Time series data processing methods

Abstract

A time-series data processing device 100 according to the present invention includes a generation unit 121 for generating a learning model that on the basis of log data, numerical data, and performance data, predicts the performance data using the log data and the numerical data as inputs and generates a feature amount vector indicating feature amounts of the log data and the numerical data, said log data indicating operation of a target in a state where the target is preset, said numerical data indicating a measurement value measured from the target, said performance data indicating the performance of the target. The generation unit 121 then generates the learning model that generates the feature amount vector so as to provide distribution satisfying preset criteria.

Description

[Technical Field]

[0001] The present invention relates to a time series data processing method, a time series data processing device, and a program. [Background technology]

[0002] In facilities such as industrial plants that manufacture energy (electricity, gas, clean water, etc.), chemical products (crude oil, gasoline, plastics, etc.), metal products (iron, semiconductors, etc.), mechanical products (automobiles, computers, etc.), food, pharmaceuticals, etc., and information processing systems, time-series data, which are measurement values from various sensors, are analyzed to detect and output the occurrence of an abnormal state. For example, in Patent Document 1, data acquired by sensors installed in the monitored facility is used as input data, and an autoencoder is used to detect a reproduction error in output data that reproduces the input data, thereby detecting an abnormality in the monitored facility. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2019-179400 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the technology of Patent Document 1 detects anomalies only from numerical data measured by a sensor, which makes it difficult to detect anomalies that take into account the behavior of the monitored object. For example, if a program that should be executed on the monitored object does not execute due to a bug, but no error code is output from the program, it is not possible to detect anomalies only from numerical data such as CPU usage. As a result, there is a problem in that it is not possible to improve the accuracy of detecting the status of the monitored object.

[0005] Therefore, an object of the present invention is to solve the above-mentioned problem that the accuracy of detecting the state of the target cannot be improved. [Means for solving the problem]

[0006] A time series data processing method according to one aspect of the present invention includes: Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. The structure is as follows.

[0007] Furthermore, a time series data processing device according to one aspect of the present invention includes: a generation unit that generates a learning model that predicts the performance data by inputting log data representing the behavior of a target in a preset state of the target, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, and that generates a feature vector representing the feature amounts of the log data and the numerical data; the generation unit generates the learning model that generates the feature vector so that the distribution satisfies a predetermined criterion. The structure is as follows.

[0008] Furthermore, a program according to one aspect of the present invention includes: On the computer, Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. Execute the process, The structure is as follows. [Effects of the Invention]

[0009] With the above-described configuration, the present invention can improve the accuracy of detecting the state of an object. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram showing a configuration of a time-series data processing device according to a first embodiment of the present invention. [Figure 2] 2 is a block diagram showing the configuration of a learning unit of the time-series data processing device disclosed in FIG. 1. FIG. [Figure 3] 2 is a diagram showing how time-series data is processed by the time-series data processing device disclosed in FIG. 1. FIG. [Figure 4] 2 is a diagram showing how time-series data is processed by the time-series data processing device disclosed in FIG. 1. FIG. [Figure 5] 2 is a diagram showing how time-series data is processed by the time-series data processing device disclosed in FIG. 1. FIG. [Figure 6] 2 is a diagram showing how time-series data is processed by the time-series data processing device disclosed in FIG. 1. FIG. [Figure 7] 2 is a flowchart showing the operation of the time-series data processing device disclosed in FIG. 1. [Figure 8] 2 is a flowchart showing the operation of the time-series data processing device disclosed in FIG. 1. [Figure 9]FIG. 10 is a block diagram showing the hardware configuration of a time-series data processing device according to a second embodiment of the present invention. [Figure 10] FIG. 10 is a block diagram showing the configuration of a time-series data processing device according to a second embodiment of the present invention. [Figure 11] 10 is a flowchart showing the operation of the time-series data processing device according to the second embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] <Embodiment 1> A first embodiment of the present invention will be described with reference to Figures 1 to 8. Figures 1 and 2 are diagrams for explaining the configuration of a time series data processing device, and Figures 3 to 8 are diagrams for explaining the processing operation of the time series data processing device.

