Anomaly detection system, anomaly detection method, anomaly detection program, and trained model generation method

Abstract

What is needed is a method or system for efficiently selecting sensors without requiring advanced expertise or extensive experience, even in the case of a new machine or an unknown fault. [Solution] The anomaly detection system 1 comprises a storage unit 10 that stores a latent variable model and a joint probability model, an acquisition unit 11 that acquires sensor data output by a sensor, a measurement unit 12 that measures the likelihood of the sensor data acquired by the acquisition unit 11 based on the latent variable model and joint probability model stored by the storage unit 10, a judgment unit 13 that determines whether the sensor data is normal or abnormal based on the likelihood of the sensor data measured by the measurement unit 12, and a learning unit 14 that learns the latent variable model and joint probability model based on the sensor data output by the sensor.

Description

[Technical field]

[0001] The present invention relates to an anomaly detection system, an anomaly detection method, an anomaly detection program, and a trained model generation method. [Background technology]

[0002] Conventionally, machine failure judgment and identification of the cause of failure have been performed by comparing sensor data when the machine was operating normally with sensor data when a past failure occurred (for example, see the flowchart showing the processing routine for failure judgment in FIG. 13 of Patent Document 1 below). In order to accurately and efficiently compare the sensor data during this judgment, the sensor that is the source of the sensor data can be accurately and efficiently selected, thereby enabling classification of the cause of failure to be performed with high accuracy and efficiency.

[0003] However, when there are many sensors to choose from, it takes a huge amount of work to select the appropriate sensor.In addition, selecting the appropriate sensor requires knowledge of each sensor attached to the machine and knowledge of the mechanical characteristics of the target machine. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2012-098901 A Summary of the Invention [Problem to be solved by the invention]

[0005] Today's machines and other devices with advanced controls are controlled and managed by multiple sensors. For example, one automobile is equipped with more than 100 types of sensors. In addition, in the case of a new machine or an unknown failure, even a specific person with advanced expertise and abundant experience cannot respond. Therefore, a method or system for efficiently selecting sensors without requiring advanced expertise or abundant experience is required.

[0006] Furthermore, even if the sensor can be selected efficiently, the definition of the sensor data is complicated, including noise, errors, and failures in the events that need to be addressed. Furthermore, the definition of the events that need to be addressed varies depending on the application, so a general-purpose means of detecting the sensor data is required.

[0007] In addition, the means of detecting sensor data requires the design of an anomaly score function for each sensor data and application. Therefore, it is necessary to design an anomaly score function every time the number of sensor data and applications increases, and there is a risk that important information for anomaly detection will be overlooked during feature design.

[0008] In addition, in the data or application sensor data frequency domain, when events are rare events to begin with and multiple factors overlap, designing models, rules, or thresholds has been extremely difficult, so a system with greater generalizability and adaptability is required.

[0009] In order to solve the problems in the conventional technologies described above, the present invention provides an anomaly detection system, an anomaly detection method, an anomaly detection program, and a trained model generation method that learn various sensor data and application data output from information systems that support social infrastructure such as electricity, water, gas, transportation, communications, medical care, finance, and services, and determine (including predict) whether possible events are normal or abnormal. [Means for solving the problem]

[0010] The anomaly detection system of the present invention is characterized by comprising a storage means for storing a pre-trained latent variable model and a joint probability model, an acquisition means for acquiring input data for which anomaly detection is to be performed, an encoder for inferring latent variables from the input data based on the latent variable model stored in the storage means, a decoder for generating reconstructed data from the latent variables based on the joint probability model stored in the storage means, and a determination means for determining whether the input data is normal or abnormal based on a deviation between the input data and the reconstructed data.

[0011] In addition, the anomaly detection system of the present invention is characterized in that the judgment means judges the amount of deviation between the input data and the restored data based on a likelihood calculated using parameters obtained during the processing in the encoder and decoder.

[0012] In addition, the anomaly detection system of the present invention is characterized in that the judgment means calculates the deviation of the components for each dimension between the input data and the restored data, and judges that an anomaly exists if there is a large deviation in any dimension.

[0013] The anomaly detection system of the present invention is characterized by further comprising a learning means for learning the latent variable model and the joint probability model based on training data consisting of normal data.

[0014] In addition, the anomaly detection system of the present invention is characterized in that the measurement means constructs the encoder and decoder using any one of VAE, AAE, LVAE, and ADGM.

[0015] Incidentally, the present invention can be described as an invention of an anomaly detection system as described above, and can also be described as an invention of an anomaly detection method and an anomaly detection program as described below. These are essentially the same inventions, just in different categories, and have similar actions and effects. The present invention can also be described as an invention of a trained model generation method used in the above anomaly detection system, anomaly detection method, and anomaly detection program.

[0016] The anomaly detection method of the present invention is an anomaly detection method executed by an anomaly detection system having a storage means for storing a latent variable model and a joint probability model that have been trained in advance, and is characterized in including an acquisition step of acquiring input data for which an anomaly is to be detected, an inference step of inferring latent variables from the input data based on the latent variable model stored in the storage means, a generation step of generating restored data from the latent variables based on the joint probability model stored in the storage means, and a determination step of determining whether the input data is normal or abnormal based on a deviation between the input data and the restored data.

[0017] The anomaly detection program of the present invention is characterized in that it causes a computer to function as a storage means for storing pre-trained latent variable models and joint probability models, an acquisition means for acquiring input data for which anomaly is to be detected, an encoder for inferring latent variables from the input data based on the latent variable models stored in the storage means, a decoder for generating reconstructed data from the latent variables based on the joint probability model stored in the storage means, and a judgment means for judging whether the input data is normal or abnormal based on a deviation between the input data and the reconstructed data.

