Analysis device, analysis method and analysis program

Abstract

To improve reliability of factor analysis of data.SOLUTION: An analysis device comprises: a detection unit that detects abnormal data by inputting data obtained from a target system into a first prediction model for which unsupervised learning has been performed based on pre-obtained data acquired when the target system was operating normally; a supervised learning unit that performs supervised learning for a second prediction model based on the abnormal data and the pre-obtained data; an evaluation unit that evaluates the first prediction model by inputting the same data as that input to the first prediction model into the second prediction model; and a re-learning unit that re-executes unsupervised learning for the first prediction model based on the evaluation results of the evaluation unit.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present invention relates to an analyzer, an analysis method, and an analysis program.

Background Art

[0002] There is a conventional technique for performing factor analysis of data using a prediction model.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in the above-described conventional technique, there is a problem that the reliability of factor analysis decreases when the accuracy of the prediction model decreases.

[0005] For example, SHAP is a method for calculating how much a feature contributes based on abnormal data output from a prediction model, and the accuracy of the Shapley value depends on the accuracy of the prediction model.

[0006] One aspect aims to provide an analyzer, an analysis method, and an analysis program capable of improving the reliability of factor analysis of data.

Means for Solving the Problems

[0007] The analysis device for one aspect has a detection unit that detects abnormal data by inputting the data acquired from the target system into the first prediction model in which unsupervised learning is performed based on the pre-data acquired during the normal operation of the target system, a supervised learning unit that performs supervised learning for the second prediction model based on the abnormal data and the pre-data, an evaluation unit that evaluates the first prediction model by inputting the same data as the data input to the first prediction model into the second prediction model, and a relearning unit that performs unsupervised learning for the first prediction model again based on the evaluation result of the evaluation unit.

[0008] The analysis method for one aspect is to detect abnormal data by inputting the data acquired from the target system into the first prediction model in which unsupervised learning is performed based on the pre-data acquired during the normal operation of the target system, perform supervised learning for the second prediction model based on the abnormal data and the pre-data, evaluate the first prediction model by inputting the same data as the data input to the first prediction model into the second prediction model, and the computer executes the process of performing unsupervised learning for the first prediction model again based on the evaluation result.

[0009] The analysis program for one aspect causes the computer to detect abnormal data by inputting the data acquired from the target system into the first prediction model in which unsupervised learning is performed based on the pre-data acquired during the normal operation of the target system, perform supervised learning for the second prediction model based on the abnormal data and the pre-data, evaluate the first prediction model by inputting the same data as the data input to the first prediction model into the second prediction model, and perform the process of performing unsupervised learning for the first prediction model again based on the evaluation result.

Advantages of the Invention

[0010] According to one embodiment, the reliability of the factor analysis of data can be improved.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Embodiments for Carrying Out the Invention

[0012] Hereinafter, examples of the analyzer, analysis method, and analysis program disclosed in the present application will be described in detail with reference to the drawings. Note that the present invention is not limited by these examples. Also, the same elements are denoted by the same reference numerals, and redundant descriptions are omitted as appropriate, and each embodiment can be combined as appropriate within a non - conflicting range.

[0013] First, after explaining the prior art, embodiments of the present application will be described. In the following description, an apparatus that executes the prior art is referred to as a "conventional apparatus". FIG. 22 is a diagram for explaining the prior art. First, in the prior art, a learning dataset 10 is prepared in advance. In the learning dataset 10, a plurality of process data collected during a period when no abnormality has occurred in the system to be monitored are registered. For example, for each of a plurality of items, feature quantities are set in the process data. For example, when the system to be monitored is a plant, the process data includes pressure, temperature, flow rate, operating state, etc.

[0014] The conventional apparatus performs unsupervised learning on the prediction model 15 based on the learning dataset 10. The prediction model 15 is, for example, One Class SVM (Support Vector Machine).

[0015] After unsupervised learning for the prediction model 15 is completed, the conventional device executes the following process. The conventional device performs an anomaly determination by inputting the process data 5 received in real time from the system 50 to be monitored into the prediction model 15. In the following description, the process data 5 determined to be abnormal is denoted as "abnormal data". Each time the conventional device receives the process data 5, it repeatedly executes the anomaly determination, and a case where a plurality of x points of abnormal data are detected will be described.

[0016] The conventional device performs a root cause analysis on a plurality of x points of abnormal data. For example, as a root cause analysis, the conventional device executes SHAP (SHapley Additive exPlanations) and calculates Shapley values for each feature of the abnormal data. The Shapley value is a value indicating how much each feature of the abnormal data contributes to the predicted value obtained by inputting data into the prediction model 15. For example, if the Shapley value for the pressure feature among the plurality of features included in the abnormal data is larger than the Shapley values of other features, it can be said that the cause of the abnormality is pressure.

[0017] (Embodiment 1) (Root Cause Analysis) Before describing Embodiment 1, an example of root cause analysis (SHAP) will be described. FIG. 1 is a diagram (1) for explaining root cause analysis (SHAP). In the example shown in FIG. 1, data 11 serving as one record and a prediction model M1 are used for explanation. In the data 11, a set of features and feature values is set.

[0018] For example, in the data 11, Age, SEX, BP (Blood Pressure), and BMI (Body Mass Index) are set as features. The feature value of the feature "Age" is "60". The feature value of the feature "Sex" is "F (Female)". The feature value of the feature "BP" is "180". The feature value of the feature "BMI" is "40". Note that the feature value of the feature "Sex" may be represented as 1 (Female) or 0 (male).

[0019] The prediction model M1 is an unsupervised learning model that outputs a predicted value when data is input. If the predicted value is greater than or equal to the threshold, the input data is determined to be normal data. On the other hand, if the predicted value is less than the threshold, the input data is determined to be abnormal data. The base rate is one of the parameters of the prediction model M1, and the larger the base rate, the easier it is to detect abnormal data. For example, the base rate is set to "0.1".

[0020] In the example shown in Figure 1, when data 11 is input to the prediction model M1, the predicted value is "0.4". For example, if the preset threshold is "0.5", data 11 is determined to be abnormal data.

[0021] When performing factor analysis by SHAP using data 11 and the prediction model M1, Shapley values corresponding to each feature are calculated. For example, the process of inputting data 11 with the feature amount of each feature changed into the prediction model 11 and calculating the predicted value is repeatedly executed, and the change in the feature amount value with respect to the change in the predicted value is calculated as the Shapley value. In the example shown in Figure 1, the Shapley value for the feature "Age" is "+0.4". The Shapley value for the feature "Sex" is "-0.3". The Shapley value for the feature "BP" is "+0.1". The Shapley value for the feature "BMI" is "+0.1".

[0022] From the calculation results of the Shapley values shown in Figure 1, it can be seen that the feature "Age" has the greatest influence on the predicted value of the prediction model M1, and the feature "Sex" has the second greatest influence.

[0023] Figure 2 is a diagram (2) for explaining factor analysis (SHAP). In the example shown in Figure 2, data 12 including a plurality of records and the prediction model M1 are used for explanation. The explanation of the prediction model M1 is the same as the explanation of the prediction model M1 performed in Figure 1.

[0024] For each record included in Data 12, a set of a feature and a feature quantity is set. The description of the feature is the same as the description given in FIG. 1. The description of the feature quantity for each feature is omitted. For example, for each feature quantity of each record included in Data 12, Data 12a is calculated by calculating the average value of the feature quantity.

[0025] In Data 12a, the average value "60" of the feature quantity of the feature "Age", the average value "F" of the feature quantity of the feature "Sex", the average value "180" of the feature quantity of the feature "BP", and the average value "40" of the feature quantity of the feature "BMI" are set.

[0026] In the example shown in FIG. 1, when Data 12a is input to the prediction model M1, the predicted value is "0.4". For example, if the preset threshold value is "0.5", Data 12a is determined to be abnormal data.

[0027] When performing factor analysis by SHAP using Data 12a and the prediction model M1, Shapley values corresponding to each feature are calculated respectively. In the example shown in FIG. 2, the Shapley value for the feature "Age" is "+0.4". The Shapley value for the feature "Sex" is "-0.3". The Shapley value for the feature "BP" is "+0.1". The Shapley value for the feature "BMI" is "+0.1".

[0028] From the calculation results of the Shapley values shown in FIG. 2, it can be seen that the feature "Age" has the greatest influence on the predicted value of the prediction model M1, and the feature "Sex" has the second greatest influence.

[0029] FIG. 3 is a diagram (3) for explaining factor analysis (SHAP). In the example shown in FIG. 3, a plurality of data 13a, 13b, 13c and the prediction model M1 are used for explanation. The explanation of the prediction model M1 is the same as the explanation of the prediction model M1 given in FIG. 1.

[0030] For data 13a, 13b, and 13c, a set of features and feature values is set. The description of the features is the same as the description given in FIG. 1. Regarding data 13a, the feature value of the feature "Age" is "60". The feature value of the feature "Sex" is "F". The feature value of the feature "BP" is "180". The feature value of the feature "BMI" is "40".

[0031] Regarding data 13b, the feature value of the feature "Age" is "50". The feature value of the feature "Sex" is "F". The feature value of the feature "BP" is "170". The feature value of the feature "BMI" is "36".

[0032] Regarding data 13c, the feature value of the feature "Age" is "62". The feature value of the feature "Sex" is "M (Male)". The feature value of the feature "BP" is "170". The feature value of the feature "BMI" is "30".

[0033] In the example shown in FIG. 3, when data 13a is input into the prediction model M1, the predicted value is "0.4". When data 13b is input into the prediction model M1, the predicted value is "0.3". When data 13c is input into the prediction model M1, the predicted value is "0.1". For example, if the preset threshold is "0.5", data 13a, 13b, and 13c are determined to be abnormal data.

