Anomaly detection device and anomaly detection method

Abstract

To provide an abnormality detection device and an abnormality detection method, which are capable of highly reliable abnormality detection.SOLUTION: An abnormality detection device according to an embodiment comprises an NN calculation unit and an abnormality determination unit. The NN calculation unit calculates a probability value related to an abnormality of a target device using a neural network. The abnormality determination unit performs abnormality determination processing on the basis of the probability value calculated by the NN calculation unit. The abnormality determination unit performs cumulative processing to reflect a reflected value according to a current probability value from the NN calculation unit on a past cumulative value based on a past probability value from the NN calculation unit, and the abnormality determination unit determines that the target device is abnormal when the cumulative value after the cumulative processing is equal to or higher than a predetermined determination threshold value.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an abnormality detection device and an abnormality detection method. [Background technology]

[0002] In recent years, artificial intelligence (AI) has become widespread, and for example, the introduction of AI into vehicle powertrain systems is being considered. Neural networks are known as a form of machine learning in AI. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 05-049580 Summary of the Invention [Problem to be solved by the invention]

[0004] Generally, AI classification methods using neural networks are based on probability theory. Therefore, when using a neural network to determine (classify) anomalies in an in-vehicle device, the reliability of the determination result differs depending on the probability value of normality (or abnormality) even for the same determination result.

[0005] The present invention has been made in view of the above, and has an object to provide an anomaly detection device and an anomaly detection method that are capable of performing highly reliable anomaly detection. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the anomaly detection device according to the present invention includes an NN calculation unit and an anomaly determination unit. The NN calculation unit calculates a probability value related to an anomaly in a target device using a neural network. The anomaly determination unit performs an anomaly determination process based on the probability value calculated by the NN calculation unit. The anomaly determination unit performs an accumulation process that reflects a reflection value according to a current probability value from the NN calculation unit to a past accumulated value based on a past probability value from the NN calculation unit, and determines that the target device is abnormal when the accumulated value after the accumulation process is equal to or greater than a predetermined determination threshold. Effect of the Invention

[0007] According to the present invention, highly reliable anomaly detection can be performed. [Brief description of the drawings]

[0008] [Figure 1A] FIG. 1A is a diagram showing an overview of an anomaly detection method according to an embodiment. [Figure 1B] FIG. 1B is a diagram showing an overview of an anomaly detection method according to an embodiment. [Diagram 2] FIG. 2 is a functional block diagram showing the configuration of the abnormality detection device according to the embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of the threshold information. [Figure 4] FIG. 4 is a diagram showing a specific example of a series of processing contents of the control unit. [Diagram 5] FIG. 5 is a flowchart illustrating a processing procedure executed by the abnormality detection device according to the embodiment. [Figure 6A] FIG. 6A is a diagram showing the process contents of the abnormality determination unit according to the modified example. [Figure 6B] FIG. 6B is a diagram showing the process contents of the abnormality determination unit according to the modified example. [Figure 7A] FIG. 7A is a diagram showing the process contents of the abnormality determination unit according to the modified example. [Figure 7B] FIG. 7B is a diagram showing the process contents of the abnormality determination unit according to the modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of an anomaly detection device and an anomaly detection method disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiment.

[0010] First, an overview of an abnormality detection method according to an embodiment will be described with reference to Fig. 1A and Fig. 1B. Fig. 1A and Fig. 1B are diagrams showing an overview of an abnormality detection method according to an embodiment. In the embodiment shown below, a case will be described in which various devices such as sensors and actuators mounted on a vehicle are treated as target devices for abnormality detection. Note that the target devices are not limited to in-vehicle devices, and any device can be used.

[0011] As shown in FIG. 1A, in the abnormality detection method according to the embodiment, first, information on a target device such as a sensor or actuator (various detection data such as sensor values, information on device characteristics, etc.) is obtained.

[0012] Next, in the anomaly detection method according to the embodiment, the acquired information is input to a neural network NN, and as an output, a probability value regarding an anomaly in the target device is calculated. In the example shown in Fig. 1A, a probability value that the target device is abnormal (anomaly probability value) and a probability value that the target device is normal (normal probability value) are calculated.

[0013] Next, in the anomaly detection method according to the embodiment, an anomaly determination process is performed based on the calculated probability values ​​(anomaly probability value and normality probability value).

[0014] In addition, in the anomaly detection method according to the embodiment, in the anomaly determination process, a reflection value according to the current probability value is reflected in a past cumulative value based on past probability values, and if the cumulative value after reflection is equal to or greater than a predetermined determination threshold value, it is determined that the target device is abnormal.

