Abnormality determination device, abnormality determination method, and abnormality determination program

Abstract

To allow for accurately determining abnormality of time series data.SOLUTION: An abnormality determination device includes: a feature quantity extraction unit which extracts a feature quantity from time series data sporadically generated by an event with respect to each of sections corresponding to event periods; an integrating unit which, with respect to each of elements constituting the feature quantities in the individual sections, calculates dispersions in corresponding element units in the plurality of sections to generate an integrated feature quantity being a feature quantity constituted by taking the dispersions in the element units as each of elements; and a determination unit which determines a degree of abnormality of the time series data on the basis of the integrated feature quantity.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an abnormality determination device, an abnormality determination method, and an abnormality determination program. [Background technology]

[0002] BACKGROUND ART Conventionally, there is known a technique for detecting abnormal sounds from the operating sounds of a machine (for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Kazuki Morita, Tomohiko Yano, Khai Q. Tran," Anomalous sound detection by using local outlier factor and gaussian mixture model," Technical Report, DCASE2020 Challenge, July 2020. Summary of the Invention [Problem to be solved by the invention]

[0004] In Non-Patent Document 1, a spectrogram created from sound data is used as a feature, and an anomaly detection method using a Local Outlier Factor (LOF) and a Gaussian Mixture Model (GMM) is used to determine the degree of anomaly, and the presence or absence of an anomaly is determined based on the anomaly degree.

[0005] However, there is still room for improvement in the accuracy of detecting anomalies with this conventional technology, especially when it comes to time-series data where events occur sporadically.

[0006] Therefore, the present invention has been made in consideration of the above problems, and aims to provide an abnormality determination device, an abnormality determination method, and an abnormality determination program that can accurately determine abnormalities in time series data. [Means for solving the problem]

[0007] In order to achieve the above object, the anomaly determination device according to the present invention includes: a feature extraction unit that extracts features for each interval corresponding to an event period from time series data in which events occur sporadically; an integration unit that calculates, for each element constituting the feature for each interval, the variation in corresponding element units across a plurality of intervals, and generates integrated features that are features constituted of the element-by-element variations as each element; and a determination unit that determines the degree of anomaly in the time series data based on the integrated features.

[0008] In the anomaly detection device according to the present invention, a feature extraction unit extracts features for each interval corresponding to the event period from time-series data in which events occur sporadically. An integration unit calculates the variability of each element constituting the feature for each interval for each corresponding element across multiple intervals, and generates integrated features, which are features constituting each element based on the element-by-element variability. Then, a determination unit determines the degree of anomaly in the time-series data based on the integrated features.

[0009] In this way, feature values ​​are extracted from time-series data for each interval corresponding to the event period, and for each element constituting the feature value for each interval, the variance is calculated for each corresponding element across multiple intervals, and integrated feature values ​​are generated to determine the degree of anomaly in the time-series data. This allows for accurate anomaly detection in time-series data.

[0010] The feature extraction unit can extract the feature using a trained model, which is a neural network model for identifying labels.

[0011] Moreover, the abnormality determination device further includes an event period estimation unit that estimates the event period of the time series data, and the feature extraction unit can extract the feature for each interval that is equal to or longer than the event period estimated by the event period estimation unit.

[0012] The determination unit can determine the degree of abnormality from the integrated feature amount using a classifier trained from normal time-series data.

[0013] The time series data may be sound data representing the operating sound of a machine.

[0014] The length of the section may be determined based on the interval between the events.

[0015] In an anomaly detection method according to the present invention, a feature extraction unit extracts features for each interval corresponding to an event period from time series data in which events occur sporadically, an integration unit calculates the variation in element units corresponding to a plurality of intervals for each element constituting the feature for each interval, and generates integrated features that are features constituted by the element-by-element variations as each element, and a determination unit determines the degree of anomaly in the time series data based on the integrated features.

