Abnormality detection device and abnormality detection method

Abstract

To detect abnormality of a signal without using measurement data of a large amount of abnormal signals.SOLUTION: The abnormality detection device 1 includes the learning unit 12 configured to perform adversarial training of a generation model including the generator 121 configured to generate pseudo abnormality information similar to true abnormality information using a mixture probability model having a set parameter as the true abnormality information representing an appearance pattern of an abnormal frequency component included in a signal, and the discriminator 122 configured to discriminate between the pseudo abnormality information generated by the generator 121 and the true abnormality information, the generation unit 14 configured to generate the pseudo abnormality information using the learned generator 121 ' constructed by the learning unit 12, and the detection unit 17 configured to detect an abnormality of the signal based on the pseudo abnormality information generated by the generation unit 14.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an abnormality detection device and an abnormality detection method. [Background technology]

[0002] Conventionally, there have been known techniques for analyzing the characteristics of a time-series signal in the frequency domain and detecting anomalies contained in the signal. For example, Patent Document 1 discloses a technique for estimating anomalies in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of both normal and abnormal signals as training data.

[0003] However, in the technology disclosed in Patent Document 1, in order to construct a model with sufficient accuracy for detecting anomalies, it is necessary to obtain a sufficient number of anomalous signals, and the anomalous signals must be accumulated over a long period of time. Furthermore, even when detecting signal anomalies in the frequency spectrum using statistical methods, a large amount of measurement data of the anomalous signals may be required. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-027386 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, with conventional techniques, it may be difficult to detect an abnormality in a signal without using a large amount of measurement data of the abnormal signal.

[0006] The present invention has been made to solve the above-mentioned problems, and has an object to detect abnormalities in a signal without using a large amount of measurement data of the abnormal signal. [Means for solving the problem]

[0007] In order to solve the above-described problems, an anomaly detection device according to the present invention includes: a first setting unit configured to set a distribution of observation data, which is a set of observation values, for a mixed probability model, where the observation value is whether or not the intensity of each frequency component in the frequency spectrum of the signal exceeds a threshold, so as to represent an appearance pattern of anomalous frequency components in which the intensity of a specific frequency component included in the signal exceeds the threshold; a second setting unit configured to set parameters of the mixed probability model based on the set distribution of observation data; a learning unit configured to perform adversarial learning of a generative model using the mixed probability model having the set parameters as true anomaly information representing the appearance pattern of the anomalous frequency component included in the signal; a generator that generates pseudo-anomaly information similar to the true anomaly information; and a classifier that distinguishes between the pseudo-anomaly information generated by the generator and the true anomaly information; a generation unit configured to generate the pseudo-anomaly information using the trained generator constructed by the learning unit; and a detection unit configured to detect anomalies in the signal based on the pseudo-anomaly information generated by the generation unit.

[0008] In addition, the abnormality detection device of the present invention may further include a collection unit configured to collect the signal measured by a terminal, and the detection unit may detect an abnormality in the signal when a frequency spectrum including the abnormal frequency component indicated by the pseudo-abnormality information matches the frequency spectrum of the signal collected by the collection unit.

[0009] In addition, in the anomaly detection device according to the present invention, the mixed probability model may be a model that follows a mixed Bernoulli distribution, and the parameters of the mixed probability model may include a mixture ratio that represents the probability that each of the clusters will generate the observed value, and a probability that the observed value of each of the clusters will have a value in which the intensity of the frequency component exceeds the threshold.

[0010] In order to solve the above-described problems, the anomaly detection method of the present invention includes: a first setting step of setting a distribution of observation data, which is a set of observation values, for a mixture probability model, whose observation values ​​indicate whether or not the intensity of each frequency component in the frequency spectrum of a signal exceeds a threshold, so that the distribution of observation data, which is a set of the observation values, represents an appearance pattern of anomalous frequency components in which the intensity of a specific frequency component included in the signal exceeds the threshold; a second setting step of setting parameters of the mixture probability model based on the set distribution of observation data; a learning step of performing adversarial learning of a generative model using the mixture probability model having the set parameters as true anomaly information representing the appearance pattern of the anomalous frequency component included in the signal, the generative model having the set parameters, a generator that generates pseudo-anomaly information similar to the true anomaly information, and a classifier that distinguishes between the pseudo-anomaly information generated by the generator and the true anomaly information; a generation step of generating the pseudo-anomaly information using the trained generator constructed in the learning step; and a detection step of detecting an anomaly in the signal based on the pseudo-anomaly information generated in the generation step.

[0011] In addition, the anomaly detection method according to the present invention may further include a collection step of collecting the signal measured by a terminal, and the detection step may detect an anomaly in the signal when a frequency spectrum including the abnormal frequency component indicated by the pseudo-anomaly information matches the frequency spectrum of the signal collected in the collection step. [Effects of the Invention]

[0012] According to the present invention, adversarial learning of a generative model is performed using a mixture probability model having set parameters as true anomaly information representing the appearance pattern of abnormal frequency components contained in a signal, a generator that generates pseudo-anomaly information similar to the true anomaly information, and a classifier that distinguishes between the pseudo-anomaly information generated by the generator and true anomaly information. This makes it possible to detect signal anomalies without using a large amount of measurement data of the abnormal signal. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality detection system including an abnormality detection device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining an overview of the anomaly detection system according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining an overview of the anomaly detection system according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the learning unit included in the abnormality detection device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the learning unit included in the abnormality detection device according to this embodiment. [Figure 6] FIG. 6 is a diagram for explaining the learning unit included in the abnormality detection device according to this embodiment. [Figure 7] FIG. 7 is a block diagram showing the hardware configuration of the abnormality detection device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality detection device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality detection device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0015] [Configuration of anomaly detection system] First, an overview of an abnormality detection system including an abnormality detection device 1 according to an embodiment of the present invention will be described with reference to FIG.

