Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

A training data input unit (11) acquires one or more data sets including abnormal data of a task related to a target task of an abnormality detection process, and a range of a false detection rate of each of the data sets. When normal data and a designated range of the false detection rate are input, a model training unit (13) uses the acquired data set and the range of a false detection rate and trains an abnormality detection training model (14a) which outputs an abnormality detector that performs abnormality detection in which pAUC is maximized in the range of a false detection rate.

Description

[Technical Field]

[0001] The present invention relates to an anomaly detection device, an anomaly detection method, and an anomaly detection program. [Background technology]

[0002] In recent years, anomaly detection technology has been used in various fields, such as intrusion detection, medical image diagnosis, and industrial system monitoring, to learn normal patterns from datasets and identify whether given unknown data is anomalous or not.

[0003] In anomaly detection technology, it is important to solve the partial AUC (pAUC) maximization problem, which maximizes the detection rate while keeping the false positive rate below a certain value (see Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Harikrishna Narasimhan, Shivani Agarwal, “A Structural SVM Based Approach for Optimizing Partial AUC”, in ICML, 2013 Summary of the Invention [Problem to be solved by the invention]

[0005] However, conventional techniques can sometimes have difficulty solving the pAUC maximization problem in anomaly detection. For example, the pAUC maximization method requires labeled data for anomalies and normals, so it cannot be used in cases where labeled data for anomalies and normals is unavailable. On the other hand, in anomaly detection, abnormal data is rare, and it can be difficult to collect abnormal data for the target task.

[0006] The present invention has been made in view of the above, and has an object to easily enable learning that maximizes pAUC in anomaly detection. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the object, the anomaly detection device of the present invention is characterized by having: an acquisition unit that acquires one or more datasets including abnormality data of tasks related to a target task that is the target of anomaly detection processing, and a false positive rate range for each dataset; and a learning unit that uses the acquired datasets and false positive rate ranges to train a model that outputs an anomaly detector that performs anomaly detection with maximized pAUC within a specified false positive rate range when normal data and a specified false positive rate range are input. [Effects of the Invention]

[0008] According to the present invention, learning that maximizes pAUC in anomaly detection becomes easily possible. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram for explaining an overview of the anomaly detection device. [Figure 2] FIG. 2 is a diagram for explaining an overview of the anomaly detection device. [Figure 3] FIG. 3 is a schematic diagram illustrating a schematic configuration of the anomaly detection device. [Figure 4] FIG. 4 is a diagram for explaining the processing of the model learning unit. [Figure 5] FIG. 5 is a flowchart showing the learning process procedure. [Figure 6] FIG. 6 is a flowchart showing the procedure of the detection process. [Figure 7] FIG. 7 is a diagram illustrating a computer that executes an anomaly detection program. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited by this embodiment. Also, in the description of the drawings, the same parts are denoted by the same reference numerals.

[0011] [Overview of Anomaly Detection Device] First, FIGS. 1 and 2 are diagrams for explaining the overview of the anomaly detection device. The anomaly detection device uses an anomaly detection model learned to maximize the partial AUC (pAUC) to detect data different from the normal pattern as an anomaly.

[0012] Here, in the anomaly detector s, using the anomaly determination threshold t, for the sample x, it is determined as an anomaly when s(x)>t, and it is determined as normal when s(x)<t. The ROC curve in this case represents the relationship between the false positive rate (FPR) and the true positive rate (TPR) when the anomaly determination threshold t is changed. And the area under the ROC curve shown by the slant lines in FIG. 1(a) is called AUC. AUC is used as a performance index of the anomaly detector.

[0013] Also, the pAUC in the false positive rate range (α,β) means the value obtained by normalizing the area when the range of FPR in AUC is limited to [α,β] as shown by the slant lines in FIG. 1(b). For example, the pAUC when α = 0 and β = 0.1 is an index for evaluating the performance of the anomaly detector when the false positive rate is 0.1 or less.