[0016] An anomaly determination program according to the present invention causes a computer to execute the following steps: extracting feature values ​​for each interval corresponding to an event period from time-series data in which events occur sporadically; calculating the variation of each element constituting the feature value for each interval for each corresponding element across a plurality of intervals; generating integrated feature values ​​that are feature values ​​constituted by the element-by-element variations as each element; and determining the degree of anomaly in the time-series data based on the integrated feature values. [Effects of the Invention]

[0017] As described above, the abnormality determination device, the abnormality determination method, and the abnormality determination program according to the present invention have the effect of being able to accurately determine abnormalities in time-series data. [Brief explanation of the drawings]

[0018] [Figure 1] 1 is a block diagram showing a configuration of an abnormality determination learning device according to an embodiment of the present invention; [Figure 2] 1 is a block diagram showing a configuration of an abnormality determination device according to an embodiment of the present invention; [Figure 3] 4 is a flowchart showing the operation of an abnormality determination learning process performed by the abnormality determination learning device according to the embodiment of the present invention. [Figure 4] 4 is a flowchart showing an operation of an abnormality determination process performed by the abnormality determination device according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0020] [Configuration of the abnormality detection learning device] The anomaly detection learning device according to an embodiment of the present invention is a device that uses pre-prepared learning data to train a model that identifies labels and a classifier that detects anomalies. Specifically, the model and classifier are trained based on the operating sounds of a machine, and the device determines whether or not there is a machine anomaly (damage, foreign matter, overvoltage, clogging, machine failure, etc.) based on predetermined sound data.

[0021] The abnormality determination learning device can be configured with a computer including a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a RAM (Random Access Memory), and a ROM (Read Only Memory) that stores programs and various data for executing the abnormality determination learning processing routine described below. Fig. 1 shows a block diagram of the abnormality determination learning device 100. Functionally, as shown in Fig. 1, the abnormality determination learning device 100 includes an input unit 10 and a calculation unit 20.

[0022] The input unit 10 receives multiple pieces of training data. This training data includes time-series data and labels representing machine operation sounds during normal operation when events occur sporadically. In other words, time-series data in which events occur sporadically means sparse time-series data in which meaningful event sound waveforms are included for only a very short period of time compared to the entire acquisition period of the time-series data.

[0023] For example, the time-series data is a spectrogram obtained for each frame from sound data representing the operating sound of a machine using STFT (Short Time Fourier Transform), the label is determined from meta-information of the sound data such as the type of individual machine or manufacturer, and the event is a spike that occurs in the waveform of the sound data, such as the opening and closing sound of a valve. In this embodiment, a valve opens and closes approximately once every 2 to 5 seconds, and a valve opening and closing sound (spike) of approximately 100 ms occurs along with the opening and closing of the valve. Hereinafter, the period during which a spike occurs along with the occurrence of an event (the period from when the spike starts to rise until it returns to its original state) is referred to as the "event period."

[0024] The calculation unit 20 includes a training data storage unit 22, a feature extractor training unit 24, a feature extractor storage unit 26, a feature extraction unit 28, an integration unit 30, a classifier training unit 32, and a classifier storage unit 34.

[0025] The learning data storage unit 22 stores a plurality of learning data received by the input unit 10.

[0026] The feature extractor learning unit 24 learns a neural network model for identifying labels for each segment extracted from the time series data, based on a plurality of learning data (time series data and labels).

[0027] Specifically, a convolutional neural network (CNN) is trained to estimate labels using spectrograms of multiple frames in one interval as input. For example, MobileFaceNet (MFN) is used as the CNN (Reference 1). The CNN is trained repeatedly so that the output approaches the label.

[0028] [Reference 1]: S. Chen, Y. Liu, X. Gao, and Z. Han, “MobileFaceNets: Efficient CNNs for Accurate Real-Time Face Verification on Mobile Devices,” pp. 428-438, 2018.

[0029] Here, the length of the section is determined based on the event duration and the interval between events. Specifically, the length of the section must be at least the length of one event duration, and it is desirable that the length be such that two or more events are not included.

[0030] For example, since the period of a spike occurring in sound data representing the operating sound of a machine, i.e., the event period, is 100 ms, the length of the section must be 100 ms or more. However, it is preferable to set the length of the section to be sufficiently longer than 100 ms so that the section is not cut out during the spike period. Furthermore, since spikes occur once every 2 to 5 seconds, it is preferable to set the length of the section to 2 seconds or less. Therefore, in this embodiment, the length of the section is set to approximately 1 second.

[0031] The feature extractor storage unit 26 stores the neural network model trained by the feature extractor training unit 24 as a trained model.

