Learning device, learning method, and learning program

Abstract

A detection device (1) includes: a training data input unit (11) that acquires, as a related data set, unlabelled data and labelled data, which are targets that are different from but related to a detection target; and an abnormality detection training model training unit (13) that uses the labelled data in the related data set to evaluate the performance of a first abnormality detector trained with the unlabelled data in the related data set, and trains the abnormality detection training model for training the first abnormality detector so as to improve the evaluation results.

Description

[Technical Field]

[0001] The present invention relates to a learning device, a learning method, and a learning program. [Background technology]

[0002] Anomaly detection is a technique that learns normal patterns from a dataset and identifies whether given unknown data is anomalous or not. Anomaly detection is used in a variety of practical applications, including intrusion detection, medical image diagnosis, and industrial system monitoring.

[0003] Anomaly detection is generally performed using unsupervised learning, in which an anomaly detector is trained from a given unlabeled data set. In this case, in order to learn normal patterns from unlabeled data, assumptions are made such as "the majority of unlabeled data is normal data" or "anomalous data in unlabeled data can be ignored."

[0004] However, in real-world situations, the above assumption often does not hold. For example, intrusion detection systems collect data from each user for a certain period of time, and detect anomalies by learning the user's normal patterns under the assumption that most of the data collected is normal. However, if a user is infected with malware, the collected data will contain a lot of abnormal data, and the above assumption will not hold. Furthermore, even a small amount of abnormal data can have a significant impact and reduce the learning performance of the anomaly detector.

[0005] This problem can be addressed by using samples labeled as normal or abnormal (normal-anomalous samples) for training. However, labeling generally requires expert review, and it is likely difficult to collect labeled data for all target tasks. In the case of the example above, this becomes particularly difficult when new users are constantly appearing.

[0006] On the other hand, if it is a related dataset, there are cases where normal and abnormal samples can be obtained. In the example above, even if it is difficult to collect labeled data from a new user, if the user has been using the system for a long time, it is possible that some normal and abnormal samples have been obtained due to the long operating time.

[0007] Therefore, a technique has been proposed to improve anomaly detection performance by utilizing a related dataset consisting of normal and abnormal data in addition to a normal dataset for the target task.

[0008] For example, there is a technology that allows a neural network that outputs an anomaly detector when a normal data set is input to learn an appropriate anomaly detector from an unknown normal data set by training the neural network using a related data set (Non-Patent Document 1).

[0009] There is also a technology that uses related datasets to train an anomaly detector to maximize the expected anomaly detection performance of an anomaly detector trained from a small set of normal and abnormal datasets, making it possible to train an appropriate anomaly detector from an unknown set of normal and abnormal datasets (Non-Patent Document 2). [Prior art documents] [Non-patent literature]

[0010] [Non-Patent Document 1] A. Kumagai, T. Iwata, and Y. Fujiwara, “Transfer Anomaly Detection by Inferring Latent Domain Representations”, In NeurIPS, 2019. [Non-patent document 2] T. Iwata, and A. Kumagai, “META-LEARNING ONE-CLASS CLASSIFIERS WITH EIGENVALUE SOLVERS FOR SUPERVISED ANOMALY DETECTION”, arXiv preprint arXiv:2103.00684, 2021. Summary of the Invention [Problem to be solved by the invention]

[0011] The techniques described in Non-Patent Documents 1 and 2 require labeled data as the target dataset, and therefore cannot be applied when the target dataset contains only unlabeled data.

[0012] The present invention has been made in consideration of the above, and aims to provide a learning device, a learning method, and a learning program that can learn a high-performance anomaly detector from unlabeled data. [Means for solving the problem]

[0013] In order to solve the above-mentioned problems and achieve the object, the learning device of the present invention is characterized by having an acquisition unit that acquires unlabeled data and labeled data of an object that is different from a detection object and is related to the detection object as a related dataset, and a learning unit that evaluates the performance of a first anomaly detector trained with the unlabeled data of the related dataset using the labeled data of the related dataset, and learns an anomaly detection learning model for training the first anomaly detector so as to improve the evaluation result. [Effects of the Invention]

[0014] According to the present invention, a high performance anomaly detector can be trained from unlabeled data. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram illustrating the processing of a detection device according to an embodiment. [Figure 2] FIG. 2 is a diagram schematically illustrating an example of the configuration of the detection device according to the embodiment. [Figure 3] FIG. 3 is a flowchart showing the procedure of the learning process. [Figure 4]FIG. 4 is a flowchart showing the procedure of the detection process. [Figure 5] FIG. 5 is a diagram for explaining the processing of the learning unit. [Figure 6] FIG. 6 is a diagram illustrating an example of a computer that implements a detection device by executing a program. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0017] [Embodiment Mode] The detection device of this embodiment utilizes a related dataset consisting of unlabeled data and normal / anomalous data to eliminate the influence of anomalies from the unlabeled data of the target task, thereby obtaining a highly accurate anomaly detector.