[0016] The anomaly detection system includes an anomaly detection device 1 and a communication terminal 2 (terminal). The anomaly detection device 1 and the communication terminal 2 are connected via a network NW. The anomaly detection system according to this embodiment detects an anomaly in a signal based on the frequency spectrum of the signal measured by the communication terminal 2.

[0017] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0018] The communication terminal 2 can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, or the like. The communication terminal 2 includes a terminal that has a SIM card and is compatible with a mobile communication network, and a terminal that has an IP address and is configured as an IoT terminal. The communication terminal 2 also includes a mobile communication module and various sensors, and can detect various physical quantities and measure them as electrical signals. The communication terminal 2 transmits the measured signals to the anomaly detection device 1 via the network NW. In this embodiment, as an example, the signals to be detected for anomaly detection are the reception level and signal strength of signals received from base stations, which are periodically measured and recorded by the communication terminal 2 using the mobile communication module.

[0019] As shown in area 2a of FIG. 1, communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of an abnormality in signal strength from the waveform data of signal strength shown in area 2a. For this reason, abnormality detection device 1, which will be described later, converts the time-series data of signal strength into a spectrum in the frequency domain and analyzes the frequency components to detect an abnormality in the signal.

[0020] The anomaly detection system according to this embodiment, having the above-described configuration, employs a mixture probability model in which the frequency spectrum pattern of a signal is modeled using a mixture Bernoulli distribution. The anomaly detection system uses the mixture probability model, whose parameters are set to reflect the appearance pattern of anomalous frequency components in which the intensity of specific frequency components exceeds a threshold, as true data for adversarial learning, to train a generator 121 that generates pseudo data similar to the true data. Furthermore, the anomaly detection system maintains a database of anomalous signals, and detects signal anomalies by comparing the pseudo data generated using the trained generator 121' with the frequency spectrum of collected actual signals.

[0021] [Function block of the anomaly detection device] Next, functional blocks of the anomaly detection device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the anomaly detection device 1 includes a first setting unit 10, a second setting unit 11, a learning unit 12, a first storage unit 13, a generation unit 14, a second storage unit 15, a collection unit 16, a detection unit 17, and a presentation unit 18.

[0022] The first setting unit 10 sets the distribution of observed data, which is a set of observed values, for a mixed probability model in which the observed values ​​indicate whether the intensity of each frequency component in the frequency spectrum of the signal exceeds a threshold, so as to represent an appearance pattern of anomalous frequency components in which the intensity of a specific frequency component contained in the signal exceeds a threshold. In this embodiment, a model following a mixed Bernoulli distribution is adopted as the mixed probability model. The observed values ​​are values ​​that represent, as binary data, whether the intensity of each frequency component exceeds a threshold in the frequency spectrum of a signal, such as the signal intensity measured by the communication terminal 2. The threshold value is a value that can distinguish between normal intensity values ​​and intensity peak values ​​that indicate the occurrence of an abnormality. In the frequency spectrum, frequency components whose intensity exceeds the threshold are anomalous frequency components, and this indicates an abnormality in the signal.

[0023] The mixed Bernoulli distribution employed in this embodiment is a model for clustering a set of N pieces of observed data formed by vectors of length D whose elements are 0 and 1. In this embodiment, the appearance patterns of abnormal frequency components whose intensity exceeds a threshold on the frequency axis of a frequency spectrum obtained by Fourier transforming a signal are considered as multiple clusters, and the observed data is a set of observed values ​​in which whether the intensity exceeds the threshold is expressed as 0 or 1 for each of the multiple frequency components on the frequency axis. In addition, the observed values ​​are generated from multiple different clusters having a binary distribution.

[0024] Here, we have N binary vector observations x1,x2,…,x N The set of observed data X is given by the parameters μ1,μ2,…,μ K The set of observed data X follows a mixed Bernoulli distribution with a parameter dataset M. That is, we assume that the observed data X is generated from multiple clusters, and each cluster is associated with a parameter μ that represents the probability that the trial will be successful, i.e., the probability that the intensity of the frequency component will exceed a threshold.

