learning unit 1103. As a result, the initial learning model M and the device ID are acquired from each anomaly detection device 20. When the calculation unit 11 of the central processing unit 10 completes the process in step S201, the process proceeds to step S202.

[0118] In step S202, the calculation unit 11 of the central processing unit 10 executes a process in which the shared model learning unit 1103 stores the initial learning model M and device ID of each anomaly detection device 20 acquired in step S201 in the initial model database 1300. As a result, the initial learning model M and device ID of each anomaly detection device 20 acquired in step S201 are stored in the initial model database 1300. When the processing in step S202 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S203.

[0119] In step S203, the calculation unit 11 of the central processing unit 10 executes a process of generating a latent variable D1 by the latent variable generation unit 1101. As a result, the latent variable D1 is generated in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S203, the process proceeds to step S204.

[0120] In step S204, the calculation unit 11 of the central processing unit 10 executes a process of generating pseudo data D2 for each anomaly detection device 20 by the pseudo data generation unit 1102. As a result, the central processing unit 10 generates pseudo data D2 for each anomaly detection device 20. When the process in step S204 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S205.

[0121] In step S205, the calculation unit 11 of the central processing unit 10 executes a process in which the simulated data generating unit 1102 stores the simulated data D2 generated in step S204 in the simulated data database 1400. As a result, the simulated data D2 is stored in the simulated data database 1400. When the process in step S205 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S206.

[0122] In step S206, the calculation unit 11 of the central processing unit 10 executes a process of calculating the loss by the shared model learning unit 1103. In the anomaly detection system 100a, this loss calculation process is performed by a Conditional Variational AutoEncoder (CVAE) decoder model. This causes the loss to be calculated. When the process in step S206 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S106.

[0123] In step S106, the calculation unit 11 of the central processing unit 10 executes a process of determining whether the convergence condition is satisfied and whether C1 is greater than ThC by the shared model learning unit 1103. If it is determined in step S106 that the convergence condition is not satisfied or that C1 is not greater than ThC (step S106: NO), the process proceeds to step S107 to update the parameters of the shared model MC. On the other hand, if it is determined in step S106 that the convergence condition is satisfied and that C1 is greater than ThC (step S106: YES), the process proceeds to step S110 to save the parameters of the shared model MC.

[0124] In step S107, the calculation unit 11 of the central processing unit 10 executes a process of updating the parameters of the shared model MC by the shared model learning unit 1103. As a result, the parameters of the shared model MC are updated in the central processing unit 10. When the process in step S107 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S108.

[0125] In step S108, the calculation unit 11 of the central processing unit 10 executes a process of calculating a convergence condition by the shared model learning unit 1103. As a result, the convergence condition is calculated in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S108, the process proceeds to step S109.

[0126] In step S109, the calculation unit 11 of the central processing unit 10 executes a process of adding 1 to the value of C1 by the shared model learning unit 1103. As a result, the value of C1 is added by 1 in the central processing unit 10. When the process in step S109 is completed, the calculation unit 11 of the central processing unit 10 returns to step S106 again.

[0127] In step S110, the calculation unit 11 of the central processing unit 10 executes a process of saving the parameters of the shared model MC by the shared model learning unit 1103. As a result, the parameters of the shared model MC are saved in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S110, the process proceeds to step S111.

[0128] In step S207, the calculation unit 11 of the central processing unit 10 executes a process of transmitting, by the shared model learning unit 1103, the shared model MC whose parameters have been saved in step S110 to each anomaly detection device 20. As a result, the shared model MC is transmitted from the central processing unit 10 to each anomaly detection device 20. Upon completing the process in step S207, the calculation unit 11 of the central processing unit 10 ends the shared model learning process shown in the flowchart 1000 in FIG. 10.

[0129] (Abnormality calculation process) 11 is a flowchart 1100 showing an example of the flow of the anomaly degree calculation process. As described above, this anomaly degree calculation process is executed in each anomaly detection device 20 constituting the anomaly detection system 100a to calculate the anomaly degree D3 of an equipment by using the shared model MC, during operation of the anomaly detection system 100a.

[0130] In step S301, the calculation unit 21 of each anomaly detection device 20 executes a process of acquiring the shared model MC from the central processing unit 10 via the communication unit 23. As a result, in each anomaly detection device 20, the shared model MC is acquired from the central processing unit 10. When the process in step S301 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S302.

