Abnormality determination device and abnormality determination program

Abstract

To provide an abnormality determination device that improves reliability of input data by appropriately notifying a party concerned when a human error or a malicious falsification or tampering in data input is suspected.SOLUTION: An abnormality determination device, which determines an abnormality in data input to a computer, includes: a trained model management unit that manages a trained model related to a procedure or contents of an operation in the computer; an abnormality determination unit that determines, on the basis of the trained model, the abnormality in the operation of the computer; and an output unit that outputs a determination result from the abnormality determination unit.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to an abnormality determination device and an abnormality determination program for determining abnormalities in input data.

Background Art

[0002] In the fields of research and development and manufacturing, it is common to perform product inspections and import the inspection results into computers at the site, such as research institutes and factories, by various means. The imported inspection results are transferred to, for example, a server separate from the on-site computer for further inspections, analyses, production management, etc., and stored and managed. There is also a known technique for detecting whether there are errors in the imported inspection data in the on-site computer server and, when an abnormality is recognized, notifying this to prompt inspection and re-entry (see, for example, Patent Document 1).

[0003] As a measure to improve the reliability of inspection data, for example, the introduction and spread of various DX technologies are also being promoted. However, as long as there is human intervention, it is difficult to completely eliminate so-called human errors (typing mistakes, copying mistakes, etc.) and malicious forgery and tampering.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In order to solve such problems, an object of the present invention is to improve the reliability of input data by appropriately notifying relevant persons when human errors or malicious forgery and tampering in data input are suspected.

Means for Solving the Problems

[0006] The abnormality determination device according to the present invention is an abnormality determination device that determines the abnormality of data input to a computer, and includes a learned model management unit that manages a learned model related to the procedure or content of operations in the computer, an abnormality determination unit that determines the abnormality of operations in the computer based on the learned model, and an output unit that outputs the determination result in the abnormality determination unit.

[0007] Further, the abnormality determination program according to the present invention is an abnormality determination program that determines the abnormality of data input to a computer, and is configured to enable a computer to execute a step of managing a learned model related to an operation in the computer, a step of determining the abnormality of the operation based on the learned model, and a step of outputting the result of the determination of the abnormality of the operation to an output unit.

Effects of the Invention

[0008] According to the present invention, when human error in data input or malicious forgery / alteration is suspected, it can be appropriately notified to relevant parties as abnormality information, thereby improving the reliability of input data. In addition, by appropriately notifying abnormality information, it is possible to deter malicious forgery or alteration, thereby further improving the reliability of input data.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8A

Figure 8B

Figure 9

Figure 10

Figure 11

Embodiments for Carrying Out the Invention

[0010] Hereinafter, this embodiment will be described with reference to the attached drawings. In the attached drawings, functionally identical elements may sometimes be denoted by the same reference numerals. Although the attached drawings show embodiments and implementation examples in accordance with the principles of the present disclosure, these are for the purpose of understanding the present disclosure and are by no means used for interpreting the present disclosure in a limiting manner. The description in this specification is merely a typical example and does not limit the scope of the claims or the application examples of the present disclosure in any way.

[0011] In this embodiment, although the description is made in sufficient detail for those skilled in the art to implement the present disclosure, other implementations and forms are also possible, and it is necessary to understand that changes in configuration and structure and replacement of various elements can be made without departing from the scope and spirit of the technical idea of the present disclosure. Therefore, the following description should not be construed as being limited thereto.

[0012] [First Embodiment] With reference to FIGS. 1 to 3, an overview of the abnormality determination device according to the first embodiment will be described. As shown in FIG. 1, this abnormality determination device is composed of a management server 20 that monitors a plurality of computers 10 connected to a network NW. The management server 20 monitors data input by workers P and the like in these computers 10, and when an event that is likely to indicate the occurrence of an abnormality (human error, malicious forgery or alteration, etc.) in the data input of the computer 10 is detected, it notifies the relevant parties including the user P. Note that the abnormalities detected by this abnormality determination device can include both those caused by negligence and those caused intentionally. Note that the range of the parties to be notified of the abnormality can be changed as appropriate and is not limited to a specific one. Notification may be made to relevant parties other than the user P, or only to the user P, and can be switched appropriately according to the situation and requirements. Also, instead of providing the management server 20, it is also possible to omit the management server 20 by incorporating the functions of the management server 20 into the computer 10.