[0012] [composition] The time-series data processing device 10 of the present invention is connected to an object C whose state is to be detected, such as an information processing system. The time-series data processing device 10 acquires and analyzes log data representing the operation of the object C, numerical data representing measurement values measured by a measuring device installed in the object C, and performance data representing the performance of the object C, and detects the state of the object C based on the analysis results.

[0013] Here, the target C is, for example, an information processing system such as a server device. In this case, the log data is log series data that represents the processing content, such as events, being executed by the information processing system. The numerical data is numerical series data expressed in numerical values, such as the CPU (Central Processing Unit) usage rate, memory usage rate, disk access frequency, number of input / output packets, input / output packet rate, and power consumption value of each information processing device that constitutes the information processing system. The performance data is data that represents performance indicators, such as the processing time, number of execution threads, and number of queues held by each information processing device that constitutes the information processing system.

[0014] In this embodiment, the state of object C detected by the time series data processing device 10 is an abnormal state of object C, and the abnormal state is detected based on time series data consisting of logs and measurement values. Here, the abnormal state is a state that significantly deviates from the state of object C over a predetermined period of time, and may be a failure, a malfunction, or a sign thereof, or a state in which object C is operating in an operating mode that it did not operate in during that predetermined period of time, or may correspond to multiple states. Note that the state of object C detected by the time series data processing device 10 is not limited to an abnormal state, and any state, such as a normal state or a state in which object C is operating in a specific operating mode, may be detected, or multiple states may be detected.

[0015] However, in the present invention, the object C whose state is to be detected is not limited to an information processing system, and may be any type of plant, such as a manufacturing factory or processing facility. For example, if the object C is a plant, the log data is data representing the processing content resulting from the operation of the devices and equipment that make up the plant, and the numerical data, which are measurement values, are values such as the temperature, pressure, flow rate, power consumption value, and raw material supply and remaining amount within the plant. Furthermore, the performance data is data representing performance indicators such as the processing time and yield rate of the plant.

[0016] The time series data processing device 10 is composed of one or more information processing devices each having a calculation device and a storage device. As shown in FIG. 1, the time series data processing device 10 includes a data acquisition unit 11, a learning unit 12, and a state detection unit 13. The functions of the data acquisition unit 11, the learning unit 12, and the state detection unit 13 can be realized by the calculation device executing a program for realizing each function stored in the storage device. The time series data processing device 10 also includes an acquired data storage unit 16 and a learning model storage unit 17. The acquired data storage unit 16 and the learning model storage unit 17 are each composed of a storage device. Each component will be described in detail below.

[0017] The data acquisition unit 11 acquires log series data corresponding to the processing content being executed by the target C at predetermined time intervals or each time an event occurs, and stores the acquired data together with time information in the acquired data storage unit 16. At this time, for example, a unique log ID previously set for each processing content is acquired and stored as the log series data. As an example, the data acquisition unit 11 acquires and stores a log ID corresponding to the processing content at each time, as shown in the log series data in the upper diagram of FIG. 3.

[0018] The data acquisition unit 11 also acquires numerical series data, which are measurement values measured at the target C, at predetermined time intervals and stores the data together with time information in the acquired data storage unit 16. At this time, for example, numerical values representing resource usage such as CPU usage of the information processing system, which is the target C, are acquired and stored as the numerical series data. As an example, the data acquisition unit 11 acquires and stores measurement values of resources at each time, as shown by the numerical series data in the upper diagram of FIG. 3.

[0019] Furthermore, the data acquisition unit 11 acquires performance data representing the performance index measured in the target C at predetermined time intervals and stores the data together with time information in the acquired data storage unit 16. At this time, for example, the processing time, the number of execution threads, and the number of queues in the information processing system that is the target C are acquired and stored as performance data.

[0020] The data acquiring unit 11 then accumulates, as learning data, the log series data (first log series data), the numerical series data (first numerical series data), and the performance data (first performance data) acquired when the operating state of the target C is determined to be normal. The data acquiring unit 11 also acquires, as state detection data, the log series data (second log series data) and the numerical series data (second numerical series data) acquired to detect an abnormal state of the target C. At this time, the data acquiring unit 11 may also acquire performance data (second performance data) as state detection data.