[0131] In step S302, the calculation unit 21 of each anomaly detection device 20 executes a process of storing the shared model MC acquired in step S301 in the shared model database 2400. As a result, in each anomaly detection device 20, the shared model MC is stored in the shared model database 2400. When the process in step S302 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S101.

[0132] In step S101, the calculation unit 21 of each anomaly detection device 20 executes a process of acquiring input data D0. As a result, the input data D0 is acquired in each anomaly detection device 20. When the process in step S101 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S303.

[0133] In step S303, the calculation unit 21 of each anomaly detection device 20 executes a process of calculating the anomaly degree D3 of the device by the anomaly degree calculation unit 2103. As a result, the anomaly degree D3 of the device is calculated in each anomaly detection device 20. Upon completing the process in step S303, the calculation unit 21 of each anomaly detection device 20 ends the anomaly degree calculation process shown in the flowchart 1100 in FIG.

[0134] The anomaly detection system 100a according to the first embodiment has been described above. EXAMPLES

[0135] Next, an anomaly detection system 100b according to Example 2 will be described. As described above, the anomaly detection system 100a according to Example 1 is composed of a central processing unit 10 and a plurality of anomaly detection devices 20. In contrast, the anomaly detection system 100b does not include a central processing unit 10, and is configured as a system in which one or more of the plurality of anomaly detection devices 20 also have the functions of the central processing unit 10.

[0136] Therefore, the following description of the second embodiment will focus only on differences in configuration, functions, effects, etc. from the first embodiment, and descriptions of common configurations, functions, effects, etc. with the first embodiment will be omitted.

[0137] <Configuration example of anomaly detection system 100b> First, a configuration example of an anomaly detection system 100b according to a second embodiment will be described with reference to Fig. 12. Fig. 12 is a diagram illustrating an example of the operation of each functional unit in the anomaly detection system 100b.

[0138] As illustrated in FIG. 12, of the multiple anomaly detection devices 20 constituting the anomaly detection system 100b, the calculation unit 21 of the anomaly detection device 20 which also serves the role of the central processing unit 10 has, in addition to an initial model learning unit 2101, a device ID generation unit 2102, and an anomaly degree calculation unit 2103, the functional blocks of a latent variable generation unit 1101, a pseudo data generation unit 1102, and a device's own model learning unit 2105.

[0139] 12, the own device model learning unit 2105 executes a process (hereinafter also referred to as an "own device model learning process") of constructing a conditional latent space model MC (hereinafter also referred to as an "own device model MC") using the device IDs of the anomaly detection device 20 and other anomaly detection devices 20 as conditions through supervised learning using the pseudo data D2 as learning data. Details of the own device model learning process will be described later with reference to FIG. 13.

[0140] That is, the own device model learning unit 2105 corresponds to the shared model learning unit 1103 included in the central processing unit 10 in the first embodiment. Also, the own device model MC is substantially equivalent to the shared model MC in the first embodiment.

[0141] Moreover, as illustrated in FIG. 12, of the multiple anomaly detection devices 20 constituting the anomaly detection system 100b, the memory unit of the anomaly detection device 20 that also serves as the central processing unit 10 has, in addition to the learning database 2300 and the device's own model database 2500, the functional blocks of an initial model database 1300 and a pseudo data database 1400.

[0142] The own device model database 2500 is a database that stores the own device model MC. That is, the own device model database 2500 corresponds to the shared model database 2400 included in each anomaly detection device 20 in the first embodiment.

[0143] Moreover, among the multiple anomaly detection devices 20 constituting the anomaly detection system 100b, the other anomaly detection devices 20 are equivalent to the anomaly detection device 20 in the first embodiment.

[0144] <Processing flow example> Next, each process executed by the anomaly detection system 100b will be described with reference to FIGS.

[0145] (Self-device model learning process) 13 is a flowchart 1300 showing an example of the flow of the own-apparatus model learning process. As described above, the own-apparatus model learning process is a process executed in anomaly detection device 20 constituting anomaly detection system 100b to construct an own-apparatus model MC during learning of the anomaly detection system 100b.