[0032] The feature extraction unit 28 uses the trained model stored in the feature extractor storage unit 26 for each of the multiple training data to extract a feature vector (feature in the present invention) from the time-series data for each interval corresponding to the event period. Specifically, spectrograms of multiple frames included in one interval are input to a CNN, which is a trained model, and a feature vector obtained from the intermediate layer of the CNN is extracted. For example, a layer before the output layer of a neural network is used.

[0033] For each of the multiple training data, the integrating unit 30 calculates the variance of each element (vector component) constituting the feature vector for each section based on the feature vector extracted for each section of the time-series data of the training data, and generates an integrated feature vector in which the calculated variance is used as each element of the vector. Specifically, the variance is calculated as the variance. For example, if the time-series data is divided into n sections and n feature vectors are extracted, the integrating unit 30 calculates the standard deviation for the first element of each feature vector from the first section to the nth section, and uses this standard deviation as the first element of the integrated feature vector. Similarly, the integrating unit 30 calculates the standard deviation for the second element of each feature vector from the first section to the nth section, and uses this standard deviation as the second element of the integrated feature vector. This process is performed for all elements of the feature vector to generate an integrated feature vector, which is a feature vector with all the calculated variances as elements. In this way, the integrating unit 30 integrates each of the feature vectors for multiple sections extracted from one training data to generate a single integrated feature vector.

[0034] The classifier training unit 32 trains a classifier for determining the degree of anomaly in the time-series data of the training data, based on the integrated feature vector generated for each of the plurality of training data.

[0035] Specifically, a Local Outlier Factor (LOF) or k-Nearest Neighbors (k-NN) is used as a classifier.

[0036] Here, Local Outlier Factor (LOF) is a density-based anomaly detection method. It utilizes the fact that the density at points near the local density of an outlier is smaller than the local density of a normal value. If the local density of a certain data is significantly smaller than the local density of nearby data in the training data, it is determined to be an anomaly, and in such cases it is set to output a high degree of anomaly.

[0037] k-Nearest Neighbors (k-NN) is an anomaly detection method based on the distance to neighbors. In k-NN, the greater the distance to the k neighbors, the further away from normality. For example, the average of the cosine distances of the five neighbors is used as the degree of anomaly.

[0038] The classifier storage unit 34 stores the trained classifier.

[0039] [Configuration of the abnormality detection device] The abnormality determination device can be configured with a computer including a CPU, a GPU, a RAM, and a ROM that stores a program for executing the abnormality determination processing routine described below and various data. Fig. 2 shows a block diagram of the abnormality determination device 150. Functionally, as shown in Fig. 2, the abnormality determination device 150 includes an input unit 60, a calculation unit 70, and an output unit 80.

[0040] The input unit 60 receives time series data to be determined. For example, the time series data to be determined is sound data that represents the operating sound of a machine before being converted into a spectrogram.

[0041] The calculation unit 70 includes an acoustic processing unit 72 , a feature extractor storage unit 73 , a feature extractor 74 , an integration unit 76 , a classifier storage unit 77 , and a determination unit 78 .

[0042] The sound processing unit 72 obtains a spectrogram for each frame from sound data representing the operating sound of the machine, which is time-series data, using STFT.

[0043] The feature extractor storage unit 73, like the feature extractor storage unit 26, stores a trained model, which is a neural network trained by the feature extractor training unit 24.

[0044] Similar to the feature extraction unit 28, the feature extraction unit 74 uses a trained model to extract feature vectors from the spectrograms of each frame acquired for each interval of the time series data corresponding to the event period.

[0045] Similar to the integrating unit 30, the integrating unit 76 calculates the element-by-element variation of the feature vector based on the feature vector extracted for each interval of the time-series data, and generates an integrated feature vector.

[0046] The classifier storage unit 77 stores the classifiers learned by the classifier learning unit 32, similar to the classifier storage unit .

[0047] The determination unit 78 determines the degree of abnormality from the integrated feature amount using a classifier stored in the classifier storage unit 77. For example, in k-NN, the average of the cosine distances of k neighboring features is used as the degree of abnormality.

