Processing device, processing system, processing method, and program

Abstract

A processing device capable of improving convenience is provided. The processing device includes a first processing unit that determines a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the determined normal data proposal.

Description

[Technical field]

[0001] The present disclosure relates to a processing device, a processing system, a processing method, and a program. [Background technology]

[0002] Data is used in various fields. Patent Document 1 discloses a related technology, which is a system that uses previously accumulated sensing data from multiple sensors to perform highly accurate anomaly detection for a monitored object. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2011 / 036809 Summary of the Invention [Problem to be solved by the invention]

[0004] Meanwhile, in the system related to Patent Document 1, a technique capable of improving convenience is required.

[0005] An object of each aspect of the present disclosure is to provide a processing device, a processing system, a processing method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0006] In order to achieve the above object, according to one aspect of the present disclosure, a processing device includes: The apparatus includes a first processing unit that obtains a normal data proposal for abnormal data detected in a device that is a target of anomaly detection and displays the obtained normal data proposal, and a second processing unit that generates an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in data that has been subjected to division processing for learning by machine learning, and the first processing unit detects the abnormal data based on the anomaly detection model generated by the second processing unit. .

[0007] In order to achieve the above object, according to another aspect of the present disclosure, a processing system includes the above processing device and a device that is a target of the anomaly detection.

[0008] In order to achieve the above object, according to another aspect of the present disclosure, a processing method includes: The method includes: determining a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displaying the determined normal data proposal; generating an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in the learning division processed data by machine learning; and detecting the abnormal data based on the generated anomaly detection model. .

[0009] In order to achieve the above object, according to another aspect of the present disclosure, a program includes: The computer is caused to obtain a normal data proposal for abnormal data detected in a device that is a target for anomaly detection, and to display the obtained normal data proposal; generate an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in the data that has been subjected to division processing for learning, by machine learning; and detect the abnormal data based on the generated anomaly detection model. . Effect of the Invention

[0010] According to each aspect of the present disclosure, convenience can be improved. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of a configuration of an anomaly detection device according to some embodiments of the present disclosure. [Diagram 2] FIG. 13 is a diagram illustrating an example of divided learning data according to some embodiments of the present disclosure. [Diagram 3] FIG. 2 is a diagram illustrating an example of target segmentation processed data according to some embodiments of the present disclosure. [Figure 4] FIG. 13 is a diagram illustrating an example of segmented image data according to some embodiments of the present disclosure. [Diagram 5] FIG. 2 is a diagram illustrating an example of image data according to some embodiments of the present disclosure. [Figure 6] FIG. 1 is a diagram illustrating an example of learned data according to some embodiments of the present disclosure. [Figure 7] FIG. 1 is a diagram illustrating an example of a configuration of a learning device according to some embodiments of the present disclosure. [Figure 8] FIG. 2 is a diagram illustrating an example of a configuration of a target device according to some embodiments of the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating a first example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 10] FIG. 11 is a diagram illustrating a second example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 11] FIG. 11 is a diagram illustrating an example of a process of dividing time-series data performed by a data division processing unit according to some embodiments of the present disclosure. [Figure 12]FIG. 11 is a diagram illustrating an example of a process of dividing time-series data performed by a data division processing unit according to some embodiments of the present disclosure. [Figure 13] FIG. 11 is a diagram illustrating a third example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 14] FIG. 2 illustrates an example of anomaly data according to some embodiments of the present disclosure. [Figure 15] FIG. 13 is a diagram illustrating an example of data identified by an anomaly correction suggestion processor according to some embodiments of the present disclosure. [Figure 16] FIG. 11 is a diagram illustrating an example of a normal data proposal that an anomaly correction proposal processor displays on a display unit according to some embodiments of the present disclosure. [Figure 17] FIG. 2 is a diagram illustrating an example of a configuration of a processing device according to some embodiments of the present disclosure. [Figure 18] FIG. 2 is a diagram illustrating an example of a processing flow of a processing device according to some embodiments of the present disclosure. [Figure 19] FIG. 1 is a schematic block diagram illustrating a configuration of a computer according to at least one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, the embodiments will be described in detail with reference to the drawings. <Embodiment> A processing system 1 according to an embodiment of the present disclosure will be described with reference to the drawings. The processing system 1 includes an anomaly detection device 10. During learning, the processing system 1 includes a learning device 20 in addition to the anomaly detection device 10. The anomaly detection device 10 learns anomaly detection using data stored in the learning device 20. During operation, the processing system 1 includes a target device 30 in addition to the anomaly detection device 10. The anomaly detection device 10 detects an anomaly in the target device 30. The anomaly detection device 10 also presents an estimated value indicating a normal state closest to the anomaly detected in the target device 30 as a correction proposal.