[0034] When performing factor analysis by SHAP using data 13a and the prediction model M1, Shapley values corresponding to each feature are calculated respectively. In the example shown in FIG. 3, the Shapley value for the feature "Age" is "+0.4". The Shapley value for the feature "Sex" is "-0.3". The Shapley value for the feature "BP" is "+0.1". The Shapley value for the feature "BMI" is "+0.1".

[0035] When performing factor analysis by SHAP using data 13b and prediction model M1, Shapley values corresponding to each feature are calculated respectively. In the example shown in Figure 3, the Shapley value for the feature "Age" is "+0.5". The Shapley value for the feature "Sex" is "-0.2". The Shapley value for the feature "BP" is "+0.2". The Shapley value for the feature "BMI" is "+0.1".

[0036] When performing factor analysis by SHAP using data 13c and prediction model M1, Shapley values corresponding to each feature are calculated respectively. In the example shown in Figure 3, the Shapley value for the feature "Age" is "+0.6". The Shapley value for the feature "Sex" is "-0.3". The Shapley value for the feature "BP" is "-0.1". The Shapley value for the feature "BMI" is "+0.1".

[0037] The average values of the Shapley values for each feature are as follows. The average value of the Shapley value for the feature "Age" is "+0.5". The average value of the Shapley value for the feature "Sex" is "-0.28". The average value of the Shapley value for the feature "BP" is "+0.1". The average value of the Shapley value for the feature "BMI" is "+0.1".

[0038] From the calculation results of the Shapley values (average values) shown in Figure 3, it can be seen that the feature "Age" has the greatest influence on the predicted value of the prediction model M1, and the feature "Sex" has the second greatest influence.

[0039] The above is an example of factor analysis (SHAP). In the examples shown in Figures 1 to 3, features such as Age, SEX, BP, and BMI were used for explanation, but for other feature quantities, factor analysis can be performed in the same way. For example, other feature quantities are feature quantities such as pressure, temperature, flow rate, and operating state set in the process data of the plant.

[0040] (Description of the Processing of the Analyzer 100) Next, an example of the processing of the analyzer 100 according to Embodiment 1 will be described. FIG. 4 is a diagram for explaining the processing of the analyzer 100 according to Embodiment 1. For example, the analyzer 100 is connected to a system 50 to be monitored.

[0041] The system 50 is a system for managing a plant, and outputs process data 5 regarding a plurality of field devices included in the plant to the analyzer 100 at predetermined time intervals. Based on the process data 5, the analyzer 100 performs unsupervised learning, factor analysis, supervised learning, evaluation of the first prediction model, and re-execution of unsupervised learning, which will be described below.

[0042] (Unsupervised Learning of Embodiment 1) The unsupervised learning executed by the analyzer 100 will be described. In Embodiment 1, a first learning dataset 141 is prepared in advance. A plurality of process data collected during a period when no abnormality has occurred in the system 50 is registered in the first learning dataset 141. The first learning dataset 141 is used when performing unsupervised learning of the first prediction model 142. The first prediction model 142 is, for example, One Class SVM.

[0043] FIG. 5 is a diagram showing an example of the data structure of the learning dataset according to Embodiment 1. As shown in FIG. 5, the first learning dataset 141 has an item number, a timestamp, a first feature, a second feature, a third feature, a fourth feature, and an evaluation result. The item number is a number for identifying the process data included in the first learning dataset 141. The timestamp is the time when the corresponding process data was measured. The first feature quantity, the second feature quantity, the third feature quantity, and the fourth feature quantity are respectively the feature quantities of the respective features of the plant.

[0044] The evaluation result shows the evaluation result when the corresponding process data is input into the unsupervised learning completed first prediction model 142. When the predicted value when the process data is input into the first prediction model 142 is greater than or equal to the threshold value, the evaluation result is "normal". When the predicted value when the process data is input into the first prediction model 142 is less than the threshold value, the evaluation result is "abnormal". In Embodiment 1, the first learning dataset 141 may not include the evaluation result.

[0045] Note that among the information shown in the first learning dataset 141, a set of the first feature amount, the second feature amount, the third feature amount, and the fourth feature amount included in one record is used as one learning data.

[0046] The analysis device 100 executes unsupervised learning of the first prediction model 142 based on the first learning dataset 141. Since a plurality of process data (learning data) collected during a period when no abnormality has occurred in the system 50 are registered in the first learning dataset 141, by executing unsupervised learning by the analysis device 100, the distribution of the feature amounts of the process data during normal times is learned.

[0047] (Factor analysis of Embodiment 1) After the unsupervised learning for the first prediction model 142 is completed, the analysis device 100 uses the first prediction model 142 to execute factor analysis. For example, the analysis device 100 determines whether the input process data is normal data or abnormal data by inputting the process data acquired in real time from the system 50 into the first prediction model 142.

[0048] When the predicted value when the analysis device 100 inputs the process data into the first prediction model 142 is greater than or equal to a preset threshold value, the analysis device 100 determines the process data as normal data. On the other hand, when the predicted value when the analysis device 100 inputs the process data into the first prediction model 142 is less than the preset threshold value, the analysis device 100 determines the process data as abnormal data. The analysis device 100 repeatedly executes the above processing until a plurality of x points of abnormal data are detected.

[0049] FIG. 6 is a diagram showing an example of a determination result of process data acquired in real time. As shown in FIG. 6, the evaluation result table T1 includes an item number, a timestamp, a first feature, a second feature, a third feature, a fourth feature, and an evaluation result. The explanations regarding the item number, the timestamp, the first to fourth feature amounts, and the evaluation result are the same as those regarding the item number, the timestamp, the first to fourth feature amounts, and the evaluation result described in FIG. 5. In the example shown in FIG. 6, the process data corresponding to item numbers 0 to 5, 11, and 12 is determined to be normal data. The process data corresponding to item numbers 6 to 10 is determined to be abnormal data.

[0050] The analyzer 100 performs a cause analysis on a plurality of x points of abnormal data. The cause analysis performed by the analyzer 100 is the same as the cause analysis described in FIGS. 1 to 3. The analyzer 100 outputs the result of the cause analysis.

[0051] The analyzer 100 uses a plurality of x points of abnormal data in the supervised learning described below.

[0052] (Supervised learning of Embodiment 1) The analyzer 100 uses the first learning data set 141 used in the unsupervised learning of the first prediction model 142 as "normal data" for the supervised learning of the second prediction model 143. The analyzer 100 sets a plurality of x points of abnormal data detected when performing the above-described cause analysis as "abnormal data" for the supervised learning of the second prediction model 143.

[0053] For example, the analyzer 100 prepares a second learning data set for performing supervised learning by executing the following processing. In FIG. 4, the illustration of the second learning data set is omitted. The analyzer 100 assigns the label "1 (normal)" to the process data included in the first learning data set 141. The analyzer 100 assigns the label "0 (abnormal)" to a plurality of x points of abnormal data.

[0054] The analysis device 100 registers the labeled process data in the second learning dataset. The analysis device 100 uses the second learning dataset to perform supervised learning on the second prediction model 143 based on the error backpropagation method or the like. The second prediction model 143 is an NN (Neural Network) or the like.

[0055] For example, the analysis device 100 inputs input data (for example, a set of the first feature amount, the second feature amount, the third feature amount, and the fourth feature amount) into the second prediction model 143, and updates the parameters of the second prediction model 143 so that the value output from the second prediction model 143 approaches the value of the label.

[0056] When the process data is input to the second prediction model 143 that has undergone supervised learning and the predicted value of the second prediction model 143 is equal to or greater than the threshold value, the input process data is "normal data". On the other hand, when the process data is input to the second prediction model 143 that has undergone supervised learning and the predicted value of the second prediction model 143 is less than the threshold value, the input process data is "abnormal data".

[0057] (Evaluation of the First Prediction Model in Embodiment 1) The analysis device 100 evaluates the first prediction model 142 using the second prediction model 143 that has undergone supervised learning. For example, the analysis device 100 inputs the process data acquired in real time from the system 50 into the first prediction model 142 and the second prediction model 143, and obtains prediction results from the first prediction model 142 and the second prediction model 143. When the prediction results of the first prediction model 142 and the second prediction model 143 are the same, the analysis device 100 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 143 are different, the analysis device 100 evaluates that the performance of the first prediction model 142 has deteriorated.

[0058] FIG. 7 is a diagram for explaining the evaluation of the first prediction model. In the example shown in FIG. 7, for convenience, the feature space F1 is shown on two axes, with the vertical axis corresponding to the first feature and the horizontal axis corresponding to the second feature. Among the feature space F1, the region F1a to the left of the line segment l1 is the region where the second prediction model 143 determines that the data is normal data. The region F1b to the right of the line segment l1 is the region where the second prediction model 143 determines that the data is abnormal data.

[0059] The circles and triangles plotted in the feature space F1 correspond to the process data. Also, the process data of the circles is the process data determined to be normal data by the first prediction model 142. The process data of the triangles is the process data determined to be abnormal data by the first prediction model 142.

[0060] In the example shown in FIG. 7, the process data of the triangles is included in the region F1a, and the process data of the circles is included in the region F1b. Therefore, in many process data, the prediction results of the first prediction model 142 and the second prediction model 143 are different, and the analyzer 100 evaluates that the performance of the first prediction model 142 has deteriorated.

[0061] Note that the analyzer 100 may perform the following process to evaluate the first prediction model 142. The analyzer 100 inputs the process data acquired in real time from the system 50 into the first prediction model 142 and acquires the data determined to be abnormal data by the first prediction model 142. The analyzer 100 repeatedly executes the above process to acquire a plurality of x points of abnormal data.

[0062] The analysis device 100 inputs the abnormal data of a plurality of x points into the second prediction model 143 respectively, and obtains the prediction results of the second prediction model 143. When the second prediction model 143 determines that the abnormal data of less than a predetermined ratio among the abnormal data of the plurality of x points is normal data, the analysis device 100 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the second prediction model 143 determines that the abnormal data of a predetermined ratio or more among the abnormal data of the plurality of x points is normal data, the analysis device 100 evaluates that the performance of the first prediction model 142 has deteriorated.