[0146] In step S401, calculation unit 21 of anomaly detection device 20 executes a process of acquiring own device data D0, which is raw input data from the system in anomaly detection device 20, from learning database 2300 by own device model learning unit 2105. As a result, in anomaly detection device 20, the own device data D0 is acquired from learning database 2300. When the process in step S401 is completed, calculation unit 21 of anomaly detection device 20 proceeds to step S201.

[0147] In step S201, the calculation unit 21 of the anomaly detection device 20 executes a process of acquiring an initial learning model M and a device ID from each of the other anomaly detection devices 20, using the local device model learning unit 2105. As a result, the initial learning model M and the device ID are acquired from each of the other anomaly detection devices 20. When the process in step S201 is completed, the calculation unit 21 of the anomaly detection device 20 proceeds to step S202.

[0148] In step S202, the calculation unit 21 of the anomaly detection device 20 executes a process of storing, by the own device model learning unit 2105, the initial learning model M and the device ID of the other anomaly detection device 20 acquired in step S201 in the initial model database 1300. As a result, the initial learning model M and the device ID of the other anomaly detection device 20 acquired in step S201 are each stored in the initial model database 1300. When the processing in step S202 is completed, the calculation unit 21 of the anomaly detection device 20 proceeds to step S203.

[0149] In step S203, the calculation unit 21 of the anomaly detection device 20 executes a process of generating a latent variable D1 by the latent variable generation unit 1101. As a result, the latent variable D1 is generated in the central processing unit 10. When the calculation unit 21 of the anomaly detection device 20 completes the process in step S203, the process proceeds to step S204.

[0150] In step S204, the calculation unit 21 of the anomaly detection device 20 executes a process of generating pseudo data D2 for each anomaly detection device 20 by the pseudo data generation unit 1102. As a result, the central processing unit 10 generates pseudo data D2 for each anomaly detection device 20. When the process in step S204 is completed, the calculation unit 21 of the anomaly detection device 20 proceeds to step S205.

[0151] In step S205, calculation unit 21 of anomaly detection device 20 executes a process in which pseudo data generation unit 1102 stores pseudo data D2 generated in step S204 in pseudo data database 1400. As a result, the pseudo data D2 is stored in pseudo data database 1400. When calculation unit 21 of anomaly detection device 20 completes the process in step S205, it proceeds to step S206.

[0152] In step S206, the calculation unit 21 of the anomaly detection device 20 executes a process of calculating a loss by the local device model learning unit 2105. In the anomaly detection system 100b, this loss calculation process is performed by a Conditional Variational AutoEncoder (CVAE). This causes the loss to be calculated. When the calculation unit 21 of the anomaly detection device 20 completes the process in step S206, it proceeds to step S106.

[0153] In step S106, the calculation unit 21 of the anomaly detection device 20 executes a process of determining whether the convergence condition is satisfied and whether C1 is greater than ThC by the own device model learning unit 2105. If it is determined in step S106 that the convergence condition is not satisfied or that C1 is not greater than ThC (step S106: NO), the process proceeds to step S107 to update the parameters of the own device model MC. On the other hand, if it is determined in step S106 that the convergence condition is satisfied and that C1 is greater than ThC (step S106: YES), the process proceeds to step S110 to save the parameters of the own device model MC.

[0154] In step S107, calculation unit 21 of anomaly detection device 20 executes processing to update the parameters of the own apparatus model MC by own apparatus model learning unit 2105. As a result, the parameters of the own apparatus model MC are updated in anomaly detection device 20. When calculation unit 21 of anomaly detection device 20 completes the processing in step S107, it proceeds to step S108.

[0155] In step S108, calculation unit 21 of anomaly detection device 20 executes a process of calculating a convergence condition by means of local device model learning unit 2105. As a result, the convergence condition is calculated in anomaly detection device 20. When calculation unit 21 of anomaly detection device 20 completes the process in step S108, it proceeds to step S109.

[0156] In step S109, calculation unit 21 of anomaly detection device 20 executes a process of adding 1 to the value of C1 by means of local device model learning unit 2105. As a result, 1 is added to the value of C1 in anomaly detection device 20. When the process in step S109 is completed, calculation unit 21 of anomaly detection device 20 returns to step S106 again.