[0021] The learning unit 12 (generation unit) performs machine learning using log series data (first log series data), numerical series data (first numerical series data), and performance data (first performance data) that are acquired and accumulated as learning data when the target C is determined to be in a normal state. In particular, the learning unit 12 inputs the log series data and numerical series data, generates a learning model that outputs performance data as a predicted value, and stores the model in the learning model storage unit 17. At this time, the learning unit 12 generates a learning model that outputs a predicted value from the input log series data and numerical series data that minimizes the error from the actual performance data. This learning model further generates a feature vector representing the feature values of the input log series data and numerical series data, and is trained by the learning unit 12 so that the distribution of the feature vector satisfies a predetermined standard. The generation process of the learning model by the learning unit 12 will be described in detail below.

[0022] As shown in Fig. 2, the learning unit 12 includes an encoder 12A and a decoder 12B. The encoder 12A includes a first feature amount calculation unit 12a, a second feature amount calculation unit 12b, and a third feature amount calculation unit 12c, and generates a feature amount vector F representing the feature amounts of log series data and numeric series data acquired as learning data from these. Note that, here, as indicated by symbol W in the upper diagram of Fig. 3, time series data consisting of log series data and numeric series data is divided into predetermined time intervals, and a feature amount vector F is generated from the log series data and numeric series data of each divided partial time series data.

[0023] The first feature amount calculation unit 12a generates a log sequence feature amount vector f1 from the log sequence data acquired as training data. For example, as shown in the lower diagram of FIG. 3, the first feature amount calculation unit 12a first combines each log ID with time information indicating the time when the log corresponding to each log ID occurred as a preprocessing step. Then, the first feature amount calculation unit 12a converts the combined data of all log IDs and times included in the partial time series data divided into time intervals as indicated by the symbol W into a log sequence vector by vectorizing the combined data. In other words, the log sequence vector is a vector representing the feature amount of the logs in each partial time series data divided into time intervals as indicated by the symbol W. However, when converting the log sequence data into a log sequence vector, the first feature amount calculation unit 12a is not necessarily limited to combining the log ID with the time, and may convert the log sequence data into a log sequence vector containing only information identifying the log ID or log. Furthermore, the log sequence vector may be added with information indicating that the numerical value is the type of log. This may be a one-hot vector representation in which the first element of the vector corresponds to the numerical sequence and the second element of the vector corresponds to the log sequence. Furthermore, the log sequence vector may be converted to have the same dimension as the numerical sequence vector described below. Furthermore, the time information indicating the time when the log was generated may be a relative time within the time range indicated by the symbol W. For example, if the UNIX times at both ends of the time range indicated by the symbol W are Ts and Te, and the UNIX time when the log was generated is T, it may be a normalized relative time calculated as T / |Te-Ts|. Here, || is an operator that extracts the absolute value.

[0024] Then, the first feature amount calculation unit 12a generates a log sequence feature amount vector f1 representing the feature amount of the log sequence vector, including information representing the dependency between the log sequence vector and the numerical sequence vector, using a technique called Cross Attention, as will be described in detail later, from the log sequence vector and the numerical sequence vector. For example, as shown on the left side of Fig. 4, the log sequence vector is set as the primary and the numerical sequence vector is set as the secondary, and the importance (score) representing the dependency between each element of each vector, that is, the degree of association, is calculated, and the importance is used as the weight of each element to generate a log sequence feature amount vector f1 representing the feature amount of the log sequence vector.

