Anomaly detection devices and satellite systems

Abstract

In anomaly detection using machine learning, models must generally be created with little or no training data showing anomalies, which makes false positives more likely. [Solution] An anomaly detection device that inputs information about multiple devices into a learning model and detects anomalies in the devices based on the anomaly score obtained from the learning model, comprising a preprocessing means that generates preprocessed data for each device by performing a first reduction process to reduce the amount of information in the data acquired from a first device among the multiple devices, and a second reduction process to reduce the amount of information in the data acquired from a second device which is set to have a lower priority than the first device, and when the preprocessed data processed by the preprocessing means is input into the learning model, it is determined whether an anomaly has occurred based on the anomaly score output from the learning model.

Description

Technical Field

[0001] The present invention relates to an abnormality detection device and a satellite system.

Background Art

[0002] In a device having many devices such as artificial satellites, an abnormality in one device affects the entire system, so it is required to detect and deal with the abnormality of the device at an early stage. In order to detect an abnormality in such a device, it is necessary to determine whether there is an abnormality in consideration of the operating relationship between a plurality of devices. Therefore, it is difficult to use an abnormality detection method such as comparing a detection signal with a threshold value to determine whether there is an abnormality, and an abnormality detection method using machine learning has been studied.

[0003] Patent Document 1 describes a satellite operation analysis support system that includes learning means for learning a command executed by a satellite and a telemetry flow as a normal operation or an abnormal operation, and supports the analysis of the operation at the time of satellite abnormality.

[0004] In such abnormality detection using machine learning, there is a problem that false detection is likely to occur because generally, there is little teacher data indicating an abnormality, or a model has to be created without teacher data indicating an abnormality.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] Therefore, in order to improve the accuracy of abnormality detection using a learning model, it is necessary to minimize the ratio of false detection even when there is little correct data.

[0007] The objective of this invention is to solve the problems of the prior art described above. [Means for solving the problem]

[0008] To achieve the above objective, an anomaly detection device according to one aspect of the present invention has the following configuration. That is, An anomaly detection device that inputs information about multiple devices into a learning model and detects anomalies in the devices based on the anomaly score obtained from the learning model, comprising: a preprocessing means that generates preprocessed data for each device by performing a first reduction process on acquired data obtained from the multiple devices, which reduces the amount of information in the acquired data obtained from a first device among the multiple devices, and a second reduction process that reduces the amount of information in the acquired data obtained from a second device which is set to have a lower priority than the first device; and a determination means that determines whether an anomaly has occurred based on the anomaly score output from the learning model when the preprocessed data processed by the preprocessing means is input into the learning model. [Effects of the Invention]

[0009] According to the present invention, in anomaly detection using a learning model, the rate of false positives can be reduced even when there is a small amount of correct data.

[0010] Other features and advantages of the present invention will become apparent from the following description with reference to the accompanying drawings. In the accompanying drawings, the same or similar components are given the same reference numeral. [Brief explanation of the drawing]

[0011] The attached drawings are included in the specification and constitute part thereof, illustrating embodiments of the present invention and are used together with the description to explain the principles of the present invention. [Figure 1] A diagram schematically showing the configuration of a satellite system according to an embodiment of the present invention. [Figure 2]A block diagram (a) illustrating the functional configuration of an artificial satellite according to the embodiment, and a block diagram (b) illustrating the hardware configuration of an anomaly detection device according to the embodiment. [Figure 3] A functional block diagram (a) illustrating the software configuration of the satellite and anomaly detection device according to Embodiment 1, and a diagram (b) illustrating the processing in preprocessing. [Figure 4] A flowchart illustrating the overview of model learning for anomaly detection processing in a satellite system according to Embodiment 1. [Figure 5] A flowchart illustrating the filtering process in S402 shown in Figure 4. [Figure 6] A flowchart illustrating the abnormality detection determination process by the abnormality detection device according to the first embodiment. [Figure 7] A flowchart illustrating the abnormality determination process for S603 in Figure 6. [Figure 8] This diagram shows an example of a chart that will be attached to an email notification sent to the operator via S605. [Figure 9] A flowchart illustrating other abnormality determination processes for S603 in Figure 6. [Figure 10] A functional block diagram illustrating the software configuration of the satellite according to Embodiment 2. [Figure 11] A flowchart illustrating the processing performed by an artificial satellite according to Embodiment 2. [Modes for carrying out the invention]

[0012] Embodiments of the present invention will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention to the claims. While multiple features are described in the embodiments, not all of these features are essential to the invention, and the features may be combined in any way. Furthermore, in the attached drawings, the same or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0013] First, a system configuration according to an embodiment of the present invention will be described.

