Abnormality management device and abnormality management method

Abstract

The object is to manage signal abnormalities even when there is little measurement data of the abnormal signal. [Solution] The anomaly management device 1 includes a first learning unit 12 that treats each observation value of the normal intensity series as a mutually independent discrete value and estimates probability parameters of a probabilistic model that represents normal intensity for each frequency component after quantization based on the occurrence frequency of each observation value; a second learning unit 13 that, while keeping fixed generator parameters, updates only classifier parameters of a classifier 132 that distinguishes between true normal data and pseudo-normal data based on the probability parameters of normal intensity estimated by the first learning unit, in a direction that maximizes classification accuracy, while treating each observation value of the normal intensity series as true normal data and generating pseudo-normal data that is sufficiently deviated from the distribution of true normal data; and an anomaly intensity database 14 that stores the pseudo-normal data output by the generator 131 after the second learning unit 13 updates the classifier parameters of the classifier 132 as information on abnormal signals having frequency components of abnormal intensity.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] Conventionally, there have been known techniques for analyzing the characteristics of a time-series signal in the frequency domain and detecting anomalies contained in the signal. For example, Patent Document 1 discloses a technique for estimating anomalies in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of both normal and abnormal signals as training data.

[0003] However, in the technology disclosed in Patent Document 1, in order to construct a model with sufficient accuracy for detecting anomalies, it is necessary to obtain a sufficient number of anomalous signals, and the anomalous signals must be accumulated over a long period of time. Furthermore, even when detecting signal anomalies in the frequency spectrum using statistical methods, a large amount of measurement data of the anomalous signals may be required. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-027386 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, according to the conventional technology, it may be difficult to manage signal abnormalities when there is little measurement data of the abnormal signal.

[0006] The present invention has been made to solve the above-mentioned problems, and has an object to manage signal abnormalities even when there is little measurement data of the abnormal signal. [Means for solving the problem]

[0007] In order to solve the above-described problems, an anomaly management device according to the present invention includes: a quantization unit configured to quantize normal intensities for each frequency component included in the frequency spectrum of a normal signal and convert the quantized normal intensity into a normal intensity sequence of integer values; a first learning unit configured to treat each observed value of the normal intensity sequence as a mutually independent discrete value and estimate probability parameters of a probabilistic model representing the normal intensity for each frequency component after quantization based on the occurrence frequency of each observed value; a second learning unit configured to update only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the normal intensities estimated by the first learning unit, in a direction to maximize classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, using each observed value of the normal intensity sequence as true normal data; and a storage unit configured to store the pseudo-normal data output by the generator as information on an abnormal signal having frequency components of abnormal intensities after the second learning unit updates the classifier parameters of the classifier.

[0008] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect the intensity of each frequency component included in the frequency spectrum of the signal to be managed, the quantization unit quantizing the collected intensity of each frequency component of the signal to be managed and converting it into an intensity series of integer values, and a determination unit configured to determine that the signal to be managed is an abnormal signal if the intensity series matches the pseudo-normal data stored in the memory unit.

[0009] Furthermore, the abnormality management device according to the present invention may further include a notification unit configured to issue a notification indicating the occurrence of an abnormality when the determination unit determines that the signal is abnormal.

[0010] In order to solve the above-described problems, the anomaly management method of the present invention includes a quantization step of quantizing normal intensities for each frequency component included in the frequency spectrum of a normal signal and converting the quantized normal intensity into a normal intensity sequence of integer values; a first learning step of treating each observed value of the normal intensity sequence as a mutually independent discrete value and estimating probability parameters of a probabilistic model representing the normal intensity for each frequency component after quantization based on the occurrence frequency of each observed value; a second learning step of updating only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the normal intensities estimated in the first learning step, in a direction to maximize classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently different from the distribution of the true normal data, using each observed value of the normal intensity sequence as true normal data; and a storage step of storing the pseudo-normal data output by the generator in a storage unit after updating the classifier parameters of the classifier in the second learning step as information of an abnormal signal having frequency components of abnormal intensities.

[0011] Furthermore, the abnormality management method according to the present invention may further include a collection step of collecting the intensity of each frequency component included in the frequency spectrum of the signal to be managed, wherein the quantization step quantizes the intensity of each frequency component of the collected signal to be managed and converts it into an intensity series of integer values, and further includes a determination step of determining that the signal to be managed is an abnormal signal if the intensity series matches the pseudo-normal data stored in the memory unit.