[0014] In order to obtain an anomaly detector that maximizes pAUC through learning, data with anomaly / normal labels is required as learning data, but anomaly data may be rare and difficult to obtain. Therefore, the anomaly detection device of this embodiment performs learning using a plurality of related data sets including normal data and anomaly data so that it can perform anomaly detection on a data set of a target task with only normal data.

[0015] Here, the related dataset is a dataset of related tasks similar to the dataset of the target task. For example, in a service for multiple users, a dataset of the target task for a specific new user can be exemplified by a dataset of related tasks for other users who have been working for a long time. In this case, it is difficult to collect a dataset containing abnormal data for the new user, but it is possible to collect a dataset containing abnormal data for users who have been working for a long time.

[0016] In this way, the anomaly detection device trains an anomaly detector for a target task by using related datasets including normal and abnormal data for training. Specifically, the anomaly detection device trains to maximize pAUC in [α,β] by inputting a false positive rate range (α,β). For example, as shown in FIG. 2, the anomaly detection device trains using various related datasets (normal datasets 1, 2, 3, ...) and various false positive rate ranges ((a1,b1), (a2,b2), (a3,b3), ...). This enables the anomaly detection device to train an anomaly detection learning model that can generalize to unknown datasets. In other words, by inputting a dataset for the target task and a desired false positive rate range (α',β') into the trained anomaly detection learning model, an anomaly detector that maximizes pAUC in [α',β'] is output.

[0017] [Configuration of anomaly detection device] 3 is a schematic diagram illustrating the general configuration of an anomaly detection device 1 according to this embodiment. The anomaly detection device 1 is implemented by a general-purpose computer such as a workstation or a personal computer, and executes an anomaly detection process, which will be described later.

[0018] As shown in FIG. 3 , the anomaly detection device 1 of this embodiment includes a learning unit 10 that performs learning processing and a detection unit 20 that performs detection processing. The learning unit 10 uses multiple related data sets to learn an anomaly detection learning model 14a that maximizes pAUC within a desired range of false positive rates. The detection unit 20 uses the anomaly detection learning model 14a output by learning from the learning unit 10 to output an anomaly detector that maximizes pAUC within a desired range of false positive rates for data of a target task. The detection unit 20 then uses the output anomaly detector to detect anomalies in the data of the target task. The detection unit 20 may be implemented on the same hardware as the learning unit 10, or on different hardware.

[0019] [Study Department] The learning unit 10 includes a learning data input unit 11, a feature extraction unit 12, a model learning unit 13, and a storage unit 14.

[0020] The learning data input unit 11 is implemented using input devices such as a keyboard and a mouse, and inputs various instruction information to the control unit in response to input operations by an operator. In this embodiment, the learning data input unit 11 functions as an acquisition unit and acquires one or more data sets including anomaly data of tasks related to a target task to be processed for anomaly detection, and a false positive rate range for each data set. As the false positive rate range, a set of predetermined ranges {(a1, b1), (a2, b2), (a3, b3), ...} may be acquired in advance.

[0021] The related data set may be input to the learning unit 10 from an external server device or the like via a communication control unit (not shown) realized by a NIC (Network Interface Card) or the like.

[0022] The control unit is realized using a CPU (Central Processing Unit) that executes a processing program, and functions as a feature extraction unit 12 and a model learning unit 13.

[0023] The feature extraction unit 12 converts each sample of the acquired related data set into a feature vector in preparation for processing by the model learning unit 13, which will be described later. Here, a feature vector is a representation of the features of the required data as an n-dimensional numeric vector. The feature extraction unit 12 performs the conversion into the feature vector using a method commonly used in machine learning. For example, when the data is text, the feature extraction unit 12 can apply a method based on morphological analysis, a method based on n-grams, a method based on delimiters, or the like.

[0024] Model learning unit 13 functions as a learning unit. That is, using the acquired related data set and the false positive rate range, model learning unit 13 learns anomaly detection learning model 14a that outputs an anomaly detector that performs anomaly detection with the pAUC maximized within the specified false positive rate range when normal data and the specified false positive rate range are input.

