Anomaly cause estimation device, anomaly cause estimation method, and program

Abstract

This cause-of-abnormality estimation device 10 has: an abnormality detection unit 11 for converting a data sequence acquired in time series from a plurality of components provided in a target system to an abnormality degree data sequence and detecting abnormality on the basis of the converted abnormality degree data sequence; and an abnormality propagation estimation unit 12 for inputting, to an abnormality propagation estimation model, a target abnormality degree data sequence that precedes a time point at which an abnormality is detected and and that is extracted from the abnormality degree data sequence, a target data sequence corresponding to the target abnormality degree data sequence, and information representing a causal relationship between the components, and estimating the likelihood of abnormality propagation, i.e., the likelihood that the abnormality will propagate between the components.

Description

[Technical field]

[0001] The present invention relates to an abnormality cause estimation device and an abnormality cause estimation method for estimating the cause of an abnormality in a system, and further relates to a program for realizing these. To Regarding. [Background technology]

[0002] In order to operate OT (Operational Technology) / IoT (Internet of Things) networks securely, when an abnormality is detected in the target system, it is necessary to deduce the cause of the abnormality and take prompt action. It is also necessary to protect the target system from threats that have invaded the target system.

[0003] Patent Document 1 discloses an anomaly diagnosis system that can express the propagation relationship between parts and easily estimate the part causing the anomaly. The anomaly diagnosis system in Patent Document 1 detects state changes in operation data using detection units set for each part. The operation data is data that lists measurement values ​​measured by multiple sensors included in the parts in chronological order.

[0004] In addition, the abnormality diagnosis system of Patent Document 1 estimates the part causing the abnormality by using the influence that the upstream part has on the downstream part (the propagation relationship between parts), the time when the state change of the driving data is detected, and the driving data that caused the state change. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2017 / 159016 Summary of the Invention [Problem to be solved by the invention]

[0006] However, the abnormality diagnosis system in Patent Document 1 simply assigns points to the detection units set for each part using preset criteria, and presumes that the part corresponding to the detection unit with the highest total score is the cause of the abnormality.

[0007] The criteria are, for example, the following (1), (2), and (3): (1) The further upstream (early stage) the detection unit is in the target system, the higher the score is given to the detection unit. (2) The earlier the detection unit detects a state change in the driving data, the higher the score is given to the detection unit. (3) The detection unit whose input condition is not included in the driving data that caused the state change is given a higher score.

[0008] According to one aspect, there is provided an anomaly cause estimation device and an anomaly cause estimation method for estimating a true anomaly cause based on the propagation of an anomaly. program The purpose is to provide. [Means for solving the problem]

[0009] In order to achieve the above object, an anomaly cause estimating device according to one aspect comprises: an anomaly detection unit that converts a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series and detects an anomaly based on the converted anomaly degree data series; an anomaly propagation estimation unit that inputs a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimates an anomaly propagation probability that an anomaly will propagate between the components; The present invention is characterized by having the following.

[0010] In order to achieve the above object, a method for estimating a cause of an anomaly in one aspect includes the steps of: A step of converting a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series; detecting an anomaly based on the converted anomaly degree data series; a step of inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; The present invention is characterized by having the following.

[0011] Furthermore, in order to achieve the above objective, M is , A step of converting a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series; detecting an anomaly based on the converted anomaly degree data series; a step of inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; Run Ruko It is characterized by: Effect of the Invention

[0012] As one aspect, the true cause of the anomaly can be inferred based on the propagation of the anomaly. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram for explaining an example of an abnormality cause estimating device. [Diagram 2] FIG. 2 is a diagram for explaining an example of conversion into an abnormality degree data series. [Diagram 3] FIG. 3 is a diagram for explaining an example of propagation of anomaly. [Figure 4]FIG. 4 is a diagram for explaining an example of propagation of anomaly. [Diagram 5] FIG. 5 is a diagram for explaining the degree of abnormality in normal data. [Figure 6] FIG. 6 is a diagram for explaining the relationship between the variable space and the anomaly degree data series. [Figure 7] FIG. 7 is a diagram for explaining the relationship of anomaly degrees between components. [Figure 8] FIG. 8 is a diagram for explaining a comprehensive inference of the cause of anomaly. [Figure 9] FIG. 9 is a diagram for explaining a comprehensive inference of the cause of anomaly. [Figure 10] FIG. 10 is a diagram for explaining an example of the abnormality cause information. [Figure 11] FIG. 11 is a diagram for explaining an example of a system having an anomaly cause estimating device. [Figure 12] FIG. 12 is a diagram for explaining an example of the operation of the abnormality cause estimating device. [Figure 13] FIG. 13 is a diagram illustrating an example of a computer that realizes the abnormality cause estimating device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] First, an overview will be given to facilitate understanding of the embodiments described below. Conventionally, the component that detected the anomaly was identified as the cause of the anomaly. However, in reality, the identified component is not necessarily the root cause (the true cause of the anomaly) that caused the anomaly. Therefore, we would like to estimate the component that is the root cause that caused the anomaly.

[0015] However, in order to identify the true cause of an anomaly that cannot be determined directly from the results of an anomaly detection (Root-Cause Analysis), detailed design information or a large amount of anomaly data is required.

[0016] Specifically, if a model that identifies causal causes is used, which is generated using detailed design information of the target system, causal causes can be identified at the component level. However, the generation of the model is expensive, and accidental relationships cannot be reflected in the model.