[0025] The observation data X and the parameter data set M are expressed as the following equations (1) and (2), respectively (T is a transpose symbol).

number

[0026] nth binary vector observation x n and the kth parameter vector μ k Each of these is further expressed as a vector having D elements, as shown in the following equations (3) and (4).

number

[0027] Observation x n element x of nAs described above, each of (i) (i=1, 2, ..., D) is a binary variable that takes the value of 0 or 1. In this embodiment, the element x n (i) is defined as follows:

number

[0028] The probability that the intensity of each frequency component exceeds the threshold and the probability that the intensity of each frequency component does not exceed the threshold are expressed by the following equations (6) and (7), respectively.

number

[0029] From the above equations (6) and (7), the observed value x of the observed data X n When cluster k is assigned to observation x n is the parameter μ of cluster k k It follows the Bernoulli distribution of the following equation (8):

number

[0030] Here, the parameter data set π of the occurrence frequency of each cluster (K ​​clusters) is defined as follows: The parameter π is the observed value x n is a parameter that indicates how much of the data is distributed to each cluster. k is the observed value x of the observed data X n indicates the mixture ratio occurring in cluster k.

number

[0031] Also, the observed value x n When cluster k is assigned to observation x n is μ k It follows D Bernoulli distributions with parameters. Furthermore, each observation x nare independently generated by the mixed Bernoulli distribution of the following equation (10).

number

[0032] The parameter μ, which indicates the probability of the Bernoulli distribution in each cluster, is defined by the definition of the mixed Bernoulli distribution in equation (10). k and the cluster mixing ratio π k and from all clusters, observation x n The probability of occurrence of the above equation (10) is a mixed probability model in this embodiment, and represents the probability distribution in which the intensity of each frequency component exceeds a threshold value.

[0033] 2(a) and 2(b) and 3(a) and 3(b) show the distribution of the observed data X set by the first setting unit 10 and the second setting unit 11, and the parameter μ k , π k 2(a) and 3(a) show frequency spectra obtained by Fourier transforming a time-series signal indicating signal intensity, etc., shown in region 2a of FIG. 1. The vertical axis indicates intensity [dB], and the horizontal axis indicates frequency [Hz]. Clusters 1 to D shown in 2(b) and 3(b) show frequency components whose intensity in the frequency spectrum exceeds a threshold and their frequency, i.e., the overall appearance pattern of abnormal frequency components. D clusters are provided (K=D), which corresponds to the number of D frequency components. The numbers of frequency components in the vertical direction between clusters correspond to each other. The observation values ​​"1 to D" that make up each cluster are the observation values ​​x , which indicate whether the intensity of the frequency component exceeds the threshold for each of the 1 to D frequency components. n In the example of (b) of FIG. 2, for each data item 1 to D of each cluster, frequency components whose intensities exceed the threshold (black dots in the figure) and frequency components whose intensities do not exceed the threshold (data other than the black dots in the figure) are set.

[0034] In the example of FIG. 2(b), the first setting unit 10 sets one observation value of "exceeds the threshold: 1" for each cluster, and the other observation values ​​are set to "does not exceed the threshold: 0." Therefore, the observation value of the frequency component "1" in cluster 1, the observation value of the frequency component "2" in cluster 2, and the observation value of the frequency component "D" in cluster D are set to "exceeds the threshold: 1." Furthermore, the first setting unit 10 can set a probability (e.g., 90%) of "exceeds the threshold: 1." In this way, the first setting unit 10 can set which frequency component in each cluster will generate an abnormal frequency component whose intensity exceeds the threshold. For example, the first setting unit 10 can set an observation value that exceeds the threshold for a specific frequency component to represent a peak of the specific frequency component that appears in the frequency spectrum of a known abnormal signal.

[0035] The second setting unit 11 sets the parameters of the mixture probability model based on the distribution of the observation data X set by the first setting unit 10. The second setting unit 11 sets the parameters μ of the mixture probability model based on the frequency components having an intensity of “exceeding the threshold: 1” in each cluster set by the first setting unit 10 and the number of such frequency components. k , π k You can set the value of

[0036] The second setting unit 11 also sets the observed value x of each cluster by the first setting unit 10. n If you set the probability of occurrence of x, the observed value of each cluster will be n The mixture ratio is set taking into account the probability of occurrence of k , π k The value of can be adjusted and determined.

[0037] For example, as shown in FIG. 2(b), the second setting unit 11 sets the observed value x of each cluster by the first setting unit 10. n Based on the setting of the above, the proportions of clusters 1 to D in the observation data X can be set to be equal. In order to equalize the probability that each of clusters 1 to D is selected, the second setting unit 11 sets the parameters π1 to π DThe value of can be set to 1 / D. Furthermore, at this time, the second setting unit 11 sets a parameter π k and the observed value x n The parameter μ that represents the probability of occurrence of k These can be mutually coordinated and determined.

[0038] In this way, the second setting unit 11 sets the parameter μ based on the occurrence probability of an observed value in which the intensity value of each frequency component exceeds the threshold value, which is set for each cluster by the first setting unit 10. k , π k By adjusting the value of x, we can extract the x from a specific cluster in the mixture probability model of equation (10). n The probability of this occurring can be further adjusted.

[0039] FIG. 2(a) is a frequency spectrum showing the appearance pattern of abnormal frequency components in clusters 1 to D in FIG. 2(b). The intensity of all frequency components "1" to "D" exceeds the threshold value TH. In other words, the frequency spectrum in FIG. 2(a) is an appearance pattern of abnormal frequency components corresponding to the setting that the intensity of one frequency component in each cluster exceeds the threshold value TH, and furthermore, each cluster is set to be selected equally.

[0040] 3(b), the first setting unit 10 sets observed values ​​exceeding the threshold value TH for the frequency component "2" of cluster 2, the frequency component "4" of cluster 4, and the frequency component "10" of cluster 10 among clusters 1 to D. In addition, the second setting unit 11 sets the observed values ​​for the parameters of clusters 1 to D such that π2=π4=π 10 = 1 / 3. The parameter π for clusters other than clusters 2, 4, and 10 k is set to 0.