[0025] Specifically, model learning unit 13 learns anomaly detection learning model 14a using a permutation-invariant neural network. Also, model learning unit 13 learns anomaly detection learning model 14a so as to output an anomaly detector using a differentiable model such as a feedforward neural network. The differentiable model is, for example, an autoencoder or a one-class SVM.

[0026] 4 is a diagram for explaining the processing of the model learning unit 13. In FIG. 4, pseudo code for the processing of the model learning unit 13 is illustrated.

[0027] First, the target dataset S containing only normal data - is expressed by equation (1).

[0028]

number

[0029] Then, it is assumed that T related data sets expressed by the following equation (2) are provided to the model learning unit 13. It is also assumed that the dimension D of the feature vector is the same in all data sets.

[0030]

number

[0031] The purpose here is to detect the target data set S that is not included in the related data set by the anomaly detection unit 23 described later. - The goal is to obtain an anomaly detector that maximizes pAUC in the false positive rate range [α, β] when given a false positive rate range input (α, β).

[0032] The model learning unit 13 generates the anomaly detection learning model 14a by learning. Then, the anomaly detection unit 23, which will be described later, generates the target data set S - and the false positive rate range (α, β), an anomaly detection learning model 14a is used to output an anomaly detector s. In this case, the feature extraction unit 22, which will be described later, outputs S - is converted into a vector expression z shown in the following equation (3).

[0033]

number

[0034] where f and g are arbitrary neural networks. The sum of f is the target dataset S - Since the order of the samples in S does not matter, one vector z is determined for the set S by the above formula (3). Note that the neural network is not particularly limited, and any permutation-invariant neural network such as a "maximum" or set transformer can be applied.

[0035] The anomaly detector s is a function that outputs an anomaly score for the sample x, and is defined by the neural network shown in the following equation (4).

[0036]

number

[0037] The linear weight parameter w(α,β) is defined by another neural network that uses two-dimensional (α,β) as input. This anomaly detector s depends on the vector representation z of the normal data and the false positive rate range (α,β), and therefore its properties change when these values ​​change. In other words, when a new vector representation z of the normal data and a new false positive rate range (α,β) are given, the model training unit 13 aims to output an anomaly detector s that maximizes pAUC within the new false positive rate range (α,β).

[0038] The model learning unit 13 generates an anomaly detection learning model 14a by learning using the related data set. Here, normal data selected from the related data set is referred to as S - The objective function of the anomaly detection learning model 14a is expressed by the following equations (5) and (6). Furthermore, the learning parameters of the anomaly detection learning model 14a are the parameters of the neural models f, g, and w.

[0039]

number

number

[0040] Here, the pAUC in the above formula (5) is a function obtained by replacing the indicator function I of the pAUC in the above formula (6) with a differentiable sigmoid function. - represents normal and abnormal data randomly sampled from the same related dataset. R is a set of false positive rate ranges specified by the user in advance. By optimizing the objective function of the above equations (5) and (6), the normal data S - An anomaly detector s, defined by the parameter (α,β) and the false positive rate range (α,β), is trained to maximize the pAUC calculated by Q. A stochastic gradient method is used for this training.

[0041] Returning to the explanation of Fig. 3, the storage unit 14 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 of this embodiment stores a trained anomaly detection learning model 14a.

[0042] [Detection unit] The detection unit 20 includes a data input unit 21, a feature extraction unit 22, an anomaly detection unit 23, and a result output unit 24.

[0043] The data input unit 21 is realized using input devices such as a keyboard and a mouse, and inputs various instruction information to the control unit and accepts data in response to input operations by an operator. In this embodiment, the data input unit 21 accepts input of a data set of a target task, a user-specified false positive rate range, and test data of the target task that is the target of anomaly detection processing.

[0044] The information may be input to the detection unit 20 from an external server device or the like via a communication control unit (not shown) realized by a NIC or the like. The data input unit 21 may be the same hardware as the learning data input unit 11.

[0045] The control unit is realized using a CPU or the like that executes a processing program, and includes a feature extraction unit 22 and an abnormality detection unit 23.

[0046] Similar to the feature extraction unit 12 of the learning unit 10, the feature extraction unit 22 converts each sample of the acquired target data set into a feature vector in preparation for processing in the anomaly detection unit 23.