[0018] The trained model generation method of the present invention is a trained model generation method consisting of a latent variable model and a joint probability model for detecting anomalies in input data, and is characterized in that it includes a training data acquisition step of acquiring at least one training data consisting of normal data, an inference step of inferring latent variables from the training data based on the latent variable model, a generation step of generating restored data from the latent variables based on the joint probability model, a deviation calculation step of calculating the deviation between the training data and the restored data, and a parameter update step of updating parameters of the latent variable model and the joint probability model based on the deviation. Effect of the Invention

[0019] According to the present invention, it is possible to select a sensor that is considered to be effective for classifying the cause of a failure more easily than in the past. For example, it is possible to select a sensor that is considered to be effective for classifying the cause of a failure without requiring mechanical knowledge.

[0020] According to the present invention, the state of the equipment can be appropriately reflected in the abnormality judgment, and the occurrence of false reports in the abnormality judgment can be reduced. In addition, it is possible to make an abnormality judgment earlier than before according to the fluctuation factor of the equipment operation data. As a result, it is possible to present appropriate countermeasures to maintenance personnel and operators.

[0021] According to the present invention, by updating learning data using sensor data diagnosed as normal, it is possible to suppress the influence of outliers and to follow deterioration over time. [Brief description of the drawings]

[0022] [Figure 1] 1 is a functional block diagram of an anomaly detection system according to an embodiment of the present invention. [Diagram 2] 1 is a diagram illustrating a hardware configuration of an anomaly detection system according to an embodiment of the present invention. [Diagram 3] 3 is a flowchart showing a process (anomaly detection method) executed in the anomaly detection system according to the embodiment of the present invention. [Figure 4] 1 is a flowchart showing a process (anomaly detection method) executed in an example of an anomaly detection system according to an embodiment of the present invention. [Diagram 5] FIG. 1 is a diagram (part 1) showing an anomaly detection system using a VAE according to an embodiment of the present invention. [Figure 6] FIG. 2 is a diagram (part 2) showing an anomaly detection system using a VAE according to an embodiment of the present invention. [Figure 7] 1 is a flowchart showing a process (anomaly detection method) executed in an anomaly detection system using a VAE according to an embodiment of the present invention. [Figure 8] FIG. 11 is a conceptual diagram illustrating an anomaly detection system according to a second embodiment of the present invention that uses AAE. [Figure 9] FIG. 11 is a conceptual diagram showing an anomaly detection system according to a third embodiment of the present invention, which uses an LVAE. [Figure 10] FIG. 11 is a conceptual diagram showing an anomaly detection system according to a fourth embodiment of the present invention that uses an ADGM. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] Hereinafter, preferred embodiments of an anomaly detection system, an anomaly detection method, and an anomaly detection program will be described in detail with reference to the drawings. In the description of the drawings, the same elements are given the same reference numerals, and duplicated description will be omitted.

[0024] Fig. 1 is a functional block diagram of an anomaly detection system 1 according to an embodiment of the present invention. As shown in Fig. 1, the anomaly detection system 1 includes a storage unit 10 (storage means), an acquisition unit 11 (acquisition means), a measurement unit 12 (measurement means), a determination unit 13 (determination means), and a learning unit 14 (learning means).

[0025] The storage unit 10 stores the latent variable model and the joint probability model. The storage unit 10 is, for example, a database. The acquisition unit 11 acquires sensor data output by a sensor. The measurement unit 12 measures the likelihood of the sensor data acquired by the acquisition unit 11 based on the latent variable model and the joint probability model stored by the storage unit 10. The determination unit 13 determines whether the sensor data is normal or abnormal based on the likelihood of the sensor data measured by the measurement unit 12. The learning unit 14 learns the latent variable model and the joint probability model based on the sensor data output by the sensor.

[0026] The measurement unit 12 may measure the likelihood by converting the sensor data acquired by the acquisition unit 11 into a dimension lower than the dimension of the sensor data based on the latent variable model stored by the storage unit 10, and converting the sensor data back to the original dimension based on the joint probability model stored by the storage unit 10. The measurement unit 12 may also measure the likelihood by using a variational autoencoder. The learning unit 14 may learn the latent variable model and the joint probability model based only on the sensor data output by the sensor under normal conditions.

[0027] The anomaly detection system 1 is configured from hardware such as a CPU. Fig. 2 is a diagram showing an example of the hardware configuration of the anomaly detection system 1. As shown in Fig. 2, the anomaly detection system 1 shown in Fig. 1 is physically configured as a computer system including a CPU 100, a RAM 101 and a ROM 102 which are main storage devices, an input / output device 103 such as a display, a communication module 104, and an auxiliary storage device 105.

[0028] The functions of each functional block of the anomaly detection system 1 shown in FIG. 1 are realized by loading specific computer software onto hardware such as the CPU 100 and RAM 101 shown in FIG. 2, thereby operating the input / output device 103, communication module 104, and auxiliary storage device 105 under the control of the CPU 100, and reading and writing data in the RAM 101.

[0029] [Processes included in the anomaly detection system 1] The anomaly detection system 1 includes three steps (FIG. 3). Step 1: A step of simultaneously learning a latent variable model and a joint probability model (realized by the learning unit 14). Step 2: A step of measuring the test data likelihood p(x) using the learned latent variable model and joint probability model (realized by the acquisition unit 11 and the measurement unit 12). Step 3: A step of judging whether the data is normal or abnormal using information about the likelihood p(x) (realized by the judgment unit 13).

[0030] [1. About Step 1] Step 1 is a step of simultaneously learning a latent variable model and a joint probability model.

[0031] In step 1, the conditional probability p(z|x) from the observed variable x to the latent variable z, and the conditional probability p(x|z) from the latent variable to the observed variable are learned.

[0032] A neural network may be used to learn the conditional probability p(z|x) and the conditional probability p(x|z). By using a neural network, learning can be performed linearly with respect to the number of parameters, regardless of the number of observed data.

