Processing device, processing system, processing method, and program

Abstract

To provide a processing device which offers improved convenience.SOLUTION: A processing device provided herein comprises a first processing unit configured to derive proposed normal data for abnormal data detected in an abnormality detection target device, and display the derived proposed normal data.SELECTED DRAWING: Figure 17

Description

[Technical Field]

[0001] The present disclosure relates to a processing device, a processing system, a processing method, and a program. [Background technology]

[0002] Data is used in a variety of fields. Patent Document 1 discloses a related technology relating to a system that uses previously accumulated sensing data from multiple sensors to perform highly accurate anomaly detection for a monitored object. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2011 / 036809 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the system related to Patent Document 1, there is a demand for a technique that can improve convenience.

[0005] One of the objectives of each aspect of the present disclosure is to provide a processing device, a processing system, a processing method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0006] In order to achieve the above object, according to one aspect of the present disclosure, a processing device includes a first processing unit that determines proposed normal data for abnormal data detected in a device that is the target of anomaly detection, and displays the determined proposed normal data.

[0007] To achieve the above object, according to another aspect of the present disclosure, a processing system includes the above processing device and a device that is a target of the anomaly detection.

[0008] In order to achieve the above object, according to another aspect of the present disclosure, a processing method includes determining proposed normal data for abnormal data detected in a device that is the target of anomaly detection, and displaying the determined proposed normal data.

[0009] In order to achieve the above object, according to another aspect of the present disclosure, a program causes a computer to obtain proposed normal data for abnormal data detected in a device that is the target of anomaly detection, and display the obtained proposed normal data. [Effects of the Invention]

[0010] According to each aspect of the present disclosure, convenience can be improved. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of a configuration of an anomaly detection device according to some embodiments of the present disclosure. [Figure 2] FIG. 10 is a diagram illustrating an example of divided learning data according to some embodiments of the present disclosure. [Figure 3] FIG. 10 is a diagram illustrating an example of segmented target data according to some embodiments of the present disclosure. [Figure 4] FIG. 10 is a diagram illustrating an example of segmented image data according to some embodiments of the present disclosure. [Figure 5] FIG. 1 is a diagram illustrating an example of image data according to some embodiments of the present disclosure. [Figure 6] FIG. 10 is a diagram illustrating an example of learned data according to some embodiments of the present disclosure. [Figure 7] FIG. 1 is a diagram illustrating an example of a configuration of a training device according to some embodiments of the present disclosure. [Figure 8] FIG. 2 illustrates an example of a configuration of a target device according to some embodiments of the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating a first example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 10] FIG. 10 is a diagram illustrating a second example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 11] FIG. 10 is a diagram illustrating an example of processing for dividing time-series data performed by a data division processing unit according to some embodiments of the present disclosure. [Figure 12] FIG. 10 is a diagram illustrating an example of processing for dividing time-series data performed by a data division processing unit according to some embodiments of the present disclosure. [Figure 13] FIG. 10 is a diagram illustrating a third example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 14] FIG. 10 illustrates an example of anomaly data according to some embodiments of the present disclosure. [Figure 15] FIG. 10 is a diagram illustrating an example of data identified by an anomaly correction suggestion processor according to some embodiments of the present disclosure. [Figure 16] FIG. 10 is a diagram illustrating an example of a normal data proposal that an anomaly correction proposal processor displays on a display unit according to some embodiments of the present disclosure. [Figure 17] FIG. 1 illustrates an example of a configuration of a processing device according to some embodiments of the present disclosure. [Figure 18] FIG. 1 is a diagram illustrating an example of a processing flow of a processing device according to some embodiments of the present disclosure. [Figure 19] FIG. 1 is a schematic block diagram illustrating the configuration of a computer according to at least one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, the embodiments will be described in detail with reference to the drawings. <Embodiment> A processing system 1 according to an embodiment of the present disclosure will be described with reference to the drawings. The processing system 1 includes an anomaly detection device 10. During learning, the processing system 1 includes a learning device 20 in addition to the anomaly detection device 10. The anomaly detection device 10 learns anomaly detection using data stored in the learning device 20. During operation, the processing system 1 includes a target device 30 in addition to the anomaly detection device 10. The anomaly detection device 10 detects an anomaly in the target device 30. The anomaly detection device 10 also presents an estimated value indicating a normal state that is closest to the anomaly detected in the target device 30 as a correction proposal.