[0012] The abnormality management method according to the present invention may further include a notification step of issuing a notification indicating the occurrence of an abnormality when the signal is determined to be abnormal in the determination step. [Effects of the Invention]

[0013] According to the present invention, after the second learning unit updates the classifier parameters of the classifier, the pseudo-normal data output by the generator is stored as information on abnormal signals having frequency components with abnormal intensities, making it possible to manage signal abnormalities even when there is little measurement data on the abnormal signals. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the intensity of each frequency component in the frequency spectrum of a signal collected by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a block diagram showing the configuration of the second learning unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0015] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0016] [Configuration of anomaly management system] First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described.

[0017] The abnormality management system includes an abnormality management device 1 and a communication terminal 2. The abnormality management device 1 and the communication terminal 2 are connected via a network NW. In a case where there is very little abnormal data of a measurement signal but a large amount of normal data of the measurement signal is available, the abnormality management system according to this embodiment generates abnormal data through a learning process based on the normal data and builds a database of abnormal data for detecting signal abnormalities.

[0018] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0019] The communication terminal 2 can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, or the like. In this embodiment, there are n (n is a positive integer of 2 or more) communication terminals 2. The communication terminals 2 include terminals compatible with a mobile communication network that have a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as an International Mobile Subscriber Identity (IMSI).

[0020] The communication terminal 2 also includes a terminal having an IP address and configured as an IoT terminal. The communication terminal 2 is equipped with a mobile communication module and various sensors, and is capable of detecting various physical quantities and measuring them as electrical signals. The communication terminal 2 transmits the measured signals to a gateway or the like (not shown) or to the abnormality management device 1 via the network NW. In this embodiment, as an example, the signals to be subject to abnormality management are the reception level and signal strength of signals received from base stations, which are periodically measured and recorded by the communication terminal 2 using the mobile communication module.

[0021] As shown in area 2a of FIG. 1, communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of an abnormality in signal strength from the waveform data of signal strength shown in area 2a. Therefore, an abnormality management device 1 (described later) converts the time-series data of signal strength into a spectrum in the frequency domain and analyzes the frequency components to detect an abnormality in the signal.

[0022] Fig. 2 is a diagram illustrating abnormal data showing a frequency spectrum containing frequency components of abnormal intensity. In Fig. 2(a), the horizontal axis is frequency and the vertical axis is intensity, with curve a1 showing a frequency spectrum in which the intensity of each frequency component of a signal measured by one communication terminal 2 is normal, and curve b1 showing a frequency spectrum in which the intensity of a frequency component is abnormal in a signal measured by another communication terminal 2. Frequency spectrum b1 has an abnormal frequency component peak that is not present in normal frequency spectrum a1, and an abnormality has occurred in the intensity of the frequency component.

[0023] A communication terminal 2 that has measured a signal related to a frequency spectrum containing such an abnormally strong frequency component is experiencing a problem with its hardware or settings, or a problem with the reception environment. For example, there may be a malfunction in the communication module of the communication terminal 2, a bug or incorrect settings in the measurement software, or the influence of an internal noise source. Therefore, it is assumed that a malfunction has occurred in a communication terminal 2 that has measured a signal related to a frequency spectrum containing an abnormally strong frequency component.

[0024] [Function block of the abnormality management device] Next, functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10, a quantization unit 11, a first learning unit 12, a second learning unit 13, an abnormality intensity database (storage unit) 14, a determination unit 15, a notification unit 16, and a storage unit 17. The abnormality management device 1 builds a database of abnormal data through a learning process using normal data.

[0025] The collection unit 10 collects, via the network NW, the normal intensity of each frequency component contained in the frequency spectrum of a normal signal measured by each of the multiple communication terminals 2. The collection unit 10 collects time-series data of the signal measured by each of the multiple communication terminals 2, and performs a Fourier transform on the signal on the collection unit 10 side to obtain the frequency spectrum. The time-series data of the signal and its frequency spectrum are associated with identification information of the communication terminal 2 that measured the signal. The frequency spectrum of the signal collected by the collection unit 10 has M (e.g., 10 million) frequency components. "Intensity" is a concept that includes the amplitude and power of each frequency component, or physical quantities corresponding to these, and also includes aspects in which a voltage value is used as intensity.