[0013] (Configuration of the processing system of the present disclosure) Fig. 1 is a diagram illustrating an example of the configuration of an anomaly detection device 10 according to some embodiments of the present disclosure. As shown in Fig. 1, the anomaly detection device 10 according to one embodiment of the present disclosure includes a data division processing unit 101, an image processing unit 102, a learning processing unit 103, an anomaly correction proposal processing unit 104, and a display unit 105. The anomaly detection device 10 performs different processing during learning and during operation.

[0014] The data division processing unit 101 stores the divided data for learning. FIG. 2 is a diagram showing an example of divided data for learning according to some embodiments of the present disclosure. The divided data for learning is stored in the data division processing unit 101 in a state in which each time series data is divided into folders for each element / division unit as shown in part (a) of FIG. 2. Part (b) of FIG. 2 shows an example of time series data in the case where the element is sensor A and the division number is 2. The time series data is divided into data groups 1, 2, and 3, each of which is divided into 2 division numbers, and as shown in part (a) of FIG. 2, for each divided data group, learning device information indicating the device, sensor information (element) indicating the sensor, acquisition time which is the time when the sensor detected, and value which is the value detected by the sensor are stored in association with each other. Note that information of data groups with the same number is collected to form one image when image data is created.

[0015] The data division processing unit 101 also stores the object division processed data. Fig. 3 is a diagram showing an example of the object division processed data according to some embodiments of the present disclosure. The object division processed data is stored in the data division processing unit 101 in a state in which each time series data is classified into a folder for each element / division unit as shown in Fig. 3.

[0016] The image processing unit 102 stores the divided image data. Fig. 4 is a diagram showing an example of divided image data according to some embodiments of the present disclosure. Fig. 5 is a diagram showing an example of image data according to some embodiments of the present disclosure. The divided image data is stored in the image processing unit 102 in a state in which each image data is divided for each element / division unit as shown in Figs. 4 and 5 (for each data group). Each image data holds reference information corresponding to each data in the divided data for learning.

[0017] The learning processing unit 103 stores the learned data. FIG. 6 is a diagram showing an example of the learned data according to some embodiments of the present disclosure. The learned data is stored in the learning processing unit 103 in a state in which each anomaly detection model data is divided for each element / division unit as shown in FIG. 6. Each model is generated from the data divided for each element / division unit of the time series data in the data after the division process for learning. Using the normal data, a model in which the range of the thresholds that are all determined to be normal is the smallest is generated by unsupervised learning. The combination of elements may be determined by any method. The combination of elements may be determined in advance.

[0018] Furthermore, when the learning processing unit 103 creates an anomaly detection model combining a plurality of elements, an anomaly detection model for each division unit is stored for each of the same combinations. For example, when combinations of "element A / element B", "element C / element E", and "element A / element E" are predefined, the learning processing unit 103 stores "element A (division unit 1)" in "element A / element B (division unit 1)" and "element A / element E (division unit 1)", and stores "element B (division unit 1)" in "element A / element B (division unit 1)". When there is a combination of elements, the time series data is treated as one block. For example, when there is "element A / element B", the time series data of element A and the time series data of element B are treated as one block. The anomaly detection model is a model for detecting an anomaly in the target device 30, and may be generated by any method in machine learning.