[0015] Specifically, as shown in FIG. 1A, the abnormality determination process includes a "provisional determination process," a "cumulative process," and a "determinative process."

[0016] The "provisional judgment process" performs a provisional judgment of an abnormality of the target device based on the calculated probability value. As will be described in detail later, the provisional judgment outputs a judgment result of "abnormal", "normal" or "pending".

[0017] The "accumulation process" determines a reflection value according to the result of the provisional determination process, and reflects the reflection value on the past accumulated value.

[0018] The "determination process" determines whether or not an abnormality has occurred in the target device based on the accumulated value after the accumulation process.

[0019] Here, the abnormality determination process will be specifically described with reference to Fig. 1B. Fig. 1B shows the result of the provisional determination process (provisional determination process result) and an abnormality determination counter. Fig. 1B also shows the current provisional determination process result on the far right and the eight previous provisional determination process results.

[0020] The abnormality determination counter is a cumulative value that increases or decreases according to the result of the provisional determination process. In the abnormality determination process, when the abnormality determination counter becomes equal to or greater than the determination threshold, an abnormality in the target device is determined.

[0021] Specifically, if the provisional judgment process result is "normal", the abnormality judgment counter up to that point is cleared. In other words, if the provisional judgment process result is "normal", the negative value of the past accumulated value up to that point is set as the reflected value, so that the reflected accumulated value becomes zero. Note that the provisional judgment process result is "normal" when the normal probability value described above is equal to or greater than a predetermined normal judgment threshold (e.g., 80% or greater).

[0022] Furthermore, if the provisional judgment processing result is "abnormal", the anomaly judgment counter is counted up to that point. In FIG. 1B, "1" is added to the anomaly judgment counter. In other words, if the provisional judgment processing result is "abnormal", the reflected value is set to "+1". Note that the provisional judgment processing result is "abnormal" when the above-mentioned abnormality probability value is equal to or greater than a predetermined anomaly judgment threshold (e.g., 80% or greater).

[0023] Furthermore, if the result of the provisional judgment process is "pending", the abnormality judgment counter is maintained up to that point. In other words, if the result of the provisional judgment process is "pending", the reflected value is set to "0". Note that the case where the result of the provisional judgment process is "pending" refers to the case where the normal probability value is less than the normal judgment threshold value and the abnormality probability value is less than the abnormality judgment threshold value.

[0024] That is, in the anomaly detection method according to the embodiment, when both the normal probability value and the abnormal probability value are low (for example, both probability values ​​are 50%) and the reliability would be low if the provisional judgment processing result were divided into normal and abnormal, the result is judged as "pending" and the cumulative value is not increased or decreased. This makes it possible to prevent a reflection value according to an erroneous provisional judgment processing result from being reflected in the cumulative value. Therefore, the anomaly detection method according to the embodiment can perform highly reliable anomaly detection.

[0025] In other words, the anomaly detection method according to the embodiment is configured to perform cumulative processing based on probability values, thereby improving the reliability of anomaly determination compared to a case in which an anomaly is determined after a single anomaly determination, and shortening the time required to determine an anomaly compared to conventional anomaly determination methods in which an anomaly is determined after multiple consecutive anomaly determinations.

[0026] In order to determine an abnormality more quickly, the abnormality determination threshold can be reduced depending on the number of consecutive "abnormalities" in the provisional determination process results, or the reflected value can be multiplied by a coefficient corresponding to the abnormality probability value (the base value shown below); these points will be discussed later.

[0027] Furthermore, it is possible to carry out a smoothing process by multiplying the above-mentioned probability value by a predetermined coefficient, and this will also be described later.

[0028] Next, the configuration of an abnormality detection device that executes the abnormality detection method will be described with reference to Fig. 2. Fig. 2 is a functional block diagram showing the configuration of the abnormality detection device according to the embodiment.

[0029] 2, the abnormality detection device 1 according to the embodiment is connected to a target device 10. As described above, the target device 10 is various sensors and actuators mounted on a vehicle. For example, the target device 10 is a powertrain device such as an engine, a clutch, a transmission, a drive shaft, various gears, etc., or a control device related to the control of the vehicle.

[0030] The abnormality detection device 1 according to the embodiment includes a control unit 2 and a storage unit 3. The control unit 2 includes an NN calculation unit 21 and an abnormality determination unit 22. The storage unit 3 stores threshold value information 31.

[0031] Here, the abnormality detection device 1 includes, for example, a computer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), a data flash, an input / output port, and various other circuits.