[0017] In addition, when using a model that identifies causal causes generated using labeled abnormal data, a large amount of abnormal data must be collected. However, collecting a large amount of abnormal data is difficult. In addition, the model cannot classify unknown abnormalities.

[0018] In addition, if a model that learns behavior during anomalies using unlabeled anomaly data and identifies causal causes is used, unknown anomalies can also be classified. However, collecting anomaly data is difficult. It is also difficult to determine (interpret) anomalies in the data. Furthermore, only the causes can be inferred.

[0019] In addition, when using a model that identifies causal causes by machine learning normal behavior from only normal data, data collection is easy because it is sufficient to collect normal data. However, since there is no information on the target system when an abnormality occurs, it is difficult to infer the component that is the root cause of the abnormality.

[0020] Through this process, the inventors discovered a problem of how to estimate the component that is the root cause of an abnormality using normal data that is easily collected, and also came to derive a means of solving the problem.

[0021] That is, the inventors have derived a means for (a) estimating the probability that an anomaly will propagate between components, and (b) estimating the component that will be the root cause based on the probability that the anomaly will propagate, in order to estimate the component that is the root cause of an anomaly using only normal data.

[0022] Hereinafter, an embodiment will be described with reference to the drawings. In the drawings described below, elements having the same or corresponding functions are denoted by the same reference numerals, and repeated description thereof may be omitted.

[0023] (Embodiment) The configuration of an abnormality cause estimating device 10 according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining an example of an abnormality cause estimating device.

[0024] [Device configuration] When an anomaly is detected in a target system, the anomaly cause estimation device 10 (a) estimates the degree to which the anomaly in a component Si will propagate to other components Sj that are in a causal relationship with the component Si (the probability that the anomaly will propagate between components), and (b) estimates the component that is the root cause of the detected anomaly based on the estimated probability that the anomaly will propagate between components. Note that i and j are different positive integers.

[0025] The target system is a system that uses an OT / IoT network, etc. The target system is a system used in, for example, power plants, transportation facilities, factories, airplanes, automobiles, home appliances, etc., and has multiple components.

[0026] A component is, for example, a device provided in a target system, such as a sensor, an actuator, etc. Also, a component outputs a signal or information indicating, for example, pressure, flow rate, temperature, voltage, current, etc.

[0027] The abnormality cause estimation device 10 includes an abnormality detection unit 11, an abnormality propagation estimation unit 12, and an abnormality cause estimation unit 13.

[0028] The anomaly detection unit 11 converts a data series acquired in time series from a plurality of components provided in a target system into an anomaly degree data series, and detects an anomaly based on the converted anomaly degree data series.

[0029] Specifically, first, the anomaly detection unit 11 converts a data sequence into an anomaly degree data sequence using a given anomaly detector (anomaly detection algorithm).

[0030] The data series is information that lists the measurement values ​​measured by each component in a time series. The anomaly data series is information that converts the measurement values ​​of the data series into anomaly levels using an anomaly detector.

[0031] The degree of anomaly is a value that indicates the degree to which a measurement value measured by a component at a certain point in time is abnormal. The point in time can be expressed, for example, by date, month, year, and time.

[0032] The anomaly detector can use, for example, upper and lower thresholds, differences from a system model, regression prediction residual methods, autoencoders, support vector machines, stochastic process regression, density estimation, density ratio estimation, invariant analysis, and the like.

[0033] However, an anomaly detector may not only output an anomaly data series for each component, but may also output one anomaly data series for multiple components. In such cases, methods such as causal analysis, correlation analysis, and factor analysis are used to convert the anomaly data series for each component. For example, multiple regression analysis, L1 sparse regression, PCA (Principal Correlation Analysis), LIME (Local Interpretable Model-agnostic Explanations ), and the conversion is performed using attention mechanisms.

[0034] Fig. 2 is a diagram for explaining an example of conversion to an anomaly degree data series. A graph 21 in Fig. 2 shows data series of components S1, S2, and S3. The data series of component S1 is represented by a dashed line, the data series of component S2 is represented by a broken line, and the data series of component S3 is represented by a solid line.

[0035] 2 shows the anomaly degree data series of each of the components S1, S2, and S3. Note that the anomaly degree data series of the component S1 is represented by a dashed line, the anomaly degree data series of the component S2 is represented by a dashed line, and the anomaly degree data series of the component S3 is represented by a solid line.

[0036] Next, the anomaly detection unit 11 detects an anomaly when the degree of anomaly in the anomaly degree data sequence becomes equal to or greater than a preset threshold value.

[0037] In the example of FIG. 2, at time t0 when an abnormality is detected, the abnormality degree of the anomaly degree data series (dashed line) of the component S2 becomes equal to or exceeds a preset threshold value, so that the anomaly detection unit 11 detects an abnormality.

[0038] The anomaly propagation estimation unit 12 inputs an anomaly degree data series (target anomaly degree data series) used to estimate the probability that an anomaly will propagate, extracted from the anomaly degree data series, a data series (target data series) corresponding to the target anomaly degree data series, and information into an anomaly propagation estimation model, and estimates the probability that an anomaly will propagate between components (anomaly propagation probability).

[0039] Although normal data is easy to collect, it does not contain information about the target system when an abnormality occurs. Therefore, as described above, a model trained using only normal data cannot estimate the component that is the root cause of the abnormality.