[0157] In step S110, calculation unit 21 of anomaly detection device 20 executes a process of saving the parameters of the own apparatus model MC by own apparatus model learning unit 2105. As a result, the parameters of the own apparatus model MC are saved in anomaly detection device 20. When calculation unit 21 of anomaly detection device 20 completes the process in step S110, it proceeds to step S111.

[0158] In step S402, the calculation unit 21 of the anomaly detection device 20 executes a process of storing, by the own apparatus model learning unit 2105, the own apparatus model MC whose parameters have been stored in step S110, in the own apparatus model database 2500. As a result, the own apparatus model MC is stored in the own apparatus model database 2500. Upon completing the process in step S402, the calculation unit 21 of the anomaly detection device 20 ends the own apparatus model learning process shown in the flowchart 1300 in FIG.

[0159] (Abnormality calculation process) 14 is a flowchart 1400 showing an example of the flow of the anomaly detection degree calculation process. As described above, this anomaly degree calculation process is executed in the anomaly detection device 20 constituting the anomaly detection system 100b to calculate the anomaly degree D3 of the device by using the own device model MC during operation of the anomaly detection system 100b.

[0160] In step S501, the calculation unit 21 of the anomaly detection device 20 executes a process of acquiring a local apparatus model MC. As a result, the local apparatus model MC is acquired in the anomaly detection device 20. When the calculation unit 21 of the anomaly detection device 20 completes the process in step S501, the calculation unit 21 proceeds to step S101.

[0161] In step S101, the calculation unit 21 of the anomaly detection device 20 executes a process to acquire input data D0. As a result, the input data D0 is acquired in the anomaly detection device 20. Note that in the other anomaly detection devices 20, the same process is executed as illustrated in step S101 of Fig. 11. When the process in step S101 is completed, the calculation unit 21 of the anomaly detection device 20 proceeds to step S303.

[0162] In step S303, the calculation unit 21 of the anomaly detection device 20 executes a process of calculating the anomaly degree D3 of the device by the anomaly degree calculation unit 2103. As a result, the anomaly degree D3 of the device is calculated in the anomaly detection device 20. Note that in the other anomaly detection devices 20, the same process is executed as illustrated in step S303 in Fig. 11. When the process in step S303 is completed, the calculation unit 21 of the anomaly detection device 20 ends the anomaly degree calculation process shown in the flowchart 1400 in Fig. 14.

[0163] 15, in the anomaly detection system 100b, all learning processes are performed in the anomaly detection device 20 that also serves as the central processing unit 10, so that in addition to the pseudo data D2 of other anomaly detection devices 20, the own device data D0 that is raw input data in the anomaly detection device 20 can be used for learning to construct the own device model MC. Therefore, in the anomaly detection system 100b, the accuracy of calculating the degree of anomaly D3 of the equipment in the anomaly detection device 20 that also serves as the central processing unit 10 can be improved.

[0164] The anomaly detection system 100b according to the second embodiment has been described above. EXAMPLES

[0165] Next, a description will be given of an anomaly detection system 100c according to a third embodiment. The anomaly detection system 100c is configured as a system in which a grouping unit 1104 is further added to the central processing unit 10 constituting the anomaly detection system 100a according to the first embodiment.

[0166] Therefore, the following description of the third embodiment will focus only on the differences in configuration, functions, effects, etc. from the first embodiment, and will omit descriptions of the common configuration, functions, effects, etc. with the first embodiment.

[0167] <Configuration example of anomaly detection system 100c> First, a configuration example of an anomaly detection system 100c according to a third embodiment will be described with reference to Fig. 16. Fig. 16 is a diagram illustrating an example of the operation of each functional unit in the anomaly detection system 100c.

[0168] As illustrated in FIG. 16, the calculation unit 11 of the central processing unit 10 constituting the anomaly detection system 100c further includes a grouping unit 1104 as a functional block.

[0169] 12, the grouping unit 1104 executes processing for grouping the pseudo data D2 for each anomaly detection device 20 by device characteristics and model number. The grouping of the anomaly detection devices 20 is performed by generating a group ID, which serves as a condition in the shared model learning processing, for each feature of the anomaly detection device 20 and assigning the same group ID to anomaly detection devices 20 having similar features.

[0170] Other configurations of the central processing unit 10 and the configurations of each anomaly detection device 20 constituting the anomaly detection system 100c are the same as those of the central processing unit 10 and the anomaly detection device 20 in the first embodiment.

