Learning device, learning method, and program

Abstract

A training device according to one embodiment of the present invention has: an input unit for inputting a set of normal data of a first system serving as a target domain and a set of normal data of a second system serving as a source domain; and a training unit for training a model comprising a first encoder for receiving input of data of the target domain and a second encoder for receiving input of data of the source domain by using the set of normal data of the first system and the set of normal data of the second system, a discriminator for receiving input of output data of either the first encoder or the second encoder and determining whether the output data represents a feature of either the target domain or the source domain, and Deep SVDD for receiving input of the output data.

Description

[Technical field]

[0001] The present invention relates to a learning device. , studies learning method , and and programs. [Background technology]

[0002] For businesses that operate ICT (Information and Communication Technology) systems, one of the most important tasks is to understand the state of anomalies that occur within the ICT system and to respond quickly to them. For this reason, research has been conducted on methods for early detection of anomalies that occur within ICT systems. In particular, unsupervised anomaly detection methods using DL (Deep Learning) have been proposed, which learn the normal state using data from the ICT system when it is normal, and detect anomalies by calculating the degree of deviation from the normal state during testing (for example, Non-Patent Documents 1 and 2).

[0003] ICT systems provide a variety of services, and users of those services also have various tendencies, so a large amount of data on normal times is required to learn the normal state of an ICT system using unsupervised anomaly detection methods that use DL.In general, the time that an ICT system is normal is often longer than the time that it is abnormal, so it is possible to collect a large amount of data on normal times in ICT systems that have been in operation for a long time. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Y. Ikeda, K. Ishibashi, Y. Nakano, K. Watanabe, K. Tajiri, and R. Kawahara, "Human-Assisted Online Anomaly Detection with Normal Outlier Retraining," ACM SIGKDD 2018 Workshop ODD v5.0, Aug. 2018. [Non-Patent Document 2] Y. Ikeda, K. Tajiri, Y. Nakano, K. Watanabe, K. Ishibashi,"Unsupervised Estimation of Dimensions Contributing to Detected Anomalies with Variational Autoencoders,"AAAI-19 Workshop on Network Interpretability for Deep Learning, 2019. Summary of the Invention [Problem to be solved by the invention]

[0005] However, there are cases where only a small amount of data is collected under normal conditions. For example, immediately after a new ICT system is constructed, it is not possible to collect a sufficient amount of data under normal conditions. For this reason, until a sufficient amount of data under normal conditions is collected, anomalies cannot be detected using unsupervised anomaly detection methods.

[0006] Furthermore, for example, when the normal state of an ICT system changes due to the provision of a new service, previous unsupervised anomaly detection methods cannot be used, and similarly, anomalies cannot be detected until a sufficient amount of normal data has been collected.

[0007] One embodiment of the present invention has been made in consideration of the above points, and aims to achieve unsupervised anomaly detection in a target system using a small amount of normal data. [Means for solving the problem]

[0008] In order to achieve the above-mentioned object, a learning device according to one embodiment has an input unit that inputs a set of data of a first system under normal conditions, which is a target domain, and a set of data of a second system under normal conditions, which is a source domain, and a learning unit that uses the set of data of the first system under normal conditions and the set of data of the second system under normal conditions to learn a model composed of a first encoder that takes as input data of the target domain, a second encoder that takes as input data of the source domain, an identifier that uses as input output data of either the first encoder or the second encoder and determines whether the output data represents a feature of the target domain or the source domain, and DeepSVDD that takes as input the output data. Effect of the Invention

[0009] Unsupervised anomaly detection in the target system can be achieved using a small amount of normal data. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a model. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of the anomaly detection device according to the present embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a functional configuration of the anomaly detection device according to the present embodiment. [Figure 4] 5 is a flowchart showing an example of the flow of an overall process executed by the anomaly detection device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] An embodiment of the present invention will be described below. In this embodiment, the configuration and function of each ICT system are different, but when ICT systems have similar configurations and functions, their normal states are also similar. This focuses on this point, and describes an unsupervised anomaly detection method in which information obtained when learning the normal state of an ICT system with a large amount of normal data is transferred to an ICT system with only a small amount of normal data. This unsupervised anomaly detection method makes it possible to obtain an anomaly detector that can detect anomalies in an ICT system with only a small amount of normal data (hereinafter also referred to as a target system).