[0025] The second feature amount calculation unit 12b generates a numeric sequence feature amount vector f2 from the numeric sequence data acquired as training data. For example, as shown in the lower diagram of FIG. 3, the second feature amount calculation unit 12b first combines time information indicating the time at which each numeric value was measured with each numeric value as a preprocessing step. Then, the second feature amount calculation unit 12b converts all combinations of numeric values and time included in the partial time series data divided into time intervals as indicated by the symbol W into a numeric sequence vector by vectorizing the combined data. In other words, the numeric sequence vector is a vector representing the feature amounts of numeric values that are measurement values in each partial time series data divided into time intervals as indicated by the symbol W. However, when converting the numeric sequence data into a numeric sequence vector, the second feature amount calculation unit 12b is not necessarily limited to combining the numeric values that are measurement values with time, and may convert into a numeric sequence vector containing only numerical information. Furthermore, the numeric sequence vector may be supplemented with information indicating the type of data. This may be a one-hot vector representation in which the first element of the vector corresponds to the numeric sequence and the second element of the vector corresponds to the log sequence. Furthermore, the numeric sequence vector may be converted to have the same dimensions as the log sequence vector described above. Furthermore, the time information indicating the time at which each value was measured may be a relative time within the time span indicated by the symbol W, as in the case of the log sequence.

[0026] Then, the second feature amount calculation unit 12b uses a technique called Cross Attention, as will be described in detail later, from the log sequence vector and the numeric sequence vector, to generate a numeric sequence feature amount vector f2 that represents the feature amount of the numeric sequence vector, including information that represents the dependency between the log sequence vector and the numeric sequence vector. For example, as shown on the right side of Fig. 4, the numeric sequence vector is set as the primary and the log sequence vector is set as the secondary, and importance (score) that represents the dependency between each element of each vector, that is, the degree of association, is calculated, and the importance is used as a weight to generate a numeric sequence feature amount vector f2 that represents the feature amount of the numeric sequence vector.

[0027] Here, an example of a method for generating the log sequence feature vector f1 and the numeric sequence feature vector f2 described above will be explained. Here, a method for generating the log sequence feature vector f1 shown on the left side of Fig. 4 will be explained with reference to Fig. 5, but the numeric sequence feature vectors are also generated in the same way. First, let the subordinate numeric vector be (K, V) and the master log sequence vector be (Q). Here, "Q, K, V" are adjusted to have the same dimension by separate fully connected layers, and although "K, V" are illustrated as being the same, the contents differ depending on the separate fully connected layers. Note that "R" indicates the data structure of each vector, "n, m" the number of data, and "d" the dimension. First, let us consider the following: T ) calculate the importance of each element from the perspective of the dependency between the log sequence vector and the numeric sequence vector. Then, use this importance as a weight and apply "softmax(QK T )V”, calculate the log sequence feature vector f1-1. Then, use “v=softmax(QK T )V” is used to calculate a softmax(QK T )V", a log sequence feature vector f1 is generated, which is a single feature vector obtained by taking a weighted average. Here, "a" can be calculated, for example, by the formula shown in FIG. 5, and "w, P, Q" represent weights. In a modified example, a vector corresponding to the latest time of the log sequence feature vector f1-1 may be used as the log sequence feature vector f1.

[0028] The third feature amount calculation unit 12c generates a feature amount vector F from the log series feature amount vector f1 and the numerical series feature amount vector f2 generated as described above. For example, the feature amount vector F is generated by adding or combining the log series feature amount vector f1 and the numerical series feature amount vector f2. The feature amount vector F generated in this way using a technique called Cross Attention includes information representing the mutual directional dependency between the log series data and the numerical series data.

[0029] However, the encoder 12A, which is the learning unit 12, is not necessarily limited to generating the feature vector F by the above-mentioned method, and may generate the feature vector F from the log series data and the numeric series data by any method. Furthermore, the generated feature vector F may include information representing any relationship between the log series data and the numeric series data.