[0013] (Configuration of the processing system of the present disclosure) 1 is a diagram illustrating an example of the configuration of an anomaly detection device 10 according to some embodiments of the present disclosure. As shown in FIG. 1, the anomaly detection device 10 according to one embodiment of the present disclosure includes a data division processing unit 101, an image processing unit 102, a learning processing unit 103, an anomaly correction proposal processing unit 104, and a display unit 105. The anomaly detection device 10 performs different processing during learning and during operation.

[0014] The data division processing unit 101 stores the division-processed data for learning. FIG. 2 is a diagram illustrating an example of the division-processed data for learning according to some embodiments of the present disclosure. The division-processed data for learning is stored in the data division processing unit 101 in a state in which each piece of time-series data is divided into folders for each element / division unit, as shown in part (a) of FIG. 2. Part (b) of FIG. 2 illustrates an example of time-series data in which sensor A is used as an element and the division number is 2. The time-series data is divided into data groups 1, 2, and 3, each divided into two divisions. As shown in part (a) of FIG. 2, for each divided data group, learning device information indicating the device, sensor information (element) indicating the sensor, acquisition time indicating the time of detection by the sensor, and value detected by the sensor are stored in association with each other. Note that information from data groups with the same number is collected to form a single image when image data is created.

[0015] The data division processing unit 101 also stores object division processed data. Fig. 3 is a diagram showing an example of object division processed data according to some embodiments of the present disclosure. The object division processed data is stored in the data division processing unit 101 in a state where each piece of time series data is sorted into a folder for each element / division unit as shown in Fig. 3.

[0016] The image processing unit 102 stores the segmented image data. FIG. 4 is a diagram showing an example of segmented image data according to some embodiments of the present disclosure. FIG. 5 is a diagram showing an example of image data according to some embodiments of the present disclosure. The segmented image data is stored in the image processing unit 102 in a state where each piece of image data is separated for each element / segmentation unit (for each data group) as shown in FIGS. 4 and 5. Each piece of image data holds reference information corresponding to each piece of data in the segmented data for learning.

[0017] The learning processing unit 103 stores trained data. FIG. 6 is a diagram illustrating an example of trained data according to some embodiments of the present disclosure. The trained data is stored in the learning processing unit 103 in a state in which each anomaly detection model data is divided into elements / division units as shown in FIG. 6. Each model is generated from the data divided into elements / division units of the time-series data in the training division processed data. Using normal data, a model with the smallest range of thresholds that determine all data as normal is generated by unsupervised learning. The combination of elements may be determined by any method. The combination of elements may also be determined in advance.

[0018] Furthermore, when the learning processing unit 103 creates an anomaly detection model that combines multiple elements, it stores an anomaly detection model for each division unit for each combination. For example, if the combinations of "element A / element B," "element C / element E," and "element A / element E" are predetermined, the learning processing unit 103 stores "element A (division unit 1)" as "element A / element B (division unit 1)" and "element A / element E (division unit 1)," and stores "element B (division unit 1)" as "element A / element B (division unit 1)." When there is a combination of elements, the time-series data is treated as a single block. For example, when there is "element A / element B," the time-series data of element A and the time-series data of element B are treated as a single block. The anomaly detection model is a model for detecting an anomaly in the target device 30, and may be generated by any machine learning method.

[0019] The anomaly correction proposal processing unit 104 calculates the degree of anomaly using the data for each element / division unit in the divided processed data for the target device and the anomaly detection model in the learned data. If the degree of anomaly is equal to or greater than a threshold, the anomaly correction proposal processing unit 104 displays an anomaly notification and a proposed correction for the data at the abnormal location (i.e., a normal data proposal) on the display unit 105. The anomaly correction proposal processing unit 104 performs this process for all data divided into each element / division unit in the divided processed data for the target device. Details of the process performed by the anomaly correction proposal processing unit 104 to generate normal data proposals will be described later. The display unit 105 displays various information about the anomaly detection device 10.