[0026] The collection unit 10 collects normal intensities of each frequency component included in the frequency spectrum of a normal signal used for learning by the first learning unit 12 and the second learning unit 13. The collection unit 10 also collects intensities of each frequency component included in the frequency spectrum of a signal to be managed, which is used by the determination unit 15 to determine whether it is abnormal.

[0027] The quantization unit 11 quantizes the normal intensity of each frequency component included in the frequency spectrum of a normal signal and converts it into a normal intensity sequence of integer values. The quantization unit 11 converts the normal intensity of each frequency component included in the frequency spectrum of the signal collected by the collection unit 10 into a predetermined discrete integer value, for example, a positive integer level value 1 to 7, as shown on the vertical axis of FIG. 2(b). The quantization unit 11 rounds the value up or down by rounding. The quantization unit 11 further quantizes the intensity of each frequency component included in the frequency spectrum of the signal to be managed collected by the collection unit 10 and converts it into an intensity sequence of integer values.

[0028] The first learning unit 12 treats each observation value in the normal intensity series as a mutually independent discrete value and estimates probability parameters of a probability model representing normal intensities after quantization based on the occurrence frequency of each observation value. The first learning unit 12 sets a probability model based on a multinomial distribution for normal intensities, estimates the probability parameters, and calculates the log-likelihood of the series of each observation value based on the probability model. In other words, when there is very little data on abnormal intensities, the first learning unit 12 uses a large amount of data on normal intensities that is available to determine a probability model of normal intensities, which serves as a statistical standard, and a corresponding index of normality.

[0029] The first learning unit 12 focuses on the fact that the naive Bayes method treats each observation value as a conditionally independent discrete variable, and sets a probability model by extending the naive Bayes method to a multinomial distribution model so that the quantized intensity for each frequency component of the signal frequency spectrum can be regarded as a category-specific occurrence count vector. Here, as shown in the following equation (1), the intensity observed for each frequency component is quantized, and the vector expressed as the occurrence count of M categories is taken as the observation value X. X=x=(x1,x2,...,x M ) ···(1)

[0030] Furthermore, the class label to which the observed value X belongs, that is, the event Y, is defined as a binary variable by the following equation (2).

number

[0031] Here, Bayes' theorem is defined by the following equation (3).

number

[0032] In the above equation (3), P(X) is the marginal probability (outcome) of observing observed value X, P(Y) is the prior probability of event Y occurring, P(X|Y) is the conditional probability that observed value X occurs given that event Y occurs, and P(Y|X) is the conditional probability (posterior probability) that event Y occurs given that observed value X occurs. It is known that maximum likelihood estimation determines the parameters of the prior probability P(Y) so that the posterior probability P(Y|X) is maximized, using observed value X as the teacher signal, which is the correct value. In contrast, Bayesian estimation is a procedure for determining the parameters (probabilistic values) of the prior probability P(Y) that best explain observed value X, which is represented by a quantized intensity sequence.

[0033] In other words, by arbitrarily setting the parameters of the prior probability P(Y) in advance (e.g., normal distribution), it is possible to estimate the parameters of the prior probability P(Y) that maximizes P(X|Y), i.e., that best matches the marginal probability P(X) (outcome). In this way, the advantage of Bayesian estimation is that the prior probability P(Y) can be arbitrarily specified in advance. When each of the P(X|Y) is independent, the event Y is predicted by the observed variable x under given conditions. i are conditionally independent of each other, and the likelihood ρ(x|y) is given by the naive Bayes estimation method of the following equation (4).

[0034]

number

[0035] In this embodiment, we deal with a sequence of integer values ​​obtained by quantizing the intensity for each frequency component, so we use a vector of occurrence counts for each category x = (x1, x2, . . . , x M) as one sample, and while maintaining the naive assumption that each frequency component is conditionally independent, we extend it to a multinomial distribution probability model. The occurrence probability θ1, θ M are independent and the sum of their occurrence probabilities is 1. Under this constraint, the probability model of the multinomial distribution is expressed by the following equation (5).