[0014] FIG. 1 is a diagram schematically showing the configuration of a satellite system according to an embodiment of the present invention.

[0015] The satellite system according to Embodiment 1 includes a satellite 10 and a ground station 20 including an antenna 21 and an information processing device 22.

[0016] The satellite 10 is a spacecraft (orbiting satellite) that observes the earth's surface or outer space from outside the atmosphere such as outer space or within the atmosphere. The satellite 10 includes devices (mission units) such as cameras necessary to perform the mission assigned to the satellite 10 and basic functions necessary for the satellite 10 to continue operating.

[0017] The antenna 21 is a receiving device that receives data such as measurement data (housekeeping data) that represents the operating state of the satellite itself from the satellite 10. The antenna 21 transfers the measurement data received from the satellite 10 to the information processing device 22. Further, the antenna 21 may have a function of transmitting an instruction to the satellite 10 received from the information processing device 22 to the satellite 10. Although only one antenna 21 is shown for simplicity, it may be composed of a plurality of antennas.

[0018] The information processing device 22 is an information processing device capable of various information processing and information transmission and reception. For example, the information processing device 22 may be any of a server device, a personal computer, a virtual machine, or a computer that provides a cloud service on the Internet.

[0019] Note that FIG. 1 shows an example in which an abnormality detection device described later is provided in the ground station 20. However, this abnormality detection device may be provided in the satellite 10. Alternatively, an abnormality detection device may be provided as an information processing device capable of communicating with the ground station 20 in addition to the ground station 20 and the satellite 10. Hereinafter, the case of FIG. 1 will be described as Embodiment 1, and an example in which the abnormality detection device is provided in the satellite 10 will be described as Embodiment 2.

[0020] Figure 2(a) is a block diagram illustrating the functional configuration of the artificial satellite 10 according to this embodiment.

[0021] The attitude control unit 201 controls the attitude of the artificial satellite 10 to be suitable for observation of the Earth's surface or outer space, based on the control of the control unit 206 which utilizes the position detection results of a position detection unit (not shown) and the like.

[0022] The power supply unit 202 includes solar panels and storage batteries, and supplies the necessary power to each part of the artificial satellite 10.

[0023] The mission unit 203 has functions to support satellite missions such as cameras.

[0024] The control unit 206 includes, for example, a ROM 211 that stores the CPU 210 and the programs executed by the CPU 210. Furthermore, the control unit 206 includes a RAM 212 that provides a work area for temporarily storing various data when the CPU 210 is executing a program.

[0025] The memory section 204 is a large-capacity data storage section that includes, for example, an HDD, flash memory, SSD, or SD card.

[0026] The communications unit 205 communicates with the server and other devices at the ground station 20 via an antenna to send and receive data.

[0027] Figure 2(b) is a block diagram illustrating the hardware configuration of the anomaly detection device 110 according to the embodiment. The anomaly detection device 110 is a device for detecting the normality or abnormality of the operation of the artificial satellite 10 based on measurement data from the artificial satellite 10.

[0028] The CPU 221 controls the overall operation of the anomaly detection device 110.

[0029] ROM222 stores programs executed by CPU221 and various data.

[0030] RAM223 provides a work area that temporarily holds various data when CPU221 is operating.

[0031] The memory unit 225 is a large-capacity memory that holds the anomaly detection model 230, which will be described later, and can also store various data in a non-volatile manner.

[0032] The input / output port 224 has the function of notifying operators, etc., of the results and degree of anomaly of the anomaly detection model 230 to external devices connected to the anomaly detection device 110, and the function of receiving updated anomaly detection models 230 and measurement data.

[0033] [Embodiment 1] Next, as Embodiment 1 of the present invention, we will describe an example in which a ground station 20 has an anomaly detection device 110 and the ground station 20 detects an anomaly in the artificial satellite 10.

[0034] Figure 3(a) is a functional block diagram illustrating the software configuration of the artificial satellite 10 and anomaly detection device 110 according to Embodiment 1.