[0032] The CPU of the computer functions as the NN calculation unit 21 and the abnormality determination unit 22 of the control unit 2, for example, by reading and executing a program stored in the ROM.

[0033] At least one or all of the NN calculation unit 21 and the abnormality determination unit 22 of the control unit 2 can be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0034] The storage unit 3 corresponds to, for example, a RAM or a data flash. The RAM or the data flash can store threshold information 31, information on various programs, etc. The abnormality detection device 1 may acquire the above-mentioned programs and various information via another computer or a portable recording medium connected via a wired or wireless network.

[0035] The threshold information 31 stored in the storage unit 3 is information on thresholds used in the processing of the abnormality determination unit 22. Fig. 3 is a diagram showing an example of the threshold information 31. As shown in Fig. 3, the threshold information 31 includes items such as "processing," "determination processing," "threshold," and "reflection value."

[0036] "Processing" indicates the processing content in which a threshold is used. "Determination result" is information that is output as a processing result when the threshold is satisfied. "Threshold" is information on the threshold used in the processing. "Reflection value" is information on the reflection value described above.

[0037] In the example shown in FIG. 3, the "provisional judgment process" is a provisional judgment process performed by the abnormality judgment unit 22, and the "definition process" is a confirmation process performed by the abnormality judgment unit 22. For example, in the "provisional judgment process", if the normal probability value is equal to or greater than the normal judgment threshold value "A", it is judged as "normal". In this case, the reflected value in the abnormality judgment unit 22 is "cleared", that is, the past accumulated value is set to zero. Also, for example, in the "definition process", if the abnormality judgment counter is equal to or greater than "6", it is "confirmed as abnormal".

[0038] The abnormality determination threshold value "B" in the "provisional determination process" shown in FIG. 3 is corrected in accordance with the past accumulated value, which will be described later.

[0039] Next, each function of the control unit 2 (the NN calculation unit 21 and the abnormality determination unit 22) will be described.

[0040] The NN calculation unit 21 uses the neural network NN to calculate a probability value related to an abnormality of the target device 10. Specifically, the NN calculation unit 21 inputs various data (sensor values, device characteristic values, etc.) acquired by the target device 10 to the neural network NN, and obtains an abnormality probability value and a normality probability value as outputs. The sum of the abnormality probability value and the normality probability value is 1 (100%).

[0041] The abnormality determination unit 22 performs an abnormality determination process based on the probability value calculated by the NN calculation unit 21. Specifically, the abnormality determination unit 22 performs an accumulation process in which a reflection value according to the current probability value from the NN calculation unit 21 is reflected in a past accumulated value based on the past probability values ​​from the NN calculation unit 21, and determines that the target device 10 is abnormal when the accumulated value after the accumulation process is equal to or greater than a predetermined determination threshold. For example, the abnormality determination unit 22 performs the abnormality determination process by comparing the threshold information 31 stored in the storage unit 3 with the probability value. As described above, the abnormality determination process includes a tentative determination process, an accumulation process, and a determination process.

[0042] <Tentative Judgment Process> In the tentative judgment process, based on the probability value calculated by the NN calculation unit 21, one of "normal", "abnormal" and "pending" is output as a judgment result.

[0043] For example, when the normality probability value is equal to or greater than the normality determination threshold value ("A" in FIG. 3) in the threshold information 31, the abnormality determination unit 22 determines that the target device 10 is normal in the provisional determination process. When the abnormality probability value is equal to or greater than the abnormality determination threshold value ("B" in FIG. 3) in the threshold information 31, the abnormality determination unit 22 determines that the target device 10 is abnormal in the provisional determination process. Note that the abnormality determination unit 22 corrects the abnormality determination threshold value in the provisional determination process, which will be described later.

[0044] Furthermore, when the normality probability value is less than the normality determination threshold and the abnormality probability value is less than the abnormality determination threshold, the abnormality determination unit 22 determines the provisional determination process as pending.

[0045] <Cumulative Processing> In the accumulation process, a current accumulated value is calculated by reflecting a reflection value according to a current probability value to a past accumulated value, which is an accumulated value of past reflection values ​​calculated based on past probability values. For example, the abnormality determination unit 22 performs the accumulation process in a different way based on a result of comparing the current probability value with a determination threshold value (a normal determination threshold value and an abnormality determination threshold value).