[0041] By setting the clusters in this way, as shown in Figure 3(a), an abnormal frequency component appearance pattern is obtained in which the intensities of the frequency components "2," "4," and "10" indicated by dotted lines exceed the threshold value TH, while the intensities of the other frequency components do not exceed the threshold value TH.

[0042] The first setting unit 10 and the second setting unit 11 select the observed value x from each cluster. n The mixed probability model in which the probability of occurrence and the probability of selection of each cluster are set in advance is used as true data during adversarial learning by the learning unit 12 described below.

[0043] The learning unit 12 learns the parameter μ set by the second setting unit 11. k , π k The adversarial learning of a generative model is performed using a mixture probability model having the following structure: a generator 121 that generates pseudo-anomaly information similar to the true anomaly information, and a classifier 122 that distinguishes between the pseudo-anomaly information generated by the generator 121 and the true anomaly information, with the mixture probability model having the following structure as true anomaly information representing the appearance pattern of abnormal frequency components contained in a signal; and a classifier 122 that distinguishes between the pseudo-anomaly information generated by the generator 121 and the true anomaly information. The true anomaly information is information that reflects a predetermined appearance pattern of abnormal frequency components. The learning unit 12 can construct a trained generator 121' (trained generators 121'_1, . . . , 121'_K) for each of 1 to K clusters of the mixture probability model. In this embodiment, D clusters are provided, and therefore trained generators 121'_1, . . . , 121'_D are constructed.

[0044] As shown in FIG. 4, the learning unit 12 adversarially trains a GAN (Generative Adversarial Network) having a generator 121 and a classifier 122. In this embodiment, it is possible to provide as many pairs of generators 121 and classifiers 122 as the number of clusters (K pairs). Alternatively, as shown in FIG. 4, it is possible to provide one classifier 122 for D generators 121_1, . . . , 121_D. Through learning by the learning unit 12, D trained generators 121′ (trained generators 121′_1, . . . , 121′_D) are constructed.

[0045] 5 and 6 are diagrams schematically illustrating the neural network configuration of the generator 121 and the classifier 122 of the GAN used by the learning unit 12. As shown in FIG. 5, the generator 121 is configured as a neural network having an input layer, a hidden layer, and an output layer. Note that the D generators 121_1, . . . , 121_D each have the same network structure, and will be collectively referred to as the generator 121 below. The generator 121 is a model that generates pseudo-anomaly information from random noise. For example, m Gaussian noise vectors are randomly sampled and input to the input node of the generator 121 (z1 to z m ).

[0046] The generator 121 performs a product-sum operation on the input and weight parameters and performs threshold processing using an activation function to output an output G(z). The output G(z) from the generator 121 is calculated based on the parameter μ set by the second setting unit 11. k , π k The data is similar to the observed data X obtained by a mixture probability model having the set parameter μ k , π k The observed values ​​x of each cluster obtained by a mixture probability model with n Each output G(z1) to G(z D ) is the observation x of each cluster n As the neural network that configures the generator 121, a CNN or a ResNet can be used.

[0047] 6 is configured as a neural network having an input layer, a hidden layer, and an output layer. In the example of FIG. 6, the parameter μ k , π k The observed values ​​x of each cluster are obtained by a mixture probability model with n is given.

[0048] The classifier 122 performs a product-sum operation on the input and weight parameters and threshold processing using an activation function, and outputs a binary output of 1 or 0. When the classifier 122 correctly identifies the input training data related to true abnormal information as true abnormal information, it outputs an output y=1. On the other hand, when the classifier 122 correctly identifies the input training data related to pseudo abnormal information as pseudo abnormal information, it outputs an output y=0. In this way, the classifier 122 is a model that distinguishes the model distribution generated by the generator 121 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 122.

[0049] FIG. 4 is a block diagram for explaining the adversarial learning of GAN by the learning unit 12. The generator 121 of the GAN adopted by the learning unit 12 is represented as a function G, and the classifier 122 is represented as a function D. Furthermore, true abnormality information is represented as x, the predicted value output by the classifier 122 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true abnormality information and 0 for pseudo abnormality information generated by the generator 121. In this case, the classifier 122 calculates the cross entropy E CE It can be expressed as:

[0050]

number

[0051] The first term in the brace of the above equation (11) represents t n lny n In this case, the predicted value y n is the correct label of the true anomaly information, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the value of the correct label (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0052] Here, the generator 121 that constitutes the GAN has parameters w G ,θ G and the function G(w G ,θ G ) The classifier 122 also uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (11) CE The objective function E of the GAN including the generator 121 and the discriminator 122 based on the above can be expressed by the following equation (12).

number

[0053] The first term of the above equation (12) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 122 classifies true abnormal information as true abnormal information. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 122 classifies the pseudo-anomaly information generated by the generator 121 as pseudo-anomaly information. In GAN learning, the generator 121 and the classifier 122 are trained adversarially through min-max optimization of the objective function E. Therefore, the generator 121 is trained to be able to generate pseudo-anomaly information that deceives the classifier 122, and the classifier 122 is trained to classify the pseudo-anomaly information generated by the generator 121 as pseudo-anomaly information.