[0018] [Detection device overview] Fig. 1 is a diagram illustrating the processing of a detection device according to an embodiment. As shown in Fig. 1, in the learning phase, in addition to the target dataset (unlabeled data), information from multiple related datasets (normal and abnormal samples and unlabeled samples) is also utilized to train a high-performance anomaly detector from unlabeled data.

[0019] First, in the training phase, a model is trained to directly maximize the expected anomaly detection performance of the anomaly detector trained from unlabeled data (first anomaly detector) using only data from the relevant dataset. Here, the expected anomaly detection performance is one of the detection performances for untrained data, and can be calculated from labeled data (anomaly and normal data).

[0020] Specifically, in the learning phase, unlabeled data is randomly extracted from the related dataset t (t = 1, ..., T) (Figure 1 (1)), input into the anomaly detection learning model, and the anomaly detector is trained (Figure 1 (2)).

[0021] Then, in the training phase, the expected anomaly detection performance of the anomaly detector trained on unlabeled data from related dataset t is calculated. In the training phase, the calculated expected anomaly detection performance is evaluated on labeled data (anomaly and normal data) from related dataset t, and the anomaly detection learning model is trained to improve the evaluation value ((3) in Figure 1).

[0022] In this case, in the training phase, by combining a mechanism that reduces the influence of anomalous data in unlabeled data, it becomes possible to train the anomaly detector without being influenced by anomalous data. For example, in the training phase, training may be performed by combining an outlier detection mechanism that reduces the influence of samples in the unlabeled data that have properties different from other samples in the training.

[0023] In the detection phase, the trained anomaly detection learning model is trained to learn an anomaly detector (second anomaly detector) suitable for the target task data by inputting unlabeled data for the target task. In the detection phase, the anomaly detector obtained through training is used to perform detection on each test data of the target task.

[0024] [Detection device] FIG. 2 is a diagram schematically illustrating an example of the configuration of a detection device according to an embodiment. The detection device 1 according to the embodiment is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The detection device 1 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The detection device 1 (learning device) is realized by a general-purpose computer such as a workstation or a personal computer. As shown in FIG. 2, the detection device 1 has a learning unit 10 that performs learning processing and a detection unit 20 that performs detection processing.

[0025] The learning unit 10 uses multiple related datasets (normal and abnormal samples and unlabeled samples) to train the anomaly detection learning model 141 so as to directly maximize the expected anomaly detection performance of the anomaly detector trained on unlabeled data.

[0026] The related dataset is a dataset consisting of unlabeled data and a small amount of normal and abnormal data. For example, the related dataset may be anomaly and normal samples and unlabeled samples from users who have been operating for a long time but are not the target of detection. Normal and abnormal samples are samples labeled as normal or abnormal.

[0027] When unlabeled data of a target task is given, the detection unit 20 uses the anomaly detection learning model 141 to learn an anomaly detector suitable for the target task. The detection unit 20 uses the obtained anomaly detector to detect test data. The detection unit 20 may be implemented on the same hardware as the learning unit 10, or on different hardware. The unlabeled data of the target task is, for example, unlabeled data of a new user to be detected.

[0028] [Study Department] The learning unit 10 includes a learning data input unit 11 (acquisition unit), a feature extraction unit 12, an anomaly detection learning model learning unit 13 (learning unit), and a storage unit 14.

[0029] The training data input unit 11 is implemented using input devices such as a keyboard and a mouse, and inputs various instruction information to the control unit in response to input operations by an operator. The training data input unit 11 functions as an acquisition unit and receives multiple related data sets (normal and abnormal samples and unlabeled samples) as input.

[0030] The related data set may be input to the learning unit 10 from an external server device or the like via a communication control unit (not shown) realized by a NIC (Network Interface Card) or the like.