[0033] The latent variable model is a model of the conditional probability p(z|x) using, for example, a neural network. The latent variable model is stored in the storage unit 10.

[0034] The joint probability is expressed by p(x,z) or p(z)·p(x|z). The joint probability model is an independent model of the joint probability, for example, using a neural network. The joint probability model is stored by the storage unit 10.

[0035] The neural network is not particularly limited in its configuration. For example, the neural network may include a fully connected layer, a nonlinear function (sigmoid, relu), a batch normalization layer, and a dropout layer.

[0036] Input data (sensor data output by a sensor) is acquired from a sensor or the like by the acquisition unit 11. The input data is not particularly limited. The input data is, for example, a multidimensional array, a tensor, or the like. The input data acquired by the acquisition unit is not limited to sensor data from a sensor, and various data may be the target data as long as it is data that is subject to anomaly detection.

[0037] When the input data x is an n-dimensional vector, each value can be, for example, a continuous value, a discrete value, etc. When there are multiple input data, it can be expanded to a multidimensional array or tensor.

[0038] Specific examples of sensors include cameras, 3D acceleration sensors, actuators, temperature sensors, humidity sensors, etc. mounted on robots. Specific examples of sensor data include image data from cameras, position, speed, and acceleration information from 3D acceleration sensors, current and voltage applied to actuators, or those separated by an appropriate time window width, or frequency decomposition of each of those.

[0039] In steps 1 to 3, SVM or LOF may be used to determine whether the data is normal or abnormal, or a variational autoencoder (hereinafter referred to as VAE) may be used to determine whether the data is normal or abnormal. In particular, it is more preferable to use VAE (FIGS. 5 to 7).

[0040] In this case, when a VAE is used in step 1 to learn a latent variable model, i.e., the conditional probability p(z|x) from observed variable x to latent variable z, the learning device is called an encoder. On the other hand, when the conditional probability p(x|z) from latent variable z to observed variable x is learned, the learning device is called a decoder.

[0041] The input of the encoder is sensor data obtained by testing the equipment (sampling at appropriate time intervals is given for a certain period of time). The test is performed multiple times continuously or periodically. The output of the decoder is represented by the anomaly degree and likelihood of each dimension of the sensor data.

[0042] The VAE can generate probability values ​​more easily than the SVM or LOF, so when the anomaly detection system 1 uses the VAE, it is easier to compare anomaly scores even for sensors with different physical quantities than when the anomaly detection system 1 uses the SVM or LOF.

[0043] In addition, the VAE can more easily perform nonlinear transformation of data representation than the SVM or LOF, so the anomaly detection system 1 can create a more complex distribution of data representation when using the VAE than when using the SVM or LOF.

[0044] In addition, the VAE can generate an anomaly score for each dimension of the input data more easily than the SVM or LOF, and therefore the anomaly detection system 1 can more easily identify the input data source causing the abnormal event when using the VAE than when using the SVM or LOF.

[0045] In addition, the VAE can learn the similarity faster than the SVM or LOF. Therefore, when the anomaly detection system 1 uses the VAE, it is not necessary to manually design the similarity between data, as compared to when the anomaly detection system 1 uses the SVM or LOF.

[0046] For example, when using VAE, it is as follows: p(z)~N(0,I) p(x|z)~N(μ(z),σ(z)) N(μ,σ) is a normal distribution with mean μ and variance σ. μ(z) and σ(z) are the outputs from the neural network.

[0047] In the anomaly detection system 1, a loss function is minimized when learning the conditional probabilities p(z|x) and p(x|z) in the encoder and decoder. The loss function here may be, for example, the negative log-likelihood -logp(x). -logp(x)=-logΠp(x_i)=-Σlog∫p(x_i|z)p(z)dz

[0048] When integrating with respect to z, the variational lower bound is calculated using the following formula: The variational lower bound evaluates the positive log-likelihood logp(x)=logΠp(x_i) from the lower bound. -logΠp(x_i)=-Σ_ilog∫p(x_i|z;θ)p(z)dz <=-Σ_iq(z|x;ξ)∫logp(x_i|z;θ)p(z) / q(z|x_i;ξ)dz =Σ_iE_{q(z|x_i;ξ)}[p(x_i|z;θ)]-KL(p(z)||q(z|x_i;ξ))

[0049] where E_{q(z|x_i;ξ)}[·] is the expectation for q(z|x_i;ξ), and KL(p||q) is the KL distance between distributions p and q.

[0050] In order to maximize the variational lower bound above, we optimize θ and ξ. In this case, we can speed up the learning speed by using the backpropagation method. For example, we can use the reparameterization trick.

[0051] [2. About Step 2] Step 2 is a step of measuring the test data likelihood p(x) using the trained latent variable model and the joint probability model.

[0052] [3. About Step 3] Step 3 is a step of determining whether the signal is normal or abnormal using information related to the likelihood p(x).

[0053] In step 3, a determination is made as to whether the data is normal or abnormal using information on whether the test data likelihood p(x) is smaller than a threshold, whether the nth derivative of the test data likelihood p(x) is smaller than a threshold, or a combination thereof.

[0054] For example, when determining whether a value indicated by certain sensor data is normal or abnormal, the normality can be determined by measuring the difference between x' and x when the data is converted from x → z → x'.

[0055] The sensors are not particularly limited in terms of their targets or number. For example, the sensors may measure the intensity of each time or frequency. The sensors may also be for different devices.

[0056] [Example 1] As described above, when the disturbance probability distribution changes between normal and abnormal conditions during repetitive operation, the anomaly detection system 1 learns a probabilistic model P using normal data and predicts anomalies in the changes in the observed data x and likelihood p(x) due to P.