[0054] In learning of the classifier 122, when true abnormality information is given, the classifier 122 outputs an output close to y=1, thereby maximizing the first term of the objective function E in the above equation (12). On the other hand, when pseudo abnormality information is given, the classifier 122 learns to output an output close to y=0, thereby maximizing the second term of the objective function E.

[0055] In the learning of the generator 121, D(G(w G ,θ G ),w D ,θ D ) (D(G(z)) in Figure 4) is close to 1. G ,θ G ) (G(z) in FIG. 4 ) to minimize the objective function E. The learning unit 12 uses a learning procedure that alternately updates the parameters of the generator 121 and the classifier 122. Details of the learning procedure of the generator 121 and the classifier 122 by the learning unit 12 will be described later.

[0056] The first storage unit 13 stores a trained generator 121′ in which the objective function E of the GAN has been optimized by the learning unit 12. More specifically, the first storage unit 13 stores D trained generators 121′ (trained generators 121′_1, . . . , 121′_D) corresponding to clusters 1 to D. The first storage unit 13 also stores a parameter μ k , π k The true abnormality information is stored as the mixed probability model of the above equation (10) in which

[0057] The generation unit 14 generates pseudo-anomaly information using the trained generator 121′ constructed by the learning unit 12. More specifically, the generation unit 14 performs calculations on each of D trained generators 121′_1, . . . , 121′_D corresponding to clusters 1 to D (K=D) to generate pseudo-anomaly information. The pseudo-anomaly information generated by the trained generator 121′ is different anomaly information that conforms to the characteristics of true anomaly information generated as a result of the GAN learning the characteristics of true anomaly information by itself through unsupervised learning.

[0058] The second storage unit 15 stores the pseudo-abnormal information generated by the generation unit 14. The pseudo-abnormal information stored in the second storage unit 15 is an appearance pattern of abnormal frequency components contained in a signal, that is, a database of abnormal signals.

[0059] The collection unit 16 collects signals measured by the communication terminal 2. For example, the collection unit 16 can collect time-series data of signal strength measured by the communication terminal 2 via the network NW. Alternatively, the collection unit 16 may collect time-series data of signal strength directly from the communication terminal 2. The collection unit 16 also performs a Fourier transform on the collected signals to obtain a frequency spectrum.

[0060] The detection unit 17 detects an abnormality in the signal based on the pseudo-abnormality information generated by the generation unit 14. The detection unit 17 can detect an abnormality in the signal when a frequency spectrum including an abnormal frequency component indicated by the pseudo-abnormality information generated by the generation unit 14 matches the frequency spectrum of the signal collected by the collection unit 16.

[0061] More specifically, the detector 17 converts the frequency spectrum of the time-series data of signal strength collected by the collector 16 into binary data of the strength of each frequency component corresponding to the above formula (5). Specifically, the detector 17 converts the strength of each frequency component of the frequency spectrum of the collected signal into a binary representation of "exceeds the threshold: 1" and "does not exceed the threshold: 0" based on the strength threshold.

[0062] The detection unit 17 can detect a signal abnormality when the binary data of the intensity of each frequency component according to the above formula (5) based on the probability that the intensity of each frequency component exceeds a threshold, as indicated by the pseudo-abnormality information, matches the binary data of the intensity of the frequency component in the frequency spectrum of the collected signal. Furthermore, the detection unit 17 can sequentially compare the binary data of the intensity of each frequency component in the frequency spectrum of the collected signal with the binary data of the intensity of each frequency component in the frequency spectrum of the signal indicated by the pseudo-abnormality information, and check for a match starting from the first frequency component. For example, depending on the signal characteristics and the type of abnormality, as shown in FIG. 3(a), a configuration may be adopted in which a signal abnormality is detected when some of the intensities of the frequency components in the binary data match, rather than when all of the peak values ​​of the abnormal frequency components match.

[0063] The presentation unit 18 presents the detection result of the signal abnormality by the detection unit 17. For example, the presentation unit 18 can notify an external communication quality control server (not shown) or the like via the network NW of the occurrence of an abnormality in the signal strength in the communication terminal 2 and information on the frequency component in which the abnormality occurs.

[0064] [Hardware configuration of the anomaly detection device] Next, an example of a hardware configuration for realizing the abnormality detection device 1 having the above-described functions will be described with reference to FIG.

[0065] 7, the abnormality detection device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106, which are connected via a bus 101, and a program that controls these hardware resources. Furthermore, the abnormality detection device 1 includes a display device 107.

[0066] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0067] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the anomaly detection device 1, such as the first setting unit 10, the second setting unit 11, the learning unit 12, the generation unit 14, the collection unit 16, the detection unit 17, and the presentation unit 18 shown in FIG.

[0068] The communication interface 104 is an interface circuit for connecting the abnormality detection device 1 to various external electronic devices via a network.

[0069] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a hard disk or semiconductor memory such as a flash memory as the storage medium.

[0070] The auxiliary storage device 105 has a program storage area for storing an anomaly detection program that detects signal anomalies. The auxiliary storage device 105 also has a program storage area for storing a mixed probability model calculation program that calculates a mixed probability model related to a mixed Bernoulli distribution. The auxiliary storage device 105 also has a program storage area for storing a learning program for performing GAN adversarial learning executed by the anomaly detection device 1. The auxiliary storage device 105 realizes the first storage unit 13 and the second storage unit 15 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0071] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0072] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can realize the presentation unit 18.