[0019] The anomaly correction proposal processing unit 104 calculates the degree of anomaly using data for each element / division unit in the divided processed data for the target device and the anomaly detection model in the learned data. Then, when the degree of anomaly is equal to or greater than a threshold, the anomaly correction proposal processing unit 104 causes the display unit 105 to display an anomaly notification and a proposal to correct the data of the abnormal location (i.e., a normal data proposal). The anomaly correction proposal processing unit 104 executes this process for all data divided into each element / division unit in the divided processed data for the target device. The process of generating the normal data proposal performed by the anomaly correction proposal processing unit 104 will be described in detail later. The display unit 105 displays various information about the anomaly detection device 10.

[0020] Fig. 7 is a diagram illustrating an example of the configuration of the training device 20 according to some embodiments of the present disclosure. The training device 20 is a device having normal data. As shown in Fig. 7, the training device 20 includes a sensor 201a, a sensor 201b, and a sensor 201c. The sensors 201a, 201b, and 201c may be collectively referred to as the sensor 201.

[0021] Fig. 8 is a diagram illustrating an example of a configuration of a target device 30 according to some embodiments of the present disclosure. The target device 30 is a device in which a malfunction (e.g., a breakdown) has occurred. In other words, the target device 30 is a device that is a target for anomaly detection. As shown in Fig. 8, the target device 30 includes sensors 301a, 301b, and 301c. The sensors 301a, 301b, and 301c may be collectively referred to as sensor 301.

[0022] The above-described processing performed by the processing system 1 according to the embodiment of the present disclosure is merely an example, and is not limited to the above-described processing. For example, the processing system 1 may perform the processing described below.

[0023] (Processing performed by the processing system of the present disclosure) Fig. 9 is a diagram showing a first example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Fig. 10 is a diagram showing a second example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Here, a process during learning performed by the processing system 1 shown in Fig. 9 and a process during operation performed by the processing system 1 shown in Fig. 10 will be described.

[0024] (Learning process) First, the process during learning performed by the processing system 1 shown in Fig. 9 will be described. The sensor 201 included in each learning device 20 acquires data at each predetermined timing (step S1). The data acquired by the sensor 201 includes learning device information, sensor information (i.e., element), acquisition time, and value. The learning device information is information indicating from which learning device 20 the value was acquired. The sensor information is information indicating from which sensor 201 the value was acquired. The acquisition time is the time when the sensor 201 acquired the value. The value is the value acquired (i.e., detected) by the sensor 201. The data division processing unit 101 stores the time series data acquired by the sensor 201 included in each learning device 20 as a "learning device sensor log" (step S2).

[0025] The data division processing unit 101 stores the divided data for learning in a state in which each data is divided, for example, as shown in FIG. 2 (step S3). The data division processing unit 101 sets a division frame width for each predetermined division unit (step S4). Then, the data division processing unit 101 divides the time series data using the set division frame width (step S5). For example, the data division processing unit 101 determines several division units. Then, the data division processing unit 101 creates data by dividing the time frame width for the same element by multiple division frame widths, shifting the time frame width by a predetermined range.

[0026] Fig. 11 is a diagram showing an example of processing for dividing time-series data performed by the data division processing unit 101 according to some embodiments of the present disclosure. Specifically, for example, as shown in part (a) of Fig. 11, the data division processing unit 101 sets a division frame width 1 to a predetermined division unit 1 (for example, every 5 seconds). Also, as shown in part (b) of Fig. 11, the data division processing unit 101 sets a division frame width 2 to a predetermined division unit 2 (for example, every 10 seconds). Also, as shown in part (c) of Fig. 11, the data division processing unit 101 sets a division frame width 3 to a predetermined division unit 3 (for example, every 20 seconds). Note that element A, element B, and element C in Fig. 11 are data obtained from sensor 201, sensor 202, and sensor 203, respectively.

[0027] Next, the image processing unit 102 converts the time series data in the divided data for learning into image data for each element / division unit (step S6). Then, the image processing unit 102 stores the divided image data in a divided state of each image data as shown in FIG. 4 (step S7).