[0040] Therefore, a model is generated that estimates the likelihood of an anomaly propagating between components, using normal data, the degree of anomaly in the normal data, and minimum information as learning data.

[0041] The target anomaly degree data series is a period used to estimate the probability of anomaly propagation, i.e., an anomaly degree data series for a period from the time when the anomaly is detected to a preset time. The target data series is a data series for a period corresponding to the target anomaly degree data series.

[0042] The minimum information is a directed graph (causal graph) that represents the causal relationships between components. The causal graph is information that uses 0 and 1 to represent, for example, whether or not there is a direct causal relationship from component Si to component Sj.

[0043] In other words, the causal graph indicates that if there is a causal relationship between components, when a measurement value of a component changes, the change in the measurement value affects the measurement value of the component with which the causal relationship exists. Note that the causal graph can be expressed, for example, by an adjacency matrix.

[0044] In learning, the anomaly propagation estimation model is generated by machine learning using normal data series acquired in time series from multiple components, a learning anomaly data series converted from the normal data series, and minimum information as learning data.

[0045] The anomaly propagation estimation model is a model that estimates the likelihood that an anomaly will propagate from a component Si to a component Sj at each point in time in anomaly cause estimation.

[0046] The propagation of anomalies will now be described. Since the degree of abnormality in an abnormal state tends to be higher than the degree of abnormality in a normal state, by comparing the increase in the degree of abnormality of component Si with the increase in the degree of abnormality of component Sj that is causally affected by component Si, it is possible to calculate the probability that component Sj will enter an abnormal state when component Si enters an abnormal state.

[0047] When comparing the increase in the degree of anomaly, a differential coefficient is calculated using a model such as linear regression, kernel regression, neural network, etc. However, since the calculated differential coefficient varies widely, it is also possible to sample the variables and the degree of anomaly and perform numerical differentiation using regression, multiple regression, etc. to calculate the robust degree of anomaly propagation.

[0048] 3 and 4 are diagrams for explaining an example of the propagation of anomalies. In Fig. 3 and Fig. 4, the anomaly detection unit 11 judges the period before time t0 when the anomaly is detected to be a normal state, but in reality, the cause of the anomaly exists before time t0.

[0049] Graph 23 in Fig. 3 shows that the true cause of the abnormality occurs at time t1, and that the abnormality detection unit 11 detects an abnormality at time t0. However, as shown by the dashed circle in graph 23 in Fig. 3, there are multiple candidates for the true cause of the abnormality.

[0050] Graph 24 in Fig. 4 shows the propagation (arrows) of an anomaly from the true cause of the anomaly at time t1 to the detection of the anomaly at time t0. Note that there are multiple anomaly propagation scenarios (paths along which an anomaly propagates from the true cause of the anomaly to the detection of the anomaly: scenarios).

[0051] The estimation of the probability that an anomaly will propagate will now be described. In the example of Fig. 4, the true cause of the abnormality is contained in the period of the normal state (the period from time t0 to time t1). Moreover, the degree of abnormality fluctuates even in the normal state.

[0052] Fig. 5 is a diagram for explaining the degree of abnormality in normal data. Conventionally, a variable space corresponding to a component Si, such as a variable space 51 shown in Fig. 5, represents the normal state and abnormal state of data as binary information (e.g., 0 or 1).

[0053] However, as described above, the degree of abnormality also varies in normal data. Therefore, as shown in the variable space 52 shown in Fig. 5, since there are multiple normal states, the distance (closeness) between the normal state and the abnormal state changes.

[0054] Fig. 6 is a diagram for explaining the relationship between the variable space and the anomaly degree data series. As shown in Fig. 6, the anomaly degree data series of graph 25 is an index representing the distance between a normal state and an abnormal state in variable space 52. Therefore, by using the ratio of anomaly degree changes between components, it is possible to estimate an index representing how close one component approaches an abnormal state when the other component approaches an abnormal state, that is, the probability that an anomaly will propagate.

[0055] Moreover, the example of FIG. 6 shows that an abnormality in a component S2 (dashed line) at time ta propagates (arrows) to components S1 and S3 at time tb.

[0056] Fig. 7 is a diagram for explaining the relationship between the anomaly degrees between components. When a component Si in a normal state approaches an abnormal state as shown in Fig. 7, the degree to which a component Sj in a normal state approaches an abnormal state (anomaly propagation likelihood) can be estimated (approximated) using a linear regression trend 71. In the example of Fig. 7, a linear regression trend is used, but is not limited thereto.

[0057] As an example, if the average anomaly degree of Si under normal conditions is Ai, the average anomaly degree of Sj is Aj, and the slope obtained as the coefficient of linear regression is Δ, the probability that an anomaly will propagate from Si to Sj may be estimated as Δ×Ai / Aj.

[0058] In this way, the anomaly propagation estimation unit 12 estimates the anomaly propagation probability between components at each time point, and therefore, the true cause of the anomaly can be estimated based on the anomaly propagation probability.

[0059] The anomaly cause estimation unit 13 inputs the target anomaly degree data series (target anomaly degree data series) and the anomaly propagation probability for each specified time into an anomaly cause estimation model, estimates the cause of the occurrence of the anomaly, and outputs anomaly cause information indicating the estimated cause.

[0060] The anomaly cause inference model evaluates the overall consistency using the consistency between the anomaly data series and the anomaly propagation scenario, and the probability that the anomaly propagation scenario itself is valid based on the anomaly propagation probability. For example, the anomaly cause inference model can use normal logical inference, parameter estimation using a propagation and diffusion model, Bayesian inference, Bayesian network, etc.