[0073] [Operation of the anomaly detection device] Next, the operation of the abnormality detection device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0074] 8, first, the first setting unit 10 sets the distribution of the observed data X in the mixed probability model (step S1). Specifically, the first setting unit 10 sets the distribution of the observed data x for each cluster so as to represent an appearance pattern of an abnormal frequency component in which the intensity of a specific frequency component included in the signal exceeds a threshold. n As explained in FIGS. 2 and 3, the number of clusters is the number of observations, that is, the number of frequency components (K=D).

[0075] Next, the second setting unit 11 adjusts the parameter μ of the mixture probability model so as to obtain the distribution of the observation data X set in step S1. k , π kSpecifically, the second setting unit 11 sets the observed value x set for each cluster in the mixed probability model of the above formula (10) (step S2). n Given the observed data X with k , π k For example, the second setting unit 11 adjusts and determines the observed value x for each cluster set in step S1. n Considering the probability of occurrence of k and set the parameter μ k , π k The values ​​of the parameters μ can be adjusted and determined. k , π k The mixed probability model in which is set is stored in the first storage unit 13 as true abnormality information.

[0076] Next, the learning unit 12 performs a learning process (step S3). Specifically, the learning unit 12 performs a learning process on the parameter μ k , π k As true abnormality information representing the appearance pattern of abnormal frequency components contained in a signal, a mixed probability model having the above formula is used, and adversarial learning of a GAN is performed, the mixed probability model having the formula:

[0077] Next, the generation unit 14 generates pseudo-anomaly information using the trained generator 121' constructed by the learning unit 12 in step S3 (step S4). More specifically, in step S4, the generation unit 14 performs calculations on each of the D trained generators 121'_1, . . . , 121'_D corresponding to clusters 1 to D to generate pseudo-anomaly information. Thereafter, the second storage unit 15 stores the pseudo-anomaly information generated in step S4 (step S5).

[0078] Next, the collection unit 16 collects signals measured by the communication terminal 2 (step S6). For example, the collection unit 16 can collect time-series data of signal strength measured by the communication terminal 2 via the network NW. Next, the collection unit 16 performs a Fourier transform on the collected signals to obtain a frequency spectrum (step S7). Subsequently, the detection unit 17 converts the frequency spectrum of the signals collected in step S6 and obtained by the conversion in step S7 into binary data for each frequency component corresponding to the above equation (5) (step S8). In step S8, based on the set threshold, the intensity for each frequency component is converted into binary data of "exceeds the threshold: 1" and "does not exceed the threshold: 0".

[0079] Next, the detection unit 17 detects an abnormality in the signal measured by the communication terminal 2 based on the pseudo-abnormality information stored in the second storage unit 15 in step S5 (step S9). The detection unit 17 can detect an abnormality in the signal when the binary data of the intensity of each frequency component of the frequency spectrum including the abnormal frequency component indicated by the pseudo-abnormality information generated by the generation unit 14 matches the binary data of the intensity of each frequency component of the frequency spectrum of the signal collected by the collection unit 16 in step S6 and further converted in steps S7 and S8. In step S9, the detection unit 17 can predict an abnormality in the signal when the binary data of the intensity of the frequency spectrum match at a frequency component before the peak value of the abnormal frequency component indicated by the pseudo-abnormality information appears.

[0080] Thereafter, the presenting unit 18 presents the detection result of the signal abnormality detected by the detecting unit 17 in step S9 (step S10). For example, in step S10, the presenting unit 18 can notify an external communication quality control server or the like via the network NW that an abnormality has occurred in the signal strength of the communication terminal 2 and the frequency component related to the abnormality.

[0081] Next, the learning process (step S3) by the learning unit 12 of the anomaly detection device 1 described in FIG. 8 will be described with reference to FIG. 9. In the example of the learning process shown in FIG. 9, the learning unit 12 repeatedly learns true abnormality information for each of 1 to D clusters. First, the learning unit 12 inputs the true abnormality information to the classifier 122 as training data 124, and adjusts the parameter w of the classifier 122 so that the true abnormality information is distinguished from the true abnormality information (y=1). D ,θ D is learned and updated (step S20).

[0082] As shown in the block diagram of the learning unit 12 in FIG. 4, the parameter μ set in step S2 in FIG. k , π k is true abnormality information that represents the appearance pattern of abnormal frequency components contained in a signal, and is used as training data 124 when training the classifier 122. In step S20, first, among clusters 1 to D, the observed values ​​x n is used as the training data 124. The true abnormality information is stored in the first storage unit 13 in advance.

[0083] In step S20, the learning unit 12 can cause the classifier 122 to learn true abnormality information using, for example, backpropagation. By step S20, the classifier 122 that can distinguish true abnormality information in cluster 1 from true abnormality information is constructed in advance.

[0084] Next, the learning unit 12 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 121 (step S21). Subsequently, the generator 121 generates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G and threshold processing using an activation function to generate pseudo abnormality information G(z) (step S22). In step S22, as shown in Fig. 4, the learning unit 12 combines 1 to D outputs generated by the D generators 121_1, ..., 121_D (point a shown in Fig. 4) to generate one pseudo abnormality information G(z).