[0048] The output unit 80 displays the results of the abnormality degree determination on a display. For example, it displays data with an abnormality degree equal to or greater than a threshold value. Alternatively, it displays data with increasing abnormality degree in order.

[0049] [Operation of the abnormality determination learning device 100] Next, the operation of the abnormality determination learning device 100 will be described.

[0050] FIG. 3 is a flowchart showing the flow of the abnormality determination learning process performed by the abnormality determination learning device 100. The abnormality determination learning process is performed by the CPU reading out an abnormality determination learning program from the ROM or storage, expanding it into the RAM, and executing it. Furthermore, multiple normal time-series data are input to the abnormality determination learning device 100 as learning data. Here, the time-series data of the learning data is, for example, a spectrogram obtained for each frame from sound data representing the operating sound of a machine using STFT. This time-series data of the learning data includes a label as meta-information. The multiple input learning data are stored in the learning data storage unit 22.

[0051] In step S100, the feature extractor training unit 24 trains a neural network model for identifying labels for each extracted section of the time-series data based on the time-series data and labels of the multiple training data. The neural network model trained by the feature extractor training unit 24 is stored in the feature extractor storage unit 26 as a trained model.

[0052] In step S102, the feature extraction unit 28 extracts a feature vector for each section of the time-series data for each of the plurality of training data using the trained model.

[0053] In step S104, the integration unit 30 calculates the variability of each feature vector for each of the plurality of training data on the basis of the feature vectors extracted for each interval of the time-series data of the training data, for each corresponding element of the feature vector, and generates an integrated feature vector.

[0054] In step S106, the classifier training unit 32 trains a classifier for determining the degree of abnormality based on the integrated feature vector generated for each of the plurality of training data. The trained classifier is stored in the classifier storage unit 34.

[0055] [Operation of abnormality determination device 150] Next, the operation of the abnormality determination device 150 will be described.

[0056] 4 is a flowchart showing the flow of the abnormality determination process by the abnormality determination device 150. The CPU reads out an abnormality determination program from the ROM or storage, expands it into the RAM, and executes it to perform the abnormality determination process. Time-series data to be determined is also input to the abnormality determination device 150. The time-series data to be determined is, for example, sound data that represents the operating sound of a machine before being converted into a spectrogram.

[0057] In addition, the feature extractor storage unit 73 stores a trained model, which is a neural network, similar to the feature extractor storage unit 26, and the classifier storage unit 77 stores a trained classifier similar to the classifier storage unit 34.

[0058] In step S110, the sound processing unit 72 obtains a spectrogram for each frame from the sound data representing the operating sound of the machine, which is time-series data, using STFT.

[0059] In step S112, the feature extraction unit 74 uses the trained model to extract, for each section of the time-series data, a feature vector from the spectrogram of each frame acquired for that section.

[0060] In step S114, the integration unit 76 calculates the variation in the corresponding element units of each feature vector based on the feature vectors extracted for each interval of the time-series data, and generates an integrated feature vector.

[0061] In step S116, the determination unit 78 uses the classifier stored in the classifier storage unit 77 to determine the degree of abnormality from the integrated feature amount.

[0062] In step S118, the output unit 80 displays the result of the abnormality degree determination on a display.

[0063] <Example> The results of an experiment conducted to demonstrate the effectiveness of the abnormality determination device 150 described in the above embodiment will be described.

[0064] First, the time-series data to be judged is 10 seconds of sound data (16 kHz, monaural) sampled from the operating sound of a machine (solenoid valve). Each piece of time-series data to be used as learning data is assigned one of three correct labels, "No. 0," "No. 1," or "No. 2," which identify individual solenoid valves.

[0065] The feature extractor is a trained neural network for identifying one of these three labels, and the classifier is trained using feature vectors obtained from the intermediate layer of the trained model.

[0066] In the acoustic processing, a spectrogram was obtained from the sound data with 2048 FFT points (window width: 128 msec) and 512 shift points (shift width: 32 msec).

[0067] We adopted MobileFaceNet as the neural network used in the feature extractor. The input unit was 1024 frequency dimensions x 32 frames (approximately 1 second), and the input unit was cut out with a 16-frame shift (approximately 0.5 second shift). The feature vector obtained from the intermediate layer was a 128-dimensional vector.