[0063] When the performance of the first prediction model 142 has deteriorated, the analysis device 100 may perform root cause analysis using the second prediction model 143.

[0064] (Re - execution of unsupervised learning in Embodiment 1) When the analysis device 100 evaluates that the performance of the first prediction model 142 has deteriorated, it executes the following processing. The analysis device 100 deletes the old process data registered in the first learning dataset 141. The analysis device 100 inputs the process data output from the system 50 into the second prediction model 143 to determine whether an abnormality has occurred in the system 50. The analysis device 100 newly registers the process data during the period when no abnormality has occurred in the system 50 in the first learning dataset 141.

[0065] The analysis device 100 uses the first learning dataset 141 in which the process data has been newly registered to re - execute unsupervised learning for the first prediction model 142.

[0066] The unsupervised learning, root cause analysis, supervised learning, evaluation of the first prediction model, and re - execution of unsupervised learning executed by the analysis device 100 have been described above.

[0067] As described above, the analyzer 100 according to Embodiment 1 executes supervised learning of the second prediction model 143 using a plurality of abnormal data detected by the first prediction model 142 in which unsupervised learning has been executed and the first learning dataset 141 acquired during normal operation of the system 50. The analyzer 100 inputs the same data as the data input to the first prediction model 142 to the second prediction model 143, and evaluates whether or not the performance of the first prediction model 142 has deteriorated based on the prediction result of the first prediction model 142 and the prediction result of the second prediction model 143. When the performance of the first prediction model 142 deteriorates, the analyzer 100 re-executes unsupervised learning of the first prediction model 142.

[0068] As a result, it is possible to detect a deterioration in the performance of the first prediction model 142 used when performing factor analysis of data, and to re-learn the first prediction model 142 at an appropriate timing, thereby improving the reliability of factor analysis.

[0069] (Functional Configuration of Analyzer 100 According to Embodiment 1) Next, a configuration example of the analyzer 100 shown in FIG. 4 will be described. FIG. 8 is a functional block diagram showing the functional configuration of the analyzer according to Embodiment 1. As shown in FIG. 8, the analyzer 100 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150. Note that the functional units included in the analyzer 100 are not limited to those shown in the figure, and the analyzer 100 may include other functional units.

[0070] The communication unit 110 is a processing unit that controls communication between the system 50 to be monitored shown in FIG. 4 and other devices, and is realized by a communication interface or the like. For example, the communication unit 110 receives process data from the system 50.

[0071] The input unit 120 is a processing unit for inputting various types of information to the control unit 150 of the analyzer 100, and is realized by a keyboard, a mouse, a touch panel, or the like.

[0072] The display unit 130 is a processing unit for displaying the information output from the control unit 150, and is realized by a display or the like. For example, the display unit 130 displays the result of cause analysis.

[0073] The storage unit 140 stores a first learning dataset 141, a first prediction model 142, a second prediction model 143, and a second learning dataset 144. The storage unit 140 is realized by a memory, a hard disk, or the like.

[0074] The first learning dataset 141 has process data collected during a period when no abnormality has occurred in the system 50. Other explanations regarding the first learning dataset 141 are the same as the explanations regarding the first learning dataset 141 described in FIG. 5 and the like.

[0075] The first prediction model 142 is an One Class SVM or the like. The first prediction model 142 is subjected to unsupervised learning by an unsupervised learning unit 152, which will be described later, based on the first learning dataset 141.

[0076] The second prediction model 143 is an NN or the like. The second prediction model 143 is subjected to supervised learning by a supervised learning unit 155, which will be described later, based on the second learning dataset 144.

[0077] The second learning dataset 144 has a plurality of labeled process data. For example, it has information in which the label "1 (normal)" is assigned to the process data included in the first learning dataset 141, and information in which the label "0 (abnormal)" is assigned to a plurality of x points of abnormal data.

[0078] The control unit 150 is a processing unit that controls the entire analyzer 100, and is realized by a processor or the like, for example. This control unit 150 includes an acquisition unit 151, an unsupervised learning unit 152, a detection unit 153, a cause analysis unit 154, a supervised learning unit 155, an evaluation unit 156, and a relearning unit 157.

[0079] The acquisition unit 151 is a processing unit that acquires process data from the system 50 in real time. The acquisition unit 151 outputs the acquired process data to the detection unit 153 and the evaluation unit 156.

[0080] The acquisition unit 151 registers the process data acquired from the system 50 in the first learning dataset 141 during a period when no abnormal data is detected by the detection unit 153 described later.

[0081] The acquisition unit 151 assigns the label "1 (normal)" to the process data set in the first learning dataset 141 and registers it in the second learning dataset 144.

[0082] The unsupervised learning unit 152 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141. Since a plurality of process data (learning data) collected during a period when no abnormality has occurred in the system 50 are registered in the first learning dataset 141, the first prediction model 142 learns the distribution of the feature amounts of the process data in the normal state.

[0083] For example, when process data is input to the unsupervised learning-completed first prediction model 142, a prediction value corresponding to the distance between the feature amounts of the input process data and the feature amounts of the distribution of the process data in the normal state is output. The closer the distance between the feature amounts of the input process data and the feature amounts of the distribution of the process data in the normal state, the larger the prediction value.

[0084] Other processes related to the unsupervised learning unit 152 are the same as the description of the above-mentioned (unsupervised learning).

[0085] The detection unit 153 inputs the process data into the first prediction model 142 that has completed unsupervised learning, and based on the predicted value, determines whether the input process data is normal data or abnormal data. When the predicted value is equal to or greater than a preset threshold (for example, 0.5), the detection unit 153 determines that the input process data is normal data. On the other hand, when the predicted value is less than the preset threshold, the detection unit 153 determines that the input process data is abnormal data.

[0086] The detection unit 153 repeatedly executes the above process to detect abnormal data at multiple x points. The detection unit 153 outputs the abnormal data at multiple x points to the cause analysis unit 154. In addition, the detection unit 153 assigns the label "0 (abnormal)" to the abnormal data at multiple x points (process data) and registers it in the second learning dataset 144.

[0087] The detection unit 153 notifies the acquisition unit 151 of the period during which no abnormal data is detected (the period during which no abnormality occurs in the system 50).

[0088] The cause analysis unit 154 performs cause analysis using the abnormal data at multiple x points and the first prediction model 142 that has completed unsupervised learning. The cause analysis performed by the cause analysis unit 154 is the same as the cause analysis described in FIGS. 1 to 3. The cause analysis unit 154 outputs the result of the cause analysis to the display unit 130 or the like.

[0089] The supervised learning unit 155 performs supervised learning on the second prediction model 143 based on the second learning dataset 144 using the error backpropagation method or the like. Other explanations regarding the supervised learning unit 155 are the same as the explanations regarding the supervised learning (in Embodiment 1).

[0090] The evaluation unit 156 evaluates the first prediction model 142 using the second prediction model 143 that has completed supervised learning. For example, the evaluation unit 156 inputs the process data acquired in real time from the system 50 into the first prediction model 142 and the second prediction model 143, and obtains prediction results from the first prediction model 142 and the second prediction model 143.

[0091] When the prediction results of the first prediction model 142 and the second prediction model 143 are the same, the evaluation unit 156 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 143 are different, the evaluation unit 156 evaluates that the performance of the first prediction model 142 has deteriorated.

[0092] When the evaluation unit 156 evaluates that the performance of the first prediction model 142 has deteriorated, it outputs a relearning request to the relearning unit 157. Other explanations regarding the evaluation unit 156 are the same as the explanations regarding (evaluation of the first prediction model in Embodiment 1) described above.

[0093] When the relearning unit 157 receives a relearning request from the evaluation unit 156, it executes relearning of the first prediction model 142 assuming that the performance of the first prediction model 142 has deteriorated. For example, the relearning unit 157 executes the following process.

[0094] The relearning unit 157 deletes the old process data registered in the first learning dataset 141 at the timing when it receives the relearning request. After the relearning unit 157 deletes the old process data registered in the first learning dataset 141, it waits until the process data during the period when no abnormality has occurred in the system 50 is re-registered in the first learning dataset 141 by the acquisition unit 151.

[0095] After the process data during the period when no abnormality has occurred in the system 50 is re-registered in the first learning dataset 141 by the acquisition unit 151, the relearning unit 157 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141. The unsupervised learning executed by the relearning unit 157 is the same as the unsupervised learning executed by the unsupervised learning unit 152 described above.

[0096] In FIG. 8, the unsupervised learning unit 152 and the relearning unit 157 are described as separate blocks, but the unsupervised learning unit 152 may have the function of the relearning unit 157.

[0097] (Processing flow of the analyzer 100 according to Embodiment 1) Next, an example of the processing flow of the analyzer 100 according to Embodiment 1 will be described. FIG. 9 is a flowchart showing the processing flow of the analyzer 100 according to Embodiment 1. As shown in FIG. 9, the unsupervised learning unit 152 of the analyzer 100 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141 (step S101).

[0098] The acquisition unit 151 of the analyzer 100 acquires process data from the system 50 in real time (step S102). The detection unit 153 of the analyzer 100 inputs the process data into the first prediction model 142 and determines whether the process data is abnormal data (step S103).

[0099] When abnormal data is detected, the cause analysis unit 154 of the analyzer 100 performs cause analysis (step S104). If the analyzer 100 has not detected a plurality of x points of abnormal data (step S105, No), the process proceeds to step S102. On the other hand, if the analyzer 100 has detected a plurality of x points of abnormal data (step S105, Yes), the process proceeds to step S106.