[0061] When using Bayesian inference and a Bayesian network, by using an approximate inference algorithm such as belief propagation or expectation propagation, it is not necessary to comprehensively search for all patterns related to abnormal states, and the amount of calculations can be reduced.

[0062] Furthermore, when using Bayesian inference and a Bayesian network, it is possible to accept additional information such as "this component is not the cause of the anomaly," and there is no problem even if there are missing values ​​for the degree of anomaly.

[0063] Specifically, first, the anomaly cause estimation unit 13 uses the target anomaly degree data series and the anomaly propagation probability to infer what point in time and in which component an anomaly occurs that will be consistent with the target anomaly degree data series.

[0064] That is, the degree of anomaly can be measured by the anomaly detection unit 11, but the abnormal state is unknown (it is not known whether it is abnormal or normal at each point in time). Therefore, the connection conditions between unknown abnormal states are specified by the way the anomaly propagates. Which component was the true cause of the anomaly at which point in time, and which component was truly normal at which point in time are evaluated in as many patterns as possible, and consistency with the anomaly degree data series is improved.

[0065] For example, if the measured anomaly data series can be reproduced (consistent) with high accuracy by assuming a scenario in which an anomaly (cause) occurs in a certain component at a certain time and the anomaly propagates according to the anomaly propagation accuracy estimated as described above, then there is a high possibility that the scenario actually proceeded. In that case, it is natural to estimate the location of the anomaly assumed in the scenario as the cause of the anomaly. However, if the measured anomaly sequence cannot be reproduced with high accuracy in such a scenario, there is a possibility that the anomaly actually propagated according to another scenario.

[0066] It is possible to assume that the anomaly (cause) occurred in a different component at a different time. It is also possible to assume that the anomaly (cause) occurred in multiple components at the same time, or in multiple components separated by time. However, it is unlikely that a scenario with multiple anomaly causes would have occurred.

[0067] Furthermore, regarding the propagation of anomalies, it can be assumed that the anomaly propagated against the estimated anomaly propagation accuracy. It can be assumed that the anomaly actually propagated despite the estimated anomaly propagation accuracy being low, and conversely, it can be assumed that the anomaly did not actually propagate despite the estimated anomaly propagation accuracy being high. However, it is unlikely that a scenario in which the anomaly propagated against the estimated anomaly propagation accuracy would have been established.

[0068] Among the various scenarios described above, there are patterns that can reproduce the measured anomaly degree data series with higher accuracy. If a scenario is highly feasible and can reproduce the measured anomaly degree data series with higher accuracy, the scenario is considered to have high overall consistency with the anomaly degree data series. Therefore, the occurrence of an anomaly assumed in the scenario can be estimated as the cause of the anomaly.

[0069] For example, all possible scenarios can be enumerated, and the possibility of each scenario being realized can be evaluated based on the assumed number of anomalies and the probability of anomaly propagation, while the accuracy with which the scenario reproduces the anomaly degree sequence can be evaluated based on the reproduction error. Then, a pattern in which both of these indices are large and exceed a threshold, a pattern in which the sum of these indices is the largest, etc. can be identified as a realized scenario, and the cause of the anomaly can be inferred.

[0070] Alternatively, by weighting the causes of anomalies in various patterns based on the above-mentioned index, it is possible to estimate the degree to which they are the cause of anomalies by superimposing various scenarios that are highly consistent with the measured anomaly degree series.

[0071] For example, when using Bayesian estimation and a Bayesian network, the degree to which such an anomaly is the cause can be calculated as a posteriori probability. Furthermore, as described above, since the overall consistency can be evaluated while the scenarios are probabilistically superimposed without actually listing all the scenarios, the amount of calculation can be reduced. Furthermore, when an approximate reasoning algorithm is used, the amount of calculation can be further reduced.

[0072] 8 and 9 are diagrams for explaining comprehensive inference of the cause of anomalies. For example, evaluation in a pattern as shown in Figs. 8 and 9 will be explained.

[0073] The solid arrows in Figures 8 and 9 represent cases where the probability of anomaly propagation is high, while the dashed arrows represent cases where the probability of anomaly propagation is low.

[0074] Graphs 81, 82, and 91 in Figures 8 and 9 all represent a situation in which the probability of anomaly propagation is low between time points t3 and t4, and high at other times. However, graphs 81, 82, and 91 assume different scenarios. Depending on the assumed scenario, the consistency with the anomaly degree series differs, and the feasibility of the scenario also differs.

[0075] The pattern of graph 81 in Fig. 8 shows the propagation at each predetermined time, assuming that a true anomaly cause occurs at time t1. The simplest method of estimating the cause is, for example, to estimate the probability of anomaly propagation by a preset threshold. End The idea is to assume a scenario in which propagation occurs when the threshold is exceeded, and no propagation occurs when the threshold is exceeded. Then, trace back the arrows indicating propagation and try to infer the cause. Such a scenario is a natural assumption.

[0076] In the case of graph 81, the path (propagation path) formed by connecting the arrows from the assumed true cause of the anomaly to the detection of the anomaly is interrupted because it is estimated that there is no propagation between time t3 and time t4.