[0068] The classifiers used were LOF, k-NN, Gaussian Mixture Model (GMM), and One Class SVM (OCSVM). For LOF, the number of neighbors was set to 4, and for k-NN, k was set to 1. The standard deviation was calculated as the variance to generate the integrated feature vector. As a comparative example, the average value was used to generate the integrated feature vector.

[0069] Table 1 shows a comparison of the performance of each classifier using the integrated feature vector with the standard deviation and the integrated feature vector with the mean. Performance evaluation was performed using the harmonic mean of AUC for three devices, "No. 0," "No. 1," and "No. 2."

[0070] [Table 1]

[0071] In Table 1, "No. 0" indicates the performance evaluation for 200 pieces of time-series data with the correct label "0" (100 pieces of abnormal data and 100 pieces of normal data). The same is true for "No. 1" and "No. 2," and "average" indicates the average of the performance evaluations for "No. 0," "No. 1," and "No. 2."

[0072] The performance comparison in Table 1 shows that the integrated feature vector using the standard deviation has better performance than the integrated feature vector using the mean. Normal integration processing uses the mean, but if abnormal time series data appears only infrequently, taking the mean will make it impossible to consider the abnormality. By integrating features using the variability, under the assumption that the degree of event variability in normal time series data where events occur sporadically will be similar, it is possible to consider anomalies that appear infrequently, enabling more accurate anomaly detection.

[0073] Next, we will explain the results of experiments in which the length of the interval that serves as the feature vector extraction unit was varied. A k-NN was used as the classifier. Standard deviation was calculated as the variance, and an integrated feature vector was generated.

[0074] The performance evaluation was 96.71% when the interval was approximately 1 second (32 frames), 95.79% when the interval was approximately 2 seconds (64 frames), 80.24% when the interval was approximately 4 seconds (128 frames), and 74.92% when the interval was approximately 8 seconds (256 frames).

[0075] From the above, we can see that the accuracy of anomaly detection decreases as the length of the interval increases. This is because as the length of an interval increases, two or more events are included within the interval. In other words, the length of an interval needs to be at least one event period or longer, and it is also desirable that the length does not include two or more events.

[0076] As described above, the anomaly detection device according to the embodiment of the present invention extracts feature vectors from time-series data for each interval corresponding to an event period, calculates the variance of the feature vectors for each interval in units of corresponding elements, generates an integrated feature vector using the variance as an element, and determines the degree of anomaly in the time-series data. This enables accurate detection of anomalies in the time-series data.

[0077] In particular, the anomaly detection device according to the embodiment of the present invention calculates the standard deviation as a statistical quantity for the feature quantities divided into sections of a single piece of time-series data, thereby making it possible to obtain a representative value that does not miss spikes that occur with low frequency, which would be missed by averaging. Therefore, anomalies can be detected more accurately in time-series data in which events occur sporadically.

[0078] Furthermore, according to the anomaly detection device of the embodiment of the present invention, by previously learning a mechanism for separating different environments in the feature extractor, even if time-series data from different environments is input, the obtained integrated features will be different at the feature level, and therefore features that are robust to environmental differences will be used for subsequent anomaly detection. Therefore, even if the time-series data is acquired in a variety of environments, anomalies can be detected with high accuracy in each acquisition environment.

[0079] Furthermore, by using the integrated vector to determine an abnormality, faster processing is possible compared to when the results of abnormality determination are integrated.

[0080] <Modification> The present invention is not limited to the device configuration and operation of the above-described embodiment, and various modifications and applications are possible within the scope of the gist of the present invention.

[0081] (Variation 1) Although the time-series data is sound data representing the operating sounds of a machine, the present invention is not limited to this example. The time-series data may be other sound data, or may be time-series data other than sound data as long as the time-series data represents events that occur sporadically.

[0082] For example, various log data collected by a computer may be used as time-series data. In this case, file access, web access, email history, login history, etc. may be used as time-series data. File access that occurs in a specific business may be used as an event, and job title information, user ID, etc. may be used as a label. In this example, it is possible to determine anomalies related to cybersecurity.

[0083] The sensing data may also be time-series data. In this case, the amount of power used, the number of steps taken, the heart rate, sleep, etc. may be used as time-series data. Specific human behaviors such as the time spent sleeping and the time falling asleep may be used as events, and user ID, age, gender, etc. may be used as labels. In this example, abnormalities related to human monitoring can be detected.