[0100] The analyzer 100 generates a second learning dataset 144 (step S106). The supervised learning unit 155 of the analyzer 100 performs supervised learning on the second prediction model 143 based on the second learning dataset 144 (step S107).

[0101] The evaluation unit 156 of the analyzer 100 evaluates the first prediction model 142 based on the prediction result when the process data is input into the first prediction model 142 and the prediction result when the process data is input into the second prediction model 143 (step S108).

[0102] When the accuracy of the first prediction model has not decreased (step S109, No), the analysis device 100 proceeds to step S102. On the other hand, when the accuracy of the first prediction model has decreased (step S109, Yes), the analysis device 100 proceeds to step S110.

[0103] The analysis device 100 updates the first learning dataset 141 (step S110). The relearning unit 157 of the analysis device 100 relearns (unsupervised learning) the first prediction model 142 based on the first learning dataset 141 (step S111), and proceeds to step S102.

[0104] (Effect of Embodiment 1) Next, the effect of the analysis device 100 according to Embodiment 1 will be described. As described above, the analysis device 100 uses a plurality of abnormal data detected by the first prediction model 142 in which unsupervised learning has been performed and the first learning dataset 141 acquired during normal operation of the system 50 to perform supervised learning of the second prediction model 143. The analysis device 100 inputs the same data as the data input to the first prediction model 142 into the second prediction model 143, and based on the prediction result of the first prediction model 142 and the prediction result of the second prediction model 143, evaluates whether the performance of the first prediction model 142 has decreased. When the performance of the first prediction model 142 has decreased, the analysis device 100 performs unsupervised learning of the first prediction model 142 again.

[0105] As a result, it is possible to detect a decrease in the performance of the first prediction model 142 used when performing data factor analysis, and to perform relearning of the first prediction model 142 at an appropriate timing, thereby improving the reliability of factor analysis.

[0106] (Embodiment 2) (Explanation of the Processing of the Analysis Device 200) Next, an example of the processing of the analyzer 200 according to Embodiment 2 will be described. FIG. 10 is a diagram for explaining the processing of the analyzer according to Embodiment 2. For example, the analyzer 200 is connected to a system 50 to be monitored. The description of the system 50 is the same as the description of the system 50 in FIG. 4.

[0107] Based on the process data 5, the analyzer 200 performs unsupervised learning, factor analysis, supervised learning, evaluation of the first prediction model, and re - execution of unsupervised learning, which will be described below.

[0108] (Unsupervised learning in Embodiment 2) Based on the first learning dataset 141, the analyzer 200 performs unsupervised learning of the first prediction model 142. The unsupervised learning performed by the analyzer 200 is the same as the unsupervised learning performed by the analyzer 100 in Embodiment 1. Also, the descriptions of the first learning dataset 141 and the first prediction model 142 are the same as the descriptions given in Embodiment 1.

[0109] (Factor analysis in Embodiment 2) After the unsupervised learning for the first prediction model 142 is completed, the analyzer 200 uses the first prediction model 142 to perform factor analysis. The factor analysis performed by the analyzer 200 is the same as the factor analysis performed by the analyzer 100 in Embodiment 1.

[0110] (Supervised learning in Embodiment 2) Among the process data included in the first learning dataset 141 used in the unsupervised learning of the first prediction model 142, the analyzer 200 uses the process data with an evaluation result of "normal" as the "normal data" for the supervised learning of the second prediction model 242. For example, in the process data shown in FIG. 5, the analyzer 200 uses the process data with item numbers 0 to 3, 5, and 6 as the "normal data" for the supervised learning of the second prediction model 242. Also, the analyzer 200 uses the plurality of x abnormal data points detected during the above - mentioned factor analysis as the "abnormal data" for the supervised learning of the second prediction model 242.

[0111] For example, the analysis device 200 prepares a second learning dataset for performing supervised learning by executing the following processes. In FIG. 10, the illustration of the second learning dataset is omitted. The analysis device 200 assigns the label "1 (normal)" to the normal data of the first learning dataset 141. The analysis device 200 assigns the label "0 (abnormal)" to a plurality of x points of abnormal data.

[0112] The analysis device 200 registers the labeled process data in the second learning dataset. The analysis device 200 uses the second learning dataset to perform supervised learning for the second prediction model 243 based on the error backpropagation method or the like. The second prediction model 243 is an NN or the like.

[0113] For example, the analysis device 200 inputs input data (for example, a set of the first feature amount, the second feature amount, the third feature amount, and the fourth feature amount) to the second prediction model 243, and updates the parameters of the second prediction model 243 so that the value output from the second prediction model 243 approaches the value of the label.

[0114] (Evaluation of the First Prediction Model in Embodiment 2) The analysis device 200 evaluates the first prediction model 142 using the supervised learning-completed second prediction model 243. For example, the analysis device 200 inputs the process data acquired in real time from the system 50 to the first prediction model 142 and the second prediction model 243, and obtains prediction results from the first prediction model 142 and the second prediction model 243. When the prediction results of the first prediction model 142 and the second prediction model 243 are the same, the analysis device 200 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 243 are different, the analysis device 200 evaluates that the performance of the first prediction model 142 has deteriorated.

[0115] Note that the analysis device 200 may evaluate the first prediction model 142 by performing the following processes. The analysis device 200 inputs the process data acquired in real time from the system 50 into the first prediction model 142, and acquires the data determined by the first prediction model 142 as abnormal data. The analysis device 200 repeatedly executes the above processes to acquire a plurality of x points of abnormal data.

[0116] The analysis device 200 inputs each of the plurality of x points of abnormal data into the second prediction model 243 and acquires the prediction results of the second prediction model 243. When the second prediction model 243 determines that the abnormal data is normal data for less than a predetermined ratio among the plurality of x points of abnormal data, the analysis device 200 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the second prediction model 243 determines that the abnormal data is normal data for a predetermined ratio or more among the plurality of x points of abnormal data, the analysis device 200 evaluates that the performance of the first prediction model 142 has deteriorated.

[0117] When the performance of the first prediction model 142 has deteriorated, the analysis device 200 may perform a cause analysis using the second prediction model 243.

[0118] (Re-execution of unsupervised learning in Embodiment 2) When the analysis device 200 evaluates that the performance of the first prediction model 142 has deteriorated, it executes the following processes. The analysis device 200 deletes the old process data registered in the first learning dataset 141. The analysis device 200 inputs the process data output from the system 50 into the second prediction model 243 to determine whether an abnormality has occurred in the system 50. The analysis device 200 newly registers the process data during the period when no abnormality has occurred in the system 50 in the first learning dataset 141.

[0119] The analysis device 200 uses the first learning dataset 141 in which the process data has been newly registered to re-execute unsupervised learning for the first prediction model 142.

[0120] The above has described the unsupervised learning, factor analysis, supervised learning, evaluation of the first prediction model, and re-execution of unsupervised learning executed by the analysis device 200.

[0121] In the analysis device 100 according to the above-described Embodiment 1, regardless of the evaluation result, supervised learning of the second prediction model 143 was performed using a plurality of process data collected during a period when no abnormality occurred in the system 50 as normal data. On the other hand, in the analysis device 200 according to Embodiment 2, among the plurality of process data collected during a period when no abnormality occurred in the system 50, the process data whose evaluation result is "normal" is used as normal data, and supervised learning of the second prediction model 243 is executed.

[0122] As a result, supervised learning is executed using normal data from which abnormal data has been removed from the learning data (process data). Therefore, the prediction accuracy of the second prediction model 243 can be improved as compared with the second prediction model 143 of Embodiment 1.

[0123] (Functional Configuration of the Analysis Device 200 of Embodiment 2) Next, a configuration example of the analysis device 200 shown in FIG. 10 will be described. FIG. 11 is a functional block diagram showing the functional configuration of the analysis device according to Embodiment 2. As shown in FIG. 11, the analysis device 200 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 240, and a control unit 250. Note that the functional units included in the analysis device 200 are not limited to those shown in the figure, and the analysis device 200 may include other functional units.

[0124] The descriptions of the communication unit 110, the input unit 120, and the display unit 130 are the same as the descriptions of the communication unit 110, the input unit 120, and the display unit 130 described with reference to FIG. 8.

[0125] The storage unit 240 stores a first learning data set 141, a first prediction model 142, a second prediction model 243, and a second learning data set 244. The storage unit 240 is realized by a memory, a hard disk, or the like.

[0126] The first learning dataset 141 has process data collected during a period when no abnormality has occurred in the system 50. Other explanations regarding the first learning dataset 141 are the same as the explanations regarding the first learning dataset 141 described in FIG. 5 and the like.

[0127] The first prediction model 142 is One Class SVM or the like. The first prediction model 142 is subjected to unsupervised learning by an unsupervised learning unit 252, which will be described later, based on the first learning dataset 141.

[0128] The second prediction model 243 is an NN or the like. The second prediction model 243 is subjected to supervised learning by a supervised learning unit 255, which will be described later, based on the second learning dataset 244.

[0129] The second learning dataset 244 has a plurality of labeled process data. For example, it has information in which the label "1 (normal)" is assigned to the normal data included in the first learning dataset 141 and information in which the label "0 (abnormal)" is assigned to a plurality of x points of abnormal data.

[0130] The control unit 250 is a processing unit that controls the entire analyzer 200 and is realized by, for example, a processor or the like. This control unit 250 includes an acquisition unit 251, an unsupervised learning unit 252, a detection unit 253, a cause analysis unit 254, a supervised learning unit 255, an evaluation unit 256, and a re-learning unit 257.

[0131] The acquisition unit 251 is a processing unit that acquires process data from the system 50 in real time. The acquisition unit 251 outputs the acquired process data to the detection unit 253 and the evaluation unit 256.

[0132] The acquisition unit 251 registers the process data acquired from the system 50 in the first learning dataset 141 during a period when no abnormal data has been detected by a detection unit 353, which will be described later.