[0031] The feature extraction unit 12 converts each sample of the input related data set into a feature vector. Here, a feature vector is a representation of the features of the required data as an n-dimensional numeric vector. The conversion to a feature vector uses a method commonly used in machine learning. For example, if the data is text, methods such as morphological analysis, n-gram, and delimiter analysis can be applied.

[0032] Anomaly detection learning model learning unit 13 uses the sample data after feature extraction to learn anomaly detection learning model 141 for learning an anomaly detector (first anomaly detector) suitable for the data from unlabeled data. When unlabeled data is input, anomaly detection learning model 141 is a model that outputs an anomaly detector corresponding to the input unlabeled data.

[0033] The anomaly detection learning model learning unit 13 evaluates the performance of the anomaly detector (first anomaly detector) that has been trained using unlabeled data from the related data set using labeled data from the related data set, and learns the anomaly detection learning model so as to improve the evaluation results.

[0034] As the base anomaly detector, it is possible to apply a method used in anomaly detection, such as an autoencoder or one-class SVM. Note that the anomaly detection learning model training unit 13 may perform learning by combining an outlier detection mechanism that reduces the influence of samples in unlabeled data that have properties different from other samples on learning.

[0035] The storage unit 14 is realized by a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores a trained anomaly detection learning model 141.

[0036] [Detection unit] The detection unit 20 includes a data input unit 21, a feature extraction unit 22, a learning and detection unit 23, and a detection result output unit 24.

[0037] The data input unit 21 is realized using input devices such as a keyboard and a mouse, and inputs various instruction information to the control unit in response to input operations by an operator, and receives unlabeled data of the target task and test data. The data input unit 21 outputs the input unlabeled data of the target task and test data to the feature extraction unit 22.

[0038] The unlabeled data and test data for the target task may be input to the detection unit 20 from an external server device or the like via a communication control unit (not shown) realized by a NIC or the like. The data input unit 21 may be the same hardware as the training data input unit 11. After the detection unit 20 receives the unlabeled data once and trains the anomaly detector, it is possible to perform detection by simply inputting the test data for the task into the anomaly detector.

[0039] Similar to the feature extraction unit 12 of the learning unit 10, the feature extraction unit 22 converts each sample of the acquired unlabeled data of the target task and test data into a feature vector in preparation for processing in the learning / detection unit 23.

[0040] The learning and detection unit 23 outputs an anomaly detector (second anomaly detector) from unlabeled data using the anomaly detection learning model 141. The obtained anomaly detector is saved, and the learning and detection unit 23 subsequently uses the obtained anomaly detector to perform detection when test data for the task is input.

[0041] The detection result output unit 24 is realized by a display device such as a liquid crystal display, a printing device such as a printer, an information communication device, etc., and outputs the results of the detection process to the operator. For example, the detection result output unit 24 outputs whether or not an abnormality is detected from the input test data.

[0042] [Detection process procedure] 3 and 4, a description will be given of the procedure of the detection process by the detection device 1. The detection process by the detection device 1 includes a learning process by the learning unit 10 and a detection process by the detection unit 20.

[0043] [Learning process] 3 is a flowchart showing the procedure of the learning process, which starts, for example, when a user performs an operation input to instruct the start of the learning process.

[0044] 3, the training data input unit 11 receives a plurality of related data sets (normal and abnormal samples and unlabeled samples) as input (step S1). The feature extraction unit 12 converts each sample in the received related data sets into a feature vector (step S2).

[0045] The anomaly detection learning model training unit 13 uses the sample data after feature extraction to train an anomaly detection learning model 141 for training an anomaly detector suitable for the data from unlabeled data (step S3). The anomaly detection learning model training unit 13 inputs unlabeled data from the related dataset t after feature extraction into the anomaly detection learning model and trains the anomaly detector. The anomaly detection learning model training unit 13 then evaluates the performance of the anomaly detector trained with the unlabeled data of the related dataset t using labeled data (anomalous and normal data) of the related dataset t, and trains the anomaly detection learning model so as to increase the evaluation value.

[0046] The anomaly detection learning model learning unit 13 stores the learned anomaly detection learning model 141 in the storage unit 14.

[0047] [Detection process] Fig. 4 is a flowchart showing the procedure of the detection process, which starts, for example, when a user performs an operation input to instruct the start of the detection process.