[0020] 7 is a diagram illustrating an example of the configuration of a training device 20 according to some embodiments of the present disclosure. The training device 20 is a device that has normal data. As shown in FIG. 7, the training device 20 includes a sensor 201a, a sensor 201b, and a sensor 201c. The sensors 201a, 201b, and 201c may be collectively referred to as the sensor 201.

[0021] 8 is a diagram illustrating an example of the configuration of a target device 30 according to some embodiments of the present disclosure. The target device 30 is a device in which a malfunction (e.g., a breakdown) has occurred. In other words, the target device 30 is a device that is the target of anomaly detection. As shown in FIG. 8, the target device 30 includes sensors 301a, 301b, and 301c. The sensors 301a, 301b, and 301c may be collectively referred to as sensors 301.

[0022] The above-described processing performed by the processing system 1 according to the embodiment of the present disclosure is merely an example, and the processing system 1 is not limited to the above-described processing. For example, the processing system 1 may perform the processing described below.

[0023] (Processing performed by the processing system of the present disclosure) Fig. 9 is a diagram showing a first example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Fig. 10 is a diagram showing a second example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Here, a learning process performed by the processing system 1 shown in Fig. 9 and an operation process performed by the processing system 1 shown in Fig. 10 will be described.

[0024] (Processing during learning) First, the learning process performed by the processing system 1 shown in Fig. 9 will be described. The sensor 201 included in each learning device 20 acquires data at predetermined timings (step S1). The data acquired by the sensor 201 includes learning device information, sensor information (i.e., elements), acquisition time, and value. The learning device information is information indicating from which learning device 20 the value was acquired. The sensor information is information indicating from which sensor 201 the value was acquired. The acquisition time is the time when the sensor 201 acquired the value. The value is the value acquired (i.e., detected) by the sensor 201. The data division processing unit 101 stores the time-series data acquired by the sensor 201 included in each learning device 20 as a "learning device sensor log" (step S2).

[0025] The data division processing unit 101 stores the division-processed data for learning in a state where each piece of data is divided, for example, as shown in FIG. 2 (step S3). The data division processing unit 101 sets a division frame width for each predetermined division unit (step S4). Then, the data division processing unit 101 divides the time series data using the set division frame width (step S5). For example, the data division processing unit 101 determines several division units. Then, the data division processing unit 101 creates data by dividing the time frame width for the same element by multiple division frame widths, shifting the time frame width by a predetermined range.

[0026] FIG. 11 is a diagram illustrating an example of processing for dividing time-series data performed by the data division processing unit 101 according to some embodiments of the present disclosure. Specifically, for example, as shown in part (a) of FIG. 11, the data division processing unit 101 sets a division frame width 1 to a predetermined division unit 1 (e.g., every 5 seconds). Furthermore, as shown in part (b) of FIG. 11, the data division processing unit 101 sets a division frame width 2 to a predetermined division unit 2 (e.g., every 10 seconds). Furthermore, as shown in part (c) of FIG. 11, the data division processing unit 101 sets a division frame width 3 to a predetermined division unit 3 (e.g., every 20 seconds). Note that element A, element B, and element C in FIG. 11 are data obtained from sensor 201, sensor 202, and sensor 203, respectively.

[0027] Next, the image processing unit 102 converts the time-series data in the divided data for learning into image data for each element / division unit (step S6). Then, the image processing unit 102 stores the divided image data in a divided state, as shown in FIG. 4 (step S7).

[0028] Next, the learning processing unit 103 generates an anomaly detection model for each element / division unit of the time-series data in the division-processed data for learning through machine learning (step S8). The machine learning here is, for example, unsupervised learning. Specifically, for example, the learning processing unit 103 performs vectorization processing on image data generated using only normal data as learning data, and generates a model (anomaly detection model) in which a normal threshold is determined through unsupervised learning. During operation, the learning processing unit 103 compares the anomaly detection model generated here with a model obtained from the target device 30 for which an anomaly is to be confirmed, and determines that the anomaly is "normal" if it is within the range of the threshold of the anomaly detection model, or "abnormal" if it is not. Then, the learning processing unit 103 stores the learned data in a state in which each anomaly detection model data is classified, as shown in FIG. 5 (step S9).