[0036]

number

[0037] As shown in the above equation (5), the observed value x, which is the count value of the intensity at each frequency component, i The sum of (x1+x2++x M ) is determined, the distribution is the product of the following equation (6), and the observed value x observed at the i-th frequency component in the series is i Independently, probability θ i ^x i can be obtained.

number

[0038] Therefore, it can be seen that the relationship is similar to that of the naive Bayes method in equation (4). Here, the prior probability P(Y) is a binary problem of abnormal values ​​(Y=0) and normal values ​​(Y=1), and each unknown parameter is θ 0 ,θ 1 Also, D is defined as the marginal probability (outcome), and the observed value of the abnormal value (Y=0) is D 0 , the normal value (Y=1) observation is D 1 The above equation (6) can be expressed as the following equation (7) by converting the product form into a sum under the Naive Bayes independence assumption and decomposing the log likelihood for the observation set D, which is the data set, by class.

[0039]

number

[0040] Here, the constraint is expressed by the following equation (8).

number

[0041] Furthermore, by applying the Lagrange multiplier method, the outlier parameter θ 0 The maximum value of the logarithmic likelihood for the i-th component of is given by the following equation (9).

number

[0042] Normal value parameter θ 1 Similarly, if we calculate the maximum value of the log likelihood for 1 , θ 0 is expressed by the following equation (10).

number

[0043] In addition, x i Since takes integer values, x i To prevent the problem of the multinomial distribution diverging when ^(n) is 0, smoothing can be performed by specifying +α (e.g., α=1) smoothing. In this way, the first learning unit 12 regards the normal intensity series for each quantized frequency component as a multinomial distribution, estimates probability parameters from the count of occurrence frequency, and measures the normality by likelihood. Note that the first learning unit 12 also calculates the parameter θ of the abnormal value. 0 No estimates are made regarding

[0044] The second learning unit 13 fixes the generator parameters of the generator 131, which regards each observed value of the normal intensity series as true normal data and generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, and updates only the classifier parameters of the classifier 132, which distinguishes between true normal data and pseudo-normal data, in a direction that maximizes the classification accuracy, based on the probability parameters of the normal intensity estimated by the first learning unit 12.

[0045] As shown in Fig. 3, the second learning unit 13 executes a Max learning phase of a GAN (Generative Adversarial Network) having a generator 131 and a classifier 132, in which only the parameters of the classifier 132 are updated while the generator 131 is fixed. When a normal intensity sequence is regarded as true normal data, the second learning unit 13 aims to generate pseudo-normal data that deviates sufficiently from the distribution of normal data, that is, an intensity sequence that can be treated as an abnormal intensity sequence. For this reason, the Min learning phase in the normal GAN ​​adversarial learning procedure, in which the generator 131 is updated in the minimization direction, is not performed.

[0046] As shown in FIG. 3, a generative model according to this embodiment, which includes a generator 131 and a classifier 132, is provided for each observed value (frequency component) of an intensity sequence. Therefore, in this embodiment, training is performed on M generative models. Here, pseudo-normal data that deviates sufficiently from the distribution of normal data refers to a generated sequence that, as a statistical property, is located in a region that significantly deviates from the normal region of normal data, relative to normal data that indicates a normal intensity sequence. When the index of distance or deviation from normal data is log-likelihood, a sequence with a smaller likelihood corresponds to the pseudo-normal data. When the index is cross-entropy, a sequence with a larger entropy value corresponds to a larger deviation. Furthermore, when the index is KL distance, a sequence with a large deviation in the overall distribution is treated as a sufficiently deviated sequence.

[0047] 4 and 5 are diagrams schematically illustrating the neural network configuration of the generator 131 and the classifier 132 of the generative model used by the second learning unit 13. As shown in FIG. 4, the generator 131 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m ).

[0048] The generator 131 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 131 is pseudo-normal data that deviates from the distribution of true normal data. CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0049] The classifier 132 shown in Fig. 5 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5, the normal intensity sequence collected by the collection unit 10 and calculated by the quantization unit 11 is used as the training data input as true normal data.