[0048] The data input unit 21 accepts input of unlabeled data and test data for the target task to be processed (step S11), and the feature extraction unit 22 converts each sample of the accepted unlabeled data and test data for the target task into a feature vector (step S12).

[0049] The learning and detection unit 23 uses the anomaly detection learning model 141 to train an anomaly detector from unlabeled data, and then uses the trained anomaly detector to detect each test sample (step S13). By training the anomaly detector from the unlabeled data of the target task, the detection unit 20 can output the detection results by inputting only the test samples of this task. Then, the detection result output unit 24 outputs the detection results of the anomaly detector (step S14).

[0050] [Effects of the embodiment] Thus, according to the embodiment, a high-performance anomaly detector is trained from unlabeled data by utilizing information from multiple related datasets in addition to the target dataset (unlabeled data).

[0051] Specifically, the detection device 1 according to the embodiment acquires unlabeled data and labeled data of an object that is different from the detection object and related to the detection object as a related dataset. The detection device 1 evaluates the performance of a first anomaly detector trained with the unlabeled data in the related dataset using the labeled data in the related dataset, and learns an anomaly detection learning model for training the first anomaly detector so as to improve the evaluation result.

[0052] In this way, the detection device 1 can learn a high-performance anomaly detector from the target dataset, which is unlabeled data, by training an anomaly detection learning model using multiple related datasets (normal and abnormal samples and unlabeled samples) rather than the target dataset (unlabeled data).

[0053] The detection device 1 trains an anomaly detection learning model to directly maximize the expected anomaly detection performance of an anomaly detector trained on unlabeled data from a related dataset, based on normal and abnormal samples from the related dataset. When unlabeled data for a target task is given, the detection device 1 uses the trained anomaly detection learning model to train an anomaly detector corresponding to the target task. The detection device 1 then uses the anomaly detector thus obtained to detect test data.

[0054] Therefore, the detection device 1 can improve anomaly detection performance even when the target task consists of only unlabeled data.

[0055] During the model training process, the detection device 1 trains the anomaly detector by reducing the influence of samples in the unlabeled data of the related dataset that have properties different from other samples. In this way, by introducing a mechanism that reduces the influence of anomalous data in the unlabeled data, the detection device 1 can train the anomaly detector without being adversely affected by the anomalous data.

[0056] [Application example] An application example of this embodiment will be specifically described. First, let S (Equation (1)) be the target data set (unlabeled data). Here, x n represents the D-dimensional feature vector of the n-th sample.

[0057]

number

[0058] Now, suppose T related datasets D (Equation (2)) are given to the learning phase.

[0059]

number

[0060] where x t , x t A , x t N Let denote the unlabeled data, anomalous data, and normal data for the t-th task, respectively. We assume that the dimension D of the feature vector is the same in all datasets. Our goal here is to train an anomaly detector suitable for a target dataset S, which is not included in the related datasets, when it is given in the testing phase.

[0061] First, we explain the anomaly detector learning model for learning an anomaly detector from S (test phase). Then, we explain the learning method of the anomaly detector learning model (learning phase).

[0062] In the detection phase, first, a vector representation z of the target dataset S is extracted using Equation (3).

[0063]

number

[0064] f and g are arbitrary neural networks. The "sum" of f does not depend on the order of the samples in S, so equation (3) defines a single vector z for the set S. Note that any permutation-invariant neural network (e.g., "maximum" or set transformer) may be used, even if it is not of this type.

[0065] Using the obtained vector z, the anomaly detector s (a function that outputs an anomaly score for sample x) is defined by the reconstruction error of equation (4).

[0066]

number

[0067] Here, || ||2 represents the l2 norm, [,] represents the combination of two vectors, H (Equation (5)) represents the neural network, and W (Equation (6)) represents the linear weight parameter.

[0068]

number

[0069]

number

[0070] Typically, reconstruction error-based anomaly detectors are trained using normal data to reduce the reconstruction error. This is expected to reduce the reconstruction error for unknown normal data, while the reconstruction error for abnormal data is expected to be large because it has not been trained. This mechanism makes reconstruction error-based anomaly detectors widely used.

[0071] However, the target dataset S may contain not only normal data but also abnormal data. Therefore, if training is performed to reduce the reconstruction error of all samples in the target dataset S, the resulting anomaly detector may be adversely affected by the abnormal data and may have poor performance.

[0072] To address this problem, in this embodiment, minimization of the objective function shown in equation (7) is considered.