[0133] The acquisition unit 251 assigns the label "1 (normal)" to the normal data (process data with an evaluation result of "normal") set in the first learning dataset 141 and registers it in the second learning dataset 244.

[0134] The unsupervised learning unit 252 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141. Other explanations regarding the unsupervised learning unit 252 are the same as those regarding the unsupervised learning unit 152 in Embodiment 1.

[0135] The detection unit 253 inputs the process data into the unsupervised learning-completed first prediction model 142 and determines whether the input process data is normal data or abnormal data based on the predicted value. The detection unit 253 determines that the input process data is normal data when the predicted value is equal to or greater than a preset threshold (for example, 0.5). On the other hand, the detection unit 253 determines that the input process data is abnormal data when the predicted value is less than the preset threshold. The detection unit 253 sets the determination result (evaluation result) in the first learning dataset 141.

[0136] The detection unit 253 repeatedly executes the above processing to detect a plurality of x points of abnormal data. The detection unit 253 outputs the plurality of x points of abnormal data to the cause analysis unit 254. Also, the detection unit 253 assigns the label "0 (abnormal)" to the plurality of x points of abnormal data (process data) and registers it in the second learning dataset 244.

[0137] The detection unit 253 notifies the acquisition unit 251 of a period during which abnormal data is not detected (a period during which no abnormality occurs in the system 50).

[0138] The cause analysis unit 254 performs cause analysis using the plurality of x points of abnormal data and the unsupervised learning-completed first prediction model 142. The cause analysis performed by the cause analysis unit 254 is the same as that of the cause analysis unit 154 in Embodiment 1. The cause analysis unit 254 outputs the result of the cause analysis to the display unit 130 and the like.

[0139] The supervised learning unit 255 performs supervised learning on the second prediction model 243 based on the second learning dataset 244 using the error backpropagation method or the like. Other explanations regarding the supervised learning unit 255 are the same as the explanations regarding (supervised learning in Embodiment 2) described above.

[0140] The evaluation unit 256 evaluates the first prediction model 142 using the second prediction model 243 that has undergone supervised learning. For example, the evaluation unit 256 inputs the process data acquired in real time from the system 50 into the first prediction model 142 and the second prediction model 243, and obtains prediction results from the first prediction model 142 and the second prediction model 243.

[0141] When the prediction results of the first prediction model 142 and the second prediction model 243 are the same, the evaluation unit 256 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 243 are different, the evaluation unit 256 evaluates that the performance of the first prediction model 142 has deteriorated.

[0142] When the evaluation unit 256 evaluates that the performance of the first prediction model 142 has deteriorated, it outputs a relearning request to the relearning unit 257. Other explanations regarding the evaluation unit 256 are the same as the explanations regarding (evaluation of the first prediction model in Embodiment 2) described above.

[0143] When the relearning unit 257 receives a relearning request from the evaluation unit 256, it performs relearning of the first prediction model 142 assuming that the performance of the first prediction model 142 has deteriorated. Other explanations regarding the relearning unit 257 are the same as the explanations regarding the relearning unit 157 in Embodiment 1.

[0144] (Flow of processing of the analyzer 200 in Embodiment 2) Next, an example of the processing flow of the analyzer 200 according to Embodiment 2 will be described. FIG. 12 is a flowchart showing the processing flow of the analyzer 200 according to Embodiment 2. As shown in FIG. 12, the unsupervised learning unit 252 of the analyzer 200 executes unsupervised learning for the first prediction model 142 based on the first learning dataset 141 (step S201).

[0145] The acquisition unit 251 of the analyzer 200 acquires process data from the system 50 in real time (step S202). The detection unit 253 of the analyzer 200 inputs the process data into the first prediction model 142 and determines whether the process data is abnormal data (step S203).

[0146] When abnormal data is detected, the cause analysis unit 254 of the analyzer 200 performs cause analysis (step S204). If the analyzer 200 has not detected a plurality of x points of abnormal data (step S205, No), the process proceeds to step S202. On the other hand, if the analyzer 200 has detected a plurality of x points of abnormal data (step S205, Yes), the process proceeds to step S206.

[0147] The analyzer 200 generates a second learning dataset 244 based on the normal data included in the first learning dataset 141 and the detected abnormal data (step S206). The supervised learning unit 255 of the analyzer 200 executes supervised learning for the second prediction model 243 based on the second learning dataset 244 (step S207).

[0148] The evaluation unit 256 of the analyzer 200 evaluates the first prediction model 142 based on the prediction result when the process data is input into the first prediction model 142 and the prediction result when the process data is input into the second prediction model 243 (step S208).

[0149] If the accuracy of the first prediction model has not decreased (step S209, No), the analysis device 200 proceeds to step S202. On the other hand, if the accuracy of the first prediction model has decreased (step S209, Yes), the analysis device 200 proceeds to step S210.

[0150] The analysis device 200 updates the first learning dataset 141 (step S210). The relearning unit 257 of the analysis device 200 relearns (unsupervised learning) the first prediction model 142 based on the first learning dataset 141 (step S211), and proceeds to step S202.

[0151] (Effect of Embodiment 2) Next, the effect of the analysis device 200 according to Embodiment 2 will be described. In the analysis device 100 of Embodiment 1 described above, regardless of the evaluation result, supervised learning of the second prediction model 143 was performed using a plurality of process data collected during a period when no abnormality occurred in the system 50 as normal data. In contrast, the analysis device 200 of Embodiment 2 uses, as normal data, a plurality of process data collected during a period when no abnormality has occurred in the system 50 and for which the evaluation result is "normal", and executes supervised learning of the second prediction model 243.

[0152] As a result, supervised learning is executed using normal data from which abnormal data has been removed from the learning data (process data), so that the prediction accuracy of the second prediction model 243 can be improved compared to the second prediction model 143 of Embodiment 1. Further, by improving the prediction accuracy of the second prediction model 243, it is possible to more appropriately detect a performance degradation of the first prediction model 142.

[0153] (Embodiment 3) (Explanation of the Processing of the Analysis Device 300) Next, an example of the processing of the analyzer 300 according to Embodiment 3 will be described. FIG. 13 is a diagram for explaining the processing of the analyzer according to Embodiment 3. For example, the analyzer 300 is connected to the system 50 to be monitored. The description of the system 50 is the same as the description of the system 50 in FIG. 4.

[0154] Based on the process data 5, the analyzer 300 performs unsupervised learning, factor analysis, supervised learning, evaluation of the first prediction model, and re-execution of unsupervised learning, which will be described below.

[0155] (Unsupervised Learning of Embodiment 3) Based on the first learning dataset 141, the analyzer 300 performs unsupervised learning of the first prediction model 142. The unsupervised learning performed by the analyzer 300 is the same as the unsupervised learning performed by the analyzer 100 of Embodiment 1. Also, the descriptions of the first learning dataset 141 and the first prediction model 142 are the same as the descriptions given in Embodiment 1.

[0156] (Factor Analysis of Embodiment 3) After the unsupervised learning for the first prediction model 142 is completed, the analyzer 300 uses the first prediction model 142 to perform factor analysis. The factor analysis performed by the analyzer 300 is the same as the factor analysis performed by the analyzer 100 of Embodiment 1.

[0157] (Supervised Learning of Embodiment 3) When performing the above factor analysis, the analyzer 300 uses the continuous y points immediately before the plurality of x points of abnormal data detected as the "normal data" for the supervised learning of the second prediction model 342. For example, the process data corresponding to item numbers 0 to 5 of the evaluation result table T1 in FIG. 6 is used as the normal data. Also, the analyzer 300 uses the plurality of x points of abnormal data detected when performing the above factor analysis as the "abnormal data" for the supervised learning of the second prediction model 342.

[0158] The analysis device 300 prepares a second learning dataset for performing supervised learning by executing the following processes. In FIG. 13, the illustration of the second learning dataset is omitted. The analysis device 300 assigns the label "1 (normal)" to the normal data in the first learning dataset 141. The analysis device 300 assigns the label "0 (abnormal)" to the abnormal data at a plurality of x points.

[0159] The analysis device 300 registers the labeled process data in the second learning dataset. The analysis device 300 uses the second learning dataset and executes supervised learning for the second prediction model 343 based on the error backpropagation method or the like. The second prediction model 343 is an NN or the like.

[0160] For example, the analysis device 300 inputs input data (for example, a set of the first feature amount, the second feature amount, the third feature amount, and the fourth feature amount) to the second prediction model 343, and updates the parameters of the second prediction model 343 so that the value output from the second prediction model 343 approaches the value of the label.

[0161] (Evaluation of the First Prediction Model in Embodiment 3) The analysis device 300 evaluates the first prediction model 142 using the supervised learning-completed second prediction model 343. For example, the analysis device 300 inputs the process data acquired in real time from the system 50 to the first prediction model 142 and the second prediction model 343, and obtains prediction results from the first prediction model 142 and the second prediction model 343. When the prediction results of the first prediction model 142 and the second prediction model 343 are the same, the analysis device 300 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 343 are different, the analysis device 300 evaluates that the performance of the first prediction model 142 has deteriorated.

[0162] Note that the analyzer 300 may evaluate the first prediction model 142 by performing the following processes. The analyzer 300 inputs the process data acquired in real time from the system 50 into the first prediction model 142, and acquires the data determined by the first prediction model 142 as abnormal data. The analyzer 300 repeatedly executes the above processes to acquire a plurality of x points of abnormal data.

[0163] The analyzer 300 inputs each of the plurality of x points of abnormal data into the second prediction model 343, and acquires the prediction results of the second prediction model 343. When the second prediction model 343 determines that the data is normal data for abnormal data less than a predetermined ratio among the plurality of x points of abnormal data, the analyzer 300 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the second prediction model 343 determines that the data is normal data for abnormal data equal to or more than a predetermined ratio among the plurality of x points of abnormal data, the analyzer 300 evaluates that the performance of the first prediction model 142 has deteriorated.