[0050] The classifier 132 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 132 outputs an output y=1 when it correctly identifies the training data related to the input true normal data as true normal data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo normal data as pseudo normal data. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0051] FIG. 3 is a block diagram for explaining the configuration of the generative model by the second learning unit 13. The generator 131 of the generative model adopted by the second learning unit 13 is represented as a function G, and the classifier 132 is represented as a function D. Furthermore, true normal data is represented as x, the predicted value output by the classifier 132 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 131. In this case, the classifier 132 calculates the cross entropy E CE It can be expressed as:

[0052]

number

[0053] The first term in the brace of the above equation (11) represents t n lny n In this case, the predicted value y n is the correct label of the true normal data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0054] Here, the generator 131 that configures the generative model uses parameters w G ,θ G and the function G(w G ,θ G ) The classifier 132 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (11) CE The objective function E of the generative model including the generator 131 and the discriminator 132 based on the above can be expressed by the following equation (12).

number

[0055] The first term of the above equation (12) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 132 classifies true normal data as true normal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 132 classifies the pseudo-normal data generated by the generator 131 as pseudo-normal data. Here, the objective function E of the generative model in the above formula (12) is set to the parameter θ using the prior probability of the classes of abnormal values ​​(Y=0) and normal values ​​(Y=1) in the multinomial distribution. 0 , θ 1 When these are multiplied and incorporated, the objective function E is expressed by the following equation (13).

[0056]

number

[0057] In the above equation (13), the parameter θ of the multinomial distribution 0 , θ 1 The objective function E of the i-th component is expressed by the following equation (14).

number

[0058] By weighting the objective function (equation (12)) of a normal GAN, an adversarial loss that proportionally allocates the contributions of the normal value class and the abnormal value class can be obtained, as shown in the above equations (13) and (14). Here, the objective function E when the generator 131 is fixed is expressed by the following equation (15).

number

[0059] The convergence value (maximum value) of the discriminator 132 is expressed by the following equation (16).

number

[0060] Normal value parameter θ i ^1 is calculated using the above formula (10). The parameter θ of the abnormal value i For ^0, since there is a small amount of abnormal data related to the intensity of the abnormal frequency spectrum, an empirical rule or a preset value is used. i ^1,θ i ^0 is the value of each observation x i The expected value ratio, E, varies depending on the ρ(x|y=1) :E ρ(x|y=0) For example, since the number of normal data is overwhelmingly large, the ratio is set in advance to 0.99:0.01.

[0061] In the learning of the generative model of this embodiment, only Max optimization of the objective function E is performed, and the parameters of the classifier 132 with the generator 131 fixed are learned. Therefore, it is possible to prevent the output of the generator 131 from converging to the distribution of normal data, and conversely, to maintain a sequence that is sufficiently deviated from the distribution of normal data. When the update of the classifier 132 has converged, the pseudo-normal data sequence output by the fixed generator 131 is a normal intensity model (parameters θ of the multinomial distribution) 1 ) has a low likelihood. In this case, the generator 131 can generate only pseudo-normal data, which is an abnormal sequence expressed by the following equation (17).

number

[0062] The abnormality intensity database 14 stores the pseudo-normal data generated by the generator 131 after the second learning unit 13 updates the parameters of the classifier 132 as abnormal signal information having frequency components with abnormal intensities. Specifically, when the generator 131 provided with the generative model corresponding to each frequency component learns with, for example, 10,000 pieces of training data, it generates 10,000 pieces of pseudo-normal data and registers them in the abnormality intensity database 14. The abnormality intensity database 14 registers frequency spectra having frequency components with abnormal intensities as reference patterns for abnormality determination.

[0063] The determination unit 15 determines that the signal to be managed is an abnormal signal when the intensity sequence for each frequency component in the frequency spectrum of the signal to be managed matches the pseudo-normal data stored in the abnormality intensity database 14. More specifically, when the intensity sequence obtained by converting the intensities of frequency components included in the frequency spectrum of the signal to be managed by the quantization unit 11 matches the pseudo-normal data stored in the abnormality intensity database 14, the determination unit 15 determines that the signal to be managed is an abnormal signal whose frequency spectrum includes frequency components of abnormal intensity.

[0064] In addition to the case where the signal matches the pseudo-normal data stored in the abnormality intensity database 14, the judgment unit 15 can judge that the signal is a frequency component of abnormal intensity, i.e., an abnormal signal, if the sum of the squares of the differences between the level values ​​of the intensity series of each frequency component included in the frequency spectrum of the signal to be managed and the level values ​​of the pseudo-normal data stored in the abnormality intensity database 14 is within a set threshold value according to the following equation (18).

number

[0065] If the signal is determined to be abnormal, the notification unit 16 issues a notification indicating the occurrence of an abnormality. The notification unit 16 can send an alarm to an external management server. Alternatively, the notification unit 16 may send a notification via the network NW to the communication terminal 2 in which the occurrence of the abnormality has been detected.