[0035] The artificial satellite 10 collects measurement data (e.g., current values, voltage values) from various instruments (devices) included in the artificial satellite 10 and stores it in the database 301 on the artificial satellite 10. In Figure 3(a), instruments A to D are shown as examples of devices, but the system is not limited to these, and may consist of many more devices.

[0036] When the satellite 10 communicates with the ground station 20, it transmits measurement data to the ground station 20. The anomaly detection device 110 then stores the received measurement data in the ground station 20's database 310. It then performs preprocessing 311 on the measurement data and inputs it into the anomaly detection model 230. The anomaly detection model 230 calculates the degree of anomaly based on the input data and outputs it. The anomaly determination device 313 compares the degree of anomaly with a threshold to determine whether an anomaly has occurred in the satellite 10. If the anomaly detection device 110 determines that an anomaly has occurred in the satellite 10, it notifies the operator accordingly.

[0037] Although the database 310 for storing measurement data was described as being located within the anomaly detection device 110, it is not limited to this and may be configured as an external database.

[0038] The anomaly detection model 230 has a learning model created by inputting, for example, past satellite data. Here, for example, normal data (ground truth data) is picked from measurement data of current and voltage values ​​of satellite components, and a learning model is created by learning the relationships between parameters for each piece of ground truth data at a given point in time. Then, during operation, unknown data is input to the learned learning model, and it is verified whether the unknown data is likely to occur under normal conditions. If the probability is high, it is determined to be normal; if the probability is low, it is determined to be an anomaly. This determination of whether or not it is an anomaly is performed by the anomaly detection 313. As for the learning model, for example, a learning model that uses graphical lasso to find the relationships between variables (parameters) may be used.

[0039] Figure 3(b) is a diagram illustrating the process in pretreatment 311.

[0040] In preprocessing 311, information about high-priority equipment and information about low-priority equipment are processed separately. Here, high-priority equipment includes equipment 320 that is always in operation, such as components that control the attitude of an artificial satellite (attitude control unit), components related to power supply (power supply unit), control units, and power control units that control the power supply. Information about such always-in-operation equipment 320 (raw data obtained from equipment 320) is processed using general filters, such as moving averages. Here, for example, for time-series data (data that changes over time), the average or median value for each certain range is calculated while shifting that range, and the data is smoothed. Note that this certain range differs depending on the equipment.

[0041] Furthermore, lower-priority equipment includes, for example, equipment 321 such as the communications unit and the mission unit, which are powered on only temporarily, meaning they operate only when necessary. Information about these devices (raw data obtained from equipment 321) is represented as binary data indicating the ON / OFF state (operating state / non-operating state).

[0042] In this embodiment, high-priority and low-priority devices are distinguished based on whether they are always running or run only when needed, but they may be grouped based on other conditions.

[0043] By doing this, it is possible to create preprocessed data 324 in which the amount of information about low-priority devices is greatly reduced, and the amount of information about high-priority devices is reduced.

[0044] Figure 4 is a flowchart illustrating the overview of model learning for anomaly detection processing in the satellite system according to Embodiment 1.

[0045] First, in S401, as explained in Figure 3(a), normal data is collected from the measurement data of various instruments (devices) (instruments A to D) included in the artificial satellite 10. Next, in S402, preprocessing is performed to reduce the amount of information by filtering the normal data.

[0046] Figure 5 is a flowchart illustrating the filtering process in S402 of Figure 4.

[0047] In S501, it is determined whether the input information pertains to a high-priority device, such as a device that is always in operation. If so, the process proceeds to S502, where the information is processed using a general filter, such as a moving average. On the other hand, if the input information is not about a high-priority device, such as a device that is always in operation, i.e., if it pertains to a low-priority device, such as a device that is only temporarily powered on, the process proceeds to S503. In S503, the information is processed into binarized data indicating the ON / OFF state.

[0048] Once the processing in S502 or S503 is completed and the filtering is finished, the process proceeds to S403, where the information from the preprocessed data at a given point in time is input into the anomaly detection model. This allows the learning model to learn the relationships between the parameters.

[0049] The learning model can be trained using pre-stored data, or it can be trained each time ground truth data is acquired while the satellite 10 is in operation.