[0029] (Processing during operation) Next, a description will be given of the processing performed by the processing system 1 shown in Fig. 10 during operation. The sensor 301 included in the target device 30 acquires data at predetermined intervals (step S21). The data division processing unit 101 stores the time-series data acquired by the sensor 301 included in the target device 30 as a "target device sensor log" (step S22).

[0030] The data division processing unit 101 stores the divided data for the target device in a state where each piece of data is divided, for example, as shown in FIG. 3 (step S23). Specifically, for example, the data division processing unit 101 sets a division frame width for each predetermined division unit. Then, the data division processing unit 101 divides the time series data using the set division frame width. For example, the data division processing unit 101 determines several division units. For the same element, the data division processing unit 101 divides the time frame width by multiple division frame widths, shifting the time frame width by a predetermined range, thereby creating divided data for the target device. Then, the data division processing unit 101 stores the created divided data.

[0031] FIG. 12 is a diagram illustrating an example of processing for dividing time-series data performed by the data division processing unit 101 according to some embodiments of the present disclosure. Specifically, for example, as shown in part (a) of FIG. 12, the data division processing unit 101 sets a division frame width 1 to a predetermined division unit 1 (e.g., every 5 seconds). Furthermore, as shown in part (b) of FIG. 12, the data division processing unit 101 sets a division frame width 2 to a predetermined division unit 2 (e.g., every 10 seconds). Furthermore, as shown in part (c) of FIG. 12, the data division processing unit 101 sets a division frame width 3 to a predetermined division unit 3 (e.g., every 20 seconds). Note that element A, element B, and element C in FIG. 12 are data obtained from sensor 301, sensor 302, and sensor 303, respectively.

[0032] Next, the anomaly correction proposal processor 104 refers to all the divided data for the target device (step S24). Then, for one of all the divided data for the target device, the anomaly correction proposal processor 104 calculates the degree of anomaly using the data for each element / division unit and the anomaly detection model in the learned data (step S25). Then, the anomaly correction proposal processor 104 determines whether the degree of anomaly is equal to or greater than a threshold (step S26).

[0033] When the anomaly correction proposal processor 104 determines that the degree of anomaly is equal to or greater than the threshold (YES in step S26), it notifies the user of the anomaly, generates a correction proposal for the data at the abnormal location (i.e., a normal data proposal), and outputs the generated correction proposal (step S27).Then, the anomaly correction proposal processor 104 determines whether the degree of anomaly has been calculated for all of the divided data for the target device (step S28).

[0034] If the anomaly correction proposal processing unit 104 determines that the degree of anomaly has not been calculated for even one of all the divided processed data for the target device (NO in step S28), it calculates the degree of anomaly for the divided processed data for the target device for which the degree of anomaly has not yet been calculated (step S29).Then, the anomaly correction proposal processing unit 104 proceeds to the processing of step S26.If the anomaly correction proposal processing unit 104 determines that the degree of anomaly has been calculated for all the divided processed data for the target device (YES in step S28), it ends the processing.

[0035] Moreover, when the abnormality correction proposal processor 104 determines that the abnormality degree is not equal to or greater than the threshold value (NO in step S26), the process proceeds to step S28.

[0036] (Process for creating normal data draft) 13 is a diagram illustrating a third example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Here, a process of generating a normal data proposal performed by the anomaly correction proposal processor 104 of the processing system 1 illustrated in FIG. 13 will be described.

[0037] The anomaly correction proposal processor 104 sets multiple sections with a certain width in the time direction for the anomaly data obtained from the segmented data for the target device (step S31). FIG. 14 is a diagram showing an example of anomaly data according to some embodiments of the present disclosure. For example, as shown in FIG. 14, the anomaly correction proposal processor 104 sets multiple sections with a certain width T in the time direction for the anomaly data. Then, the anomaly correction proposal processor 104 treats the anomaly data as a vector line with one or more control points in each section T (step S32). The number of control points is determined in advance.