[0066] The storage unit 17 stores parameters of a probabilistic model that indicates the intensity of a normal frequency spectrum, estimated by the learning by the first learning unit 12. The storage unit 17 also stores a generator 131 included in the trained generative model constructed by the learning by the second learning unit 13.

[0067] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0068] 6, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0069] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0070] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, the quantization unit 11, the first learning unit 12, the second learning unit 13, the determination unit 15, and the notification unit 16 shown in FIG.

[0071] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0072] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0073] The auxiliary storage device 105 has a program storage area for storing an anomaly management program. The auxiliary storage device 105 also has a program storage area for storing a first learning program executed by the anomaly management device 1 to estimate parameters related to normal strength using a probabilistic model of multinomial distribution. The auxiliary storage device 105 also has a program storage area for storing a second learning program for training the classifier 132 of the generative model executed by the anomaly management device 1. The auxiliary storage device 105 realizes the anomaly strength database 14 and the storage unit 17 described in FIG. 1 . Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0074] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0075] Display device 107 is configured with an organic EL display, a liquid crystal display, etc. Display device 107 can display information about communication terminal 2 that has measured an abnormal signal on its screen. Display device 107 also constitutes notification unit 16 and can display an alarm on its screen indicating that an abnormal signal has been detected.

[0076] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0077] 7, first, the collection unit 10 collects the frequency spectrum of a normal signal that contains at least a certain number of normal intensities (step S1). The collection unit 10 collects, for example, multiple signals with normal frequency spectra that contain at least 99% frequency components with normal intensities. The collection unit 10 can collect time series data of signals measured at each communication terminal 2 from a gateway or each communication terminal 2 via the network NW and convert the data into a frequency spectrum.

[0078] Next, the quantization unit 11 quantizes the normal intensity for each frequency component included in the frequency spectrum of the normal signal collected in step S2, and converts it into a normal intensity sequence of integer values ​​(step S2). Next, the first learning unit 12 performs a first learning process (step S3). FIG. 8 is a flowchart illustrating the first learning process of step S3 in more detail. As shown in step S30 of FIG. 8, the first learning unit 12 models the normal intensity sequence obtained by conversion in step S2 using a multinomial distribution (step S30). The first learning model sets the probability model of the above equation (5).

[0079] Next, the first learning unit 12 learns the parameters θ for binary classification of normal intensity and abnormal intensity. 1 , θ 0 (Step S31). Next, the first learning unit 12 defines the log-likelihood in accordance with the above formula (7) (Step S32). In Step S32, the first learning unit 12 converts the objective function for optimization from a product form (formula (5)) to a sum form. Next, the first learning unit 12 determines the parameter θ related to the normal strength that maximizes the log-likelihood (formula (7)) under the constraint (formula (8)) by the Lagrange multiplier method of the above formula (9). 1 (Equation (10)) is estimated (step S33). 1 is stored in the storage unit 17, and the process proceeds to step S4 in FIG.

[0080] Next, the second learning unit 13 determines the parameters θ of the normal values ​​estimated by the first learning unit 12 in step S3 while fixing the generator parameters of the generator 131 that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, using each observed value of the normal intensity sequence as true normal data. 1 Based on this, only the classifier parameters of the classifier 132 that distinguishes between true normal data and pseudo normal data are updated in a direction that maximizes the classification accuracy (second learning process) (step S4).

[0081] 9 is a flowchart for explaining the second learning process in step S4. First, the second learning unit 13 calculates the normal and abnormal value parameters θ of the probabilistic model of the multinomial distribution estimated in the first learning process in step S3. 1 ,θ 0 is set as the objective function (Equation (15)) of the generative model (step S50). More specifically, the second learning unit 13 sets the parameter θ i ^1 is substituted into the objective function when the generator 131 in the above equation (15) is fixed, and the parameter θ i For ^0, we use an empirical rule or a preset value and substitute it into the above equation (15). Furthermore, the ratio of the expected values, E ρ(x|y=1) :E ρ(x|y=0) Regarding , since the number of normal data is overwhelmingly large, a preset value of, for example, 0.99:0.01 is adopted in the above equation (15).