[0013] Operator P inputs the measurement data obtained by various measuring instruments 40 (such as calipers, micrometers, electronic balances, etc.) into the electronic spreadsheet software or spreadsheet software of computer 10 by, for example, the following methods. · Operator P visually checks the displayed value of the measuring instrument 40 and manually enters it into the electronic spreadsheet software or the like using a keyboard or the like. · Transfer the measurement data of the measuring instrument 40 to the computer 10 and copy it to the electronic spreadsheet software or the like. · Image the measured value displayed on the measuring instrument 40 with a scanner or camera, transfer this image data to the computer 10, convert it to text data, and input it into the electronic spreadsheet software.

[0014] In addition, the management server 20 monitors the data input by operator P in multiple computers 10. When a certain accuracy is recognized in the input operation, the input operation is learned and saved as a learned model. The saved learned model can be used to determine the suitability of data input in other computers 10 that perform input operations thereafter. That is, the multiple computers 10 can be the objects of monitoring by the management server 20 and can also be computers that provide teacher data for generating a learned model for determining abnormalities in data input in the management server 20. The management server 20 can determine whether the data input in the computer 10 is normal or abnormal based on the learned model generated according to the regular data input. Note that the learning of the input operation is not limited to the actual input operation from the computer 10, and it is also possible to execute it based on data obtained from sources other than the elements shown in FIG. 1. In addition, it is also possible to automatically generate an RPA (Robotic Process Automation) system based on the generated learned model and make it available for data input support and abnormality determination in the computer 10.

[0015] Referring to FIG. 2, an example of the hardware and software configuration of computer 10 will be described. Computer 10 is operated by an operator P or the like and is used, for example, to perform the operation of inputting measurement data obtained by a measuring device 40. As an example, computer 10 may include a CPU 101, a RAM 102, a ROM 103, an input / output interface 104, a storage device 105, a display unit 106, a speaker 107, a microphone 108, various sensors 109, a communication control unit 111, and a WEB camera 112. The configuration in FIG. 2 is an example, and elements other than the illustrated components may be added, appropriately omitted, or replaced by other components of the same type.

[0016] CPU 101 is an arithmetic unit responsible for various operations related to various operations of computer 10. In addition to CPU 101, a GPU (Graphical Processing Unit) responsible for image processing may be provided. RAM 102 has a function of temporarily holding various arithmetic data and the like during the execution of various programs stored in computer 10. ROM 103 stores BIOS and firmware of peripheral devices.

[0017] Input / output interface 104 is an interface device that captures input signals from input devices (keyboard, mouse, etc., not shown) and outputs output signals to various output devices. Storage device 105 is a storage device that stores various programs such as an electronic form program and an abnormality detection program, as well as various data. For example, it is a hard disk drive device or a solid state drive device. RAM 102, ROM 103, and storage device 105 are examples of storage devices, and it goes without saying that a configuration of a storage device different from this can be adopted.

[0018] The display unit 106 (output unit) is a display device (output device) for displaying (outputting) an execution screen of electronic form software or the like, and is, for example, a liquid crystal display or the like. The speaker 107 is an audio output device that outputs various output information in the electronic form software or the like as sound. The microphone 108 is an acoustic conversion device that senses the voice uttered by the operator P and converts it into an electrical signal. The sensor 109 is a sensor for detecting the state of the operator P, and is, for example, a human presence sensor that detects the presence of the operator P, a gaze sensor that detects the gaze direction, a posture detection sensor that detects the posture of the operator P, or the like. The communication control unit 111 controls communication with an external computer including the management server 20. Further, the WEB camera 112 is an imaging device that images the surroundings of the computer 10 including the operator P and transmits the captured image to the management server 20 via the network NW.

[0019] As an example, the abnormality detection program can be realized in the computer 10 with a learning start / end instruction unit 121, an operation history recording unit 122, and an abnormality detection start / end instruction unit 125.

[0020] The learning start / end instruction unit 121 is an instruction unit for instructing the start or end of learning when a learned model is generated according to the data input of the computer 10. The instruction to start or end learning may be input by the operator P, may be performed according to an instruction from the management server 20, or may be performed according to the detection result of the sensor 109. Note that the management server 20 can detect that data input has started in the computer 10, and the learning start / end instruction unit 121 can be omitted by configuring to start the learning process according to the result.

[0021] The operation history recording unit 122 records information regarding the history of data input operations in the computer 10 both when the computer 10 is the object of learning and when it is the object of monitoring after the generation of the learned model. The operation history information includes the order in which each data item is input, the time interval, the number of corrections, the timing of corrections, and the like.