[0171] <Processing flow example> Next, each process executed by the anomaly detection system 100c will be described with reference to FIGS.

[0172] (Shared model learning process) 17 is a flowchart 1700 showing an example of the flow of the shared model learning process. As described above, this shared model learning process is a process executed in the central processing unit 10 constituting the anomaly detection system 100c to construct the shared model MC during learning of the anomaly detection system 100c.

[0173] In step S201, the calculation unit 11 of the central processing unit 10 executes a process of acquiring an initial learning model M and a device ID from each anomaly detection device 20 by the shared model learning unit 1103. As a result, the initial learning model M and the device ID are acquired from each anomaly detection device 20. When the calculation unit 11 of the central processing unit 10 completes the process in step S201, the process proceeds to step S202.

[0174] In step S202, the calculation unit 11 of the central processing unit 10 executes a process in which the shared model learning unit 1103 stores the initial learning model M and device ID of each anomaly detection device 20 acquired in step S201 in the initial model database 1300. As a result, the initial learning model M and device ID of each anomaly detection device 20 acquired in step S201 are stored in the initial model database 1300. When the processing in step S202 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S203.

[0175] In step S203, the calculation unit 11 of the central processing unit 10 executes a process of generating a latent variable D1 by the latent variable generation unit 1101. As a result, the latent variable D1 is generated in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S203, the process proceeds to step S204.

[0176] In step S204, the calculation unit 11 of the central processing unit 10 executes a process of generating pseudo data D2 for each anomaly detection device 20 by the pseudo data generation unit 1102. As a result, the central processing unit 10 generates pseudo data D2 for each anomaly detection device 20. When the process in step S204 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S205.

[0177] In step S205, the calculation unit 11 of the central processing unit 10 executes a process in which the simulated data generation unit 1102 stores the simulated data D2 generated in step S204 in the simulated data database 1400. As a result, the simulated data D2 is stored in the simulated data database 1400. When the process in step S205 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S501.

[0178] In step S501, the calculation unit 11 of the central processing unit 10 executes a process of grouping the pseudo data D2 stored in the pseudo data database 1400 in step S205 by the grouping unit 1104. This causes the pseudo data D2 to be grouped. When the process in step S501 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S206.

[0179] In step S206, the calculation unit 11 of the central processing unit 10 executes a process of calculating a loss by the shared model learning unit 1103. In the anomaly detection system 100c, this process is performed by a conditional variational autoencoder (CVAE). This causes the loss to be calculated. When the calculation unit 11 of the central processing unit 10 completes the process in step S206, the process proceeds to step S106.

[0180] In step S106, the calculation unit 11 of the central processing unit 10 executes a process of determining whether the convergence condition is satisfied and whether C1 is greater than ThC by the shared model learning unit 1103. If it is determined in step S106 that the convergence condition is not satisfied or that C1 is not greater than ThC (step S106: NO), the process proceeds to step S107 to update the parameters of the machine learning model. On the other hand, if it is determined in step S106 that the convergence condition is satisfied and that C1 is greater than ThC (step S106: YES), the process proceeds to step S110 to save the parameters of the machine learning model.

[0181] In step S107, the calculation unit 11 of the central processing unit 10 executes a process of updating the parameters of the shared model MC by the shared model learning unit 1103. As a result, the parameters of the shared model MC are updated in the central processing unit 10. When the process in step S107 is completed, the calculation unit 11 of the central processing unit 10 proceeds to step S108.

[0182] In step S108, the calculation unit 11 of the central processing unit 10 executes a process of calculating a convergence condition by the shared model learning unit 1103. As a result, the convergence condition is calculated in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S108, the process proceeds to step S109.

[0183] In step S109, the calculation unit 11 of the central processing unit 10 executes a process of adding 1 to the value of C1 by the shared model learning unit 1103. As a result, the value of C1 is added by 1 in the central processing unit 10. When the process in step S109 is completed, the calculation unit 11 of the central processing unit 10 returns to step S106 again.

[0184] In step S110, the calculation unit 11 of the central processing unit 10 executes a process of saving the parameters of the shared model MC by the shared model learning unit 1103. As a result, the parameters of the shared model MC are saved in the central processing unit 10. When the calculation unit 11 of the central processing unit 10 completes the process in step S110, the process proceeds to step S111.