[0082] Next, the second learning unit 13 acquires the normal intensity sequence collected in step S1 and quantized and transformed in step S2 as true normal data (step S51). Next, the second learning unit 13 inputs the true normal data as training data 134 to the classifier 132, and adjusts the parameter w D ,θ D(Step S52). In Step S52, the second learning unit 13 can cause the classifier 132 to learn true normal data using, for example, an error backpropagation method. In Step S51, the classifier 132 that can distinguish true normal data from true normal data is pre-trained.

[0083] Next, the second learning unit 13 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 131 (step S53). Subsequently, the generator 131 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo-normal data G(z) (step S54).

[0084] Next, the second learning unit 13 learns the classifier 132. The learning of the classifier 132 is performed by using the parameter w D ,θ D First, the second learning unit 13 provides true normal data as training data 134 as input to the classifier 132. Then, the second learning unit 13 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D (Step S55). The label of the training data 134 is set to 1 (true normal data).

[0085] Next, the second learning unit 13 provides the pseudo-normal data generated by the generator 131 in step S54 to the classifier 132, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D is updated (step S56).

[0086] The learning of the classifier 132 in steps S55 and S56 corresponds to the dashed arrows in the block diagram of the second learning unit 13 shown in FIG. 3 , which indicate that a classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0087] Thereafter, the learning of the classifier 132 from step S54 to step S56 is repeated until the value of the objective function E converges (step S57: NO). On the other hand, if the value of the objective function E converges to the optimal solution of the above equation (16) (step S57: YES), the processing from step S52 to step S57 is repeated using the remaining true normal data in order until the generator 131 and the classifier 132 are learned (step S58: NO).

[0088] Thereafter, when the classifier 132 has been trained using all true normal data (step S58: YES), the second learning unit 13 stores the generator 131 in the storage unit 17 (step S59). The second learning unit 13 also performs the processes from step S50 to step S59 for each generative model corresponding to M observed values ​​(frequency components) to train the classifier 132. Note that in steps S52, S55, and S56, batch processing may be performed to update the parameters. Similarly, in steps S53 and S54, noise may be generated in batch units to generate pseudo-normal data. Thereafter, the process proceeds to step S5 in FIG. 7.

[0089] Next, the anomaly intensity database 14 stores the pseudo-normal data generated by the generator 131 after the classifier 132 has been updated through learning by the second learning unit 13 (step S5). In step S5, the pseudo-normal data generated by the generator 131 corresponding to each frequency component is registered in the anomaly intensity database 14. For example, assume that 1,000 frequency components (M=1,000) are set. In this case, if learning is performed using, for example, 10,000 pieces of training data in each of 1,000 generative models corresponding to the 1,000 frequency components in the second learning process of step S4, the generator 131 of each generative model generates 10,000 pieces of pseudo-normal data. Therefore, 10,000 pieces of pseudo-normal data are registered in the anomaly intensity database 14 for each of the 1,000 frequency components.

[0090] Next, the collection unit 10 collects the intensity of each frequency component included in the frequency spectrum of the signal to be managed (step S6). Thereafter, the quantization unit 11 quantizes the intensity of each frequency component of the signal to be managed collected in step S6 and converts it into an intensity sequence (step S7).

[0091] Next, the determination unit 15 determines that the signal to be managed is an abnormal signal (step S8) if the intensity sequence for each frequency component of the frequency spectrum of the signal to be managed obtained in step S7 matches the pseudo-normal data stored in the abnormality intensity database 14. In step S8, the determination unit 15 can determine that the signal to be managed is an abnormal signal if the intensity for each frequency component of the frequency spectrum of the signal to be managed matches the pseudo-normal data completely or matches it within a certain tolerance range.

[0092] Specifically, the judgment unit 15 can judge that the signal to be managed is an abnormal signal if the sum of the squares of the differences between the level values ​​of the intensity series for each frequency component of the frequency spectrum of the signal to be managed and the level values ​​of the pseudo-normal data is within a threshold value according to the above equation (18).

[0093] In addition, the pseudo-normal data for each frequency component can be sequentially compared, without necessarily matching the intensity series of all frequency components, and when the intensity series of the signal to be managed partially matches the series of pseudo-normal data, it can be determined that the signal to be managed is an abnormal signal.