[0084] (Variation 2) Although the above description takes as an example a case where labels are determined from meta information of time-series data, the present invention is not limited to this. Labels may be determined from the time-series data itself. For example, clusters obtained by applying a clustering algorithm such as k-means to the time-series data are used as labels.

[0085] (Variation 3) Although the above description has been given using CNN to extract feature vectors, the present invention is not limited to this. Feature vectors may be extracted using other methods, such as melspectrograms and AutoEncoders, as long as they can aggregate information from input data.

[0086] (Variation 4) Although the description has been given using an example in which the length of the interval is predetermined, this is not limiting. The anomaly detection and learning device and the anomaly detection device may further include an event period estimation unit that estimates an event period of the time-series data, and the feature extraction unit may extract features for each interval corresponding to the event period estimated by the event period estimation unit. For example, the waveform of sound data, which is time-series data, may be analyzed to determine the time when the rise of a spike indicating a change greater than or equal to a predetermined threshold is detected and the time until the spike returns to its original state, and the event period may be estimated from the time difference between the two times.

[0087] (Variation 5) Although the description has been given taking an example in which a feature vector is used as a feature, the present invention is not limited to this. A scalar, a matrix, a tensor, or the like may also be used as a feature.

[0088] (Variation 6) Although the abnormality detection learning device has been described with reference to an example in which a spectrogram of sound data is input as learning data, the present invention is not limited to this. Sound data may also be input as learning data to the abnormality detection learning device. In this case, the sound processing unit may convert the sound data into a spectrogram, as in the abnormality detection device.

[0089] As described above, those skilled in the art can make various modifications to the embodiments within the scope of the present invention. [Explanation of symbols]

[0090] 10 Input section 20 Arithmetic section 22 Learning data storage unit 24 Feature extractor learning unit 26 Feature extractor memory unit 28 Feature Extraction Unit 30 Integration Department 32 Classifier training unit 34 Classifier memory unit 60 Input section 70 Arithmetic section 72 Acoustic Processing Unit 73 Feature extractor memory unit 74 Feature Extraction Unit 76 Integration Department 77 Classifier memory unit 78 Judgment section 80 Output section 100 Abnormality Judgment Learning Device 150 Abnormality determination device

Claims

1. a feature extraction unit that extracts features for each interval corresponding to an event period from time series data in which events occur sporadically; an integration unit that calculates the variation in element units corresponding to a plurality of sections for each element constituting the feature for each section, and generates an integrated feature that is a feature constituted by the element-by-element variation; a determination unit that determines a degree of anomaly in the time-series data based on the integrated feature amount; An abnormality determination device including:

2. The abnormality determination device according to claim 1 , wherein the feature extraction unit extracts the feature using a trained model that is a neural network model for identifying labels.

3. further comprising an event period estimation unit that estimates the event period of the time series data; 3. The abnormality determination device according to claim 1, wherein the feature extracting unit extracts the feature for each section that is equal to or longer than the event period estimated by the event period estimating unit.

4. 4. The abnormality determination device according to claim 1, wherein the determination unit determines the degree of abnormality from the integrated feature amount using a classifier learned from normal time-series data.

5. 5. The abnormality determination device according to claim 1, wherein the time series data is sound data representing the operating sound of a machine.

6. 6. The abnormality determination device according to claim 1, wherein the length of the section is determined based on the interval between the events.

7. A feature extraction unit extracts features for each section corresponding to the event period from time series data in which events occur sporadically, an integration unit calculates the variation in element units corresponding to the plurality of sections for each element constituting the feature for each section, and generates an integrated feature which is a feature constituted by the element-by-element variation; A determination unit determines the degree of abnormality of the time-series data based on the integrated feature amount. Abnormality determination method.

8. For time series data where events occur sporadically, feature values ​​are extracted for each interval corresponding to the event period. For each element constituting the feature for each section, a variation is calculated for each element corresponding to a plurality of sections, and an integrated feature is generated, which is a feature constituted by the variation for each element; Determining the degree of anomaly in the time-series data based on the integrated feature amount An abnormality detection program that causes a computer to execute the following.

Images