[0077] In the propagation path of graph 81, the propagation is interrupted midway, so the anomaly does not propagate beyond that point. Nevertheless, the measured degree of anomaly continues to increase even after time t4, so this scenario is not consistent with the target anomaly degree data series (the degree of consistency is low). However, graph 81 is a scenario based on the natural assumption that whether propagation occurs or not is determined according to the probability of anomaly propagation, so the possibility of the scenario itself being valid is high.

[0078] In the pattern of graph 82 in FIG. 8, it is assumed that true causes of anomalies occur at time points t1 and t4, and the path (propagation path) connecting the arrows from the assumed true causes of anomalies to the detection of anomalies is estimated to have no propagation between time points t3 and t4, but there are two assumed true causes of anomalies.

[0079] In the propagation path of Graph 82, the propagation appears to be interrupted midway, but since there are two assumed true anomaly causes, the increase in the degree of anomaly in the first half is caused by the first anomaly cause, and the increase in the degree of anomaly in the latter half is caused by the second anomaly cause, so this scenario is consistent with the target anomaly data series. However, since it is unlikely that there are two assumed true anomaly causes in the target system, it is unlikely that this scenario itself actually occurred.

[0080] From the two examples shown in Figure 8, the simple method described above assumes a scenario in which an anomaly will not propagate if the anomaly propagation probability is lower than a threshold value. Therefore, if the anomaly propagation probability is mistakenly determined to be low even though an anomaly has actually propagated, it is not possible to trace back any further to infer the cause.

[0081] In other words, if there is even one large error when calculating the anomaly propagation probability, it will be impossible to correctly estimate the cause. Therefore, even if the anomaly propagation probability is low, it is desirable to assume a pattern in which the anomaly propagates and estimate the most plausible scenario.

[0082] In that case, a scenario that assumes that an anomaly has propagated even though the probability of anomaly propagation is low (corresponding to no propagation as described above) is based on an assumption that is unlikely to hold true.

[0083] In summary, it is necessary to deduce the cause of an anomaly by taking into consideration both the consistency between the hypothesized scenario and the target anomaly data series, and the feasibility of the scenario itself (in other words, whether the scenario is based on unreasonable assumptions).

[0084] The pattern of graph 91 in Fig. 9 shows the propagation at each predetermined time, assuming that the true cause of the anomaly occurred at time t1. At first glance, in the case of graph 91, the propagation path from the assumed true cause of the anomaly to the detection of the anomaly appears to be interrupted.

[0085] However, if we assume a scenario in which the anomaly propagation probability is low between t3 and t4 in graph 91, but the anomaly actually propagated (if local errors are absorbed based on consistency with the anomaly data series), then the scenario including this dashed-line arrow is consistent with the target anomaly data series. Therefore, making an assumption that contradicts the anomaly propagation probability increases the probability that the anomaly data series will be consistent with this scenario. On the other hand, such an assumption that contradicts the anomaly propagation probability reduces the possibility of this scenario being realized.

[0086] Comparing graphs 81, 82, and 91, graph 81 assumes that anomalies do not propagate when the anomaly propagation probability is low, which is a valid assumption and the possibility of this scenario being established is high. However, since the measured value of the degree of anomaly continues to increase even after time t3 when the propagation of anomalies should have stopped, the consistency with the target anomaly degree data series is extremely low.

[0087] Graph 82 assumes that the second anomaly cause appears after the anomaly propagation is interrupted. A scenario in which two anomaly causes arise independently is irrational, and the likelihood of this scenario occurring is low. On the other hand, by connecting the propagation of anomalies caused by the two anomaly causes, there is a high probability that a scenario leading to an anomaly detection will occur.

[0088] In graph 91, it is assumed that the anomaly has propagated, even though the probability of the anomaly propagation is low. Compared to graph 81, the possibility of the scenario of graph 91, which requires such an assumption, is low. However, compared to a scenario such as graph 82, in which two anomaly causes occur independently, the possibility of the scenario of graph 91 is relatively high. In addition, as described above, graphs 82 and 91 are highly consistent with the target anomaly degree data series.

[0089] Therefore, the anomaly cause estimation unit 13 selects the most plausible scenario as the true cause of the occurrence of the anomaly. The selection criteria are based on whether the consistency between the scenario and the target anomaly degree data series and the possibility that the scenario itself is established are both high, or the sum of these is greater than that of other scenarios (overall consistency), etc.

[0090] Therefore, the anomaly cause estimation unit 13 selects the scenario of graph 91 as the true anomaly cause that caused the anomaly to occur. The reason is that since the consistency between the scenario of graph 81 and the target anomaly degree data series is extremely low, even if the possibility of the scenario of graph 91 being established is low, graph 91 is a scenario with higher overall consistency than graph 81. Similarly, compared to the scenario of graph 82, although the consistency between both scenarios and the target anomaly degree data series is the same, graph 91 is a scenario with higher overall consistency than graph 81. 82 This is because the overall consistency is higher for graph 91, since the scenario itself is more likely to be established than for graph 92. Therefore, it is estimated that the true cause of the abnormality occurred at time t1 in the scenario shown in graph 91.

[0091] In the examples of Figs. 8 and 9, estimation is performed using three scenarios, but in reality, the true cause of the abnormality is estimated by evaluating various patterns of scenarios.

[0092] Furthermore, rather than simply selecting one of the more plausible scenarios from a variety of patterns, Bayesian inference and other methods can be used to estimate the true cause of anomalies as a posteriori probability from a probabilistic superposition of a variety of scenarios. In this case, the estimated cause of anomalies takes on a probability value. In addition, the cause of anomalies can be estimated with a degree of certainty by combining multiple major scenarios.