[0094] Next, the notification unit 16 notifies an external management server or the like that an abnormality has occurred in the communication terminal 2 that measured the signal determined to be an abnormal signal (step S9).

[0095] As described above, the anomaly management device 1 according to this embodiment employs a multinomial distribution Naive Bayes algorithm as a probability model for a sequence of integer values ​​obtained by quantizing the intensity of a normal frequency spectrum, and estimates probability parameters for a normal intensity sequence. Furthermore, the probability parameters for the estimated normal intensity sequence are set as the objective function of the generative model, and learning is performed by updating only the classifier 132 while keeping the generator 131 fixed, so that pseudo-normal data that is sufficiently different from the distribution of true normal data indicating a normal intensity sequence is output from the generator 131. The collected pseudo-normal data is registered as a database for anomaly detection, making it possible to manage signal anomalies even when there is little measurement data of abnormal signals.

[0096] In the embodiment described above, the second learning unit 13 has been described as having a generative model with a GAN configuration. However, the generative model can be configured not only based on a GAN but also based on a VAE (Variational Autoencoder), Energy-Based Models (EBMs), or the like.

[0097] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0098] 1...abnormality management device, 2...communication terminal, 10...collection unit, 11...quantization unit, 12...first learning unit, 13...second learning unit, 14...abnormality intensity database, 15...judgment unit, 16...notification unit, 17...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 131...generator, 132...identifier, NW...network.

Claims

1. a quantization unit configured to quantize the normal intensity of each frequency component included in the frequency spectrum of the normal signal and convert it into a normal intensity sequence of integer values; a first learning unit configured to treat each observed value of the normal intensity sequence as a discrete value independent of each other, and to estimate probability parameters of a probability model representing the normal intensity for each of the frequency components after quantization based on an appearance frequency of each observed value; a second learning unit configured to update only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo normal data, based on the probability parameter of the normal intensity estimated by the first learning unit, in a direction that maximizes classification accuracy, while keeping fixed a generator parameter of a generator that generates pseudo normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value of the normal intensity sequence considered as true normal data; a storage unit configured to store the pseudo-normal data output by the generator as information on an abnormal signal having a frequency component of abnormal intensity after the second learning unit updates the classifier parameters of the classifier; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, Further, a collection unit configured to collect the intensity of each frequency component included in the frequency spectrum of the signal to be managed, the quantization unit quantizes the intensity of each frequency component included in the frequency spectrum of the collected signal to be managed, and converts it into an intensity series of integer values; The apparatus further includes a determination unit configured to determine that the signal to be managed is an abnormal signal when the intensity sequence matches the pseudo-normal data stored in the storage unit. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, Further, a notification unit configured to notify the occurrence of an abnormality when the determination unit determines that the signal is abnormal. An abnormality management device characterized by:

4. a quantization step of quantizing the normal intensity of each frequency component included in the frequency spectrum of the normal signal and converting it into a normal intensity sequence of integer values; a first learning step of treating each observed value of the normal intensity sequence as a discrete value independent of each other and estimating probability parameters of a probability model representing the normal intensity for each of the frequency components after quantization based on the occurrence frequency of each observed value; a second learning step of updating only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo normal data, based on the probability parameter of the normal intensity estimated in the first learning step, in a direction that maximizes classification accuracy, while keeping fixed a generator parameter of a generator that generates pseudo normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value of the normal intensity sequence considered as true normal data; a storage step of storing the pseudo-normal data output by the generator in a storage unit as information on an abnormal signal having a frequency component of abnormal intensity after updating the classifier parameters of the classifier in the second learning step; An abnormality management method comprising:

5. 5. The abnormality management method according to claim 4, Further, a collection step of collecting the intensity of each frequency component included in the frequency spectrum of the signal to be managed is provided, the quantization step quantizes the intensity of each frequency component included in the frequency spectrum of the collected signal to be managed and converts it into an intensity series of integer values; The method further includes a determination step of determining that the signal to be managed is an abnormal signal when the intensity sequence matches the pseudo-normal data stored in the storage unit. An abnormality management method characterized by:

6. 6. The abnormality management method according to claim 5, Further, the method includes a notification step of issuing a notification indicating the occurrence of an abnormality when the signal is determined to be abnormal in the determination step. An abnormality management method characterized by:

Images