[0012] Also, an anomaly detection device 10 that creates an anomaly detector and detects an anomaly in a target system using the anomaly detector by using the unsupervised anomaly detection method described above will be described.

[0013] <Unsupervised anomaly detection method> The theoretical configuration of the unsupervised anomaly detection method according to this embodiment will be described below.

[0014] First, an ICT system with a large amount of data under normal conditions is defined as the source domain S, and an ICT system (target system) with only a small amount of data under normal conditions is defined as the target domain T.

[0015] In addition, a certain data obtained from the source domain S under normal conditions is expressed as n-dimensional vector data x s =[x1 (s) ,x n (s) ], these n-dimensional vector data x s A dataset consisting of

[0016]

number

[0017] Similarly, a certain data obtained from the target domain T under normal conditions is expressed as m-dimensional vector data x t =[x1 (t) ,x m (t) ], these m-dimensional vector data x t A dataset consisting of

[0018]

number

[0019] Next, a model used in the unsupervised anomaly detection method according to this embodiment will be described. An encoder (encoder), which is a type of DL, and DeepSVDD (Deep Support Vector Data Description) (Reference 1) are used as a method for detecting anomalies in each of the source domain S and the target domain T. More specifically, after input data (normal data) is compressed by the encoder E, learning is performed so that when the compressed data (feature amount) is mapped onto a hypersphere by the DeepSVDD, the hypersphere (its volume or the area of ​​the hypersphere) is minimized. After learning, anomaly detection is performed using the encoder and SVDD that input data from the target domain. Hereinafter, the encoder of the source domain S is referred to as E. S , and its parameters are θ S , the encoder of the target domain is E T , and its parameters are θ E Let us assume that.

[0020] In addition, a method using a Generative Adversarial Network (GAN) is known as a method for transferring knowledge in a certain domain to another domain (Reference 2). Therefore, in the unsupervised anomaly detection method according to the present embodiment, in the GAN-based transfer learning method, the encoder E S and E TWe use a model that combines DeepSVDD and

[0021] Specifically, we take an encoder E from each of the source domain S and the target domain T. S and E T By extracting features using the encoder E, we obtain a transferable representation (feature) from the source domain S and apply it to the target domain T. S ( ;θ S ), E T ( ;θ T ) output E S (x s ;θ S ), E T (x t ;θ T ), we use a discriminator D(·;θ D ) is prepared. Here, the discriminator D(·;θ D ) is represented by a neural network, and θ D are its parameters. In other words, the discriminator D is a neural network that determines whether the input data is data from the source domain or data from the target domain. Note that the discriminator D(·;θ D ) input layer dimensions and encoder E S ( ;θ S ) and E T ( ;θ T ) have the same dimensionality of their output layers (e.g., they both have dimensionality k).

[0022] The above model is the learning target. In the following, the index of the data input to the learning target model is i, i=1,...,|D S |+|D T For each i, s i ∈{1, ,|D S |} or t i ∈{1, ,|D T Only one of the following is true: si ∈{1, ,|D S For i where |} does not hold, for example, s i =|D S |+1, etc. Similarly, t i ∈{1, ,|D T For i for which |} does not hold, for example, t i =|D T |+1, etc. In the following, "s" should be written to the right of "x". i " and "t i " are used in the text of the specification as "x s_i " and "x s_i " should be written.

[0023] The model to be trained is shown in Figure 1. For each i, x s_i or x t_i One of these is input into the model, and x s_i is input to the model, the output of the source domain encoder is E S (x s_i ;θ S ) are input to the DeepSVDD DSVDD and the discriminator D, respectively. Meanwhile, x t_i is input to the model, the output of the target encoder is E T (x t_i ;θ T ) is input to the DeepSVDD DSVDD and the discriminator D, respectively.

[0024] Next, we define the loss function for the model to be trained above.

[0025] First, the discriminator D(·;θ D ) loss function is defined as follows:

[0026]

number

[0027] Next, DeepSVDD DSVDD(·;θ DSVDD ) loss function is defined as follows:

[0028]

number

[0029] To summarize the above, we define the loss function for the model to be trained as follows:

[0030]

number

[0031] Then, the parameters are learned so as to minimize the loss function shown in the above equation 5. That is, the encoder E S and E T and DeepSVDD DSVDD is such that the hypersphere centered on c is minimized, and the encoder E S and E T Regarding classifier D, each parameter is trained so as to maximize the discrimination performance of classifier D. Specifically, the parameters are trained as follows.