[0030] Then, the decoder 12B learns to output the performance data acquired as training data as a predicted value from the feature vector F generated as described above. At this time, the learning unit 12, which is composed of the encoder 12A and the decoder 12B, learns to generate the feature vector F by the above-described method, which minimizes the error between the predicted value to be output and the performance data acquired as training data, and has a distribution that satisfies a preset standard. In this embodiment, as shown in FIG. 2, the learning unit 12 sets a predetermined range R centered on the origin in a predetermined coordinate space, and generates the feature vector F so that the value of the feature vector F falls within this range R. Here, the dimension of this coordinate space matches the dimension of the feature vector F, and the origin is the center of the distribution of the feature vector F. Note that the feature vector F generated by the learning unit 12 may be densely packed according to a predetermined distribution, and may be, for example, a plurality of center points C1, C2, . . . , C N and the corresponding radius R1, radius R2, ..., radius R N The feature vector F may be generated so that the value of the feature vector F falls within the range R. The predetermined range R may be a hypersphere with a radius r. The predetermined range R may be a range in which most of the feature vectors F of the training data fall, and when the predetermined range R is a hypersphere with a radius r, the predetermined range R may be determined using the upper q percentile of the distribution of distances from the origin of the predetermined coordinate space to the points indicated by the feature vectors F of the training data.

[0031] Here, an example of a learning method for the encoder 12A and the decoder 12B will be described, taking as an example a case where the encoder 12A and the decoder 12B are configured as neural networks.

[0032] Assume that N sets of training samples are obtained as training data. Each sample has length lm. i Numerical series data xm i , length ll i Log series data xl i , performance data y of length 1 i Here, i is an index indicating the sample ID. The encoder 12A receives the numerical sequence data xm i and log series data xl i is a D-dimensional feature vector Fz i =[z i1 , z i2 ,..., z iD ]. The decoder 12B converts the feature vector Fz i This is a neural network that calculates the predicted value of performance data (Equation 1) from

[0033]

number

[0034] In this embodiment, the encoder 12A and decoder 12B calculate the gradient of each parameter with respect to the loss by backpropagation and update each parameter by stochastic gradient descent so as to minimize the loss with respect to the prediction error defined by Equation 2. This parameter update is continued until the loss value converges.

[0035]

number

[0036] Next, the initial value of the center of distribution of the feature vector F is calculated. The feature vector Fz of each learning sample is calculated using the encoder 12A. i Calculate the center of distribution of the feature vector F, c=[c1,c2,...,c D ] is converted into the feature vector Fz i Initialize as the average value of

[0037]

number

[0038] Using these initial values, the parameters of the encoder 12A are updated by the stochastic gradient descent method, after finding the gradient of each parameter with respect to the loss using the backpropagation method, so as to minimize the loss with respect to the spread of the distribution of the feature vector F defined by Equation 4. This parameter update is continued until the loss value converges.

[0039]

number

[0040] In a modified example, the encoder 12A and the decoder 12B are L p After learning to minimize, the parameters are updated to minimize Equation 5, where λ is a tuning parameter with a value greater than or equal to 0.

[0041]

number

[0042] The above-described learning method is just an example, and the present invention is not limited to this example.

[0043] The state detection unit (detection unit) 13 inputs the log series data (second log series data) and the numerical series data (second numerical series data), which are state detection data measured from the target C after generating the above-described learning model, into the learning model stored in the learning model storage unit 17, and detects the state of the target C from the output. In this embodiment, a feature vector F is newly generated and output from the learning model, and an abnormal state is detected based on the feature vector F and the range R of the planar space set during learning by the learning unit 12. For example, as shown in FIG. 6, the state detection unit 13 calculates the distance D between the origin, which is the center of the range R of the planar space, and the newly generated feature vector F, and calculates the abnormality degree of the target C from the distance D. In this case, the abnormality degree is calculated so that the distance D is higher as the distance D is located outside the range R of the planar space, and an abnormal state is detected. Note that if the feature vector F is trained to have a predetermined distribution during learning, the abnormality degree may be calculated from the deviation between the distribution and the newly generated feature vector F to detect an abnormal state.

[0044] Furthermore, the state detection unit 13 may calculate an error between a predicted value of performance output by inputting the log series data and the numerical series data into the learning model and performance data (second performance data) acquired from the target C as state detection data, and calculate an abnormality degree from the error to detect the state of the target C. For example, the state of the target C may be detected based on both the values of the abnormality degree calculated from the feature vector F described above and the abnormality degree calculated from the prediction error.