[0046] For example, when the result of the current tentative judgment process is "normal", the abnormality judgment unit 22 clears the past accumulated value up to the immediately preceding time, thereby setting the reflected accumulated value to zero. That is, the abnormality judgment unit 22 sets the current accumulated value to zero. That is, when the current probability value is a probability value with a low probability of abnormality (the abnormality probability value is less than the abnormality judgment threshold), the abnormality judgment unit 22 resets the past accumulated value according to the magnitude of the probability value. Note that the abnormality judgment unit 22 is not limited to clearing the past accumulated value to set the current accumulated value, and may, for example, subtract a predetermined reflected value (for example, "1") from the past accumulated value to set the current accumulated value.

[0047] Furthermore, when the result of the current tentative judgment process is "abnormal," the abnormality judgment unit 22 adds a predetermined reflection value (for example, "1") to the previous accumulated value up to that point. In other words, the abnormality judgment unit 22 sets the current accumulated value to the value obtained by accumulating the reflection value to the previous accumulated value. Note that the abnormality judgment unit 22 may vary the reflection value according to the abnormality probability value. For example, when the abnormality probability value is 90% or more (above a threshold value higher than the abnormality judgment threshold), the abnormality judgment unit 22 may double the reflection value to "2."

[0048] Furthermore, when the result of the current tentative determination process is "pending", the abnormality determination unit 22 maintains the previous cumulative value up to the immediately preceding time. That is, the abnormality determination unit 22 sets the previous cumulative value and the current cumulative value to the same value, in other words, sets the reflection value to zero. That is, when the current probability value is a probability value with a low probability of abnormality (the abnormality probability value is less than the abnormality determination threshold value), the abnormality determination unit 22 sets the reflection value to be reflected in the previous cumulative value to zero according to the magnitude of the probability value as the accumulation process. Note that the abnormality determination unit 22 is not limited to maintaining the previous cumulative value as the current cumulative value, and may, for example, add a reflection value (e.g., "0.5") that is smaller than the reflection value when it is determined to be "abnormal" to the previous cumulative value to set the current cumulative value, or may subtract a predetermined reflection value (e.g., "1") from the previous cumulative value to set the current cumulative value.

[0049] As described above, the abnormality determination unit 22 sets a reflection value for resetting the past accumulated value when the result of the tentative determination process is "normal", sets the reflection value to "1" when the result is "abnormal", and sets the reflection value to "0" when the result is "pending". That is, the abnormality determination unit 22 varies the amount of the reflection value to be accumulated with respect to the past accumulated value in accordance with the magnitude of the current probability value as the accumulation process.

[0050] <Confirmation process> The determination process is a process for determining that the target device 10 is abnormal based on the accumulated value after the accumulation process. Specifically, the abnormality determination unit 22 determines that the target device 10 is abnormal when the accumulated value after the accumulation process is equal to or greater than a predetermined determination threshold. The determination threshold is, for example, a threshold for the determination process included in the threshold information 31 (the abnormality determination counter in FIG. 3 is 6 or greater).

[0051] Furthermore, the abnormality determination unit 22 corrects the abnormality determination threshold used in the provisional determination process. Specifically, the abnormality determination unit 22 corrects the abnormality determination threshold in the threshold information 31 ("B" in FIG. 3) based on a past accumulated value. For example, the abnormality determination unit 22 corrects the abnormality determination threshold based on the number of consecutive "abnormal" determination results in the provisional determination process up to the previous time.

[0052] Specifically, the abnormality determination unit 22 sets the corrected abnormality determination threshold value as θ n If the number of consecutive “abnormal” judgment results is n, the initial value of the abnormality judgment threshold is θ0, and the fixed value is β, then this can be expressed by the following formula.

[0053] That is, θ n =θ0-β·n. Here, θ0 is, for example, "80", and β is, for example, "2". Note that, although details will be described later, if the result of the immediately preceding tentative judgment process is "normal", the abnormality judgment threshold is set to the initial value (θ0), and if it is "pending", the previous abnormality judgment threshold is maintained.

[0054] As a result, the more consecutive "abnormalities" are found as a result of the provisional judgment process, the smaller the corrected abnormality judgment threshold becomes. That is, the more consecutive "abnormalities" are found as a result of the provisional judgment process, the higher the possibility that the target device 10 is abnormal, so the abnormality judgment unit 22 reduces the corrected abnormality judgment threshold. This makes it easier for the abnormality judgment unit 22 to judge an abnormality even if there is some variation in the abnormality probability value. As a result, the timing at which the cumulative value becomes equal to or greater than the confirmation threshold in the confirmation process by the abnormality judgment unit 22 can be made earlier. That is, abnormality detection can be performed early and with high accuracy.