[0047] The anomaly detection unit 23 functions as a detection unit. That is, the anomaly detection unit 23 inputs normal data of the target task and a specified false positive rate range into the trained anomaly detection learning model 14a, and detects anomalies in the data of the target task using the output anomaly detector. Specifically, as described above, the anomaly detection unit 23 detects anomalies in the target data set S that is not included in the related data set. - and the false positive rate range input (α,β) are input, and an anomaly detector that maximizes pAUC in the false positive rate range [α,β] is obtained. The anomaly detection unit 23 uses the output anomaly detector to determine whether each test data of the target task is normal or abnormal.

[0048] The result output unit 24 is realized by a display device such as a liquid crystal display, a printing device such as a printer, an information communication device, etc., and outputs the results of the anomaly detection process to the operator. For example, it outputs the determination result of whether the input test data of the target task is normal or abnormal.

[0049] [Abnormality detection processing] 5 and 6, the abnormality detection process by the abnormality detection device 1 will be described. The abnormality detection process by the abnormality detection device 1 includes a learning process by the learning unit 10 and a detection process by the detection unit 20.

[0050] [Learning process] Fig. 5 is a flowchart illustrating a learning process procedure, which starts, for example, when a user performs an operation input to instruct the start of the learning process.

[0051] First, the training data input unit 11 receives input of multiple related datasets, each including normal data and abnormal data, and the range of false positive rates for each dataset (step S1). Next, the feature extraction unit 12 converts each sample from the received related dataset into a feature vector (step S2).

[0052] Next, the model learning unit 13 uses the input related data set and false positive rate range to learn anomaly detection learning model 14a that outputs an anomaly detector that performs anomaly detection with maximized pAUC within the specified false positive rate range when normal data and the specified false positive rate range are input (step S3).

[0053] That is, model learning unit 13 generates anomaly detection learning model 14a through learning using the input related data set and false positive rate range. This anomaly detection learning model 14a outputs an anomaly detector when normal data and a specified false positive rate range are input. The anomaly detector outputs an anomaly score for the input data so as to maximize pAUC within the specified detection rate range.

[0054] Furthermore, the model learning unit 13 stores the learned anomaly detection learning model 14a in the storage unit 14. This completes the series of learning processes.

[0055] [Detection process] Next, Fig. 6 is a flowchart illustrating an example of a detection process procedure. The flowchart in Fig. 6 starts, for example, when a user performs an operation input to instruct the start of estimation process.

[0056] First, the data input unit 21 receives normal data of a target task and a specified false detection rate range (step S11), and the feature extraction unit 22 converts each received sample (normal data) into a feature vector (step S12).

[0057] Next, the anomaly detection unit 23 inputs the normal data of the target task and the specified false positive rate range into the learned anomaly detection learning model 14a, and detects anomalies in the test data of the target task using the output anomaly detector (step S13).

[0058] That is, the anomaly detection unit 23 detects the target data set S that is not included in the related data set. -and the false positive rate range input (α,β) to obtain an anomaly detector that maximizes pAUC in the false positive rate range [α,β]. The anomaly detection unit 23 also inputs test data for the target task to the output anomaly detector and obtains a judgment result as to whether each test data is normal or abnormal.

[0059] Then, the result output unit 24 outputs the abnormality detection result, that is, the result of the determination as to whether the determination is normal or abnormal (step S14), thereby completing the series of detection processes.

[0060] [effect] As described above, in anomaly detection device 1, learning data input unit 11 acquires one or more datasets including abnormal data for tasks related to a target task that is the target of anomaly detection processing, and the false positive rate range for each dataset. Using the acquired datasets and false positive rate ranges, model learning unit 13 trains anomaly detection learning model 14a that, when normal data and a specified false positive rate range are input, outputs an anomaly detector that performs anomaly detection with the pAUC maximized within the specified false positive rate range.

[0061] Specifically, model learning unit 13 learns anomaly detection learning model 14a using a permutation-invariant neural network. Also, model learning unit 13 trains anomaly detection learning model 14a so as to output an anomaly detector using a differentiable model.