[0164] When the performance of the first prediction model 142 has deteriorated, the analyzer 200 may perform a cause analysis using the second prediction model 343.

[0165] (Re - execution of unsupervised learning in Embodiment 3) When the analyzer 300 evaluates that the performance of the first prediction model 142 has deteriorated, it executes the following processes. The analyzer 300 deletes the old process data registered in the first learning dataset 141. The analyzer 300 inputs the process data output from the system 50 into the second prediction model 343 to determine whether an abnormality has occurred in the system 50. The analyzer 300 newly registers the process data during the period when no abnormality has occurred in the system 50 in the first learning dataset 141.

[0166] The analyzer 300 uses the first learning dataset 141 in which the process data has been newly registered to re - execute the unsupervised learning for the first prediction model 142.

[0167] As described above, when performing cause analysis, the analyzer 300 according to Embodiment 3 uses the immediately preceding continuous y points of the plurality of x points of abnormal data detected as the "normal data" for supervised learning of the second prediction model 342, and sets the plurality of x points of abnormal data detected when performing the above-described cause analysis as the "abnormal data" for supervised learning of the second prediction model 342. Thereby, supervised learning of the second prediction model 343 can be executed using the latest process data.

[0168] (Functional Configuration of Analyzer 300 According to Embodiment 3) Next, a configuration example of the analyzer 300 shown in FIG. 13 will be described. FIG. 14 is a functional block diagram showing the functional configuration of the analyzer according to Embodiment 3. As shown in FIG. 14, the analyzer 300 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 340, and a control unit 350. Note that the functional units included in the analyzer 300 are not limited to those shown in the figure, and the analyzer 300 may include other functional units.

[0169] The descriptions of the communication unit 110, the input unit 120, and the display unit 130 are the same as the descriptions of the communication unit 110, the input unit 120, and the display unit 130 described with reference to FIG. 8.

[0170] The storage unit 340 stores a first learning data set 141, a first prediction model 142, a second prediction model 343, and a second learning data set 344. The storage unit 340 is realized by a memory, a hard disk, or the like.

[0171] The first learning data set 141 includes process data collected during a period when no abnormality has occurred in the system 50. Other descriptions of the first learning data set 141 are the same as the descriptions of the first learning data set 141 described with reference to FIG. 5 and the like.

[0172] The first prediction model 142 is an One Class SVM or the like. The first prediction model 142 is subjected to unsupervised learning by an unsupervised learning unit 352, which will be described later, based on the first learning data set 141.

[0173] The second prediction model 343 is an NN or the like. The second prediction model 343 is subjected to supervised learning by a supervised learning unit 355, which will be described later, based on the second learning dataset 344.

[0174] The second learning dataset 344 includes normal data with the label "1 (normal)" and abnormal data with the label "0 (abnormal)". The normal data is the data of consecutive y points immediately before a plurality of x points of abnormal data detected during factor analysis. The abnormal data is the data of a plurality of x points detected during factor analysis.

[0175] The control unit 350 is a processing unit that controls the entire analyzer 300 and is realized by, for example, a processor or the like. This control unit 350 includes an acquisition unit 351, an unsupervised learning unit 352, a detection unit 353, a factor analysis unit 354, a supervised learning unit 355, an evaluation unit 356, and a relearning unit 357.

[0176] The acquisition unit 351 is a processing unit that acquires process data from the system 50 in real time. The acquisition unit 351 outputs the acquired process data to the detection unit 353 and the evaluation unit 356.

[0177] The acquisition unit 351 registers the process data acquired from the system 50 in the first learning dataset 141 during a period when no abnormal data is detected by the detection unit 353, which will be described later.

[0178] The unsupervised learning unit 352 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141. Other descriptions regarding the unsupervised learning unit 352 are the same as those regarding the unsupervised learning unit 152 in Embodiment 1.

[0179] The detection unit 353 inputs the process data into the first pre-trained prediction model 142 without a teacher, and based on the predicted value, determines whether the input process data is normal data or abnormal data. When the predicted value is equal to or greater than a preset threshold (for example, 0.5), the detection unit 353 determines that the input process data is normal data. On the other hand, when the predicted value is less than the preset threshold, the detection unit 353 determines that the input process data is abnormal data.

[0180] The detection unit 353 repeatedly executes the above processing to detect abnormal data at a plurality of x points. The detection unit 253 outputs the abnormal data at a plurality of x points to the cause analysis unit 254.

[0181] The detection unit 353 attaches the label "1 (normal)" to the continuous y points of data (normal data) immediately before the abnormal data at a plurality of x points and registers it in the second learning dataset 344. The detection unit 353 attaches the label "0 (abnormal)" to the abnormal data at a plurality of x points and registers it in the second learning dataset 344.

[0182] The detection unit 353 notifies the acquisition unit 351 of the period during which no abnormal data is detected (the period during which no abnormality occurs in the system 50).

[0183] The cause analysis unit 354 performs cause analysis using the abnormal data at a plurality of x points and the first pre-trained prediction model 142 without a teacher. The cause analysis performed by the cause analysis unit 354 is the same as that of the cause analysis unit 154 in Embodiment 1. The cause analysis unit 354 outputs the result of the cause analysis to the display unit 130 and the like.

[0184] The supervised learning unit 355 performs supervised learning on the second prediction model 343 based on the second learning dataset 344 using the error backpropagation method or the like. Other explanations regarding the supervised learning unit 355 are the same as the explanations regarding the above-mentioned (supervised learning in Embodiment 3).

[0185] The evaluation unit 356 evaluates the first prediction model 142 using the second prediction model 343 that has been trained with a teacher. For example, the evaluation unit 356 inputs the process data acquired in real time from the system 50 into the first prediction model 142 and the second prediction model 343, and obtains prediction results from the first prediction model 142 and the second prediction model 343.

[0186] When the prediction results of the first prediction model 142 and the second prediction model 343 are the same, the evaluation unit 356 evaluates that the performance of the first prediction model 142 has not deteriorated. On the other hand, when the prediction results of the first prediction model 142 and the second prediction model 343 are different, the evaluation unit 356 evaluates that the performance of the first prediction model 142 has deteriorated.

[0187] When the evaluation unit 356 evaluates that the performance of the first prediction model 142 has deteriorated, it outputs a relearning request to the relearning unit 357. Other explanations regarding the evaluation unit 356 are the same as the explanations regarding (evaluation of the first prediction model in Embodiment 3) described above.

[0188] When the relearning unit 357 receives a relearning request from the evaluation unit 356, it executes relearning of the first prediction model 142 on the assumption that the performance of the first prediction model 142 has deteriorated. Other explanations regarding the relearning unit 357 are the same as the explanations regarding the relearning unit 157 in Embodiment 1.

[0189] (Processing flow of the analyzer 300 in Embodiment 3) Next, an example of the processing flow of the analyzer 300 in Embodiment 3 will be described. FIG. 15 is a flowchart showing the processing flow of the analyzer 300 in Embodiment 3. As shown in FIG. 15, the unsupervised learning unit 252 of the analyzer 300 executes unsupervised learning on the first prediction model 142 based on the first learning dataset 141 (step S301).

[0190] The acquisition unit 251 of the analyzer 300 acquires process data from the system 50 in real time (step S302). The detection unit 353 of the analyzer 300 inputs the process data into the first prediction model 142 and determines whether the process data is abnormal data (step S303).

[0191] When abnormal data is detected, the cause analysis unit 354 of the analyzer 300 performs cause analysis (step S304). If the analyzer 300 has not detected a plurality of x points of abnormal data (step S305, No), it proceeds to step S302. On the other hand, if the analyzer 300 has detected a plurality of x points of abnormal data (step S305, Yes), it proceeds to step S306.

[0192] The analyzer 300 assigns labels to a plurality of x points of abnormal data and a plurality of y points of normal data to generate a second training dataset (step S306). The supervised learning unit 355 of the analyzer 300 performs supervised learning of the second prediction model 343 based on the second training dataset 344 (step S307).

[0193] The evaluation unit 356 of the analyzer 300 evaluates the first prediction model 142 based on the prediction result when the process data is input into the first prediction model 142 and the prediction result when the process data is input into the second prediction model 343 (step S308).

[0194] If the accuracy of the first prediction model has not decreased (step S309, No), the analyzer 300 proceeds to step S302. On the other hand, if the accuracy of the first prediction model has decreased (step S309, Yes), the analyzer 300 proceeds to step S310.

[0195] The analyzer 300 updates the first training dataset 141 (step S310). The relearning unit 257 of the analyzer 200 relearns (unsupervised learning) the first prediction model 142 based on the first training dataset 141 (step S311) and proceeds to step S302.

[0196] (Effect of Embodiment 3) When the analyzer 300 according to Embodiment 3 performs cause analysis, the continuous y points immediately before the abnormal data of the plurality of x points detected during the cause analysis are used as "normal data" for supervised learning of the second prediction model 342, and the plurality of x points of abnormal data detected when performing the above cause analysis are used as "abnormal data" for supervised learning of the second prediction model 342. Thus, supervised learning of the second prediction model 343 can be executed based on the latest process data.

[0197] (Embodiment 4) In the above-described Embodiments 1 to 3, it has been determined whether or not an abnormality has occurred in the system 50 using the first prediction model 142 or the second prediction model 143 (243, 343), but the present invention is not limited thereto. For example, in addition to the prediction results of the first prediction model 142 or the second prediction model 143, a plant KPI (Key Performance Indicator) is further calculated, and based on the prediction results of the first prediction model 142 or the second prediction model 143 and the value of the plant KPI, it is determined whether or not an abnormality has occurred in the system 50, and cause analysis is executed.