[0038] The anomaly correction proposal processor 104 calculates the similarity between the image of the abnormal data and each image of the divided image data (step S33). For example, the anomaly correction proposal processor 104 calculates the similarity by vectorizing the image and comparing the vector distance.

[0039] The anomaly correction proposal processing unit 104 identifies the highest similarity from the calculated similarities and identifies segmented image data having a similarity similar to the identified highest similarity. The anomaly correction proposal processing unit 104 identifies data corresponding to the identified segmented image data in the learning segmentation processed data (step S34). The anomaly correction proposal processing unit 104 displays the identified data on the display unit 105 (step S35). FIG. 15 is a diagram illustrating an example of data identified by the anomaly correction proposal processing unit 104 according to some embodiments of the present disclosure. The anomaly correction proposal processing unit 104 identifies, for example, data as shown in FIG. 15 in the learning segmentation processed data.

[0040] The anomaly correction proposal processor 104 calculates the sum of the differences between the values ​​at the control points in each section T and the values ​​of similar normal data for the identified learning division processed data (step S36). Note that a section is a division unit width divided into fixed widths. For sections T with the largest sum of differences, the anomaly correction proposal processor 104 repeatedly increases the number of sections by one (i.e., widens the sections) in order from the section T with the largest difference up to a predetermined fixed number of sections (step S37).

[0041] The anomaly correction proposal processor 104 randomly selects control points that reduce the difference in all sections within a certain range and brings the selected control points closer to the data that has been subjected to the learning division process (i.e., normal data) to a certain extent (step S38). At this time, the magnitude of the difference within section T is reduced by the amount that the control points are brought closer to the data that has been subjected to the learning division process. For example, the value by which this difference is reduced is set to approximately the same as the value by which the difference of the initially selected control point is reduced. Note that the value of a control point closer to the control point whose value is being brought closer may be changed more significantly. Furthermore, since changing the value of only one point when reducing the difference results in a concave shape in only one part of the graph, a process may be performed to smoothly change the concave part. The anomaly correction proposal processor 104 calculates the degree of anomaly. The anomaly correction proposal processor 104 determines whether the calculated degree of anomaly is within a threshold (step S39).

[0042] If the anomaly correction proposal processor 104 determines that the abnormality level is not within the threshold (NO in step S39), the process returns to step S38. If the anomaly correction proposal processor 104 determines that the abnormality level is within the threshold (YES in step S39), the anomaly correction proposal processor 104 identifies the divided data of the target device with the smallest sum of differences across all sections T (step S40). The anomaly correction proposal processor 104 then retains the identified divided data (step S41). The anomaly correction proposal processor 104 then displays the identified divided data as a normal data proposal on the display unit 105 (step S42). Note that the divided data here refers to data acquired from the original data, not data after values ​​have been changed. FIG. 16 illustrates an example of a normal data proposal that the anomaly correction proposal processor 104 displays on the display unit 105 together with the abnormal data, as shown in FIG. 16, for example.

[0043] The anomaly correction proposal processor 104 determines whether the sum of the differences in each section T from the identified divided data is equal to or greater than a predetermined value (step S43). If the anomaly correction proposal processor 104 determines that the sum of the differences is less than the predetermined value (NO in step S43), it terminates the processing. If the anomaly correction proposal processor 104 determines that the sum of the differences is equal to or greater than a predetermined value (YES in step S43), it causes the display unit 105 to prominently display, for example, highlight the section T in the normal data proposal (step S44). Then, the anomaly correction proposal processor 104 terminates the processing.

[0044] The anomaly correction proposal processor 104 may use reinforcement learning to find a normal data proposal that minimizes the sum of the differences in the vertical axis direction and has an anomaly degree equal to or less than a threshold value.