[0050] Figure 6 is a flowchart illustrating the anomaly detection determination process by the anomaly detection device 110 according to Embodiment 1. The program that executes this process is stored in the ROM 222 of the anomaly detection device 110, and the CPU 221 executes this program to realize the process shown in this flowchart. The measurement data input to the learning model in this process is unknown data, and it is unclear whether it is normal or abnormal.

[0051] First, in S601, CPU221 performs the aforementioned preprocessing on the measurement data of satellite 10 stored in database310.

[0052] Next, the process moves to S602, where the CPU 221 inputs the pre-processed data into the machine learning model, the anomaly detection model 230.

[0053] Next, the process moves to S603, where the CPU 221 determines whether an anomaly has occurred based on the anomaly degree output from the anomaly detection model 230 and a pre-set threshold.

[0054] Figure 7 is a flowchart illustrating the abnormality determination process for S603 in Figure 6.

[0055] In S701, the CPU 221 determines whether the anomaly level output from the anomaly detection model 230 is greater than a preset threshold. If the anomaly level is determined to be greater than the threshold, the process proceeds to S702, where the CPU 221 determines that an anomaly has occurred and terminates this process. On the other hand, if the anomaly level is determined to be less than or equal to the threshold in S701, the process proceeds to S703, where the CPU 221 determines that it is normal and terminates this process.

[0056] Once the abnormality determination process in S603 is complete, the process proceeds to S604. If the abnormality determination process determines that an abnormality has occurred, the process proceeds to S605, and the abnormality is notified to the operator. On the other hand, if the abnormality determination process determines that the system is normal, i.e., that no abnormality has occurred, the process ends there.

[0057] Figure 8 shows an example of a chart attached to an email notification sent to the operator via S605. In Figure 8, the horizontal axis represents elapsed time (seconds), and the vertical axis represents the degree of anomaly.

[0058] Figure 8(a) shows the waveform of the actually measured data, and Figure 8(b) shows the state when an abnormality was detected. In Figure 8(b), 901 to 903 show the state when the abnormality level exceeds the threshold of 904 and an abnormality occurs.

[0059] By notifying the operator of the raw measurement data of each device for a predetermined period prior to the occurrence of the anomaly—that is, the data before pre-processing and the data indicating the anomaly—the operator can easily and accurately confirm the situation.

[0060] Furthermore, this notification may include information indicating which device the data comes from, in addition to the chart mentioned above.

[0061] Furthermore, such charts may be displayed, for example, as a pop-up on the monitors of the ground station 20.

[0062] Figure 9 is a flowchart illustrating other processes for determining the degree of abnormality in S603 of Figure 6.

[0063] Here, in S801, the CPU 221 sets a threshold according to the operating mode of the satellite 10. Then, in S802 to S804, the abnormality level output from the anomaly detection model 230 is compared with the pre-set threshold to determine whether an anomaly has occurred. The processing in S802 to S804 is the same as S701 to S703 in Figure 7 above, so the explanation is omitted.

[0064] The threshold settings described above, which correspond to the operating mode, involve changing the threshold settings depending on the amount of correct data that can be acquired. By setting a higher threshold in operating modes with little correct data and a lower threshold in operating modes with a lot of correct data, it is possible to reduce the rate of false positives.

[0065] In Embodiment 1, notifications were set to be sent only in the event of an abnormality, but the system is not limited to this; notifications may also be sent periodically during normal operation.

[0066] Furthermore, while Embodiment 1 describes the operation assuming that the operator will take action on the satellite 10 after being notified of an anomaly, the invention is not limited to this. For example, notification may be sent to the ground station 20 using a pop-up or the like. In addition, the ground station 20 may automatically determine what action to take depending on the device (component) of the satellite 10 that is thought to be showing an anomaly, and then take action on the satellite 10. As for taking action on the satellite 10, for example, if the anomaly score output from the learning model exceeds a preset threshold value, if the equipment that caused the anomaly score to increase can be identified, the equipment in question may be reset. Also, if the value deviates significantly from the preset threshold value (significantly exceeds it), it may be assumed that there is a possibility of latch-up, etc. If the equipment that caused the anomaly score to increase can be identified, the power to the equipment in question may be turned off, or if it cannot be identified, all equipment may be reset and the satellite 10 may be put into safe mode.