[0198] (Explanation of the Processing of the Analyzer 400) An example of the processing of the analyzer 400 according to Embodiment 4 will be described. FIG. 16 is a diagram for explaining the processing of the analyzer according to Embodiment 4. For example, the analyzer 400 is connected to the system 50 to be monitored. The description of the system 50 is the same as the description of the system 50 in FIG. 4.

[0199] The analysis device 400 performs supervised learning on the second prediction model 143 based on the pre-prepared normal data 60a and abnormal data 60b. The analysis device 400 may collect the normal data 60a by the methods shown in Embodiments 1 to 3, or may collect it by other methods. The analysis device 400 uses the abnormal data obtained by the unsupervised learning-completed first prediction model 142 as the abnormal data 60b. The description of the first prediction model 142 is the same as the content described in Embodiment 1. Also, the supervised learning that the analysis device 400 performs on the second prediction model 143 is the same as the content described in Embodiment 1.

[0200] The analysis device 400 inputs the process data 5 into the supervised learning-completed second prediction model 143 and determines whether the process data 5 is abnormal data.

[0201] Also, the analysis device 400 inputs the process data 5 into the plant KPI calculation model 445 and calculates the value of the plant KPI. In addition to the feature quantities described in Embodiment 1, the process data 5 includes feature quantities related to the productivity, quality, cost, etc. of the plant.

[0202] The plant KPI calculation model 445 is a model that calculates the plant KPI for the predetermined feature quantities included in the process data 5. For example, the plant KPI calculation model 445 calculates the plant KPI based on Equation (1). For example, the actual value is the predetermined feature quantity (product quality, CO2 emission amount, etc.) included in the process data 5, and the target value is a preset value.

[0203] Plant KPI = (Actual value ÷ Target value) × 100 ··· (1)

[0204] FIG. 17 is a diagram for explaining an example of the determination policy of the analyzer according to Embodiment 4. For example, when the determination result when the analyzer 400 inputs process data into the second prediction model 143 is "abnormal data", and the KPI value when the process data is input into the plant KPI calculation model 445 is less than the threshold value, the analyzer 400 performs a cause analysis on the corresponding process data. In addition, even when the determination result when the analyzer 400 inputs process data into the second prediction model 143 is "normal data", if the KPI value when the process data is input into the plant KPI calculation model 445 is less than the threshold value, the analyzer 400 performs a cause analysis on the corresponding process data.

[0205] FIG. 18 is a diagram showing an example of the determination result of process data acquired in real time and the plant KPI. As shown in FIG. 18, the evaluation result table T2 includes an item number, a timestamp, a first feature, a second feature, a third feature, a fourth feature, an evaluation result, and a plant KPI. The explanations regarding the item number, timestamp, first to fourth feature amounts, and evaluation result are the same as the explanations regarding the item number, timestamp, first to fourth feature amounts, and evaluation result described in FIG. 5. Also, the explanation regarding the plant KPI is the same as the above explanation. Note that the threshold value compared with the plant KPI is "50".

[0206] In the example shown in FIG. 18, the analyzer 400 determines that the process data corresponding to item numbers 6 to 11 is the process data to be the target of the cause analysis shown in FIG. 17. The analyzer 400 performs a cause analysis on the process data corresponding to item numbers 6 to 11. The cause analysis performed by the analyzer 400 is the same as the cause analysis described in Embodiments 1 to 3.

[0207] As described above, the analyzer 400 according to Embodiment 4 identifies process data to be subjected to cause analysis based on the prediction result of the second prediction model 143 for the process data and the calculation result of the plant KPI calculation model 445. As a result, it is possible to perform cause analysis on process data that would not be subject to cause analysis in Embodiments 1 to 3. For example, in the analyzer 400 according to Embodiment 4, even if the determination result when the process data is input to the second prediction model 143 is "normal data", if the KPI value when the process data is input to the plant KPI calculation model 445 is less than the threshold value, cause analysis can be performed on the corresponding process data.

[0208] (Functional Configuration of the Analyzer 400 of Embodiment 4) Next, a configuration example of the analyzer 400 shown in FIG. 16 will be described. FIG. 19 is a functional block diagram showing the functional configuration of the analyzer according to Embodiment 4. As shown in FIG. 19, the analyzer 400 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 440, and a control unit 450. Note that the functional units included in the analyzer 400 are not limited to those shown in the figure, and it may have other functional units.

[0209] The explanations regarding the communication unit 110, the input unit 120, and the display unit 130 are the same as the explanations regarding the communication unit 110, the input unit 120, and the display unit 130 described with reference to FIG. 8.

[0210] The storage unit 440 stores the first learning dataset 141, the first prediction model 142, the second prediction model 243, the second learning dataset 144, and the plant KPI calculation model 445. The storage unit 440 is realized by a memory, a hard disk, or the like.

[0211] The first learning dataset 141 includes process data collected during a period when no abnormality has occurred in the system 50. Other explanations regarding the first learning dataset 141 are the same as the explanations regarding the first learning dataset 141 described with reference to FIG. 5 and the like.

[0212] The first prediction model 142 is, for example, One Class SVM. The first prediction model 142 is subjected to unsupervised learning by an unsupervised learning unit 452, which will be described later, based on the first learning dataset 141.

[0213] The second prediction model 143 is, for example, a neural network (NN). The second prediction model 143 is subjected to supervised learning by a supervised learning unit 455, which will be described later, based on the second learning dataset 144.

[0214] The second learning dataset 144 has a plurality of labeled process data. For example, it has information in which the label "1 (normal)" is assigned to the normal data included in the first learning dataset 141, and information in which the label "0 (abnormal)" is assigned to a plurality of x points of abnormal data.

[0215] The plant KPI calculation model 445 is a model for calculating plant KPIs.

[0216] The control unit 450 is a processing unit that controls the entire analyzer 400 and is realized by, for example, a processor or the like. This control unit 450 includes an acquisition unit 451, an unsupervised learning unit 452, a detection unit 453, a cause analysis unit 454, a supervised learning unit 455, an evaluation unit 456, and a relearning unit 457.

[0217] The acquisition unit 451 is a processing unit that acquires process data from the system 50 in real time. The acquisition unit 451 outputs the acquired process data to the detection unit 453 and the evaluation unit 456.

[0218] The acquisition unit 451 registers the process data acquired from the system 50 in the first learning dataset 141 during a period when no abnormal data is detected by the detection unit 453, which will be described later.

[0219] The acquisition unit 451 assigns the label "1 (normal)" to the normal data (process data with an evaluation result of "normal") set in the first learning dataset 141 and registers it in the second learning dataset 244. Note that the acquisition unit 451 may acquire normal data by other methods, assign a label to the acquired normal data, and register it in the second learning dataset 244.

[0220] The unsupervised learning unit 452 performs unsupervised learning on the first prediction model 142 based on the first learning dataset 141. Other explanations regarding the unsupervised learning unit 452 are the same as those regarding the unsupervised learning unit 152 in Embodiment 1.

[0221] The detection unit 453 inputs the process data into the unsupervised learning-trained first prediction model 142 and determines whether the input process data is normal data or abnormal data based on the predicted value. The detection unit 453 determines that the input process data is normal data when the predicted value is greater than or equal to a preset threshold (for example, 0.5). On the other hand, the detection unit 453 determines that the input process data is abnormal data when the predicted value is less than the preset threshold.

[0222] In addition, the detection unit 453 inputs the process data into the plant KPI calculation model 445 and calculates the value of the plant KPI. The process by which the detection unit 453 calculates the plant KPI is the same as the above-described process.

[0223] The detection unit 453 repeatedly executes the above-described process, extracts the process data to be the target of the cause analysis described in FIG. 17, and outputs the extracted process data to the cause analysis unit 454. For example, the detection unit 453 outputs the process data corresponding to item numbers 6 to 11 among the process data described in FIG. 18 to the cause analysis unit 454.

[0224] The root cause analysis unit 454 performs root cause analysis using a plurality of x-points of process data (abnormal data) and the second prediction model 143 that has been trained with a teacher. The root cause analysis performed by the root cause analysis unit 454 is the same as that of the root cause analysis unit 154 in Embodiment 1. The root cause analysis unit 454 outputs the result of the root cause analysis to the display unit 130 or the like. Note that the root cause analysis unit 454 may perform root cause analysis using the first prediction model 142 that has been trained without a teacher.

[0225] The supervised learning unit 455 performs supervised learning on the second prediction model 143 based on the second training dataset 144 using the error backpropagation method or the like. Other explanations regarding the supervised learning unit 455 are the same as the explanations regarding (the supervised learning in Embodiment 1).

[0226] The evaluation unit 456 evaluates the first prediction model 142 using the second prediction model 143 that has been trained with a teacher. The explanation regarding the evaluation unit 456 is the same as the explanation regarding the evaluation unit 156 described in Embodiment 1.

[0227] When the retraining unit 457 receives a retraining request from the evaluation unit 456, assuming that the performance of the first prediction model 142 has deteriorated, the retraining unit 457 performs retraining of the first prediction model 142. Other explanations regarding the retraining unit 457 are the same as the explanations regarding the retraining unit 157 in Embodiment 1.

[0228] (Flow of processing of the analysis device 400 in Embodiment 4) Next, an example of the flow of processing of the analysis device 400 in Embodiment 4 will be described. FIG. 20 is a flowchart showing the flow of processing of the analysis device 400 in Embodiment 4. Note that the flow of processing in which the analysis device 400 performs unsupervised learning of the first prediction model 142, the flow of processing in which the analysis device 400 performs supervised learning of the second prediction model 143, and the flow of processing for determining deterioration of the performance of the first prediction model 142 are the same as the flow of processing of the analysis device 100 in Embodiment 1. Therefore, in the description of the flow of processing in FIG. 20, it is assumed that supervised learning for the second prediction model 143 has been completed, and the flow of processing closely related to Embodiment 4 will be described.