[0093] Next, the anomaly cause estimation unit 13 outputs anomaly cause information indicating the estimated cause. Fig. 10 is a diagram for explaining an example of the anomaly cause information. The anomaly cause information shown in Fig. 10 indicates the probability that each component is the cause of an anomaly at each of predetermined points in time t1, t2, t3, t4, .... The points in time are indicated, for example, by year, month, date, and time.

[0094] The abnormality cause information may be, for example, the time when the true cause of the abnormality occurred and the component that caused the true abnormality. Also, candidates for the path along which the abnormality propagates may be output.

[0095] [System Configuration] The configuration of the anomaly cause estimating device 10 in the embodiment will be described in more detail below. Fig. 11 is a diagram for explaining an example of a system having an anomaly cause estimating device.

[0096] 11, the system in the embodiment includes an anomaly cause estimating device 10, an input device 20, a storage device 30, and an output device 40. The anomaly cause estimating device 10, the input device 20, the storage device 30, and the output device 40 may be connected via a network.

[0097] The anomaly cause estimation device 10 is, for example, an information processing device such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or a circuit equipped with any one or more of them, a server computer, a personal computer, or a mobile terminal.

[0098] The input device 20 is a device for inputting data to the anomaly cause estimating device 10. The input device 20 is, for example, a keyboard, a mouse, a touch panel, etc. In the example of Fig. 11, the input device 20 is provided outside the anomaly cause estimating device 10, but it may be provided inside the anomaly cause estimating device 10.

[0099] The storage device 30 stores, for example, a data series, an anomaly degree data series, an anomaly propagation estimation model, an anomaly cause The storage device 30 stores an estimation model, anomaly cause information, setting data, etc. The storage device 30 is, for example, a database or a server computer. In the example of Fig. 11, the storage device 30 is provided outside the anomaly cause estimation device 10, but it may be provided inside. Also, the storage device 30 may be divided into multiple storage devices.

[0100] The output device 40 acquires output information (to be described later) that has been converted into an outputtable format by the output information generating unit 16, and outputs generated images and sounds based on the output information. The output device 40 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may also include an audio output device such as a speaker. The output device 40 may also be a printing device such as a printer.

[0101] The abnormality cause estimation device will now be described in detail. The anomaly cause estimation device 10 includes an anomaly detection unit 11 , an anomaly propagation estimation unit 12 , an anomaly cause estimation unit 13 , a setting unit 14 , a causal graph generation unit 15 , and an output information generation unit 16 .

[0102] Incidentally, the anomaly detection unit 11, the anomaly propagation estimation unit 12, and the anomaly cause estimation unit 13 have already been explained, and therefore their explanation will be omitted.

[0103] The setting unit 14 sets a period for estimating the cause of an abnormality before the time of abnormality detection. The setting unit 14 also performs settings required for estimating the cause of an abnormality.

[0104] The causal graph generating unit 15 generates a causal graph from normal data. The causal graph generating unit 15 generates a causal graph using, for example, logistic regression, PCA, causal effect estimation, PC algorithm, TPDA (Three Phase Dependency Analysis) algorithm, Bayesian estimation, information criterion, transfer entropy, Granger causality, structural equation, LiNGAM (Linear Non-Gaussian Acyclic Model), or the like.

[0105] The output information generating unit 16 converts the abnormality cause information into a format that can be output to the output device 40 to generate output information, and outputs the output information to the output device 40.

[0106] The output information generating unit 16 may cause the output device 40 to display a ranking of the components identified as the true cause of the abnormality in descending order of probability of being the cause of the abnormality. The output information generating unit 16 may also cause the output device 40 to display the components identified as the true cause of the abnormality and the recovery procedure. Furthermore, the output information generating unit 16 may cause the output device 40 to display the propagation path, etc.

[0107] [Device operation] The operation of the anomaly cause estimation device in the embodiment will be described with reference to Fig. 12. Fig. 12 is a diagram for explaining an example of the operation of the anomaly cause estimation device. In the following description, the diagram will be referred to as appropriate. In the embodiment, the anomaly cause estimation method is implemented by operating the anomaly cause estimation device. Therefore, the description of the anomaly cause estimation method in the embodiment will be replaced by the following description of the operation of the anomaly cause estimation device.

[0108] First, the anomaly detection unit 11 converts a data sequence acquired in time series from a plurality of components provided in a target system into an anomaly degree data sequence (step A1). Next, the anomaly detection unit 11 detects an anomaly based on the converted anomaly degree data sequence (step A2).

[0109] Next, the anomaly propagation estimation unit 12 inputs a target anomaly degree data series (target anomaly degree data series) extracted from the anomaly degree data series to be used for estimating the probability that an anomaly will propagate, a data series (target data series) corresponding to the target anomaly degree data series, and minimum information (causal graph) into an anomaly propagation estimation model, and estimates the probability that an anomaly will propagate between components (anomaly propagation probability) (step A3).

[0110] Next, the anomaly cause estimation unit 13 inputs the target anomaly degree data series (target anomaly degree data series) and the anomaly propagation probability to an anomaly cause estimation model, and estimates the cause of the occurrence of the anomaly (step A4).