[0028] Next, the learning processing unit 103 generates an anomaly detection model for each element / division unit of the time-series data in the learning division processed data by machine learning (step S8). The machine learning here is, for example, unsupervised learning. Specifically, for example, the learning processing unit 103 performs vectorization processing on image data generated using only normal data as learning data, and generates a model (anomaly detection model) in which a normal threshold is determined by unsupervised learning. During operation, the learning processing unit 103 compares the anomaly detection model generated here with a model obtained from the target device 30 in which an anomaly is to be confirmed, and determines that the anomaly is "normal" if it is within the range of the threshold in the anomaly detection model, and that the anomaly is "abnormal" if it is not. Then, the learning processing unit 103 stores the learned data in a state in which each anomaly detection model data is classified as shown in FIG. 5 (step S9).

[0029] (Processing during operation) Next, a process during operation performed by the processing system 1 shown in Fig. 10 will be described. The sensor 301 included in the target device 30 acquires data at predetermined timings (step S21). The data division processing unit 101 stores the time-series data acquired by the sensor 301 included in the target device 30 as a "target device sensor log" (step S22).

[0030] The data division processing unit 101 stores the divided data for the target device in a state in which each data is divided, for example, as shown in FIG. 3 (step S23). Specifically, for example, the data division processing unit 101 sets a division frame width for each predetermined division unit. Then, the data division processing unit 101 divides the time series data using the set division frame width. For example, the data division processing unit 101 determines several division units. For the same element, the data division processing unit 101 divides the time frame width by multiple division frame widths while shifting the time frame width by a predetermined range, thereby creating divided data for the target device. Then, the data division processing unit 101 stores the created divided data.

[0031] Fig. 12 is a diagram showing an example of processing for dividing time-series data performed by the data division processing unit 101 according to some embodiments of the present disclosure. Specifically, for example, as shown in part (a) of Fig. 12, the data division processing unit 101 sets a division frame width 1 to a predetermined division unit 1 (for example, every 5 seconds). Also, as shown in part (b) of Fig. 12, the data division processing unit 101 sets a division frame width 2 to a predetermined division unit 2 (for example, every 10 seconds). Also, as shown in part (c) of Fig. 12, the data division processing unit 101 sets a division frame width 3 to a predetermined division unit 3 (for example, every 20 seconds). Note that element A, element B, and element C in Fig. 12 are data obtained from sensor 301, sensor 302, and sensor 303, respectively.

[0032] Next, the anomaly correction proposal processor 104 refers to all the divided data for the target device (step S24). Then, for one of the divided data for the target device, the anomaly correction proposal processor 104 calculates the degree of anomaly using the data for each element / division unit and the anomaly detection model in the learned data (step S25). Then, the anomaly correction proposal processor 104 determines whether the degree of anomaly is equal to or greater than a threshold (step S26).

[0033] When the anomaly correction proposal processor 104 judges that the degree of anomaly is equal to or greater than the threshold (YES in step S26), it notifies the user of the anomaly, generates a correction proposal for the data at the anomalous location (i.e., a normal data proposal), and outputs the generated correction proposal (step S27).Then, the anomaly correction proposal processor 104 judges whether the degree of anomaly has been calculated for all the divided data for the target device (step S28).

[0034] If the anomaly correction proposal processing unit 104 determines that the degree of anomaly has not been calculated for even one of all the divided processed data for the target device (NO in step S28), it calculates the degree of anomaly for the divided processed data for the target device for which the degree of anomaly has not yet been calculated (step S29). Then, the anomaly correction proposal processing unit 104 proceeds to the process of step S26. If the anomaly correction proposal processing unit 104 determines that the degree of anomaly has been calculated for all the divided processed data for the target device (YES in step S28), it ends the process.

[0035] Moreover, when the anomaly correction proposal processor 104 determines that the degree of anomaly is not equal to or greater than the threshold value (NO in step S26), the process proceeds to step S28.

[0036] (Process for creating normal data proposal) 13 is a diagram illustrating a third example of a processing flow of the processing system 1 according to some embodiments of the present disclosure. Here, a process of generating a normal data proposal performed by the anomaly correction proposal processor 104 of the processing system 1 illustrated in FIG. 13 will be described.