[0057] As an example of an embodiment of the present invention, a system that executes five procedures will be described below. Procedures 1 to 5 of the anomaly detection system 1 will be described below (FIG. 4).

[0058] [About Step 1] In step 1 (realized by the acquisition unit 11), pre-processing is performed on the input data. For example, spectrum conversion may be performed.

[0059] [About step 2] In step 2 (realized by the learning unit 14), a set of data in a normal state is input as training data, and the probabilistic model P is trained to restore the input data. For example, a vector in which spectra are arranged can be used as the input x.

[0060] When the number of dimensions is several thousand, it is difficult to estimate a probability model of a high-dimensional vector. Therefore, the anomaly detection system 1 uses deep learning to estimate the probability model. For example, the following latent variable model is obtained. Note that ":=" in the following formula means "define." p(x;θ):=∫p(x,z;θ)dz p(x,z;θ):=p(x|z;θ)p(z)

[0061] Generate z from N(0,I), then generate x from z from N(μ(z;θ),σ(z;θ)). Here, use a neural network characterized by parameters θ, μ(z;θ) and σ(z;θ). Then, optimize θ to maximize the log-likelihood Σlogp(x;θ) of the training data X.

[0062] Optimizing θ was difficult because it involved the calculation of the sum of log-likelihoods. p(x;θ) = ∫p(x|z;θ)p(z)dz

[0063] Therefore, the anomaly detection system 1 uses the following variational lower bound. logp(x;θ) = log∫p(x,z;θ)dz =log∫p(x,z;θ)q(z|x;φ) / q(z|x;φ)dz >=∫q(z|x;φ)logp(x,z;θ) / q(z|x;φ)dz =Eq(z|x;φ)[logp(x,z;θ) / q(z|x;φ)] =L(θ,φ)

[0064] Here, φ is a parameter that characterizes the neural network that generates the joint probability model, q(z,x) is the probability distribution defined by the neural network, and q(z|x) is the conditional probability of x conditioned on z calculated using the probability distribution q(z,x).

[0065] At this time, in order to maximize L(θ,φ), θ and φ are simultaneously optimized by using a Variational AutoEncoder (hereinafter referred to as VAE). L(θ,φ)=Eq(z|x;φ)[logp(x,z;θ) / q(z|x;φ)]

[0066] Specifically, by utilizing the stochastic gradient descent method, the gradients dL / dθ and dL / dφ are obtained for the L(θ,φ) maximization parameters θ and φ, and θ and φ are simultaneously optimized.

[0067] When estimating the gradient dL / dφ using the Monte Carlo method, the variance can be large, so by using the reparameterization trick, we can estimate the gradient dL / dφ faster.

[0068] A neural network is used to learn q(z|x;φ) in the encoder and p(x|z;θ) in the decoder.

[0069] [About step 3] In step 3 (realized by the measurement unit 12), a trained encoder and decoder are prepared, and for the judgment data for anomaly detection, the trained encoder and decoder are used as input to calculate the likelihood p(x) by P. The likelihood p(x) is correlated with the degree of anomaly in each dimension between the input judgment data and the output results of the trained encoder and decoder.

[0070] [About step 4] In step 4 (realized by the measurement unit 12 or the determination unit 13), the likelihood p(x) is converted into a score S(x) and smoothed. For example, the conversion process may be logarithmic.

[0071] If the score S(x) value is bumpy, you can smooth it out and use it as the output. For example, you can use Locally Weighted Scatterplot Smoothing.

[0072] However, if the above smoothing method results in a slow rise in the change, a smoothing method that results in a faster rise in the change can be used.

[0073] [About step 5] In step 5 (realized by the determination unit 13), when S(x) exceeds a threshold, it is determined that an abnormality has occurred.

[0074] [Effect] The anomaly detection system 1 simultaneously learns the latent variable model and the joint probability model. Therefore, the anomaly detection system 1 does not require feature design. Note that a neural network may be used to model the latent variable model and the joint probability model.

[0075] The anomaly detection system 1 is characterized in that the input data in the step of simultaneously learning the latent variable model and the joint probability model is a multidimensional array or a tensor. Therefore, the anomaly detection system 1 does not require prior knowledge of the data or the application.

[0076] The anomaly detection system 1 is made up of n sensors and learns n joint probability models. Therefore, according to the anomaly detection system 1, even if the number of sensors increases, it can be handled by learning the joint probability model. Specifically, it is possible to detect anomalies by taking into account the correlation between the n sensors.

[0077] The anomaly detection system 1 uses a neural network when learning the conditional probability p(z|x) and the conditional probability p(x|z). Therefore, the anomaly detection system 1 can learn linearly with respect to the number of parameters, regardless of the number of observed sensor data.

[0078] Furthermore, the anomaly detection system 1 can handle, in an integrated manner, sensor data transmitted from multiple sensors provided on multiple machines, high-dimensional sensor data including image data, or sensor data including a combination of these, thereby enabling more efficient and faster anomaly detection.

[0079] The anomaly detection system 1 uses SVM, LOF, or VAE when learning a latent variable model. Therefore, the anomaly detection system 1 can convert the input data representation nonlinearly. In particular, when using VAE, nonlinear conversion can be performed regardless of the number of parameters of the input data.

[0080] When using VAE, the anomaly detection system 1 can learn the similarity from the sensor data. Therefore, the anomaly detection system 1 does not need to manually design the similarity between the sensor data.

[0081] When using VAE, the anomaly detection system 1 can obtain the underlying features of the sensor data by reducing the dimensionality of the sensor data. Therefore, the anomaly detection system 1 can convert a wider range of data representations.

[0082] When using VAE, the anomaly detection system 1 can convert data representation in a linear calculation time regardless of the number of parameters of the data. Therefore, the anomaly detection system 1 can convert data representation with high efficiency.