[0045] The log sequence data and the numerical sequence data input to the learning model in the state detection unit 13 described above have the same data structure as that input to the learning unit 12 during learning. That is, in this embodiment, a log sequence vector and a numerical sequence vector are input, in which time information is added to the log sequence data and the numerical sequence data of a predetermined time width as shown by the symbol W in Fig. 3.

[0046] [Operation] Next, the operation of the above-mentioned time series data processing device 10 will be described mainly with reference to the flowcharts of Figures 7 and 8. First, with reference to the flowchart of Figure 7, the operation when generating a learning model for detecting an abnormal state of the object C will be described.

[0047] The time series data processing device 10 acquires, from a target C operating normally, log series data corresponding to the processing content being executed by the target C, numerical series data which are measurement values measured on the target C, and performance data representing performance indicators measured on the target C, and stores these as learning data (step S1). Then, the time series data processing device 10 performs machine learning using the log series data, numerical series data, and performance data stored as learning data (step S2). At this time, as described above, the time series data processing device 10 outputs a predicted value that minimizes the error from the actual performance data from the input log series data and numerical series data, and generates and stores a learning model that generates a feature vector representing the feature amounts of the log series data and numerical series data such that the distribution satisfies a predetermined standard (step S3). In particular, the time series data processing device 10 generates a learning model that generates a feature vector F including information representing the dependency between the log series vector and the numerical series vector.

[0048] Next, the operation for detecting an abnormal state of the object C will be described with reference to the flowchart in Fig. 8. This operation is performed after the learning model is generated as described above.

[0049] First, the time series data processing device 10 acquires, as described above, log series data corresponding to the processing content being executed by the target C and numerical series data that are measurement values measured by the target C as state detection data (step S11). Then, the time series data processing device 10 inputs the log series data and numerical series data to a stored learning model (step S12). The time series data processing device 10 calculates the abnormality degree of the target C based on a feature vector F newly generated in the learning model and a set range R of a planar space (step S13), and detects an abnormal state of the target C from the value of the abnormality degree (step S14). For example, as shown in FIG. 6, the time series data processing device 10 detects an abnormal state when the newly generated feature vector F is located outside the range R of the planar space with respect to the origin, which is the center of the range R of the planar space.

[0050] As described above, in this embodiment, a learning model is generated using a log corresponding to the processing content being executed by the target C and numerical values that are measurement values measured by the target C. By detecting the state of the target C using this learning model, the state of the target C can be detected with higher accuracy than when state detection is performed using numerical values alone or logs alone. In particular, in this embodiment, a learning model is generated that generates a feature vector including the dependency between the log and the measurement value, and further, the learning model is generated so that this feature vector has a predetermined distribution, so that state detection can be performed with higher accuracy that takes the dependency between the log and the measurement value into consideration.

[0051] Furthermore, in this embodiment, the learning model is configured to output a predicted value of the performance of the target C. In particular, since the learning model is trained to minimize the error in the predicted value of performance, the feature vector generated by the learning model reflects input data that affects the performance prediction. In other words, the generated feature vector does not reflect input data that does not affect the performance prediction. As a result, by performing state detection using the feature vector, false detection can be suppressed, and state detection can be performed with higher accuracy.

[0052] <Embodiment 2> Next, a second embodiment of the present invention will be described with reference to Fig. 9 to Fig. 11. Fig. 9 to Fig. 10 are block diagrams showing the configuration of a time series data processing device in embodiment 2, and Fig. 11 is a flowchart showing the operation of the time series data processing device. Note that this embodiment shows an outline of the configuration of the time series data processing device and the time series data processing method described in the above embodiments.