[0185] In step S207, the calculation unit 11 of the central processing unit 10 executes a process of transmitting, by the shared model learning unit 1103, the shared model MC whose parameters have been saved in step S110 to each anomaly detection device 20. As a result, the shared model MC is transmitted from the central processing unit 10 to each anomaly detection device 20. Upon completing the process in step S207, the calculation unit 11 of the central processing unit 10 ends the shared model learning process shown in the flowchart 1700 of FIG. 17.

[0186] (Abnormality calculation process) Fig. 18 is a flowchart 1800 showing an example of the flow of an anomaly degree calculation process. As described above, this anomaly degree calculation process is executed in each anomaly detection device 20 constituting the anomaly detection system 100c to calculate the anomaly degree D3 of an equipment by using the shared model MC, and is a process performed during operation of the anomaly detection system 100c. Note that each process in the flowchart 1800 illustrated in Fig. 18 is equivalent to each process in the flowchart 1100 illustrated in Fig. 11.

[0187] In step S301, the calculation unit 21 of each anomaly detection device 20 executes a process of acquiring the shared model MC from the central processing unit 10 via the communication unit 23. As a result, in each anomaly detection device 20, the shared model MC is acquired from the central processing unit 10. When the process in step S301 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S302.

[0188] In step S302, the calculation unit 21 of each anomaly detection device 20 executes a process of storing the shared model MC acquired in step S301 in the shared model database 2400. As a result, in each anomaly detection device 20, the shared model MC is stored in the shared model database 2400. When the process in step S302 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S101.

[0189] In step S101, the calculation unit 21 of each anomaly detection device 20 executes a process of acquiring input data D0. As a result, the input data D0 is acquired in each anomaly detection device 20. When the process in step S101 is completed, the calculation unit 21 of each anomaly detection device 20 proceeds to step S303.

[0190] In step S303, the calculation unit 21 of each anomaly detection device 20 executes a process of calculating the anomaly degree D3 of each device using the anomaly degree calculation unit 16. This causes the anomaly degree D3 of each device to be calculated in each anomaly detection device 20. Upon completing the process in step S303, the calculation unit 21 of each anomaly detection device 20 ends the anomaly degree calculation process shown in the flowchart 1800 of FIG.

[0191] In this way, in the anomaly detection system 100c, by using the group ID as a condition in the shared model learning process, it is possible to collectively learn data on anomaly detection devices 20 having similar characteristics, as illustrated in Fig. 19. Therefore, in the anomaly detection system 100c, by using the shared model MC constructed in this way to calculate the degree of anomaly D3 of the equipment in each anomaly detection device 20, it is possible to robustly calculate the degree of anomaly D3 of the equipment.

[0192] The above-described embodiment of the present invention can be summarized as follows.

[0193] (1) The anomaly detection system (100a, 100b, 100c) is a system that detects anomalies in equipment using a machine learning model constructed by federated learning, and includes a plurality of computers (10, 20) each having at least a processor and a storage device, an initial model learning unit 2101 that constructs an initial learning model M based on input data D0, a device ID generation unit 2102 that generates a device ID that uniquely identifies each computer (20), a latent variable generation unit 1101 that generates a latent variable D1 to be input to the model, a pseudo data generation unit 1102 that generates pseudo data D2 for each of the plurality of computers 20, and a shared model learning unit 1103 that constructs a shared model MC, which is a conditional generative model, based on the pseudo data D2, and the plurality of computers (10, 20) includes a plurality of anomaly detection devices 20 that detect anomalies in the equipment by calculating an anomaly degree D3 of the equipment from the input data D0. As a result, the anomaly detection systems (100a, 100b, 100c) can model the normal space of each anomaly detection device 20 more accurately (improved anomaly detection accuracy) by learning a conditional generative model using the device ID as a condition. Furthermore, in the anomaly detection systems (100a, 100b, 100c), each anomaly detection device 20 transmits only the model to the central processing unit 10, so data can be kept secret between the anomaly detection devices (ensuring confidentiality). As a result, the anomaly detection systems (100a, 100b, 100c) can achieve both sufficient data confidentiality and high anomaly detection accuracy in a system using federated learning.