[0055] Next, a specific example of a series of processes in the control unit 2 will be described with reference to Fig. 4. Fig. 4 is a diagram showing a specific example of the series of processes in the control unit 2. Note that the provisional determination process by the abnormality determination unit 22 is performed once at each of times t1 to t13 shown in Fig. 4.

[0056] In FIG. 4, the normality determination threshold is 80%, the initial value of the abnormality determination threshold is 80%, and the fixed value β is 2%.

[0057] For example, at time t1, the NN calculation unit 21 outputs a normal probability value of 80% and an abnormality probability value of 20% as the calculation result. Therefore, since the normality probability value is equal to or greater than the normality determination threshold, the abnormality determination unit 22 determines "normal" in the tentative determination process at time t1. Then, the abnormality determination unit 22 clears the abnormality determination counter to zero.

[0058] Next, at time t2, the NN calculation unit 21 outputs a normal probability value of 20% and an abnormality probability value of 80% as the calculation result. Also, at time t2, the abnormality determination unit 22 sets the corrected abnormality determination threshold value to the initial value because the result of the tentative determination process immediately before (at time t1) was "normal." In other words, in the above formula, n becomes zero, so the abnormality determination unit 22 resets θ n Calculate =θ0.

[0059] Then, since the abnormality probability value is equal to or greater than the abnormality determination threshold, the abnormality determination unit 22 determines "abnormal" in the tentative determination process at time t2. Then, the abnormality determination unit 22 adds "1", which is a reflection value, to the abnormality determination counter.

[0060] Next, at time t3, the NN calculation unit 21 outputs a normal probability value of 20% and an abnormality probability value of 80% as the calculation result. Also, at time t3, the abnormality determination unit 22 outputs θ n =θ0-2(2×1)=76% is calculated as the corrected anomaly determination threshold.

[0061] Then, since the abnormality probability value is equal to or greater than the abnormality determination threshold, the abnormality determination unit 22 determines "abnormal" in the tentative determination process at time t3. Then, the abnormality determination unit 22 adds "1", which is a reflection value, to the abnormality determination counter.

[0062] Next, at time t4, the NN calculation unit 21 outputs a normal probability value of 20% and an abnormality probability value of 80% as the calculation result. Also, at time t4, the abnormality determination unit 22 outputs θn =θ0-4(2×2)=76% is calculated as the corrected anomaly determination threshold.

[0063] Then, since the abnormality probability value is equal to or greater than the abnormality determination threshold, the abnormality determination unit 22 determines "abnormal" in the tentative determination process at time t4. Then, the abnormality determination unit 22 adds "1", which is a reflection value, to the abnormality determination counter.

[0064] Next, at time t5, it is assumed that the NN calculation unit 21 outputs a normal probability value of 80% and an abnormality probability value of 20% as the calculation result. Therefore, since the normality probability value is equal to or greater than the normality determination threshold, the abnormality determination unit 22 determines "normal" in the tentative determination process at time t5. Then, the abnormality determination unit 22 clears the abnormality determination counter to zero. Also, at time t5, since there have been three consecutive "abnormalities" up until just before (time t4), that is, since n becomes 3 in the above formula, θ n =θ0-6(2×3)=74% is calculated as the corrected anomaly determination threshold.

[0065] Next, time t9 will be described, omitting times t6 to t8. At time t9, it is assumed that the NN calculation unit 21 outputs a normal probability value of 50% and an abnormality probability value of 50% as the calculation result. Also, at time t9, the abnormality determination unit 22 outputs θ n =θ0-6(2×3)=74% is calculated as the corrected anomaly determination threshold.

[0066] Then, since the abnormality probability value is less than the abnormality judgment threshold and the normality probability value is less than the normality judgment threshold, the abnormality judgment unit 22 judges the abnormality as "pending" in the tentative judgment process at time t9. Then, the abnormality judgment unit 22 maintains the abnormality judgment counter by setting the reflection value to zero. In this way, by judging the abnormality as "pending" when it is doubtful whether the abnormality is normal or not and setting the reflection value to zero, it is possible to reduce the occurrence of judging the abnormality as "pending" and prematurely confirming the abnormality, or of judging the abnormality as "normal" and delaying the confirmation of the abnormality.