[0032]

number

[0033] After learning using the above formula 6, the DSVDD(ET ( ;θ T );θ DSVDD Specifically, the data to be detected as an anomaly in the target domain is x, and DSVDD(E T (x;θ T );θ DSVDD ) and calculate DSVDD(E T (x;θ T );θ DSVDD If the difference between DSVDD(E) and c exceeds a certain threshold, it is determined to be abnormal, otherwise it is determined to be normal. The threshold can be set arbitrarily, but for example, T ( ;θ T );θ DSVDD ) for each x t ∈D T For DSVDD(E T (x t ;θ T );θ DSVDD ) and c, and calculate their mean μ and variance σ 2 Then μ+σ 2 or μ-σ 2 It is possible to set the threshold value as above.

[0034] <Hardware configuration of the anomaly detection device 10> Next, a hardware configuration of the anomaly detection device 10 according to the present embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the hardware configuration of the anomaly detection device 10 according to the present embodiment.

[0035] 2, the anomaly detection device 10 according to this embodiment is realized by the hardware configuration of a general computer or computer system, and includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a processor 105, and a memory device 106. Each of these hardware components is communicatively connected via a bus 107.

[0036] The input device 101 is, for example, a keyboard, a mouse, a touch panel, etc. The display device 102 is, for example, a display.

[0037] The external I / F 103 is an interface with an external device such as a recording medium 103a. The anomaly detection device 10 can read and write data from and to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), a SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0038] The communication I / F 104 is an interface for connecting the anomaly detection device 10 to a communication network. The processor 105 is, for example, various types of arithmetic devices such as a central processing unit (CPU) or a graphics processing unit (GPU). The memory device 106 is, for example, various types of storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read only memory (ROM), and a flash memory.

[0039] The anomaly detection device 10 according to this embodiment has the hardware configuration shown in Fig. 2 and can realize various processes described below. Note that the hardware configuration shown in Fig. 2 is an example, and the anomaly detection device 10 may have other hardware configurations. For example, the anomaly detection device 10 may have multiple processors 105, or multiple memory devices 106.

[0040] <Functional configuration of the abnormality detection device 10> Next, the functional configuration of the anomaly detection device 10 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the functional configuration of the anomaly detection device 10 according to this embodiment.

[0041] 3, the anomaly detection device 10 according to this embodiment includes a learning unit 201, an inference unit 202, and a user interface unit 203. Each of these units is realized, for example, by a process executed by a processor 105 of one or more programs installed in the anomaly detection device 10.

[0042] Moreover, the anomaly detection device 10 according to this embodiment includes a target domain DB 204, a source domain DB 205, and a trained model DB 206. Each of these DBs (databases) is realized by, for example, the memory device 106.

[0043] The learning unit 201 uses m-dimensional vector data x stored in the target domain DB 204. t and n-dimensional vector data x stored in the source domain DB 205 s Using the model shown in Figure 1 (i.e., the encoder E S and E T , DeepSVDD, DSVDD, and a classifier D) is trained. The model trained by the training unit 201 (hereinafter also referred to as a trained model) is stored in a trained model DB 206.

[0044] The inference unit 202 uses the DSVDD(E T ( ;θ T );θ DSVDD ) is used as an anomaly detector, and this anomaly detector and the m-dimensional vector data x of the anomaly detection target are used to determine whether an anomaly has occurred in the target system.

[0045] The user interface unit 203 outputs to a user the result of the determination made by the inference unit 202. For example, the user interface unit 203 outputs the result of the determination to a terminal or the like used by an operator or the like of the target system.

[0046] The target domain DB 204 is a data set D of the target domain T. TThe source domain DB 205 stores the data set D of the source domain S. S The trained model DB 206 stores trained models.

[0047] 3 is merely an example, and other functional configurations may be used. For example, each functional unit and each DB may be arranged in a plurality of devices.

[0048] <Overall process flow executed by the anomaly detection device 10> Next, the flow of the overall process executed by the anomaly detection device 10 according to this embodiment will be described with reference to FIG. 4. FIG. 4 is a flowchart showing an example of the flow of the overall process executed by the anomaly detection device 10 according to this embodiment. Here, step S101 in FIG. 4 is a learning phase process, and steps S102 to S103 are inference phase processes. Note that the learning phase is a phase in which a model is learned, while the inference phase is a phase in which inference (i.e., anomaly detection) is performed using a trained model. The learning phase is performed in advance of the inference phase.