[0083] In the anomaly detection system 1, devices in multiple different locations may be configured to communicate with each other using communication means. Sensor data can be sent to another arithmetic device via the communication means, and the arithmetic device can perform learning and anomaly detection determination.

[0084] For example, it is possible to perform output processing such as issuing a notification or performing a predetermined control corresponding to the action determined by analyzing the determination result by the anomaly detection system 1.

[0085] Furthermore, the anomaly detection system 1 does not limit the location of each process. For example, the sensor installation and the learning process can be performed in different locations. Furthermore, the location of anomaly detection or anomaly determination is not limited. They can be performed in the same location or in different locations.

[0086] [Example 2] The anomaly detection system 1 in the above-mentioned Example 1 has been mainly described in terms of the case where a VAE is used as a machine learning model, whereas in this Example 2, a case where an AAE (Adversarial AutoEncoder) is used as a machine learning model will be described.

[0087] Fig. 8 is a conceptual diagram showing an anomaly detection system according to a second embodiment of the present invention, which uses AAE. When AAE is used in an anomaly detection system, as shown in Fig. 8, it is characterized in that in addition to training an encoder and a decoder, training of a discriminator is also performed.

[0088] The flow of the AAE learning process will be explained. Learning of AAE is performed in two phases: a reconstruction phase in which the encoder and decoder are trained, and a regularization phase in which the discriminator is trained. In the reconstruction phase, normal data, i.e., training data x, is first input to the encoder to infer the representation z of the input data (latent variable z), and then the representation z of the input data is input to the decoder to infer the reconstructed data x. ~ The latent variable model infers the representation z of the input data, and the recovered data x ~ The joint probability model generates the training data x and the recovery data x ~ Then, the parameters of the encoder and decoder are updated by, for example, stochastic gradient descent so as to reduce the reconstruction loss by referring to the reconstruction error.

[0089] In the learning of the regularization stage, the classifier is trained, and at the same time, the encoder that infers the representation z0 of the input data to be input to the classifier is also trained. First, the normal data, training data x, is input to the encoder to infer the representation z0 of the input data based on the latent variable model, and on the other hand, a false representation z1 is generated by sampling from a sample generator (Sampler). For suitable learning, it is desirable to prepare multiple z0 and z1. Based on z0 and z1, training data (z0,0) and (z1,1) to be input to the classifier are created. Here, 0 and 1 are correct answer labels that indicate whether the training data is the representation z0 based on normal data or the false representation z1, respectively. The classifier is trained to distinguish the representation z0 based on normal data from the false representation z1 using the training data (z0,0) and (z1,1). Specifically, the classifier first updates the parameters of the classifier in order to distinguish training data (z0,0) based on normal data from fake training data (z1,1) sampled from a sample generator (Sampler). Next, the classifier updates the parameters of the encoder so as to confuse the network for classification in the classifier. The trained classifier outputs the probability that the input is real data (the probability that the input is a sample of the prior distribution). In this way, a regularization error is obtained in the process of distinguishing between normal data and fake data in the classifier, and the parameters of not only the classifier but also the encoder are updated and learned using this regularization error, thereby improving the accuracy of inference in the encoder and the classification accuracy of the classifier.

[0090] The flow of anomaly detection processing using AAE is explained. A trained model that has undergone sufficient training is prepared. Data for anomaly detection is input to the encoder of the trained model, and the representation of the data for anomaly detection is inferred, and reconstructed data is generated from the representation in the decoder. The reconstructed data obtained is compared with the input data for anomaly detection, and anomalies are detected from the discrepancy between the two. In addition, by inputting the representation of the data for anomaly detection to a classifier, it is also possible to distinguish whether the representation is based on normal data or a false representation.

[0091] As described above, according to the anomaly detection system using AAE, the latent variable model and the joint probability model are trained in advance based on normal data, and at the same time, the classifier is also trained, and not only the classifier but also the encoder and decoder are trained together using the output of the classifier, so that highly accurate anomaly detection is possible. In addition, since AAE can use complex distributions if sampling is possible, it is expected that the expressive power of the decoder will be improved and the generation accuracy will be improved.

[0092] [Example 3] In this third embodiment, a case will be described in which a ladder variational autoencoder (LVAE) is used as a machine learning model.

[0093] Fig. 9 is a conceptual diagram showing an anomaly detection system according to a third embodiment of the present invention, which uses LVAE. When LVAE is used in an anomaly detection system, as shown in Fig. 9, an encoder and a decoder are trained, and the decoder is characterized in that it uses the encoder parameters in the process of generating restored data from a representation z.

[0094] The flow of the LVAE learning process is as follows. LVAE learning involves inputting normal training data x to the encoder to infer the representation z of the input data (latent variable z), inputting the representation z of the input data to the decoder to generate the restored data x. ~ In detail, as shown in FIG. 9, the latent variable model obtains the results for each layer from the input data x in the order of d1 → d2 → d3, and finally generates the expression z3. The latent variable model obtains the results for each layer from the expression z3 in the order of z3 → z2 → z1, and finally generates the restored data x ~ The joint probability model generates the following. The number of layers is an example and is not limited to this.

[0095] In the decoder, the restored data x is~ When generating ~ 3 and variance σ ~ 3 is used for sampling z3. By adding noise ε3 when sampling z3, backpropagation is possible even if there is a stochastic function part. Similarly, the average μ obtained from d2 in the encoder ~ 2 and variance σ ~ 2 is used to find the mean μ2 and variance σ2 used for sampling z2. Similarly, the mean μ obtained from d1 in the encoder ~ 1 and variance σ ~ 1 is used to calculate the mean μ1 and variance σ1 used for sampling z1. In this way, in each layer of the decoder, the decoder process is performed using the parameters in the corresponding layer of the encoder. The restored data x ~ Compare the training data x to calculate the difference, and update the parameters of each layer of the encoder and decoder so that the difference is eliminated. ~ Repeat learning until the values ​​match.