[0067] Next, at time t10, the NN calculation unit 21 outputs a normal probability value of 25% and an abnormality probability value of 75% as the calculation result. Also, at time t10, the abnormality determination unit 22 outputs the normal probability value of 25% and the abnormality probability value of 75% as the calculation result. Since the abnormality determination unit 22 determines that the abnormality occurred at time t9 and that the abnormality occurred three times in succession up to time t8, that is, n becomes 3 in the above formula, θ n =θ0-6(2×3)=74% is calculated as the corrected abnormality determination threshold. In other words, if the previous time (time t9) was "pending", the abnormality determination unit 22 substitutes the number of consecutive "abnormal" events up to the previous time t8 into the above formula. That is, the abnormality determination unit 22 uses the abnormality determination threshold used immediately before (time t9) in the current provisional determination process.

[0068] Then, since the abnormality probability value is equal to or greater than the abnormality determination threshold, the abnormality determination unit 22 determines "abnormal" in the tentative determination process at time t10. Then, the abnormality determination unit 22 adds "1", which is a reflection value, to the abnormality determination counter.

[0069] That is, because the abnormality determination threshold becomes smaller than the initial value due to the correction process of the abnormality determination unit 22, what would have been determined as "pending" when the abnormality determination threshold was at the initial value can be determined as "abnormal."

[0070] Next, at time t12, the NN calculation unit 21 outputs a normal probability value of 25% and an abnormality probability value of 75% as the calculation result. Also, at time t12, the abnormality determination unit 22 outputs θ n =θ0-10(2×5)=70% is calculated as the corrected anomaly determination threshold.

[0071] Then, since the abnormality probability value is equal to or greater than the abnormality determination threshold, the abnormality determination unit 22 determines "abnormal" in the tentative determination process at time t12. Then, the abnormality determination unit 22 adds "1", which is a reflected value, to the abnormality determination counter. Then, since the abnormality determination counter after reflection is equal to or greater than the confirmation threshold, the abnormality determination unit 22 confirms that the target device 10 is abnormal.

[0072] In FIG. 4, the provisional judgment process, accumulation process, and determination process are continued even after time t13 after the abnormality is confirmed. However, after the abnormality is confirmed, the provisional judgment process, accumulation process, and determination process do not have to be performed for the target device 10 in which the abnormality has been confirmed.

[0073] Next, a processing procedure of the processing executed by the abnormality detection device 1 according to the embodiment will be described with reference to Fig. 5. Fig. 5 is a flowchart showing the processing procedure of the processing executed by the abnormality detection device 1 according to the embodiment.

[0074] 5, first, the NN calculation unit 21 uses the neural network NN to calculate a probability value related to an abnormality in the target device 10 (S101). Specifically, the NN calculation unit 21 calculates a normality probability value and an abnormality probability value.

[0075] Next, the abnormality determination unit 22 corrects the abnormality determination threshold value based on the past accumulated value (step S102).

[0076] Next, the abnormality determination unit 22 determines whether the normality probability value is equal to or greater than the normality determination threshold (step S103), and if it is equal to or greater than the normality determination threshold (step S103: Yes), it determines that the target device 10 is normal (step S104).

[0077] Next, the abnormality determination unit 22 clears the abnormality determination counter (past accumulated value) up to that point (step S105), and ends the process.

[0078] On the other hand, in step S103, if the normality probability value is less than the normality determination threshold (step S103: No), the abnormality determination unit 22 determines whether the abnormality probability value is equal to or greater than the abnormality determination threshold (step S106).

[0079] If the abnormality probability value is equal to or greater than the abnormality determination threshold (step S106: Yes), the abnormality determination unit 22 determines that the target device 10 is abnormal (step S107).

[0080] Next, the abnormality determination unit 22 counts up the abnormality determination counter up to that point (step S108), and determines whether the reflected abnormality determination counter is equal to or greater than the final threshold value (step S109).

[0081] If the abnormality determination counter is equal to or greater than the determination threshold (step S109: Yes), the abnormality determination unit 22 determines that the target device 10 is abnormal (step S110), and ends the process.

[0082] On the other hand, in step S106, if the abnormality probability value is less than the abnormality determination threshold value (step S106: No), the abnormality determination unit 22 determines to hold (step S111).

[0083] Next, the abnormality determination unit 22 maintains the abnormality determination counter up to that point (step S112), and executes the process of step S109.

[0084] Furthermore, in step S109, if the abnormality determination counter is less than the final threshold value (step S109: No), the abnormality determination unit 22 ends the process.