[0053] First, the hardware configuration of the time series data processing device 100 in this embodiment will be described with reference to Fig. 9. The time series data processing device 100 is configured as a general information processing device, and is equipped with the following hardware configuration, as an example. ·CPU(Central Processing Unit)101(Arithmetic unit) ROM (Read Only Memory) 102 (storage device) RAM (Random Access Memory) 103 (storage device) Programs 104 loaded into RAM 103 A storage device 105 for storing a group of programs 104 A drive device 106 that reads and writes from a storage medium 110 external to the information processing device A communication interface 107 that connects to a communication network 111 outside the information processing device Input / output interface 108 for inputting and outputting data Bus 109 connecting each component

[0054] The time-series data processing device 100 can be equipped with a generating unit 121 shown in Fig. 10 by having the CPU 101 acquire and execute the group of programs 104. The group of programs 104 is stored in advance in, for example, the storage device 105 or the ROM 102, and is loaded into the RAM 103 and executed by the CPU 101 as needed. The group of programs 104 may be supplied to the CPU 101 via the communication network 111, or may be stored in advance in the storage medium 110, and the drive device 106 may read out the programs and supply them to the CPU 101. However, the generating unit 121 described above may be constructed using a dedicated electronic circuit for realizing such a means.

[0055] 9 shows an example of the hardware configuration of the information processing device that is the time-series data processing device 100, and the hardware configuration of the information processing device is not limited to the above-described case. For example, the information processing device may be configured with a part of the above-described configuration, such as excluding the drive device 106.

[0056] The time series data processing device 100 then executes the time series data processing method shown in the flowchart of FIG. 11 by the function of the generating unit 121 constructed by the program as described above.

[0057] As shown in FIG. 11, the time series data processing device 100 Based on time-series data including log data representing the behavior of the target in a preset state, numerical data representing measured values of the target, and performance data representing the target's performance, the log data and the numerical data are used as inputs to predict the performance data, and a learning model is generated that generates a feature vector representing the features of the log data and the numerical data so that the feature vector has a distribution that satisfies a preset criterion (step S101). The following process is executed.

[0058] By configuring the present invention as described above, it is possible to generate a learning model that takes into account the relationship between the target log data and numerical data, and by using such a learning model it is possible to detect the target's condition with higher accuracy.

[0059] The above-described program can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The program may also be supplied to a computer by various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable media can supply the program to a computer via a wired communication path such as an electric wire or optical fiber, or via a wireless communication path.

[0060] Although the present invention has been described above with reference to the above-described embodiments, the present invention is not limited to the above-described embodiments. Various modifications that are understandable to those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. Furthermore, at least one or more of the functions of the generation unit 121 described above may be executed by an information processing device installed and connected anywhere on a network, i.e., may be executed by so-called cloud computing.

[0061] <Additional Notes> Some or all of the above embodiments can be described as follows: The following provides an overview of the configurations of the time-series data processing method, the time-series data processing device, and the program according to the present invention. However, the present invention is not limited to the following configurations. (Appendix 1) Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. Time series data processing methods. (Appendix 2) 10. The time series data processing method according to claim 1, generating the learning model that generates the feature vector so as to minimize an error between the performance data corresponding to the log data and the numerical data and a predicted value when the log data and the numerical data are input; Time series data processing methods. (Appendix 3) 3. The time-series data processing method according to claim 1, further comprising: generating the learning model for generating the feature vector relating to information representing a relationship between the log data and the numerical data included in the time-series data; Time series data processing methods. (Appendix 4) 4. The time-series data processing method according to claim 3, generating the learning model that generates the feature vector related to information that represents the dependency relationship between the log data and the numerical data; Time series data processing methods. (Appendix 5) 5. The time-series data processing method according to claim 4, generating the learning model that generates the feature vector related to information that represents the mutual dependency relationship between the log data and the numerical data; Time series data processing methods. (Appendix 6) 6. The time series data processing method according to any one of Supplementary Notes 1 to 5, generating the learning model that generates the feature vector so that the feature vector falls within a predetermined spatial range; Time series data processing methods. (Appendix 7) 7. The time-series data processing method according to claim 6, generating the learning model that generates the feature vector so that the feature vector falls within a predetermined range centered on a preset coordinate; Time series data processing methods. (Appendix 8) 8. The time series data processing method according to any one of Supplementary Notes 1 to 7, detecting a state of the target based on the new feature vector generated by inputting the log data and the numerical data newly measured from the target into the learning model; Time series data processing methods. (Appendix 9) 9. The time-series data processing method according to claim 8, further comprising: determining a state of the target based on a distribution of the feature vectors generated when generating the learning model and the new feature vector; Time series data processing methods. (Appendix 10) a generation unit that generates a learning model that predicts the performance data by inputting log data representing the behavior of a target in a preset state of the target, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, and that generates a feature vector representing the feature amounts of the log data and the numerical data; the generation unit generates the learning model that generates the feature vector so that the distribution satisfies a predetermined criterion. Time series data processing device. (Appendix 11) 11. The time-series data processing device according to claim 10, the generation unit generates the learning model that generates the feature vector so as to minimize an error between the performance data corresponding to the log data and the numerical data and a predicted value when the log data and the numerical data are input. Time series data processing device. (Appendix 12) 12. The time-series data processing device according to claim 10, the generation unit generates the learning model that generates the feature vector related to information representing a relationship between the log data and the numerical data. Time series data processing device. (Appendix 13) 13. The time series data processing device according to any one of Supplementary Notes 10 to 12, the generation unit generates the learning model that generates the feature vector so that the feature vector falls within a predetermined spatial range. Time series data processing device. (Appendix 14) 14. The time series data processing device according to any one of Supplementary Notes 10 to 13, a detection unit that detects a state of the object based on the new feature vector generated by inputting the log data and the numerical data newly measured from the object into the learning model, Time series data processing device. (Appendix 15) 15. The time-series data processing device according to claim 14, the detection unit determines the state of the target based on a distribution of the feature vectors generated when generating the learning model and the new feature vector. Time series data processing device. (Appendix 16) On the computer, Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. A computer-readable storage medium that stores a program for executing a process. [Explanation of symbols]