[0194] (2) The multiple computers further include a central processing unit 10 that constructs a shared model MC based on an initial learning model M obtained from each of the multiple anomaly detection devices 20, and each of the multiple anomaly detection devices 20 has an initial model learning unit 2101, a device ID generation unit 2102, and an anomaly degree calculation unit 2103, and the central processing unit has a pseudo data generation unit 1102 and a shared model learning unit 1103.

[0195] (3) The shared model MC is constructed by conditioning learning using the pseudo data D2 and the device ID as conditions.

[0196] (4) The central processing unit 10 further includes a grouping unit 1104 that groups a plurality of anomaly detection devices 20, and the shared model MC is constructed by conditioning learning using the group ID generated by the grouping unit 1104 as a condition.

[0197] (5) At least one of the computers (10, 20) further includes an output unit (13, 23) that outputs a GUI that enables input or selection of the device ID and / or the pseudo data D2 to a display device.

[0198] (6) At least one of the plurality of computers (10, 20) includes a pseudo data database 1400 that stores the pseudo data D2.

[0199] The present invention is not limited to the above-described embodiment, and can be implemented using any components without departing from the spirit of the present invention.

[0200] The above-mentioned embodiments, examples, and modifications are merely examples, and the present invention is not limited to these contents as long as the characteristics of the invention are not impaired. In addition, although various embodiments, examples, and modifications have been described above, the present invention is not limited to these contents. Other aspects that are conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention.

[0201] In the above figures, the control lines and information lines are shown as those considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the actual implementation. For example, it may be considered that almost all the components are actually connected to each other.

[0202] The above-described arrangement of the functional units of the anomaly detection systems (100a, 100b, 100c) is merely an example. The arrangement of the functional units can be changed to an optimal arrangement in terms of the performance, processing efficiency, communication efficiency, and the like of the hardware and software included in the anomaly detection systems (100a, 100b, 100c). [Explanation of symbols]

[0203] 100: Anomaly detection system

Claims

1. An anomaly detection system that detects anomalies in equipment using a machine learning model constructed by federated learning, A plurality of computers each having at least a processor and a storage device, An initial model learning unit that constructs an initial learning model based on input data; a device ID generating unit that generates a device ID that uniquely identifies each computer; A latent variable generation unit that generates latent variables to be input into the model; a pseudo data generating unit that generates pseudo data for each of the plurality of computers; a shared model learning unit that constructs a shared model, which is a conditional generative model, based on the pseudo data; Equipped with The plurality of computers include a plurality of anomaly detection devices that detect an anomaly in the device by calculating an anomaly degree of the device from the input data. Anomaly detection system.

2. The plurality of computers further includes a central processing unit that constructs the shared model based on an initial learning model acquired from each of the plurality of anomaly detection devices; Each of the plurality of anomaly detection devices includes the initial model learning unit, the device ID generation unit, and the anomaly degree calculation unit, The central processing unit has the pseudo data generation unit and the shared model learning unit. The anomaly detection system according to claim 1 .

3. The anomaly detection system according to claim 1 , wherein the shared model is constructed by conditioning learning using the pseudo data and the device ID as conditions.

4. The central processing unit further includes a grouping unit that groups the plurality of anomaly detection devices, The anomaly detection system according to claim 2 , wherein the shared model is constructed by conditioning learning using the group ID generated by the grouping unit as a condition.

5. The anomaly detection system according to claim 1 , wherein at least one of the plurality of computers further comprises an output unit that outputs to a display device a GUI that enables input or selection operations for the device ID and / or the pseudo data.

6. The anomaly detection system according to claim 1 , wherein at least one of the plurality of computers includes a pseudo data database that stores the pseudo data.

7. An anomaly detection method for detecting an anomaly in an equipment using a machine learning model constructed by federated learning, comprising: A plurality of computers each having at least a processor and a storage device, An initial learning model is constructed based on the input data, generating a device ID that uniquely identifies each computer; Generate latent variables to be input into the model, generating simulated data for each of the plurality of computers; A shared model is constructed based on the pseudo data, which is a conditional generative model; The plurality of computers include a plurality of anomaly detection devices that detect an anomaly in the device by calculating an anomaly degree of the device from the input data. Anomaly detection methods.

Images