[0085] As described above, the abnormality detection device according to the embodiment includes the NN calculation unit 21 and the abnormality determination unit 22. The NN calculation unit 21 calculates a probability value related to an abnormality in the target device 10 using a neural network. The abnormality determination unit 22 performs an abnormality determination process based on the probability value calculated by the NN calculation unit 21. The abnormality determination unit 22 performs an accumulation process in which a reflection value according to a current probability value from the NN calculation unit 21 is reflected in a past accumulated value based on a past probability value from the NN calculation unit 21, and determines that the target device 10 is abnormal when the accumulated value after the accumulation process is equal to or greater than a predetermined determination threshold. This allows for highly reliable abnormality detection.

[0086] As an example other than the above embodiment, the abnormality determination unit 22 may perform smoothing processing as the accumulation processing. This point will be described with reference to Figs. 6A and 6B.

[0087] 6A and 6B are diagrams showing the processing contents of the abnormality determination unit 22 according to the modified example. As shown in Fig. 6A, the abnormality determination unit 22 performs smoothing processing on the current probability value, which is the output of the neural network NN, to correct the probability value, and outputs it to the determination processing. Note that the smoothing processing is performed on both the abnormal probability value and the normal probability value.

[0088] Specifically, the abnormality determination unit 22 first inputs the current probability value to the subtractor 22a as a positive value. The abnormality determination unit 22 also inputs the previous corrected probability value (previous value) to the subtractor 22a as a negative value. The abnormality determination unit 22 then inputs the calculation result of the subtractor 22a to the multiplier 22c.

[0089] Furthermore, the abnormality determination unit 22 multiplies the current probability value by a first coefficient and inputs the result to the multiplier 22b. Here, the first coefficient will be described with reference to FIG. 6B.

[0090] 6B shows a graph with the first coefficient on the vertical axis and the probability value on the horizontal axis. As shown in FIG. 6B, the first coefficient is selected to have a value according to the probability value. Specifically, the closer the probability value is to 50%, the smaller the first coefficient value becomes. In other words, the abnormality determination unit 22 changes the smoothing coefficient in the smoothing process according to the probability value.

[0091] For example, when the probability value is 20% (or 80%), the first coefficient is 0.8. That is, the value input to the multiplier 22b is 16% (64%).

[0092] Furthermore, the abnormality determination unit 22 inputs a second coefficient to the multiplier 22b. The second coefficient is a coefficient for the accuracy of the neural network NN. In other words, the second coefficient is a coefficient according to the learning degree of the neural network NN. Note that the second coefficient may be a preset value, or may be dynamically changed based on the result of judging the learning degree.

[0093] Then, the abnormality determination unit 22 inputs the multiplication result of the multiplier 22b to the multiplier 22c. Next, the abnormality determination unit 22 inputs the calculation result obtained by multiplying the calculation result of the subtractor 22a and the calculation result of the multiplier 22b to the adder 22d.

[0094] The abnormality determination unit 22 outputs the calculation result obtained by adding the calculation result of the multiplier 22c and the previous value to the determination process as a corrected probability value. In this way, the abnormality determination unit 22 performs a smoothing process using the first coefficient and the second coefficient on the probability value that is the output of the neural network NN. Specifically, the abnormality determination unit 22 reduces the amount of smoothing by making the first coefficient larger as the probability value approaches 0% or 100%, and on the other hand, increases the amount of smoothing by making the first coefficient smaller as the probability value approaches 50%.

[0095] By smoothing the probability value in this way, it is possible to reduce the so-called hunting phenomenon in which the probability value fluctuates around the abnormality judgment threshold and the normality judgment threshold in the determination process of the abnormality judgment unit 22, causing the judgment result to repeatedly invert (between normality and pending, or between abnormality and pending). Therefore, it is possible to perform abnormality detection with high reliability.

[0096] In the above embodiment, the abnormality determination unit 22 adds a fixed reflection value (counts up "1") to the cumulative value in the accumulation process when the result of the tentative determination process is "abnormal", but the reflection value may be variable depending on the abnormality probability value. This point will be described with reference to Figures 7A and 7B.

[0097] 7A and 7B are diagrams showing the processing contents of the abnormality determination unit 22 according to the modified example. Fig. 7A shows a functional block diagram of the abnormality determination processing of the abnormality determination unit 22 according to the modified example. Fig. 7B shows information for determining a reflection value to be added to a cumulative value according to an abnormality probability value. Such information is stored in the storage unit 3, for example.

[0098] 7A, in the abnormality determination process of abnormality determination section 22 according to the modified example, a correction process, an accumulation process, and a determination process are performed on the probability value calculated by NN calculation section 21. That is, in the abnormality determination process of abnormality determination section 22 according to the modified example, a correction process is performed as a tentative determination process.