[0067] [Embodiment 2] Next, as Embodiment 2 of the present invention, an example in which the artificial satellite 10 has an anomaly detection device 110 will be described. Although it is omitted in the configuration of the artificial satellite 10 in Figure 2(a) relating to Embodiment 1, the artificial satellite relating to Embodiment 2 will include the anomaly detection device 110 shown in Figure 2(b). Furthermore, since the anomaly detection device 110 in Figure 3 is located within the artificial satellite 10, the database of the anomaly detection device 110 used in Embodiment 1 is shared with the database 301 in which the artificial satellite 10 stores measurement data. However, this embodiment is not limited to this, and processing may be performed using a separate database for the anomaly detection device, in addition to the database 301.

[0068] Furthermore, the learning model according to Embodiment 2 is the same as the learning model according to Embodiment 1, so its explanation will be omitted.

[0069] Figure 10 is a functional block diagram illustrating the software configuration of the artificial satellite 10 according to Embodiment 2. In Figure 10, the same reference numerals are used for parts that are common with the configuration of Figure 3(a) according to Embodiment 1 described above, and their explanations are omitted.

[0070] Figure 11 is a flowchart illustrating the processing performed by the satellite 10 according to Embodiment 2. The program that performs this processing is stored in the ROM 211 of the control unit 206 of the satellite 10, and the CPU 210 executes this program to realize the processing shown in this flowchart.

[0071] In Embodiment 2, as in Embodiment 1, measurement data from various devices (e.g., current values, voltage values) are stored in the database 301. This data is used to perform anomaly detection processing as shown in Figure 11. The processing from S1101 to S1104 in Figure 11 is essentially the same as the processing from S601 to S604 in Figure 6, except that the executing entity changes from CPU 221 to CPU 210, so it will be explained briefly.

[0072] In S1103, an abnormality determination is performed, and when an abnormality level is output from the anomaly detection model 230, that abnormality level is saved to the database 301 and the process proceeds to S1104.

[0073] If S1104 determines that an abnormality has occurred in CPU210, the process proceeds to S1105. If it determines that there is no abnormality, this process is terminated.

[0074] In S1105, CPU210 determines whether the satellite itself can handle the anomaly. Here, we explain that the satellite determines it can handle the anomaly if the solution is to perform a reset; however, this is not the only solution, and other methods may be used.

[0075] If the CPU 210 determines in S1105 that the satellite itself can handle the issue, it proceeds to S1106. The CPU 210 outputs a log to the memory unit 204 indicating that the malfunctioning equipment, or all equipment, will be reset, then performs the reset of the equipment to be reset and proceeds to S1107. After that, it outputs a log indicating that the reset of the equipment to be reset is complete. These logs are saved in the database 301.

[0076] On the other hand, if CPU210 determines in S1105 that the satellite itself cannot handle the situation, it proceeds to S1107 without performing a reset.

[0077] Then, in S1107, the satellite transmits log data, such as measurement data, stored in database 301, to ground station 20.

[0078] When the ground station 20 receives log data, it performs log analysis. Based on the results of this analysis, it notifies the operator of information regarding any abnormalities in the satellite 10, such as whether an anomaly that the satellite itself can handle has occurred and a reset has been performed, or whether an anomaly that the satellite itself cannot handle has occurred. At this time, the notification may also include a time chart, as explained in Figure 8.

[0079] In Embodiment 2, the analysis of log data received from the satellite 10 was described as being performed at the ground station 20, but the analysis may also be performed within the satellite 10. In that case, the results of the analysis performed within the satellite 10 should be transmitted to the ground station 20 along with the measurement data.

[0080] Alternatively, instead of immediately resetting in S1106, the reset may be performed only when an anomaly is detected consecutively more than a predetermined number of times. Or, prioritizing the continued operation of satellite 10, the reset may be performed at a time that does not affect the communications of satellite 10.

[0081] (Other embodiments) The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions.

[0082] The present invention is not limited to the embodiments described above, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, the following claims are attached to make the scope of the invention public. [Explanation of Symbols]

[0083] 10...Artificial satellite, 20...Ground station, 110...Anomaly detection device, 206...Control unit, 230...Anomaly detection model, 301...Database, 311...Preprocessing, 313...Anomaly determination, 310...Database, 324...Preprocessed data

Claims

1. An anomaly detection device that inputs information about multiple devices into a learning model and detects anomalies in the devices based on the degree of anomaly obtained from the learning model, A preprocessing means that generates preprocessed data for each device by performing a first reduction process on acquired data obtained from the plurality of devices, which reduces the amount of information in the acquired data obtained from the first device among the plurality of devices, and a second reduction process which reduces the amount of information in the acquired data obtained from the second device which is set to have a lower priority than the first device. A determination means for determining whether an anomaly has occurred based on the anomaly score output from the learning model when the preprocessed data processed by the preprocessing means is input to the learning model, An anomaly detection device characterized by having the following features.