[0229] As shown in FIG. 20, the acquisition unit 451 of the analyzer 400 acquires process data from the system 50 in real time (step S401). The detection unit 453 of the analyzer 400 inputs the process data into the second prediction model 143 and obtains a prediction result (step S402).

[0230] The detection unit 453 inputs the process data into the plant KPI calculation model 445 and calculates the value of the plant KPI (step S403). The detection unit 453 determines whether the process data is the target of cause analysis based on the prediction result of the second prediction model 143 and the value of the plant KPI (step S405).

[0231] When the process data is the target of cause analysis (step S405, Yes), the cause analysis unit 454 of the analyzer 400 performs cause analysis (step S406) and proceeds to step S402. On the other hand, when the process data is not the target of cause analysis (step S405, No), the cause analysis unit 454 proceeds to step S402.

[0232] (Effect of Embodiment 4) The analyzer 400 according to Embodiment 4 identifies the process data that is the target of cause analysis based on the prediction result of the second prediction model 143 for the process data and the calculation result of the plant KPI calculation model 445. Thereby, cause analysis can be performed on process data that would not be subject to cause analysis in Embodiments 1 to 3. For example, in the analyzer 400 according to Embodiment 4, even if the determination result when the process data is input into the second prediction model 143 is "normal data", when the KPI value when the process data is input into the plant KPI calculation model 445 is less than the threshold value, cause analysis can be performed on the corresponding process data.

[0233] (Hardware) Next, a hardware configuration example of the analyzer 100 (200, 300, 400) will be described. FIG. 21 is a diagram for explaining the hardware configuration example. As shown in FIG. 21, the analyzer 100 includes a communication device 5a, an HDD (Hard Disk Drive) 5b, a memory 5c, and a processor 5d. Also, each part shown in FIG. 21 is interconnected by a bus or the like.

[0234] The communication device 5a is a network interface card or the like and communicates with other servers. The HDD 5b stores programs and databases for operating the functions shown in FIG. 8.

[0235] The processor 5d reads out a program for executing the same processes as the respective processing units shown in FIG. 8 from the HDD 5b or the like and expands it in the memory 5c, thereby operating a process for executing each function described in FIG. 8 and the like. For example, this process executes functions similar to those of each processing unit included in the analyzer 100. Specifically, the processor 5d executes a process for executing the same processes as the acquisition unit 151, the unsupervised learning unit 152, the detection unit 153, the factor analysis unit 154, the supervised learning unit 155, the evaluation unit 156, the re-learning unit 157, and the like.

[0236] In this way, the analyzer 100 operates as an analyzer that executes an analysis method by reading and executing a program. Also, the analyzer 100 can read the above program from a recording medium by a medium reader and execute the read program to realize the same functions as those in the above-described embodiments. Note that the program referred to in this other embodiment is not limited to being executed by the analyzer 100. For example, the present invention can be similarly applied when another computer or server executes the program, or when these cooperate to execute the program.

[0237] This program can be distributed via a network such as the Internet. Also, this program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a magneto-optical disk (MO), or a digital versatile disc (DVD), and can be executed by being read from the recording medium by a computer.

[0238] (Others) Some examples of combinations of the disclosed technical features are described below.

[0239] (1) A detection unit that detects abnormal data by inputting data acquired from the target system into a first prediction model in which unsupervised learning is performed based on pre-data acquired during normal operation of the target system; A supervised learning unit that performs supervised learning on a second prediction model based on the abnormal data and the pre-data; An evaluation unit that evaluates the first prediction model by inputting the same data as the data input to the first prediction model into the second prediction model; A relearning unit that performs unsupervised learning on the first prediction model again based on the evaluation result of the evaluation unit And an analyzer having the same.

[0240] (2) The analyzer according to (1), further comprising a cause analysis unit that performs cause analysis based on the abnormal data and the first prediction model.

[0241] (3) The detection unit further calculates a value of a plant key performance indicator (KPI) based on the data acquired from the target system, and the cause analysis unit is based on the prediction result of the first prediction model or the second prediction model and the value of the plant KPI. The analyzer according to (1) or (2), which identifies data to be subjected to cause analysis from a plurality of data acquired from the target system.

[0242] (4) When the evaluation unit inputs data into the first prediction model, the evaluation unit evaluates the first prediction model based on the first prediction result output from the first prediction model and the second prediction result output from the second prediction model when the same data as the data input into the first prediction model is input into the second prediction model. The analysis apparatus according to any one of (1) to (3).

[0243] (5) When the evaluation unit inputs data predicted as abnormal data by the first prediction model into the second prediction model, the evaluation unit evaluates the first prediction model based on the second prediction result output from the second prediction model. The analysis apparatus according to (4).

[0244] (6) When the first prediction result and the second prediction result are different, the evaluation unit evaluates that the performance of the first prediction model has deteriorated. When it is evaluated that the performance of the first prediction model has deteriorated, the re-learning unit re-executes unsupervised learning for the first prediction model. The analysis apparatus according to (5).

[0245] (7) Based on the normal data determined to be normal by the first prediction model and the abnormal data among a plurality of pre-data acquired during normal operation of the target system, the supervised learning unit executes supervised learning for the second prediction model. The analysis apparatus according to any one of (1) to (6).

[0246] (8) Based on the data acquired from the target system immediately before the abnormal data detected by the detection unit and the abnormal data, the supervised learning unit executes supervised learning for the second prediction model. The analysis apparatus according to any one of (1) to (6).

[0247] (9) By inputting the data acquired from the target system into the first prediction model for which unsupervised learning has been executed based on the pre-data acquired during normal operation of the target system, abnormal data is detected, and Based on the abnormal data and the pre-data, perform supervised learning for the second prediction model. Evaluate the first prediction model by inputting the same data as that input to the first prediction model into the second prediction model. Based on the evaluation result, perform unsupervised learning for the first prediction model again. An analysis method for executing the process.

[0248] (10) Cause a computer to Detect abnormal data by inputting the data obtained from the target system into the first prediction model in which unsupervised learning has been performed based on the pre-data obtained during the normal operation of the target system. Based on the abnormal data and the pre-data, perform supervised learning for the second prediction model. Evaluate the first prediction model by inputting the same data as that input to the first prediction model into the second prediction model. Based on the evaluation result, perform unsupervised learning for the first prediction model again. An analysis program for causing the process to be executed.

Explanation of Signs

[0249] 100, 200, 300, 400 Analysis device 110 Communication unit 120 Input unit 130 Display unit 140 Storage unit 141 First learning dataset 142 First prediction model 143 Second prediction model 144 Second learning dataset 150, 250, 350, 450 Control unit 151, 251, 351, 451 Acquisition unit 152, 252, 352, 452 Unsupervised learning unit 153, 253, 353, 453 Detection unit 154, 254, 354, 454 Cause analysis unit 155,255,355,455 Teacher-present learning department 156,256,356,456 Evaluation department 157,257,357,457 Relearning department

Claims

1. A detection unit that detects abnormal data by inputting data acquired from the target system into a first prediction model in which unsupervised learning is executed based on pre-data acquired during normal operation of the target system; A supervised learning unit that executes supervised learning for a second prediction model based on the abnormal data and the pre-data; An evaluation unit that evaluates the first prediction model by inputting the same data as the data input to the first prediction model into the second prediction model; A relearning unit that re-executes unsupervised learning for the first prediction model based on the evaluation result of the evaluation unit; An analysis device having the above.

2. The analysis device according to claim 1, further comprising a factor analysis unit that performs factor analysis based on the abnormal data and the first prediction model.

3. The detection unit further calculates a value of a plant KPI (Key Performance Indicator) based on data acquired from the target system, and the factor analysis unit is based on a prediction result of the first prediction model or the second prediction model and the value of the plant KPI. The analysis device according to claim 2, which specifies data to be subjected to factor analysis from a plurality of data acquired from the target system.

4. The evaluation unit evaluates the first prediction model based on a first prediction result output from the first prediction model when data is input to the first prediction model and a second prediction result output from the second prediction model when the same data as the data input to the first prediction model is input to the second prediction model. The analysis device according to claim 1.

5. The evaluation unit evaluates the first prediction model based on a second prediction result output from the second prediction model when data predicted by the first prediction model as abnormal data is input to the second prediction model. The analysis device according to claim 4.

6. When the evaluation unit determines that the performance of the first prediction model has deteriorated when the first prediction result is different from the second prediction result, the re-learning unit re-executes unsupervised learning on the first prediction model when it is determined that the performance of the first prediction model has deteriorated. The analysis apparatus according to claim 5.

7. The supervised learning unit executes supervised learning on the second prediction model based on the normal data determined to be normal by the first prediction model and the abnormal data among the plurality of pre-data acquired during normal operation of the target system. The analysis apparatus according to any one of claims 1 to 6.

8. The supervised learning unit executes supervised learning on the second prediction model based on the data acquired from the target system immediately before the abnormal data detected by the detection unit and the abnormal data. The analysis apparatus according to any one of claims 1 to 6.

9. A computer By inputting the data acquired from the target system into the first prediction model on which unsupervised learning has been executed based on the pre-data acquired during normal operation of the target system, abnormal data is detected, Based on the abnormal data and the pre-data, supervised learning is executed on the second prediction model, By inputting the same data as the data input to the first prediction model into the second prediction model, the first prediction model is evaluated, Based on the evaluation result, unsupervised learning on the first prediction model is re-executed, An analysis method for executing processing.

10. On a computer By inputting the data acquired from the target system into the first prediction model on which unsupervised learning has been executed based on the pre-data acquired during normal operation of the target system, abnormal data is detected, Based on the abnormal data and the pre-data, supervised learning is executed on the second prediction model, By inputting the same data as the data input to the first prediction model into the second prediction model, the first prediction model is evaluated, Based on the evaluation results, unsupervised learning for the first prediction model is executed again An analysis program that executes the process.

Images