[0049] Step S101: The learning unit 201 performs the learning on the m-dimensional vector data x stored in the target domain DB 204. t and n-dimensional vector data x stored in the source domain DB 205 s 1 is trained using the above equation (6). That is, the training unit 201 trains the parameters of the model using an optimization method such as Adam.

[0050] Step S102: The inference unit 202 calculates the DSVDD(E T ( ;θ T );θ DSVDD ) as an anomaly detector, and uses this anomaly detector and the m-dimensional vector data x of the anomaly detection target to determine whether an anomaly has occurred in the target system. T (x;θT );θ DSVDD If the difference between c and d exceeds a predetermined threshold, it is judged as abnormal; otherwise, it is judged as normal.

[0051] Step S103: The user interface unit 203 outputs the determination result (normal or abnormal) of the above step S102 to the user. Note that the user interface unit 203 may output the determination result of the above step S102 to the user only when the determination result is abnormal.

[0052] As described above, with the anomaly detection device 10 of this embodiment, even if there is only a small amount of data on the target system under normal conditions, it is possible to detect anomalies in the target system by an unsupervised anomaly detection method using DL, by transferring normal state information from an ICT system that has a large amount of normal state data.

[0053] As described above, the anomaly detection device 10 has a learning phase and an inference phase, and in this embodiment, the same anomaly detection device 10 executes the learning phase and the inference phase, but these phases may be executed by different devices. Furthermore, the anomaly detection device 10 in the learning phase may be called a "learning device" or the like.

[0054] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0055] [References] Reference 1: Ruff, Lukas, et al. "Deep one-class classification." International conference on machine learning. PMLR, 2018. Reference 2: Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M.: Domain adversarial neural networks. arXiv preprint arXiv:1412.4446 (2014) Reference 3: Ruder, Sebastian. "An overview of gradient descent optimization algorithms." arXiv preprint arXiv:1609.04747 (2016). [Explanation of symbols]

[0056] 10. Anomaly detection device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 processors 106 Memory Device 107 Bus 201 Learning Department 202 Reasoning section 203 User Interface Section 204 Target Domain DB 205 Source Domain DB 206 Trained Model DB

Claims

1. an input unit for inputting a set of data in a normal state of a first system that is a target domain and a set of data in a normal state of a second system that is a source domain; a learning unit that uses a set of data of the first system in a normal state and a set of data of the second system in a normal state to learn a model that is configured of a first encoder that receives data of the target domain as an input, a second encoder that receives data of the source domain as an input, a classifier that receives output data of either the first encoder or the second encoder as an input and determines whether the output data represents a feature of the target domain or the source domain, and a DeepSVDD that receives the output data as an input; having The learning unit is a learning device that learns parameters of the first encoder, parameters of the second encoder, and parameters of the DeepSVDD so as to minimize a hypersphere when the output data is mapped onto a hypersphere by the DeepSVDD, and learns parameters of the first encoder, parameters of the second encoder, and parameters of the classifier so as to maximize a discrimination performance of the classifier.

2. The learning device according to claim 1 , wherein the number of data items included in the set of normal data items of the target domain is smaller than the number of data items included in the set of normal data items of the source domain.

3. an input step of inputting a set of data in a normal state of a first system that is a target domain and a set of data in a normal state of a second system that is a source domain; a learning procedure for learning a model using a set of data of the first system under normal conditions and a set of data of the second system under normal conditions, the model being composed of a first encoder receiving data of the target domain as an input, a second encoder receiving data of the source domain as an input, a classifier receiving output data of either the first encoder or the second encoder as an input and determining whether the output data represents a feature of the target domain or the source domain, and a DeepSVDD receiving the output data as an input; The computer executes The learning procedure includes: a learning method for learning parameters of the first encoder, parameters of the second encoder, and parameters of the DeepSVDD so as to minimize a hypersphere when the output data is mapped onto the hypersphere by the DeepSVDD, and for learning parameters of the first encoder, parameters of the second encoder, and parameters of the classifier so as to maximize a discrimination performance of the classifier.

4. A program for causing a computer to function as the learning device according to claim 1 or 2.

Images