[0073]

number

[0074] where || || F represents the Frobenius norm. || ||1 represents the l1 norm. λ and μ represent positive real numbers. A (Equation (8)) is a matrix representing the outlier components. a n is a vector for removing outlier components, which are abnormal data. As shown in equation (7), the objective function is n By introducing this, the influence of outlier components on learning is reduced.

[0075]

number

[0076] When λ = ∞, A = 0, and the objective function in equation (7) is the same as the objective function of a typical reconstruction error-based anomaly detector (equation (4)). Generally, when the majority of data in the target dataset S is normal, it is expected that reconstruction of abnormal data will be difficult because the abnormal data has different properties compared to normal data. If the matrix A representing the outlier components is not introduced (when A = 0), the system will learn to forcibly reconstruct such samples as well.

[0077] On the other hand, as shown in Equations (7) and (8), when introducing a matrix A that represents outlier components, the sample x that is difficult to reconstruct m is a m By estimating a as a non-zero vector, it is possible to avoid unreasonable reconstruction and learn. n By estimating and minimizing the objective function (equation (7)), it is expected that the anomaly detector can be trained in a way that reduces the adverse effects of abnormal data in the target dataset S.

[0078] a n The l1 norm regularization is introduced to control the magnitude of the estimated abnormal component. Note that without this l1 regularization (when λ = 0), the optimal solution of the objective function (Equation (7)) is trivial and meaningless (A = -X S ,W=0).

[0079] It is also important to note that the objective function (Equation (7)) estimates the matrix A, which represents the outlier components, and the linear weight parameter W. In the objective function (Equation (4)) of the reconstruction error-based anomaly detector, not only the linear weight parameter W but also h is to be learned, but when training the anomaly detector from S, only W is learned. The learning of h will be described later. This makes the objective function (Equation (7)) a convex function, making it possible to find the global optimum using a simple update formula. Specifically, it can be found by alternately repeating the update formulas shown in Equations (9) and (10).

[0080]

number

[0081]

number

[0082] By repeating the alternating updates shown in equations (9) and (10) a sufficient number of times, a global optimum solution for the objective function can be obtained. However, such multiple updates cause problems such as increased computational costs and an increase in the computational graph of the neural network, which leads to increased learning difficulty (gradient vanishing).

[0083] To address this issue, in this embodiment, the initial values ​​of the matrix A representing the outlier components are also modeled using a neural network.

[0084] Specifically, sample x in S n The initial value a 0n is given in the form of equation (11).

[0085]

number

[0086] v is an arbitrary neural network. v is a model that can obtain an initial value suitable for the target data set S by making it dependent on the vector representation z of the target data set S. W obtained by repeating the update in the previous section I times is called W. * Then, the anomaly detector trained from the target data set S is given by equation (12).

[0087]

number

[0088] Here, we describe a method for training a model using a related dataset. Here, the unlabeled data selected from the related dataset is represented by the symbol S. The training parameters of the proposed model are the parameters of the neural networks f, g, h, and v, and the regularization parameters λ and μ. The objective function is given by Equation (13).

[0089]

number

[0090] where s x represents the anomaly detector (anomaly score function) trained from S by using Equations (3) to (12). In Equation (13), the dataset D t The pseudo-small training data and pseudo-test data obtained by randomly sampling from are denoted by S and Q, respectively. S is unlabeled data, and Q is labeled data. AUC takes a high value when the scores of abnormal samples are higher than those of normal samples. In other words, a high-performance anomaly detector can be trained by maximizing AUC.

[0091] 5 is a diagram for explaining the processing of the learning unit 10. In FIG. 5, pseudocode of the processing of the learning unit 10 is illustrated.

[0092] First, the learning unit 10 sets D as a related data set and generates unlabeled data (pseudo learning data) S (number of samples N S ), labeled data (pseudo test data) Q (number of samples N Q ) (Algorithm 1).

[0093] In the learning phase, the learning unit 10 randomly selects a task t, unlabeled data S, and labeled data Q as samples (lines 2-4 of Algorithm 1).

[0094] The learning unit 10 calculates the vector z from the unlabeled data S using equation (3) (line 5 of Algorithm 1).

[0095] The learning unit 10 calculates the initial value A0 of the matrix A representing the outlier components from the unlabeled data S using equation (11) (sixth line of Aolorithm1).