[0037] The anomaly correction proposal processor 104 sets multiple sections with a certain width in the time direction for the anomaly data obtained from the segmented data for the target device (step S31). FIG. 14 is a diagram showing an example of the anomaly data according to some embodiments of the present disclosure. For example, as shown in FIG. 14, the anomaly correction proposal processor 104 sets multiple sections with a certain width T in the time direction for the anomaly data. Then, the anomaly correction proposal processor 104 handles the anomaly data as a vector line having one or more control points in each section T (step S32). The number of control points is determined in advance.

[0038] The anomaly correction proposal processor 104 calculates the similarity between the image of the abnormal data and each image of the divided image data (step S33). For example, the anomaly correction proposal processor 104 calculates the similarity by vectorizing the image and comparing the vector distance.

[0039] The anomaly correction proposal processing unit 104 identifies the highest similarity from among the obtained similarities, and identifies segmented image data having a similarity similar to the identified highest similarity. The anomaly correction proposal processing unit 104 identifies data corresponding to the identified segmented image data in the learning segmentation processed data (step S34). The anomaly correction proposal processing unit 104 causes the display unit 105 to display the identified data (step S35). FIG. 15 is a diagram illustrating an example of data identified by the anomaly correction proposal processing unit 104 according to some embodiments of the present disclosure. The anomaly correction proposal processing unit 104 identifies, for example, data as shown in FIG. 15 in the learning segmentation processed data.

[0040] The anomaly correction proposal processor 104 calculates the sum of the differences between the values ​​at the control points in each section T and the values ​​of similar normal data for the identified divided data for learning (step S36). Note that a section is a section obtained by dividing the division unit width into a certain width. The anomaly correction proposal processor 104 repeatedly increases the number of sections by one (i.e., widens the sections) for the sections T with the largest sum of differences, starting from the section T with the largest difference, up to a predetermined number of sections (step S37).

[0041] The anomaly correction proposal processing unit 104 randomly selects control points that reduce the difference in all sections that have a certain range, and brings the selected control points closer to the data that has been divided for learning (i.e., normal data) to a certain extent (step S38). At this time, the magnitude of the difference in the section T is reduced by the amount that the control points are brought closer to the data that has been divided for learning, and the difference in the control points that are not brought closer is reduced. For example, the value by which this difference is reduced is set to approximately the same as the value by which the difference of the control point that is initially selected is reduced. Note that the value of the control point closer to the control point that brings the value closer may be changed more greatly. In addition, if the value of only one point is changed when reducing the difference, the graph will have a partially concave shape, so a process of smoothly changing the concave part may be performed. The anomaly correction proposal processing unit 104 calculates the degree of anomaly. The anomaly correction proposal processing unit 104 determines whether the calculated degree of anomaly is within a threshold value (step S39).

[0042] When the anomaly correction proposal processing unit 104 determines that the degree of anomaly is not within the threshold (NO in step S39), the process returns to step S38. When the anomaly correction proposal processing unit 104 determines that the degree of anomaly is within the threshold (YES in step S39), the anomaly correction proposal processing unit 104 identifies the divided data of the target device having the smallest sum of the differences in all sections T (step S40). Then, the anomaly correction proposal processing unit 104 holds the identified divided data (step S41). Furthermore, the anomaly correction proposal processing unit 104 causes the display unit 105 to display the identified divided data as a normal data proposal (step S42). Note that the divided data here is data acquired from the original data, and is not data after the value is changed. FIG. 16 is a diagram showing an example of a normal data proposal that the anomaly correction proposal processing unit 104 according to some embodiments of the present disclosure causes the display unit 105 to display the normal data proposal together with the abnormal data, for example, as shown in FIG. 16.

[0043] The anomaly correction proposal processing unit 104 determines whether the sum of the differences in each section T is equal to or greater than a predetermined value from the identified divided data (step S43). If the anomaly correction proposal processing unit 104 determines that the sum of the differences is less than the predetermined value (NO in step S43), it ends the processing. If the anomaly correction proposal processing unit 104 determines that the sum of the differences is equal to or greater than a predetermined value (YES in step S43), it causes the display unit 105 to prominently display, for example highlighting, that section T in the normal data proposal (step S44). Then, the anomaly correction proposal processing unit 104 ends the processing.

[0044] The anomaly correction proposal processor 104 may use reinforcement learning to find a normal data proposal that has an anomaly degree equal to or less than a threshold and minimizes the sum of differences in the vertical axis direction.