[0062] In this way, by training using a related dataset including abnormal data, the anomaly detection device 1 can obtain an anomaly detector that maximizes pAUC within a desired false positive rate range, even when only normal data is available for the target task, and can perform anomaly detection on the data of the target task. Furthermore, once training is performed using the related dataset to generate the anomaly detection learning model 14a, an anomaly detector can be obtained without retraining for any normal dataset. This enables highly accurate anomaly detection without retraining, which requires costly calculations. For example, anomaly detection can be performed even on a low-resource computer, where anomaly detection is generally difficult. In this way, training to maximize pAUC in anomaly detection is easily possible.

[0063] Furthermore, the anomaly detection unit 23 inputs the normal data of the target task and the specified false positive rate range into the trained anomaly detection learning model 14a, and detects anomalies in the test data of the target task using the output anomaly detector. This makes it possible to perform highly accurate anomaly detection that maximizes the pAUC within the desired false positive rate range, even when only normal data is available for the target task.

[0064] [program] A program can be created in which the processing executed by the anomaly detection device 1 according to the above embodiment is written in a computer-executable language. In one embodiment, the anomaly detection device 1 can be implemented by installing an anomaly detection program that executes the above anomaly detection processing as package software or online software on a desired computer. For example, by having an information processing device execute the above anomaly detection program, the information processing device can function as the anomaly detection device 1. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the anomaly detection device 1 may also be implemented on a cloud server.

[0065] 7 is a diagram showing an example of a computer that executes an anomaly detection program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0066] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, a display 1061.

[0067] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored in the hard disk drive 1031 or memory 1010, for example.

[0068] The anomaly detection program is stored in the hard disk drive 1031, for example, as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the anomaly detection device 1 described in the above embodiment is written is stored in the hard disk drive 1031.

[0069] Furthermore, data used for information processing by the anomaly detection program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0070] The program module 1093 and program data 1094 related to the anomaly detection program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the anomaly detection program may be stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0071] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0072] 1. Anomaly detection device 10 Learning Department 11 Learning data input section 12 Feature Extraction Unit 13 Model Learning Section 14 Storage area 14a Anomaly detection learning model 20 Detection unit 21 Data Entry Section 22 Feature Extraction Unit 23 Abnormality detection unit 24 Result output section

Claims

1. an acquisition unit that acquires one or more datasets including anomaly data of tasks related to a target task that is the target of anomaly detection processing, and a false positive rate range for each dataset; a learning unit that uses the acquired data set and the false positive rate range to learn a model that outputs an anomaly detector that performs anomaly detection with a maximized pAUC within a specified false positive rate range when normal data and a specified false positive rate range are input; An anomaly detection device comprising:

2. 2. The anomaly detection device according to claim 1, further comprising a detection unit that inputs normal data of the target task and a specified false positive rate range into the trained model and detects anomalies in the data of the target task using the output anomaly detector.

3. 2. The anomaly detection device according to claim 1, wherein the learning unit learns the model using a permutation-invariant neural network.

4. 2. The anomaly detection device according to claim 1, wherein the learning unit learns the model so as to output the anomaly detector using a differentiable model.

5. An anomaly detection method executed by an anomaly detection device, an acquisition step of acquiring one or more datasets including anomaly data of a task related to a target task for which anomaly detection is to be performed, and a false positive rate range for each dataset; a learning process for learning a model that outputs an anomaly detector that detects anomalies with a maximized pAUC within a specified false positive rate range when normal data and the specified false positive rate range are input, using the acquired data set and the specified false positive rate range; An anomaly detection method comprising:

6. On the computer, an acquisition step of acquiring one or more datasets including anomaly data of a task related to a target task for which anomaly detection is to be performed, and a false positive rate range for each dataset; a learning step of using the acquired dataset and the specified false positive rate range to learn a model that outputs an anomaly detector that performs anomaly detection with maximizing pAUC within the specified false positive rate range when normal data and the specified false positive rate range are input; An anomaly detection program characterized by executing the above.

Images