[0096] The learning unit 10 obtains a globally optimal solution to the objective function (Equation (7)) by alternately repeating the update equations shown in Equation (9) and Equation (10) (lines 7 to 9 of Aolorithm1).

[0097] The learning unit 10 calculates the AUC for the labeled data Q using equation (13) (line 10 of Aolorithm1).

[0098] Based on the calculation result, the learning unit 10 updates the parameters of the model so as to maximize the AUC (Aolorithm1, line 11).

[0099] The detection device according to the present embodiment provides certain improvements over conventional detection methods such as those described in Non-Patent Documents 1 and 2, and represents an advancement in the technical field of anomaly detection performance evaluation.

[0100] [System configuration of the embodiment] Each component of the detection device 1 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the detection device 1 is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0101] Furthermore, all or any part of the processes performed in the detection device 1 may be realized by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed in the detection device 1 may be realized as hardware using wired logic.

[0102] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0103] [program] 6 is a diagram showing an example of a computer in which the detection device 1 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0104] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0105] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the detection device 1 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the detection device 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0106] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0107] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0108] The following additional notes are provided regarding the above-described embodiments.

[0109] (Additional note 1) Memory and at least one processor coupled to said memory; Including, The processor: acquiring unlabeled data and labeled data of an object that is different from the detection object and is related to the detection object as a related data set; The performance of the first anomaly detector trained on the unlabeled data of the related dataset is evaluated on the labeled data of the related dataset, and an anomaly detection learning model for training the first anomaly detector is trained so as to improve the evaluation results. Learning device.

[0110] (Additional note 2) The learning device according to claim 1, When unlabeled data of a detection target, which is a target task, is given, a second anomaly detector corresponding to the target task is trained using the anomaly detection learning model trained by the learning unit, and anomalies are detected in test data of the detection target using the trained second anomaly detector. Learning device.

[0111] (Additional note 3) The learning device according to claim 1, The learning includes: The first anomaly detector is trained by reducing the influence of samples in the unlabeled data of the related dataset that have different properties from other samples. Learning device.

[0112] (Additional note 4) A non-transitory storage medium storing a program executable by a computer to perform a learning process, The learning process includes: acquiring unlabeled data and labeled data of an object that is different from the detection object and is related to the detection object as a related data set; The performance of the first anomaly detector trained on the unlabeled data of the related dataset is evaluated on the labeled data of the related dataset, and an anomaly detection learning model for training the first anomaly detector is trained so as to improve the evaluation results. Non-transitory storage medium.

[0113] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0114] 1. Detection device 10 Learning Department 11 Learning data input section 12,22 Feature Extraction Unit 13 Anomaly detection learning model learning section 14 Storage area 20 Detection unit 21 Data Entry Section 23 Learning and detection unit 24 Detection result output section 141 Anomaly Detection Learning Model

Claims

1. an acquisition unit that acquires unlabeled data and labeled data of an object that is different from the detection object and is related to the detection object as a related data set; a learning unit that evaluates the performance of a first anomaly detector trained on unlabeled data in the related dataset using labeled data in the related dataset, and learns an anomaly detection learning model for training the first anomaly detector so as to improve the evaluation result; A learning device comprising:

2. a detection unit that, when given unlabeled data of a detection target that is a target task, uses the anomaly detection learning model learned by the learning unit to learn a second anomaly detector corresponding to the target task, and performs anomaly detection on test data of the detection target using the learned second anomaly detector; 2. The learning device according to claim 1, further comprising:

3. 2. The learning device according to claim 1, wherein the learning unit trains the first anomaly detector by reducing the influence of samples in the unlabeled data of the related dataset that have properties different from other samples in the learning.

4. A learning method executed by a learning device, acquiring unlabeled data and labeled data of an object that is different from the detection object and that is related to the detection object as an associated data set; a step of evaluating the performance of a first anomaly detector trained on unlabeled data of the related dataset using labeled data of the related dataset, and training an anomaly detection learning model for training the first anomaly detector so as to improve the evaluation result; A learning method comprising:

5. acquiring unlabeled data and labeled data of an object that is different from the detection object and that is related to the detection object as a related data set; a step of evaluating the performance of a first anomaly detector trained on unlabeled data of the related dataset using labeled data of the related dataset, and training an anomaly detection learning model for training the first anomaly detector so as to improve the evaluation result; A learning program that allows a computer to execute the above.

Images