[0062] 10 Time series data processing device 11 Data Acquisition Section 12 Learning Department 13 Status detection unit 16 Acquired data storage unit 17 Learning model memory section 100 Time series data processing device 101 CPU 102 ROM 103 RAM 104 Programs 105 Storage device 106 Drive device 107 Communication Interface 108 Input / Output Interface 109 Bus 110 Storage medium 111 Communication Network 121 Generation part

Claims

1. An information processing device, Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. Time series data processing methods.

2. 2. The time series data processing method according to claim 1, The information processing device, generating the learning model that generates the feature vector so as to minimize an error between the performance data corresponding to the log data and the numerical data and a predicted value when the log data and the numerical data are input; Time series data processing methods.

3. 3. The time series data processing method according to claim 1, further comprising: The information processing device, generating the learning model that generates the feature vector related to information that represents the relationship between the log data and the numerical data; Time series data processing methods.

4. 4. The time series data processing method according to claim 3, The information processing device, generating the learning model that generates the feature vector related to information that represents the dependency relationship between the log data and the numerical data; Time series data processing methods.

5. 5. The time series data processing method according to claim 4, The information processing device, generating the learning model that generates the feature vector related to information that represents the mutual dependency relationship between the log data and the numerical data; Time series data processing methods.

6. 6. The time series data processing method according to claim 1, further comprising: The information processing device, generating the learning model that generates the feature vector so that the feature vector falls within a predetermined spatial range; Time series data processing methods.

7. 7. The time series data processing method according to claim 6, The information processing device, generating the learning model that generates the feature vector so that the feature vector falls within a predetermined range centered on a preset coordinate; Time series data processing methods.

8. 8. The time series data processing method according to claim 1, further comprising: The information processing device, detecting a state of the target based on the new feature vector generated by inputting the log data and the numerical data newly measured from the target into the learning model; Time series data processing methods.

9. a generation unit that generates a learning model that predicts the performance data by inputting log data representing the behavior of a target in a preset state of the target, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, and that generates a feature vector representing the feature amounts of the log data and the numerical data; the generation unit generates the learning model that generates the feature vector so that the distribution satisfies a predetermined criterion. Time series data processing device.

10. On the computer, Based on log data representing the behavior of the target in a preset state, numerical data representing measurement values measured from the target, and performance data representing the performance of the target, the log data and the numerical data are used as inputs to predict the performance data, and when generating a learning model that generates a feature vector representing the feature amounts of the log data and the numerical data, the learning model is generated to generate the feature vector so that the distribution satisfies a preset standard. A program for executing a process.

Images