[0111] Next, the anomaly cause estimation unit 13 outputs anomaly cause information indicating the estimated cause (step A5). Next, the output information generation unit 16 converts the anomaly cause information into a format that can be output to the output device 40 to generate output information, and outputs the output information to the output device 40 (step A6).

[0112] [Effects of the embodiment] According to the embodiment, costs can be reduced by constructing a model that causally infers the true cause of an anomaly using only normal data and minimal design knowledge (causal graph).

[0113] Since the true cause of an abnormality can be identified, rapid action can be taken when an abnormality is detected.

[0114] By utilizing minute changes in the degree of anomaly, it is possible to construct an anomaly propagation probability estimation model that estimates the probability of anomaly propagation even from normal data. At that time, the anomaly propagation probability estimation model can robustly estimate the degree of propagation and suppress errors.

[0115] By combining information that contains errors and is an ambiguous continuous value, such as the degree of anomaly and the probability of anomaly propagation, it is possible to identify the true cause of anomaly that is not reflected in the degree of anomaly. Even if there are gaps in the degree of anomaly, it is possible to estimate the true cause of anomaly by taking the gaps into account.

[0116] [program] The program in the embodiment may be a program that causes a computer to execute steps A1 to A6 shown in Fig. 12. By installing and executing this program in a computer, the anomaly cause estimation device and anomaly cause estimation method in the embodiment can be realized. In this case, the processor of the computer functions as anomaly detection unit 11, anomaly propagation estimation unit 12, anomaly cause estimation unit 13, a setting unit 14, a causal graph generation unit 15, and an output information generation unit 16, and performs processing.

[0117] The program in this embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the anomaly detection unit 11, the anomaly propagation estimation unit 12, the anomaly cause estimation unit 13, the setting unit 14, the causal graph generation unit 15, and the output information generation unit 16.

[0118] [Physical configuration] Here, a computer that realizes the anomaly cause estimating device by executing the program in the embodiment will be described with reference to Fig. 13. Fig. 13 is a diagram for explaining an example of a computer that realizes the anomaly cause estimating device in the embodiment.

[0119] 13, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU or an FPGA in addition to the CPU 111 or instead of the CPU 111.

[0120] The CPU 111 loads the programs (codes) in the embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). The programs in the embodiment are provided in a state stored in a computer-readable recording medium 120. The programs in the embodiment may be distributed on the Internet connected via the communication interface 117. The recording medium 120 is a non-volatile recording medium.

[0121] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0122] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0123] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0124] The anomaly cause estimating device 10 in the embodiment can be realized by using hardware corresponding to each part, instead of a computer with a program installed. Furthermore, the anomaly cause estimating device 10 may be partially realized by a program and the remaining part by hardware.

[0125] [Note] The following supplementary notes are further disclosed regarding the above-described embodiments. A part or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 18) described below, but are not limited to the following descriptions.

[0126] (Appendix 1) an anomaly detection unit that converts a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series and detects an anomaly based on the converted anomaly degree data series; an anomaly propagation estimation unit that inputs a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimates an anomaly propagation probability that an anomaly will propagate between the components; An abnormality cause estimation device having the above configuration.

[0127] (Appendix 2) 2. The abnormality cause estimating device according to claim 1, the anomaly propagation estimation model is generated by machine learning using, as learning data, a normal data series acquired in time series from the plurality of components, a learning anomaly degree data series obtained by converting the normal data series using the anomaly detection unit, and the causal graph; Abnormal cause estimation device.

[0128] (Appendix 3) 3. The abnormality cause estimating device according to claim 2, The information is a causal graph generated using the normal data series. Abnormal cause estimation device.

[0129] (Appendix 4) 4. The abnormality cause estimating device according to claim 1, an anomaly cause estimation unit that inputs the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate a cause of the occurrence of the anomaly and outputs anomaly cause information indicating the estimated cause; An abnormality cause estimation device having the above configuration.

[0130] (Appendix 5) 5. The abnormality cause estimating device according to claim 4, The anomaly cause inference model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario, and the likelihood that the anomaly propagation scenario itself is established based on the anomaly propagation likelihood. Abnormal cause estimation device. (Appendix 6) 6. The abnormality cause estimation device according to claim 4, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. Abnormal cause estimation device.

[0131] (Appendix 7) A step of converting a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series; detecting an anomaly based on the converted anomaly degree data series; a step of inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; The method for estimating the cause of an abnormality includes the steps of:

[0132] (Appendix 8) The method for estimating a cause of an anomaly according to claim 7, The anomaly propagation estimation model is generated by machine learning using, as learning data, normal data series acquired in time series from the plurality of components, learning anomaly degree data series obtained by converting the normal data series, and the information. Anomaly cause estimation method.

[0133] (Appendix 9) The method for estimating a cause of an anomaly according to claim 8, The information is a causal graph generated using the normal data series. Anomaly cause estimation method.

[0134] (Appendix 10) 10. The method for estimating a cause of an anomaly according to any one of claims 7 to 9, inputting the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate the cause of the anomaly, and outputting anomaly cause information indicating the estimated cause; The method for estimating the cause of an abnormality includes the steps of:

[0135] (Appendix 11) The method for estimating a cause of an anomaly according to claim 10, The anomaly cause inference model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario, and the likelihood that the anomaly propagation scenario itself is established based on the anomaly propagation likelihood. Anomaly cause estimation method.

[0136] (Appendix 12) The method for estimating a cause of an anomaly according to claim 10 or 11, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. Anomaly cause estimation method.