[0045] (advantage) The processing system 1 according to an embodiment of the present disclosure has been described above. In the anomaly detection device 10 (an example of a processing device) of the processing system 1, the anomaly correction proposal processor 104 (an example of a first processor) obtains a normal data proposal for abnormal data detected in a target device 30 (an example of a device that is a target of anomaly detection). Then, the anomaly correction proposal processor 104 displays the obtained normal data proposal.

[0046] This anomaly detection device 10 (an example of a processing device) can show the operator how much correction is required to return a value to normal at a given time. In other words, the anomaly detection device 10 (an example of a processing device) can improve convenience.

[0047] 17 is a diagram illustrating an example of a configuration of a processing device 300 according to some embodiments of the present disclosure. As illustrated in FIG.

[0048] The first processing unit 301 obtains a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the obtained normal data proposal. The first processing unit 301 can be realized, for example, by using the function of the anomaly correction proposal processing unit 104 illustrated in Fig. 1. The processing device 300 can be realized, for example, by using the function of the anomaly detection device 10 illustrated in Fig. 1.

[0049] Next, a process performed by the processing device 300 according to some embodiments of the present disclosure will be described. Fig. 18 is a diagram showing an example of a processing flow of the processing device 300 according to some embodiments of the present disclosure. Here, the process of the processing device 300 will be described with reference to Fig. 18.

[0050] In the processing device 300, the first processing unit 301 obtains a normal data proposal for abnormal data detected in a device that is a target for abnormality detection, and displays the obtained normal data proposal (step S101).

[0051] The processing device 300 according to some embodiments of the present disclosure has been described above. The processing device 300 can improve convenience.

[0052] The order of the processes in each embodiment of the present disclosure may be changed as long as appropriate processes are performed.

[0053] Although each embodiment of the present disclosure has been described, the above-mentioned processing system 1, anomaly detection device 10, learning device 20, target device 30, and other control devices may have a computer system therein. The above-mentioned process steps are stored in a computer-readable recording medium in the form of a program, and the above-mentioned process is performed by the computer reading and executing the program. Specific examples of computers are shown below.

[0054] 19 is a schematic block diagram showing the configuration of a computer according to at least one embodiment. As shown in FIG. 19, a computer 5 includes a CPU (Central Processing Unit) 6, a main memory 7, a storage 8, and an interface 9.

[0055] For example, the above-mentioned processing system 1, anomaly detection device 10, learning device 20, target device 30, and other control devices are each implemented in a computer 5. The operations of each of the above-mentioned processing units are stored in the storage 8 in the form of a program. The CPU 6 reads the program from the storage 8, loads it in the main memory 7, and executes the above-mentioned processing in accordance with the program. The CPU 6 also secures storage areas in the main memory 7 corresponding to each of the above-mentioned storage units in accordance with the program.

[0056] Examples of the storage 8 include a hard disk drive (HDD), a solid state drive (SSD), a magnetic disk, a magneto-optical disk, a compact disc read only memory (CD-ROM), a digital versatile disc read only memory (DVD-ROM), and a semiconductor memory. The storage 8 may be an internal medium directly connected to the bus of the computer 5, or an external medium connected to the computer 5 via an interface 9 or a communication line. In addition, when the program is distributed to the computer 5 via a communication line, the computer 5 that receives the program may load the program into the main memory 7 and execute the above-mentioned process. In at least one embodiment, the storage 8 is a non-transitory tangible storage medium.

[0057] The program may also realize some of the functions described above. Furthermore, the program may be a file that can realize the functions described above in combination with a program already recorded in the computer system, that is, a so-called differential file (differential program).

[0058] Although some embodiments of the present disclosure have been described, these embodiments are merely examples and do not limit the scope of the disclosure. Various additions, omissions, substitutions, and modifications may be made to these embodiments without departing from the spirit of the disclosure.

[0059] Note that some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0060] (Appendix 1) a first processing unit that determines a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the determined normal data proposal; A processing device comprising:

[0061] (Appendix 2) The first processing unit is Displaying the proposed normal data together with the abnormal data; 2. The processing device of claim 1.