[0045] (advantage) The processing system 1 according to one embodiment of the present disclosure has been described above. In the anomaly detection device 10 (an example of a processing device) of the processing system 1, the anomaly correction proposal processor 104 (an example of a first processing device) obtains proposed normal data for abnormal data detected in the target device 30 (an example of a device that is a target of anomaly detection). Then, the anomaly correction proposal processor 104 displays the obtained proposed normal data.

[0046] This anomaly detection device 10 (an example of a processing device) can show the operator how much correction is required to return a value to normal at a given time. In other words, the anomaly detection device 10 (an example of a processing device) can improve convenience.

[0047] 17 is a diagram illustrating an example of the configuration of a processing device 300 according to some embodiments of the present disclosure. As shown in FIG.

[0048] The first processing unit 301 calculates a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the calculated normal data proposal. The first processing unit 301 can be realized, for example, by using the function of the anomaly correction proposal processing unit 104 illustrated in Fig. 1. The processing device 300 can be realized, for example, by using the function of the anomaly detection device 10 illustrated in Fig. 1.

[0049] Next, a description will be given of processing performed by the processing device 300 according to some embodiments of the present disclosure. Fig. 18 is a diagram showing an example of a processing flow of the processing device 300 according to some embodiments of the present disclosure. Here, the processing of the processing device 300 will be described with reference to Fig. 18.

[0050] In the processing device 300, the first processing unit 301 obtains a normal data proposal for abnormal data detected in a device that is a target for abnormality detection, and displays the obtained normal data proposal (step S101).

[0051] The processing device 300 according to some embodiments of the present disclosure has been described above. The processing device 300 can improve convenience.

[0052] The order of the processes in each embodiment of the present disclosure may be changed as long as the processes are performed appropriately.

[0053] Each embodiment of the present disclosure has been described, but the processing system 1, anomaly detection device 10, learning device 20, target device 30, and other control devices may have a computer system built therein. The above-described processing steps are stored in the form of a program on a computer-readable recording medium, and the computer reads and executes this program to perform the above processing. Specific examples of computers are shown below.

[0054] 19 is a schematic block diagram showing the configuration of a computer according to at least one embodiment. As shown in FIG. 19, the computer 5 includes a CPU (Central Processing Unit) 6, a main memory 7, a storage 8, and an interface 9.

[0055] For example, the above-described processing system 1, anomaly detection device 10, learning device 20, target device 30, and other control devices are each implemented in a computer 5. The operations of each of the above-described processing units are stored in the form of a program in storage 8. CPU 6 reads the program from storage 8, loads it into main memory 7, and executes the above-described processing in accordance with the program. Furthermore, CPU 6 allocates storage areas in main memory 7 corresponding to each of the above-described storage units in accordance with the program.

[0056] Examples of storage 8 include a hard disk drive (HDD), a solid state drive (SSD), a magnetic disk, a magneto-optical disk, a compact disc read-only memory (CD-ROM), a digital versatile disc read-only memory (DVD-ROM), and a semiconductor memory. Storage 8 may be an internal medium directly connected to the bus of computer 5, or an external medium connected to computer 5 via interface 9 or a communication line. In addition, when this program is distributed to computer 5 via a communication line, computer 5 that receives the program may load the program into main memory 7 and execute the above-mentioned processing. In at least one embodiment, storage 8 is a non-transitory tangible storage medium.

[0057] The program may also implement some of the functions described above. Furthermore, the program may be a file that can implement the functions described above in combination with a program already recorded in the computer system, a so-called differential file (differential program).

[0058] Although several embodiments of the present disclosure have been described, these embodiments are merely examples and do not limit the scope of the disclosure. Various additions, omissions, substitutions, and modifications may be made to these embodiments without departing from the spirit of the disclosure.

[0059] Note that part or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0060] (Appendix 1) a first processing unit that determines a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the determined normal data proposal; A processing device comprising:

[0061] (Appendix 2) The first processing unit is Displaying the proposed normal data together with the abnormal data; 10. The processing device of claim 1.

[0062] (Appendix 3) The first processing unit is Displaying the normal data proposal superimposed on the abnormal data; 3. The processing device of claim 2.