[0137] (Appendix 13) To your computer A step of converting a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series; detecting an anomaly based on the converted anomaly degree data series; a step of inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; Contains instructions to execute Mup Logura Hmm.

[0138] (Appendix 14) As described in Appendix 13 program And, The anomaly propagation estimation model is generated by machine learning using, as learning data, normal data series acquired in time series from the plurality of components, learning anomaly degree data series obtained by converting the normal data series, and the information. program .

[0139] (Appendix 15) As described in Appendix 14 program And, The information is a causal graph generated using the normal data series. program .

[0140] (Appendix 16) Any one of appendix 13 to 15 program And, The program is inputting the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate the cause of the anomaly, and outputting anomaly cause information indicating the estimated cause. Contains instructions to execute Mup Logura Hmm.

[0141] (Appendix 17) As described in Appendix 16 program And, The anomaly cause estimation model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario, and the probability that the anomaly propagation scenario itself is established based on the anomaly propagation probability. program .

[0142] (Appendix 18) The method described in Appendix 16 or 17 program And, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. program .

[0143] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0144] As described above, according to the present invention, when an abnormality is detected, the true cause of the detected abnormality can be inferred based on the propagation of the abnormality. The present invention is useful in fields where it is necessary to infer the fundamental cause of an abnormality in a system. [Explanation of symbols]

[0145] 10 Abnormality cause estimation device 11 Anomaly detection section 12. Anomaly Propagation Estimation Unit 13 Abnormality cause estimation section 14 Setting section 15 Causal graph generation unit 16 Output information generation unit 20 Input Devices 30 Storage device 40 Output Device 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. an anomaly detection means for converting a data series acquired in time series from a plurality of components provided in the target system into an anomaly degree data series, and detecting an anomaly based on the converted anomaly degree data series; anomaly propagation estimation means for inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly will propagate between the components; An abnormality cause estimation device having the above configuration.

2. 2. The abnormality cause estimating device according to claim 1, the anomaly propagation estimation model is generated by machine learning using, as learning data, a normal data series acquired in time series from the plurality of components, a learning anomaly degree data series obtained by converting the normal data series using the anomaly detection means, and the information; Abnormal cause estimation device.

3. 3. The abnormality cause estimating device according to claim 2, The information is a causal graph generated using the normal data series. Abnormal cause estimation device.

4. 4. The abnormality cause estimating device according to claim 1, anomaly cause estimation means for inputting the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate a cause of the occurrence of the anomaly, and outputting anomaly cause information indicating the estimated cause; An abnormality cause estimation device having the above configuration.

5. The abnormality cause estimating device according to claim 4, The anomaly cause estimation model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario, and the likelihood that the anomaly propagation scenario itself is established based on the anomaly propagation likelihood. Abnormal cause estimation device.

6. The abnormality cause estimating device according to claim 4 or 5, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. Abnormal cause estimation device.

7. A data series acquired in a time series manner from a plurality of components installed in the target system is converted into an anomaly data series; Detecting an anomaly based on the converted anomaly degree data series; inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; Anomaly cause estimation method.

8. The method for estimating a cause of an anomaly according to claim 7, The anomaly propagation estimation model is generated by machine learning using, as learning data, normal data series acquired in time series from the plurality of components, learning anomaly degree data series obtained by converting the normal data series, and the information. Anomaly cause estimation method.

9. The method for estimating a cause of an abnormality according to claim 8, The information is a causal graph generated using the normal data series. Anomaly cause estimation method.

10. 10. The method for estimating a cause of an anomaly according to claim 7, further comprising the steps of: inputting the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate the cause of the anomaly, and outputting anomaly cause information indicating the estimated cause; Anomaly cause estimation method.

11. The method for estimating a cause of an anomaly according to claim 10, The anomaly cause inference model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario, and the likelihood that the anomaly propagation scenario itself is established based on the anomaly propagation likelihood. Anomaly cause estimation method.

12. The method for estimating a cause of an anomaly according to claim 10 or 11, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. Anomaly cause estimation method.

13. On the computer, A data series acquired in a time series manner from a plurality of components installed in the target system is converted into an anomaly data series; Detecting an anomaly based on the converted anomaly degree data series; inputting a target anomaly degree data series extracted from the anomaly degree data series before the time when the anomaly was detected, a target data series corresponding to the target anomaly degree data series, and information indicating a causal relationship between the components into an anomaly propagation estimation model, and estimating an anomaly propagation probability that an anomaly propagates between the components; A program containing instructions.

14. The program according to claim 13, The anomaly propagation estimation model is generated by machine learning using, as learning data, normal data series acquired in time series from the plurality of components, learning anomaly degree data series obtained by converting the normal data series, and the information. program.

15. The program according to claim 14, The information is a causal graph generated using the normal data series. program.

16. 16. A program according to any one of claims 13 to 15, The computer includes: inputting the anomaly degree data series and the anomaly propagation probability into an anomaly cause estimation model to estimate a cause of the anomaly, and outputting anomaly cause information indicating the estimated cause; A program containing instructions.

17. The program according to claim 16, The anomaly cause estimation model evaluates overall consistency using the consistency between the anomaly degree data series and an anomaly propagation scenario and the probability that the anomaly propagation scenario itself is established based on the anomaly propagation probability. program.

18. 18. The program according to claim 16 or 17, The anomaly cause information is a probability that the component is the anomaly cause at a given time point. program.

Images