[0062] (Appendix 3) The first processing unit is Displaying the proposed normal data overlaid on the abnormal data; 3. The processing device according to claim 2.

[0063] (Appendix 4) The first processing unit is a portion of the proposed normal data that indicates a value equal to or greater than a predetermined value is displayed in a manner different from a portion of the proposed normal data that indicates a value less than the predetermined value; 4. The processing device according to claim 1,

[0064] (Appendix 5) a second processing unit that generates an anomaly detection model for each element / division unit of the time-series data in the divided learning data by machine learning; Equipped with The first processing unit is Detecting the abnormal data based on the anomaly detection model generated by the second processing unit. 5. The processing device according to claim 1,

[0065] (Appendix 6) A processing device according to any one of claims 1 to 5; An apparatus that is a target of the anomaly detection; A processing system comprising:

[0066] (Appendix 7) determining a normal data proposal for the abnormal data detected in the device that is the target of the abnormality detection, and displaying the determined normal data proposal; A processing method comprising:

[0067] (Appendix 8) Displaying the proposed normal data together with the abnormal data; 8. The method of claim 7, comprising:

[0068] (Appendix 9) displaying the proposed normal data overlaid on the abnormal data; 9. The method of claim 8, comprising:

[0069] (Appendix 10) displaying a portion of the proposed normal data that indicates a value equal to or greater than a predetermined value in a manner different from a portion that indicates a value less than the predetermined value; 10. The method of claim 7, further comprising:

[0070] (Appendix 11) generating an anomaly detection model for each element / division unit of time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; and 11. The method of claim 7, further comprising:

[0071] (Appendix 12) On the computer, determining a normal data proposal for the abnormal data detected in the device that is the target of the abnormality detection, and displaying the determined normal data proposal; A program that executes the following.

[0072] (Appendix 13) Displaying the proposed normal data together with the abnormal data; 13. The program according to claim 12, which causes the computer to execute the above steps.

[0073] (Appendix 14) displaying the proposed normal data overlaid on the abnormal data; 14. The program according to claim 13, which causes the computer to execute the above steps.

[0074] (Appendix 15) displaying a portion of the proposed normal data that indicates a value equal to or greater than a predetermined value in a manner different from a portion that indicates a value less than the predetermined value; 15. The program according to any one of claims 12 to 14, which causes the computer to execute the program.

[0075] (Appendix 16) generating an anomaly detection model for each element / division unit of time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; and 16. The program according to any one of claims 12 to 15, which causes the computer to execute the program. [Explanation of symbols]

[0076] 1. Processing system 5. Computers 6. CPU 7. Main memory 8. Storage 9. Interface 10. Anomaly detection device 20. Learning Devices 30. Target device 101 Data division processing unit 102 Image processing unit 103...Learning processing unit 104: Anomaly correction proposal processing unit 105...Display section 201a, 201b, 201c, 301a, 301b, 301c... Sensor

Claims

1. A first processing unit that obtains a normal data proposal for abnormal data detected in a device that is a target of anomaly detection, and displays the obtained normal data proposal; a second processing unit that generates an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in the divided learning data by machine learning; Equipped with The first processing unit is Detecting the abnormal data based on the anomaly detection model generated by the second processing unit. Processing unit.

2. The first processing unit is Displaying the proposed normal data together with the abnormal data; The processing device of claim 1 .

3. The first processing unit is Displaying the proposed normal data overlaid on the abnormal data; The processing device according to claim 2 .

4. A processing device according to claim 1 ; An apparatus that is a target of the anomaly detection; A processing system comprising:

5. determining a normal data proposal for the abnormal data detected in the device that is the target of the abnormality detection, and displaying the determined normal data proposal; generating an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; and A processing method comprising:

6. On the computer, determining a normal data proposal for the abnormal data detected in the device that is the target of the abnormality detection, and displaying the determined normal data proposal; generating an anomaly detection model for each combination of a sensor and a predetermined division frame width for time-series data in the divided learning data by machine learning; Detecting the abnormal data based on the generated anomaly detection model; and A program that executes the following.

Images