[0022] The abnormality detection start / end instruction unit 125 is a part that inputs an instruction for starting or ending abnormality detection when the computer 10 is to be monitored and abnormal conditions are to be detected. The instruction for starting or ending abnormality detection may be in a form input by the operator P, or may be performed according to an instruction from the management server 20. Note that the management server 20 may detect that data input has started in the computer 10, and configure the abnormality detection process to start according to the result, thereby omitting the abnormality detection start / end instruction unit 125.

[0023] Referring to FIG. 3, an example of the hardware configuration of the management server 20 will be described. As an example, the management server 20 may include a CPU 21, an input / output interface 22, a RAM 23, a ROM 24, and a storage device 25.

[0024] The CPU 21 is an arithmetic unit responsible for various operations related to various operations of the management server 20. In addition to the CPU 21, a GPU (Graphical Processing Unit) responsible for image processing may be provided. The input / output interface 22 is an interface device responsible for input / output of various signals between the management server 20 and an external computer. The RAM 23 has a function of temporarily holding various arithmetic data and the like during the execution of various programs (such as an abnormality detection program) stored in the management server 20. The ROM 24 stores the BIOS and firmware of peripheral devices. The storage device 25 is a storage device that stores data necessary for the execution of various programs and data of the operation results of the abnormality detection program, and is, for example, a hard disk drive device or a solid state drive device.

[0025] The management server 20 may include a data relationship analysis unit 201, an operation history analysis unit 202, a learned model management unit 203, an outlier determination unit 204, an operation determination unit 205, and a numerical / operation abnormality determination unit 206 by an abnormality detection program.

[0026] The data relationship analysis unit 201 is an arithmetic unit that analyzes the relationships between the data input by the computer 10 obtained from the computer 10 to be learned (the computer 10 that performs correct data input) or the computer 10 to be monitored / abnormality-detected. The relationship can be represented by, for example, the correlation coefficient between two pieces of data, etc.

[0027] The operation history analysis unit 202 is an arithmetic unit that analyzes the operation history of data input in the computer 10 (the operation history recorded in the operation history recording unit 122) obtained from the computer 10 to be learned. The operation history includes the order in which each data item is input, the time interval, the number of corrections, the timing of corrections, etc.

[0028] The learned model management unit 203 manages the learned model as a result of learning the content of the input data, the data input procedure, the time interval, the timing, etc. in the computer 10 that is recognized to have performed normal data input, which is generated by executing the learning process. The learned model can be updated as appropriate. Note that in this specification, when the term "procedure" is used, it is used in the sense of including not only the order in which a plurality of items are executed, but also the time interval between adjacent items being executed and the time at which each item is executed.

[0029] The outlier determination unit 204 is a part that refers to the learned model managed by the learned model management unit 203 and determines whether the data item input in the computer 10 to be monitored / abnormality-detected is an outlier. As an example, regarding a certain data item, it is possible to determine whether the data item input by the computer 10 to be monitored / abnormality-detected is an outlier according to the average value, median, standard deviation, etc. of the data value. In addition, outliers can be determined according to the Smirnov-Grubbs test, the trimmed mean method, cluster analysis, or a combination thereof. The operation determination unit 205 is a part that refers to the learned model and makes a determination regarding the data input operation in the computer 10 to be monitored / abnormality-detected.

[0030] The numerical / operation abnormality determination unit 206 determines the presence or absence of an abnormality in the content of the input data or an abnormality in the data input procedure, time interval, timing, etc. according to the determination result of the outlier determination unit 204 and the determination result of the operation determination unit 205. The abnormality in the content of the input data can be determined in consideration of the correlation between different data items in addition to the determination result of the outlier determination unit 204.

[0031] Subsequently, with reference to the flowchart of FIG. 4, the execution procedure of the learning phase for learning data input in the computer 10 will be described. When a certain computer 10 is selected as the learning target, an instruction to start learning is issued from the learning start / end instruction unit 121 in that computer 10 (step S11).

[0032] Subsequently, in the computer 10 that is the learning target, a data input operation in an electronic form program or the like is executed (step S12). The operator P of the computer 10 that is the learning target performs data input according to the normal input procedure of the inspection data. The management server 20 receives the inspection data group as the result of data input and the operation history data indicating the input procedure of the inspection data group from the computer 10.

[0033] Then, the management server 20 analyzes the received inspection data group, and analyzes the relationship between the input data included in the inspection data group in the data relationship analysis unit 201 (step S13). Also, in the operation history analysis unit 202, it is analyzed at what procedure, time interval, and timing the inspection data group was input (step S14). When the inspection data group and operation history data necessary for learning are received and the analysis thereof is completed, the learning start / end instruction unit 121 instructs the end of the learning phase (step S15). Thereafter, a learned model is generated according to the analysis results in steps S13 and S14 (step S16). The learned model can be repeatedly updated based on newly obtained learning data.