2. The abnormality detection device according to claim 1, characterized in that the aforementioned high-priority equipment is equipment that is in continuous operation.

3. The abnormality detection device according to claim 1, characterized in that the equipment with low priority is equipment that can be in an operating state or a non-operating state.

4. The anomaly detection device according to claim 1, characterized in that the first reduction process calculates a moving average of information regarding the high-priority equipment and outputs it as the preprocessed data.

5. The anomaly detection device according to claim 1, characterized in that the second reduction process binarizes information regarding the low-priority equipment and outputs it as the preprocessed data.

6. The anomaly detection device according to claim 1, characterized in that the amount of information reduction due to the first reduction process is less than the amount of information reduction due to the second reduction process.

7. The anomaly detection device according to claim 1, characterized in that the learning model is a model in which the device learns by inputting normal information as correct data.

8. The determination means determines that an abnormality has occurred if the degree of abnormality is greater than the threshold, The anomaly detection device according to claim 7, characterized in that the threshold is set high in the operating mode when the amount of correct data is less than a predetermined amount, and low in the operating mode when the amount of correct data is greater than a predetermined amount.

9. An anomaly detection device that inputs information about multiple devices into a learning model and detects anomalies in the devices based on the degree of anomaly obtained from the learning model, A preprocessing means that supplies preprocessed data obtained by preprocessing information about the aforementioned multiple devices to the learning model, A determination means for determining whether an anomaly has occurred based on the anomaly score and threshold output from the learning model, An anomaly detection device characterized by having the following features.

10. The aforementioned learning model is a model that learns by inputting normal information from the device as correct data. The anomaly detection device according to claim 9, characterized in that the threshold is set high in the operating mode when the amount of correct data is less than a predetermined amount, and low in the operating mode when the amount of correct data is greater than a predetermined amount.

11. The abnormality detection device according to claim 1 or 9, further comprising a notification means for notifying the operator when the determination means determines that an abnormality has occurred.

12. The anomaly detection device according to claim 11, characterized in that the notification means notifies the operator by email.

13. The anomaly detection device according to claim 12, characterized in that the email includes time chart data including measurement data in which the anomaly was determined to have occurred.

14. The abnormality detection device according to claim 12, characterized in that the email further includes information about the equipment in which the abnormality has been determined to have occurred.

15. A satellite system that detects the occurrence of anomalies in an artificial satellite by inputting information about multiple devices contained in the artificial satellite into a learning model, A preprocessing means for performing preprocessing on information relating to the plurality of devices, comprising a first reduction means for reducing the amount of information relating to high-priority devices, and a second reduction means for reducing the amount of information relating to low-priority devices, A determination means for determining whether an anomaly has occurred based on the anomaly score output from the learning model when the preprocessed data processed by the preprocessing means is input to the learning model, A satellite system characterized by having the following features.

16. A satellite system that detects the occurrence of anomalies in an artificial satellite by inputting information about multiple devices contained in the artificial satellite into a learning model, A preprocessing means that supplies preprocessed data obtained by preprocessing information about the aforementioned multiple devices to the learning model, A determination means for determining whether an anomaly has occurred based on the anomaly score and threshold output from the learning model, A satellite system characterized by having the following features.

17. The aforementioned learning model is a model that learns by inputting normal information from the device as correct data. The satellite system according to claim 16, characterized in that the threshold is set high in the operating mode when the amount of correct data is less than a predetermined amount, and low in the operating mode when the amount of correct data is greater than a predetermined amount.

18. The satellite system according to any one of claims 15 to 17, wherein the ground station has the preprocessing means, the learning model, and the determination means, and the ground station has a notification means for notifying the operator when the determination means determines that an abnormality has occurred.

19. The satellite system according to any one of claims 15 to 17, wherein the satellite has the preprocessing means, the learning model, and the determination means, and the satellite notifies a ground station when the determination means determines that an anomaly has occurred, and resets the anomaly if it is an anomaly that can be dealt with by the satellite.

Images