[0085] Next, the learning unit 12 performs learning of the classifier 122. The learning of the classifier 122 is performed by using the parameter w D ,θ D First, the learning unit 12 fixes the parameter μ set in step S2 of FIG. k , π k The true anomaly information is input to the classifier 122 as training data 124. Then, the learning unit 12 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (12) is maximized. D ,θ D (Step S23). The label of the training data 124 is set to 1 (true abnormal information). In Step S23, first, the learning unit 12 updates the observed values ​​x n The classifier 122 is trained using the true abnormality information.

[0086] Next, the learning unit 12 provides the pseudo-abnormal information generated by the generator 121 in step S22 to the discriminator 122 as an input, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (12) is maximized. D ,θ D (Step S24). That is, in steps S23 and S24, in order to maximize the objective function E in the above equation (12), the first term is updated as D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D )=0. Note that the label 0 (pseudo abnormal information) is set in the training data 124. In step S24, the classifier 122 is trained using one pseudo abnormal information G(z) generated by each of the D generators 121_1, . . . , 121_D and combined.

[0087] The learning of the classifier 122 in steps S23 and S24 corresponds to the dashed arrows in the block diagram of the learning unit 12 shown in FIG. 4 , which indicate that a classifier error is calculated in block 125 of the objective function E based on output 123 from the classifier 122, and then the error is back-propagated to the classifier 122.

[0088] Next, the learning unit 12 learns the generators 121 (generators 121_1, . . . , 121_D). The learning of the generators 121 is performed with the parameters of the classifier 122 fixed. The learning unit 12 learns the generator 121 so that pseudo-anomaly information is generated when random Gaussian noise is given to the generator 121. Specifically, the learning unit 12 learns the parameters w G ,θ G is updated (step S25).

[0089] The learning in step S25 corresponds to the flow indicated by the dashed arrow indicating backpropagation of error to the generator 121 in the block diagram of the learning unit 12 in Fig. 4. That is, step S25 corresponds to the flow indicated by the dashed arrow in Fig. 4 in which pseudo anomaly information generated by the generator 121 is input to the discriminator 122, a generator error is calculated from the output 123 thereof in the block 125 of the objective function E, and the error is further backpropagated to the generator 121.

[0090] Thereafter, learning of the discriminator 122 and the generator 121 (generators 121_1 to 121_D) from step S22 to step S25 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S26: NO). On the other hand, if the value of the objective function E converges (step S26: YES), the processing from step S20 to step S26 is repeated using the remaining true abnormality information from cluster 2 to cluster D, out of all the true abnormality information from cluster 1 to cluster D, until learning of D generators 121_1, . . . , 121_D and the discriminator 122 is performed (step S27: NO).

[0091] Thereafter, when the generator 121 (generator 121_1 to generator 121_D) and the discriminator 122 are trained using the true anomaly information of the remaining D-1 clusters from cluster 2 to cluster D (step S27: YES), the training unit 12 stores 1 to D trained generators 121'_1, ..., 121'_D in the first storage unit 13 (step S28). The trained generator 121' is constructed by the above-described processes from step S20 to step S28. After that, the process proceeds to step S4 in FIG. 8.

[0092] As described above, according to the anomaly detection device 1 of this embodiment, the frequency spectrum pattern of the signal is modeled using a mixed Bernoulli distribution, and the parameter μ is set to obtain a distribution of the observation data X that is set to represent an appearance pattern of an abnormal frequency component in which the intensity of a specific frequency component exceeds a threshold. k , π k The mixed probability model with the above set is used as the true data in the GAN adversarial learning. Furthermore, the pseudo-anomalous information generated by the trained generator 121' constructed by the adversarial learning is stored in a database as an anomalous signal having an anomalous frequency component whose intensity exceeds a threshold, and an anomaly in the signal is detected when the frequency spectrum of the collected actual signal matches the frequency spectrum having the anomalous frequency component in the database. Therefore, it is possible to detect an anomaly in the signal without using a large amount of measurement data of the anomalous signal.

[0093] Furthermore, according to the anomaly detection device 1 of this embodiment, the parameter μ that reflects the appearance pattern of abnormal frequency components whose intensity exceeds a threshold in the frequency spectrum of the signal is k , π k The mixed probability model in which the above is set is used as true abnormal information, which is true data in the adversarial learning of the GAN, and a generator 121 is trained to generate pseudo abnormal information similar to the true abnormal information, i.e., pseudo abnormal information that does not necessarily match the true abnormal information. Therefore, by performing the adversarial learning of the GAN, it is possible to learn the latent variables of the mixed probability model that follows the mixed Bernoulli distribution.

[0094] Furthermore, according to the anomaly detection device 1 of this embodiment, whether or not the intensity of each frequency component in the frequency spectrum exceeds a threshold is used as the observation value for each cluster of the mixed Bernoulli distribution, so that it is possible to specify the occurrence of peaks at specific frequency components and their frequency for each cluster to accommodate various anomaly occurrence patterns. This makes it possible to set detailed anomaly occurrence patterns in the frequency domain specific to each signal, enabling more effective detection of signal anomalies.