[0063] (Appendix 4) The first processing unit is a portion of the normal data proposal that indicates a value equal to or greater than a predetermined value is displayed in a manner different from a portion that indicates a value less than the predetermined value; 4. The processing device according to claim 1,

[0064] (Appendix 5) a second processing unit that generates an anomaly detection model for each element / division unit of the time-series data in the divided data for learning by machine learning; Equipped with The first processing unit is Detecting the abnormal data based on the anomaly detection model generated by the second processing unit. 5. The processing device according to any one of claims 1 to 4.

[0065] (Appendix 6) A processing device according to any one of Supplementary Note 1 to Supplementary Note 5; a device that is a target of the abnormality detection; A processing system comprising:

[0066] (Appendix 7) determining a normal data proposal for the abnormal data detected in the device that is the target of anomaly detection, and displaying the determined normal data proposal; A processing method comprising:

[0067] (Appendix 8) Displaying the proposed normal data together with the abnormal data; Attachment 7, a processing method comprising:

[0068] (Appendix 9) displaying the proposed normal data overlaid on the abnormal data; Attachment 8, a processing method comprising:

[0069] (Appendix 10) displaying a portion of the proposed normal data that indicates a value equal to or greater than a predetermined value in a manner different from a portion that indicates a value less than the predetermined value; 10. The processing method according to any one of appendices 7 to 9,

[0070] (Appendix 11) Generating an anomaly detection model for each element / division unit of time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; 11. The processing method according to any one of claims 7 to 10,

[0071] (Appendix 12) On the computer, determining a normal data proposal for the abnormal data detected in the device that is the target of anomaly detection, and displaying the determined normal data proposal; A program that executes the following.

[0072] (Appendix 13) Displaying the proposed normal data together with the abnormal data; 13. The program according to claim 12, which causes the computer to execute the above steps.

[0073] (Appendix 14) Displaying the proposed normal data overlaid on the abnormal data; 14. The program according to claim 13, which causes the computer to execute the above steps.

[0074] (Appendix 15) displaying a portion of the proposed normal data that indicates a value equal to or greater than a predetermined value in a manner different from a portion that indicates a value less than the predetermined value; 15. The program according to any one of appendices 12 to 14, which causes the computer to execute the above.

[0075] (Appendix 16) Generating an anomaly detection model for each element / division unit of time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; 16. The program according to any one of appendices 12 to 15, which causes the computer to execute the above. [Explanation of symbols]

[0076] 1. Processing System 5. Computer 6 CPU 7. Main memory 8. Storage 9. Interface 10. Anomaly detection device 20. Learning Device 30. Target device 101 Data division processing unit 102 Image processing unit 103 Learning processing unit 104: Abnormal correction proposal processing unit 105...Display section 201a, 201b, 201c, 301a, 301b, 301c... Sensor

Claims

1. a first processing unit that determines a normal data proposal for abnormal data detected in a device that is a target of abnormality detection, and displays the determined normal data proposal; A processing device comprising:

2. The first processing unit Displaying the proposed normal data together with the abnormal data; The processing device of claim 1 .

3. The first processing unit Displaying the normal data proposal superimposed on the abnormal data; The processing device according to claim 2 .

4. The first processing unit a portion of the normal data proposal that indicates a value equal to or greater than a predetermined value is displayed in a manner different from a portion that indicates a value less than the predetermined value; The processing device according to any one of claims 1 to 3.

5. a second processing unit that generates an anomaly detection model for each element / division unit of the time-series data in the division-processed data for learning by machine learning; Equipped with The first processing unit detecting the abnormal data based on the anomaly detection model generated by the second processing unit; The processing device of claim 1 .

6. The processing device according to claim 1 ; a device that is a target of the abnormality detection; A processing system comprising:

7. determining a normal data proposal for the abnormal data detected in the device that is the target of anomaly detection, and displaying the determined normal data proposal; A processing method comprising:

8. On the computer, determining a normal data proposal for the abnormal data detected in the device that is the target of anomaly detection, and displaying the determined normal data proposal; A program that executes the following.

Images