[0096] The flow of anomaly detection processing using LVAE is explained below. A trained model that has undergone sufficient training is prepared. Data for anomaly detection is input to the encoder of the trained model, and the representation of the data for anomaly detection is inferred. Reconstructed data is generated from the representation in the decoder. The reconstructed data obtained is compared with the input data for anomaly detection, and anomalies are detected from the discrepancy between the two.

[0097] As described above, in the anomaly detection system using LVAE, each layer of the decoder is configured to use the parameters in the corresponding layer of the encoder to perform decoder processing. Therefore, by correcting the probability distribution modeled by the decoder in a data-dependent manner via the encoder, it is possible to properly learn even complex models that contain multiple samples.

[0098] [Example 4] In this fourth embodiment, a case will be described in which an auxiliary deep generative model (ADGM) is used as a machine learning model.

[0099] FIG. 10 is a conceptual diagram showing an anomaly detection system according to a fourth embodiment of the present invention using an ADGM. In FIG. 10, a solid arrow indicates a sampling process, a dashed arrow indicates copying of data, and a dashed arrow indicates calculation of loss L. When an ADGM is used in an anomaly detection system, as shown in FIG. 10, an encoder and a decoder are trained. This ADGM is an extension of the concept of VAE in the first embodiment by adding an auxiliary variable a. In the ADGM, when input data x, a latent variable z, and an auxiliary variable a are given, if the flow of calculations indicated by the arrows in FIG. 10 is expressed by an appropriate neural network, all of the probability distributions q(z|a,x), q(a|x), p(a|x,z), and p(x|z) can be calculated. Note that p(z) is a given probability distribution (for example, a standard normal distribution).

[0100] The flow of the ADGM learning process is as follows. ADGM learning involves inputting normal training data x to the encoder to infer the representation z of the input data (latent variable z), inputting the representation z of the input data to the decoder to generate the restored data x. ~ In the fourth embodiment, the auxiliary variable a is further inferred using the training data x and the representation z, and the restored data x is generated. ~ Then, the loss (error function) L is calculated using the following formula: L = log[p(x ~ |z)]+log[p(a|x ~ ,z) / q(a|x)]+log[p(z) / q(z|a,x)] Learning is repeated so that the value of this loss L becomes sufficiently small. Note that since it is difficult to directly calculate the log likelihood p(x) in calculating the loss L, it is found by maximizing the variational lower bound.

[0101] The flow of anomaly detection processing using ADGM is explained below. A trained model that has undergone sufficient training is prepared. Data for anomaly detection is input to the encoder of the trained model, and the representation of the data for anomaly detection is inferred. Reconstructed data is generated from the representation in the decoder. The obtained reconstructed data is compared with the input data for anomaly detection, and anomalies are detected from the discrepancy between the two.

[0102] As described above, in the anomaly detection system using ADGM, the auxiliary variable a is introduced into the processing in the encoder and decoder, and the process of inferring the auxiliary variable a is performed simultaneously. This enables the decoder to model complex probability distributions, which is expected to improve the accuracy of generation.

[0103] [About the method of anomaly detection] In the first embodiment, the method of detecting anomalies is described as determining whether the sensor data is normal or abnormal based on the likelihood, and this determination method can be adopted in the second to fourth embodiments. In any of the first to fourth embodiments, the likelihood is not calculated, and the input data x and the restored data x are used. ~ The deviation between the input data x and the restored data x may be calculated and the abnormality or normality may be detected according to the amount of deviation. ~ For each dimension of i -x i ~ ) 2 and if there is a large deviation in any dimension, it may be determined that there is an abnormality.

[0104] [Techniques for learning and anomaly detection 1] In the above-mentioned first to fourth embodiments, the inference of the latent variable z, the expression z, the auxiliary variable a, etc., is obtained by sampling from a probabilistic function, and the description has been made assuming that the latent variable z, the expression z, the auxiliary variable a, etc. are obtained by sampling only once, and the loss L is calculated. However, this is not limited to this, and it is also possible to perform sampling multiple times, calculate the loss L for each obtained value, and take the average. In this way, by performing sampling multiple times, it is possible to absorb the bias of sampling, and therefore it is expected that the efficiency of learning and the accuracy of anomaly detection can be improved.

[0105] [Techniques for learning and anomaly detection 2] In the first to fourth embodiments, in both the learning process and the anomaly detection process, input data x is input to an encoder to infer a representation z (latent variable z) of the input data, and the representation z of the input data is input to a decoder to generate restored data x. ~ and generate input data x and restored data x ~ However, in this case, the restored data x ~ However, there were cases where the value of the normal data was not close enough to that of the normal data. Therefore, the restored data x obtained in one inference and generation process was ~ For example, the reconstructed data x0 may be input to the encoder. ~ Generate recovery data x0 ~ Restore data x1 ~ Generate and restore data x1 ~ Restore data x2 ~ By repeating the process of inputting the obtained output back into the encoder, it is possible to obtain restored data close to the value of the normal data. In this case, the loss L may be calculated for each inference and generation process and the sum of the losses L may be taken, or the process may be repeated multiple times to obtain the final restored data (in the above example, the restored data x2 ~) may be compared with the input data x to calculate the loss L. In this way, by calculating the loss L after repeating the inference and generation process multiple times, it is expected that the efficiency of learning and the accuracy of anomaly detection can be improved.

[0106] [Other embodiments] The anomaly detection system 1 can be used as a failure prediction system for machines and electronic devices. The failure prediction system according to this embodiment not only processes data collected from various data sources sequentially to predict possible events, but also determines appropriate actions (responses) for the detected events (occurrence of an event), and realizes output processing for notifying related systems of the determined actions and performing predetermined control in a series of flows.