[0095] Furthermore, according to the anomaly detection device 1 of this embodiment, the intensity of each frequency component of the frequency spectrum indicated by the pseudo anomaly information generated by the learned generator 121′ is compared with the intensity of each frequency component of the frequency spectrum of the actually measured signal, so that if parts of the spectrum match, it becomes possible to predict an anomaly in the signal.

[0096] In the embodiment described above, the first setting unit 10 sets a frequency component whose intensity is "exceeding the threshold: 1" or a frequency component whose intensity is "not exceeding the threshold: 0" for 1 to D observed values ​​of each cluster, and further sets the occurrence probability of each observed value. Also, the second setting unit 11 sets a mixing ratio parameter π k Furthermore, the parameter μ k and the mixing ratio parameter π k and adjust the parameter μ k , π k However, the first setting unit 10 sets specific binary values ​​for 1 to D observation values ​​of each cluster in the observation data X, and the second setting unit 11 sets the occurrence probability of each observation value, and the parameter μ k , π k may be configured to adjust each other.

[0097] In the embodiment described above, the signal measured by the communication terminal 2 is time-series data of signal strength. However, the time-series signal that is the target of anomaly detection is not limited to signal strength, as long as it is a signal that can be subjected to frequency analysis. For example, the communication terminal 2 may be configured to include a biosensor and measure time-series data of biosignals such as the user's heart rate, blood pressure, and body temperature. Alternatively, the communication terminal 2 may be configured to include various sensors such as a vibration sensor, a sound sensor, and a pressure sensor, and measure time-series data of physical quantities such as vibration, sound, and pressure.

[0098] In the embodiment described above, the communication terminal 2 is exemplified as a terminal equipped with a SIM card, such as a smartphone, and an IoT terminal having an IP address. However, the communication terminal 2 may be a conventional device without a communication function as long as it can input the time-series data of the measured signal to the anomaly detection device 1.

[0099] The above describes embodiments of the anomaly detection device and anomaly detection method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0100] 1...anomaly detection device, 2...communication terminal, 10...first setting unit, 11...second setting unit, 12...learning unit, 13...first memory unit, 14...generation unit, 15...second memory unit, 16...collection unit, 17...detection unit, 18...presentation unit, 101...bus, 102...processor, 103...main memory unit, 104...communication interface, 105...auxiliary memory unit, 106...input / output I / O, 107...display device, 121...generator, 121'...trained generator, 122...discriminator, 123...output, 124...training data, 125...block of objective function E, NW...network.

Claims

1. a first setting unit configured to set a distribution of observation data, which is a set of observation values, for a mixture probability model in which an observation value is whether or not an intensity of each frequency component in a frequency spectrum of a signal exceeds a threshold, so as to represent an appearance pattern of an abnormal frequency component in which an intensity of a specific frequency component included in the signal exceeds the threshold; a second setting unit configured to set parameters of the mixed probability model based on the set distribution of the observation data; a learning unit configured to perform adversarial learning of a generative model including: a generator that generates pseudo-anomaly information similar to true anomaly information, using the mixed probability model having the set parameters as true anomaly information representing an appearance pattern of the abnormal frequency component included in the signal; and a classifier that distinguishes between the pseudo-anomaly information generated by the generator and the true anomaly information; a generation unit configured to generate the pseudo anomaly information using a trained generator constructed by the learning unit; a detection unit configured to detect an abnormality in the signal based on the pseudo-abnormality information generated by the generation unit; An abnormality detection device comprising:

2. 2. The abnormality detection device according to claim 1, further comprising a collection unit configured to collect the signals measured at the terminal; The detection unit detects an abnormality in the signal when a frequency spectrum including the abnormal frequency component indicated by the pseudo-abnormality information matches a frequency spectrum of the signal collected by the collection unit. An abnormality detection device characterized by:

3. 2. The abnormality detection device according to claim 1, the mixed probability model is a model that follows a mixed Bernoulli distribution, The parameters of the mixture probability model include a mixture ratio representing the probability that each cluster generates the observed value, and a probability that the observed value of each cluster has a value in which the intensity of the frequency component exceeds the threshold. An abnormality detection device characterized by:

4. a first setting step of setting a distribution of observed data, which is a set of observed values, for a mixture probability model in which an observation value indicates whether or not the intensity of each frequency component in a frequency spectrum of a signal exceeds a threshold value, so as to represent an appearance pattern of an abnormal frequency component in which the intensity of a specific frequency component included in the signal exceeds the threshold value; a second setting step of setting parameters of the mixed probability model based on the set distribution of the observation data; a learning step of performing adversarial learning of a generative model including a generator that generates pseudo-anomaly information similar to true anomaly information representing an appearance pattern of the abnormal frequency component included in the signal using the mixture probability model having the set parameters, and a classifier that distinguishes between the pseudo-anomaly information generated by the generator and the true anomaly information; a generating step of generating the pseudo anomaly information using a trained generator constructed in the learning step; a detection step of detecting an abnormality in the signal based on the pseudo-abnormality information generated in the generation step; An anomaly detection method comprising:

5. The abnormality detection method according to claim 4, further comprising a collecting step of collecting the signals measured at a terminal; The detecting step detects an abnormality in the signal when a frequency spectrum including the abnormal frequency component indicated by the pseudo-abnormal information matches a frequency spectrum of the signal collected in the collecting step.

1. An anomaly detection method comprising:

Images