[0099] Specifically, the abnormality determination unit 22 performs accumulation processing based on the count value (reflected value) corrected by the correction processing. More specifically, in the correction processing, the abnormality determination unit 22 calculates the count value using the information shown in FIG. 7B.

[0100] Here, the information shown in FIG. 7B includes items such as "abnormality probability value", "base value", "variation adjustment coefficient", "final value", and "count value".

[0101] For example, when the abnormality probability value is greater than 50% and equal to or less than 75%, the base value is set to 50%, and the base value is further multiplied by 0.5, which is the variation adjustment coefficient, to calculate a final value of 25%. In other words, when the maximum count value is 1, the abnormality determination unit 22 multiplies the count value by 25%, which is the final value, to obtain 0.25. The abnormality determination unit 22 then reflects 0.25 as a reflection value in the past cumulative value.

[0102] The base value and the variation adjustment coefficient can be set to any value in advance, but it is preferable to set values ​​that will result in a higher final value the higher the abnormality probability value, i.e., the higher the abnormality probability value, the higher the count value.

[0103] As a result, the higher the abnormality probability value, the higher the reflection value, so that the determination threshold is likely to be reached sooner. In other words, an abnormality can be determined earlier.

[0104] Further advantages and modifications may readily occur to those skilled in the art. Thus, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof. [Explanation of symbols]

[0105] 1. Anomaly detection device 2. Control section 3 Storage section 21 NN calculation section 22 Abnormality determination section 22a Subtractor 22b, 22c Multiplier 22d Adder 31 Threshold Information NN Neural Network

Claims

1. An anomaly detection device that detects an anomaly based on a probability value regarding an anomaly of a target device calculated using a neural network, a control unit that performs accumulation processing according to a currently calculated probability value on a past accumulated value based on a previously calculated probability value, and determines that the target device is abnormal when the accumulated value after the accumulation processing is equal to or greater than a determination threshold value; The control unit is In the accumulation process, if the currently calculated probability value is equal to or greater than the abnormality determination threshold, a reflection value according to the currently calculated probability value is added to the past accumulated value, and if the currently calculated probability value is less than the abnormality determination threshold, the past accumulated value is reset or the reflection value is subtracted from the past accumulated value. An abnormality detection device comprising:

2. The control unit is In the accumulation process, the amount of the reflection value to be accumulated with respect to the past accumulation value is changed according to the magnitude of the currently calculated probability value.

2. The abnormality detection device according to claim 1 .

3. the control unit changes the way in which the accumulation process is performed based on a result of comparing the currently calculated probability value with the abnormality determination threshold, performing a correction process for correcting the abnormality determination threshold value based on the past cumulative value; 3. The abnormality detection device according to claim 1 or 2.

4. An anomaly detection device that detects an anomaly based on a probability value regarding an anomaly of a target device calculated using a neural network, a control unit that performs accumulation processing according to a currently calculated probability value on a past accumulated value based on a previously calculated probability value, and determines that the target device is abnormal when the accumulated value after the accumulation processing is equal to or greater than a determination threshold value; The control unit is The method of performing the accumulation process is changed based on the result of comparing the currently calculated probability value with a judgment threshold, and the judgment threshold is corrected based on the past accumulated value. An abnormality detection device comprising:

5. An anomaly detection method executed by an anomaly detection device that detects an anomaly based on a probability value regarding an anomaly of a target device calculated using a neural network, comprising: a control step of performing accumulation processing according to a currently calculated probability value on a past accumulated value based on a previously calculated probability value, and determining that the target device is abnormal when the accumulated value after the accumulation processing is equal to or greater than a determination threshold value; The control step includes: In the accumulation process, if the currently calculated probability value is equal to or greater than the abnormality determination threshold, a reflection value according to the currently calculated probability value is added to the past accumulated value, and if the currently calculated probability value is less than the abnormality determination threshold, the past accumulated value is reset or the reflection value is subtracted from the past accumulated value. The anomaly detection method is characterized by:

6. An anomaly detection method executed by an anomaly detection device that detects an anomaly based on a probability value regarding an anomaly of a target device calculated using a neural network, comprising: a control step of performing accumulation processing according to a currently calculated probability value on a past accumulated value based on a previously calculated probability value, and determining that the target device is abnormal when the accumulated value after the accumulation processing is equal to or greater than a determination threshold value; The control step includes: The method of performing the accumulation process is changed based on the result of comparing the currently calculated probability value with a judgment threshold, and the judgment threshold is corrected based on the past accumulated value. The anomaly detection method is characterized by:

Images