[0034] Referring to the flowchart of FIG. 5, the execution procedure of the abnormal detection phase of data input in the computer 10 executed by the management server 20 will be described. In one computer 10, when the start of the abnormal detection operation is instructed from the abnormal detection start / end instruction unit 125 (step S21), the management server 20 sets the computer 10 as the monitoring target and starts the abnormal detection operation. When a data input operation is started in the target computer 10 (step S21), the outlier determination unit 204 refers to the learned model managed by the learned model management unit 203 and determines whether the input data is an outlier (step S23). Also, in the operation determination unit 205, the propriety of the operation in the computer 10 for monitoring / abnormal detection determination is determined (step S24). Then, the numerical value / operation abnormality determination unit 206 determines the abnormality of the input operation in the computer 10 to be monitored / abnormally detected according to the determination results in the outlier determination unit 204 and the operation determination unit 205 (step S25).

[0035] Referring to FIG. 6, an example of the method for analyzing the data interrelationship in the data interrelationship analysis unit 201 will be described. In the data interrelationship analysis unit 201, it is possible to analyze the relationship between different data items that are assumed to have a certain correlation among the data input in the computer 10 to be learned. As an example, as shown in FIG. 6, the relationship between the measurement values of the vertical (measured with a micrometer), horizontal (measured with a caliper), and height (measured with a three-dimensional measuring instrument) of a certain measurement object can be analyzed and managed as a learned model. Also, the relationship between the data obtained at different timings for a certain identical data item can be analyzed and managed as a learned model.

[0036] Referring to FIGS. 7, 8A, and 8B, an example of a display screen showing the result of determining an abnormality such as a numerical value or an operation procedure is shown. For example, when a certain data item is recognized as an outlier and it is determined that there is a suspicion of input error, malicious forgery, or alteration, as shown in FIG. 7, the data item can be displayed in reverse display or with an arrow mark AM, and a message to that effect can be displayed. Also, as shown in FIG. 8A, when it is determined that the data input procedure or the like in a certain data item is abnormal based on a learned model, the relevant part can be specified with an arrow mark AM or a rectangular mark BM, and a message to that effect can be displayed. As shown in FIG. 8B, when it is determined that there is a suspicion about the relationship between a plurality of data items, the relevant part can be specified with an arrow mark AM or a rectangular mark CM, and a message to that effect can be displayed.

[0037] As described above, according to the first embodiment, when there is a suspicion of human error in data input or malicious forgery / alteration, it can be appropriately notified to the relevant parties as abnormality information, thereby improving the reliability of the input data. For example, by managing a learned model as a result of learning correct data input and determining whether to accept the input of a computer to be monitored / abnormality-detected based on this, when there is an input that is different in content or procedure from the learned model, it can be pointed out. By appropriately notifying the abnormality information, it is possible to deter malicious forgery or alteration, thereby further improving the reliability of the input data.

[0038] [Second Embodiment] Next, an abnormality detection device according to the second embodiment will be described with reference to FIGS. 9 to 11. The overall configuration of the abnormality detection device of the second embodiment is substantially the same as that of the first embodiment. However, as shown in FIG. 9, the computer 10 of the second embodiment includes a posture history recording unit 123 and a gaze history recording unit 124 in addition to the components of the first embodiment. The operation determination unit 205 and the numerical value / operation abnormality determination unit 206 of the management server 20 can determine operation abnormalities according to the recorded data of the posture history recording unit 123 and the gaze history recording unit 124.

[0039] The posture history recording unit 123 records the history of the posture of the worker P extracted from the captured image of the WEB camera 112, for example. Instead of or in addition to the WEB camera 112, the posture of the worker P may be recorded according to various sensors capable of detecting the posture of the worker P. The gaze history recording unit 124 records the history (change) of the gaze of the worker P detected by a gaze sensor, for example. The posture history recording unit 123 and the gaze history recording unit 124 record the state of the worker P during work. This record can be used as one of the elements for determining whether the worker P has performed a normal input operation.

[0040] Referring to the flowchart of FIG. 10, the execution procedure of the learning phase for learning data input in the computer 10 in the abnormality detection device of the second embodiment will be described. The basic procedure is the same as that of the first embodiment (FIG. 4), but the difference is that information regarding the gaze and posture of the worker P of the computer 10 to be learned is analyzed and recorded in the posture history recording unit 123 and the gaze history recording unit 124 (step S18).