[0107] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0108] For example, it can be used in a failure prediction system for multiple industrial machines and robots in a factory, anomaly prediction systems for infrastructure facilities such as power plants, and anomaly prediction systems for multiple parts in aircraft and automobiles.

[0109] The anomaly detection system 1 can be used as a system for predicting replacement times for consumables and parts. The prediction system according to this embodiment not only predicts possible events by sequentially processing data collected from various data sources, but also determines appropriate actions (responses) for the detected events (occurrence of an event), and realizes output processing for notifying related systems of the determined actions and performing predetermined control in a series of flows.

[0110] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0111] For example, the present invention can be used to predict and notify the replacement time of consumables including engine oil for aircraft and automobiles, and can also be used to predict and notify the replacement time of consumables such as drill teeth for machine tools.

[0112] The anomaly detection system 1 can be used in a general-purpose monitoring and control system. The monitoring and control system according to this embodiment realizes a series of control processes, including sequential processing of data collected from various data sources to detect possible events, determination of appropriate actions (responses) for the detected events (occurrence of an event), and output processing for notifying related systems of the determined actions and for causing them to perform predetermined control.

[0113] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0114] For example, the present invention can be used in a home security monitoring system, and also in monitoring systems for buildings such as buildings, public facilities, gardens, etc.

[0115] The anomaly detection system 1 can be used in a network security monitoring system. The monitoring system according to this embodiment realizes a series of control processes, in a sequential manner, the detection of possible events by sequentially processing data collected from various data sources, the determination of appropriate actions (responses) for the detected events (occurrence of an event), and the output process of issuing notifications corresponding to the determined actions to related systems and performing predetermined controls.

[0116] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0117] The abnormality detection system 1 can be used in a medical image diagnostic system. The image diagnostic system according to this embodiment realizes a series of control processes, in a sequential manner, the detection of possible events by sequentially processing data collected from various data sources, the determination of appropriate actions (responses) for the detected events (occurrence of an event), and the output process of issuing notifications corresponding to the determined actions to related systems and performing predetermined controls.

[0118] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0119] For example, image recognition technology using CT and NMR is used for early detection and early treatment of cancer. Conventionally, abnormalities and phenomena were found in these images by doctors with high levels of expertise and abundant experience. However, by using this system, abnormal phenomena (abnormal tissue images that differ from the patterns of normal tissue images) can be detected more accurately and quickly.

[0120] The abnormality detection system 1 can be used for quality control of cell preparations in regenerative medicine. The image diagnostic system according to this embodiment realizes a series of control processes, in a sequential manner, the detection of possible events by sequentially processing data collected from various data sources, the determination of appropriate actions (responses) for the detected events (occurrence of an event), and the output process of issuing notifications corresponding to the determined actions to related systems and performing predetermined controls.

[0121] In addition, the actual results of actions taken by related systems in response to determined actions (occurring events) (including cases where no action was taken at all) are accumulated as feedback information, improving the accuracy of event detection and making it possible to provide highly useful additional information to systems that work in conjunction with the monitoring and control system.

[0122] For example, when inducing differentiation of pluripotent stem cells into stem cells, progenitor cells, and differentiated cells of various tissues, the unevenness of the final product, the cell preparation, due to the uneven differentiation efficiency is an issue. Therefore, by using the abnormality detection system 1, abnormal cell images that differ from normal cell image patterns can be detected more accurately and quickly.

[0123] The configurations described in the above embodiments of the anomaly detection system 1 are merely examples, and can be modified as appropriate without departing from the technical concept of the anomaly detection system 1. Furthermore, the configurations described in the respective embodiments can be used in combination as long as they do not contradict each other.

[0124] As described above, the anomaly detection system 1 can be realized by one or more computer devices, and each function can be configured as a program. For example, the program for each function of the monitoring and control system stored in the auxiliary storage device 105 shown in Fig. 2 can be stored, and a control unit such as the CPU 100 can read the program for each function of the monitoring and control system stored in the auxiliary storage device 105 into the RAM 101, and the control unit can execute the program read into the RAM 101, causing one or more computers to operate each functional block of this embodiment. In other words, one or more computers in which a program for each function of the monitoring and control system of this embodiment is installed can operate as a computer device (system) that performs each function, either alone or in cooperation with each other.

[0125] The above program can also be provided to a computer in a state in which it is recorded on a computer-readable recording medium. Examples of computer-readable recording media include optical disks such as CD-ROMs, phase-change optical disks such as DVD-ROMs, magneto-optical disks such as MO (Magnet Optical) and MD (Mini Disk), magnetic disks such as floppy (registered trademark) disks and removable hard disks, and memory cards such as Compact Flash (registered trademark), Smart Media, SD memory cards, and memory sticks. Also included as recording media are hardware devices such as integrated circuits (IC chips, etc.) specially designed and configured for the purpose of the present invention.

[0126] Although the embodiment of the present invention has been described, the embodiment is presented as an example and is not intended to limit the scope of the invention. This new embodiment can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0127] 1 Anomaly Detection System 10 Storage area 11 Acquisition Department 12 Measuring part 13 Judgment section 14 Learning Department

Claims

1. A means for acquiring data corresponding to the data of the anomaly detection target, the data being generated from latent variables of the data of the anomaly detection target using a decoder that has learned a joint probability model by a neural network regarding normal data for the anomaly detection target; a means for performing a process related to anomaly detection for the anomaly detection target by using at least the data of the anomaly detection target and the acquired corresponding data; Equipped with Anomaly detection systems.

2. The anomaly detection system according to claim 1 , wherein the generated data is data generated by using the decoder based on the data of the anomaly detection target.

3. The anomaly detection system according to claim 1 , wherein the decoder learns the joint probability model that generates data corresponding to the latent variables from the latent variables.