[0041] Referring to the flowchart of FIG. 11, the execution procedure of the abnormality detection phase for data input in the computer 10 to be monitored / abnormality detected in the abnormality detection device of the second embodiment will be described. The basic procedure is the same as that of the first embodiment (FIG. 5), but the difference is that information on the gaze and posture of the worker P is acquired and used for abnormality determination (step S26).

[0042] According to the second embodiment, the same effects as those of the first embodiment can be obtained. In addition, in the second embodiment, a learned model according to the operator P's line of sight and posture is generated, and monitoring and anomaly detection are performed, so that more refined anomaly detection can be performed.

[0043] [Others] The present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Also, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, for a part of the configuration of each embodiment, addition, deletion, or replacement with other configurations is possible.

[0044] Hereinafter, an appendix related to the above embodiment is disclosed. [Appendix 1] An anomaly determination device that determines anomalies in data input to a computer, a learned model management unit that manages a learned model related to the procedure or content of operations in the computer, an anomaly determination unit that determines anomalies in operations in the computer based on the learned model, and an output unit that outputs a determination result in the anomaly determination unit An anomaly determination device comprising: [Appendix 2] The anomaly determination unit analyzes the relevance between data input to the computer to determine data anomalies. The anomaly determination device according to Appendix 1. [Appendix 3] The learned model management unit manages information on operations on the computer when normal data input is performed as the learned model. The anomaly determination device according to Appendix 1. [Appendix 4] The learned model is the abnormality determination device according to Appendix 3, including at least one piece of information among the procedure of data input to the computer, the input time of each item, the operation speed of the input device, or the presence or absence of data modification. [Appendix 5] An abnormality determination program for determining the abnormality of data input to a computer, managing a learned model related to operations in the computer; determining the abnormality of the operation based on the learned model; and causing the output unit to output the result of the determination of the operation abnormality. An abnormality determination program configured to be executable by a computer. [Appendix 6] The abnormality determination program according to Appendix 5, further comprising analyzing the relevance of data input to the computer to determine the abnormality of the data. [Appendix 7] The abnormality determination program according to Appendix 5, managing information related to operations on the computer when normal data input is performed as the learned model. [Appendix 8] The learned model is the abnormality determination program according to Appendix 7, including at least one piece of information among the procedure of data input to the computer, the input time of each item, the operation speed of the input device, or the presence or absence of data modification.

Explanation of Signs

[0045] 10…Computer 20…Management Server 40…Measuring Instrument 101, 21…CPU 102, 23…RAM 103, 24…ROM 104, 22…Input / Output Interface 105, 25…Storage Device 106…Display Unit 107…Speaker 108…Microphone 109…Various Sensors 111… Communication control unit 112… Web camera 121… Learning start / end instruction unit 122… Operation history recording unit 123… Posture history recording unit 124… Gaze history recording unit 125… Abnormality detection start / end instruction unit 201… Data relationship analysis unit 202… Operation history analysis unit 203… Learned model management unit 204… Outlier determination unit 205… Operation determination unit 206… Numerical / operation abnormality determination unit AM… Arrow mark BM… Rectangle mark NW… Network P… Worker

Claims

1. An abnormality determination device for determining an abnormality in data input to a computer, comprising: a learned model management unit that manages a learned model related to an operation procedure or content in the computer; an abnormality determination unit that determines an abnormality in an operation in the computer based on the learned model; an output unit that outputs a determination result in the abnormality determination unit An abnormality determination device comprising:

2. The abnormality determination device according to claim 1, wherein the abnormality determination unit analyzes the relevance between data input to the computer to determine an abnormality in the data.

3. The abnormality determination device according to claim 1, wherein the learned model management unit manages, as the learned model, information on an operation on the computer when normal data input is performed.

4. The abnormality determination device according to claim 3, wherein the learned model includes at least one piece of information on a data input procedure to the computer, an input time for each item, an operation speed of an input device, or presence or absence of data correction.

5. An abnormality determination program for determining an abnormality in data input to a computer, comprising: a step of managing a learned model related to an operation in the computer; a step of determining an abnormality in the operation based on the learned model; and a step of causing an output unit to output a result of determination of the abnormality in the operation An abnormality determination program configured to be executable by a computer.

6. The abnormality determination program according to claim 5, further comprising a step of analyzing the relevance of data input to the computer to determine an abnormality in the data.

7. The abnormality determination program according to claim 5, wherein information on an operation on the computer when normal data input is performed is managed as the learned model.

8. The abnormality determination program according to claim 7, wherein the learned model includes at least one piece of information on a data input procedure to the computer, an input time for each item, an operation speed of an input device, or presence or absence of data correction.

Images