4. The anomaly detection system according to claim 3 , wherein the generated data is data generated by using the decoder from the latent variables corresponding to the data of the anomaly detection target.

5. 5. The anomaly detection system according to claim 1, wherein the decoder is obtained by updating a parameter of the decoder that defines the joint probability model learned by the decoder, based on the normal data.

6. means for storing said decoder; The anomaly detection system according to claim 1 , wherein the acquiring means acquires the corresponding data by generating the corresponding data using the stored decoder.

7. The anomaly detection system according to claim 1 , wherein the process includes a process of calculating, for each dimension of the data subject to anomaly detection, a deviation between the data and the generated data.

8. 8. The anomaly detection system according to claim 1, wherein the data subject to anomaly detection is data acquired from at least one of a camera, a three-dimensional acceleration sensor, an actuator, a temperature sensor, and a humidity sensor.

9. 9. The anomaly detection system according to claim 1, wherein the normal data and the data for which an anomaly is to be detected include at least any one of image data from a camera mounted on the robot, position, speed, and acceleration information from a three-dimensional acceleration sensor, and current and voltage amounts applied to an actuator, or data obtained by frequency decomposing at least any one of the above data.

10. 10. The anomaly detection system according to claim 1, wherein the data subject to anomaly detection is data obtained by frequency-decomposing time-series data.

11. An anomaly detection system as described in any one of claims 1 to 10, wherein the joint probability model is a conditional probability from latent variables to observed variables.

12. The anomaly detection system of claim 1 , wherein the decoder is a neural network.

13. The anomaly detection system according to claim 1 , wherein the decoder is any one of a Variational Auto Encoder (VAE), an Adversarial Auto Encoder (AAE), a Ladder Variational Auto Encoder (LVAE), and an Auxilliary Deep Generative Model (ADGM).

14. 14. The anomaly detection system according to claim 1, which is used in any one of a failure prediction system, a replacement time prediction system, a general-purpose monitoring and control system, and a medical image diagnostic system.

15. The anomaly detection system according to claim 1 , wherein the normal data is data of the object of anomaly detection when the object is in a normal state.

16. The anomaly detection system according to claim 15 , wherein the target of anomaly detection is a machine or equipment.

17. The anomaly detection system according to claim 1 , wherein the normal data is data on a target of the same type as the target for anomaly detection when the target is in a normal state.

18. The anomaly detection system according to claim 17 , wherein the target for anomaly detection is a tissue in a living body, and the homogeneous target is a tissue of the same type as the target tissue.

19. A program for implementing the anomaly detection system according to any one of claims 1 to 18 on one or more computer devices.

20. by one or more processors, acquiring data corresponding to the data of the anomaly detection target, the data being generated from latent variables of the data of the anomaly detection target using a decoder that has learned a joint probability model by a neural network regarding normal data for the anomaly detection target; performing a process related to anomaly detection for the anomaly detection target by using at least the data of the anomaly detection target and the acquired corresponding data; Equipped with Anomaly detection methods.

21. 21. The anomaly detection method according to claim 20, wherein the generated data is data generated by using the decoder based on the data for which anomaly is detected.

22. 22. The anomaly detection method according to claim 20, wherein the decoder learns the joint probability model that generates data corresponding to the latent variables from the latent variables.

23. The anomaly detection method according to claim 22 , wherein the generated data is data generated by using the decoder from the latent variables corresponding to the data of the anomaly detection target.

24. 24. The anomaly detection method according to claim 20, wherein the decoder is obtained by updating a parameter of the decoder that defines the joint probability model learned by the decoder, based on the normal data.

25. means for storing said decoder; 25. The method of claim 20, wherein the acquiring means acquires the corresponding data by generating the corresponding data using the stored decoder.

26. 26. The anomaly detection method according to claim 20, wherein the processing step includes a step of calculating, for each dimension of the data subject to anomaly detection, a deviation between the data and the generated data.

27. 27. The anomaly detection method according to claim 20, wherein the data subject to anomaly detection is data acquired from at least one of a camera, a three-dimensional acceleration sensor, an actuator, a temperature sensor, and a humidity sensor.

28. 28. The anomaly detection method according to claim 20, wherein the normal data and the data for which an anomaly is to be detected include at least any one of image data from a camera mounted on the robot, position, speed, and acceleration information from a three-dimensional acceleration sensor, and current and voltage amounts applied to an actuator, or data obtained by frequency decomposing at least any one of the data.

29. 29. The anomaly detection method according to claim 20, wherein the data subject to anomaly detection is data obtained by frequency-decomposing time-series data.

30. An anomaly detection method described in any of claims 20 to 29, wherein the joint probability model is a conditional probability from latent variables to observed variables.

31. 31. The method of claim 20, wherein the decoder is a neural network.

32. The anomaly detection method according to any one of claims 20 to 31, wherein the decoder is any one of a Variational Auto Encoder (VAE), an Adversarial Auto Encoder (AAE), a Ladder Variational Auto Encoder (LVAE), and an Auxilliary Deep Generative Model (ADGM).

33. 33. The abnormality detection method according to claim 20, which is used in any one of a failure prediction system, a replacement time prediction system, a general-purpose monitoring and control system, and a medical image diagnostic system.

34. 34. The anomaly detection method according to claim 20, wherein the normal data is data of the object of anomaly detection when the object is in a normal state.

35. The anomaly detection method according to claim 34 , wherein the object of anomaly detection is a machine or equipment.

36. 34. The anomaly detection method according to claim 20, wherein the normal data is data on a target of the same type as the target for which an anomaly is to be detected when the target is in a normal state.

37. 37. The abnormality detection method according to claim 36, wherein the abnormality detection target is a tissue in a living body, and the homogeneous target is a tissue of the same type as the tissue.

Images