Abnormality management device and abnormality management method

Abstract

The object is to manage signal abnormalities even when there is little measurement data of the abnormal signal. [Solution] The abnormality management device 1 includes a learning unit 12 that uses the characteristic directions of normal data as training data to learn, by maximum likelihood estimation, parameters of a probability model that outputs the posterior probability that the intensity of each frequency component corresponding to each of the characteristic directions of the normal data is normal; a derivation unit 13 that derives a probability distribution for the characteristic directions of abnormal data that shows abnormal intensities of frequency components that deviate from a normal intensity range, based on the posterior probability estimated by the probability model learned by the learning unit 12, the probability distribution for the characteristic directions of the normal data, and the prior probability of normality; and a calculation unit 14 that calculates a first index value that indicates the degree of spatial agreement formed by the probability distribution for the characteristic directions of the abnormal data derived by the derivation unit 13 and the probability distribution for the characteristic directions of the normal data.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] Conventionally, there have been known techniques for analyzing the characteristics of a time-series signal in the frequency domain and detecting anomalies contained in the signal. For example, Patent Document 1 discloses a technique for estimating anomalies in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of both normal and abnormal signals as training data.

[0003] However, in the technology disclosed in Patent Document 1, in order to construct a model with sufficient accuracy for detecting anomalies, it is necessary to obtain a sufficient number of anomalous signals, and the anomalous signals must be accumulated over a long period of time. Furthermore, even when detecting signal anomalies in the frequency spectrum using statistical methods, a large amount of measurement data of anomalous signals may be required. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-027386 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, according to the conventional technology, it may be difficult to manage signal abnormalities when there is little measurement data of the abnormal signal.

[0006] The present invention has been made to solve the above-mentioned problems, and has an object to manage signal abnormalities even when there is little measurement data of the abnormal signal. [Means for solving the problem]

[0007] In order to solve the above-described problems, an anomaly management device according to the present invention includes: a feature extraction unit configured to extract characteristic directions of normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal intensities for each frequency component included in a frequency spectrum of a normal signal observed at each time; a learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the intensities of each frequency component corresponding to each of the characteristic directions of the normal data are normal, using the characteristic directions of the normal data extracted by the feature extraction unit as training data; a derivation unit configured to derive a probability distribution for characteristic directions of abnormal data that indicate abnormal intensities of frequency components that deviate from the normal intensity range, based on the posterior probability estimated by the probability model learned by the learning unit, a probability distribution for the characteristic directions of the normal data, and a prior probability of normality; a calculation unit configured to calculate a first index value that indicates a spatial coincidence formed by the probability distribution for the characteristic directions of the abnormal data derived by the derivation unit and the probability distribution for the characteristic directions of the normal data; and a setting unit configured to set the first index value calculated by the calculation unit as a threshold for anomaly determination of a signal including the abnormal intensities.

[0008] Moreover, the abnormality management device according to the present invention may further include a collection unit configured to collect a first frequency spectrum of a signal to be managed observed at a first time and a second frequency spectrum of the signal to be managed observed at a second time after the first time, wherein the feature extraction unit extracts a characteristic direction of the first frequency spectrum and a characteristic direction of the second frequency spectrum based on a first data matrix constituted by observation vectors representing the intensity of each frequency component included in the first frequency spectrum and a second data matrix constituted by observation vectors representing the intensity of each frequency component included in the second frequency spectrum, respectively, the calculation unit calculates a second index value indicating a spatial coincidence formed between the extracted characteristic direction of the first frequency spectrum and the extracted characteristic direction of the second frequency spectrum, and a determination unit configured to determine that an abnormality has occurred in the signal to be managed at that time when the second index value calculated by the calculation unit exceeds the threshold value.

[0009] In addition, the abnormality management device of the present invention may further include a notification unit configured to notify the occurrence of an abnormality when the judgment unit determines that an abnormality has occurred in the signal of the managed object.

[0010] In addition, in the abnormality management device according to the present invention, the feature extraction unit may extract a transformation matrix of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix.

[0011] In order to solve the above-described problems, an anomaly management method according to the present invention includes a feature extraction step of extracting a characteristic direction of normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal intensities for each frequency component contained in a frequency spectrum of a normal signal observed at each time point; a learning step of using the characteristic directions of the normal data extracted in the feature extraction step as training data and learning, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the intensity of each frequency component corresponding to each of the characteristic directions of the normal data is normal; a derivation step of deriving a probability distribution for a characteristic direction of abnormal data indicating abnormal intensities of frequency components that deviate from the normal intensity range, based on the posterior probability estimated by the probability model learned in the learning step, a probability distribution for the characteristic direction of the normal data, and a prior probability of normality; a calculation step of calculating a first index value that indicates a spatial coincidence formed by the probability distribution for the characteristic direction of the abnormal data derived in the derivation step and the probability distribution for the feature direction of the normal data; and a setting step of setting the first index value calculated in the calculation step as a threshold for anomaly determination of a signal including the abnormal intensities.

[0012] Furthermore, the anomaly management method according to the present invention may further include a collection step of collecting a first frequency spectrum of a signal to be managed observed at a first time point and a second frequency spectrum of the signal to be managed observed at a second time point after the first time point, wherein the feature extraction step extracts a characteristic direction of the first frequency spectrum and a characteristic direction of the second frequency spectrum based on a first data matrix constituted by observation vectors representing the intensity of each frequency component included in the first frequency spectrum and a second data matrix constituted by observation vectors representing the intensity of each frequency component included in the second frequency spectrum, respectively, and the calculation step calculates a second index value indicating a spatial coincidence formed between the extracted characteristic direction of the first frequency spectrum and the extracted characteristic direction of the second frequency spectrum, and further includes a determination step of determining that an anomaly has occurred in the signal to be managed at the second time point if the second index value calculated in the calculation step exceeds the threshold value.

[0013] Furthermore, the abnormality management method according to the present invention may further include a notification step of issuing a notification indicating the occurrence of an abnormality when it is determined in the determination step that an abnormality has occurred in the signal of the managed object.

[0014] In addition, in the anomaly management method according to the present invention, the feature extraction step may extract a transformation matrix of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix. [Effects of the Invention]

[0015] According to the present invention, a first index value indicating the spatial degree of coincidence formed between the probability distribution for the characteristic direction of the abnormal data derived by the derivation unit and the probability distribution for the characteristic direction of the normal data is set as a threshold value for determining an abnormality in a signal containing an abnormal intensity. Therefore, even when there is little measurement data of the abnormal signal, it is possible to manage the abnormality of the signal. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining abnormal data of signals managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining the operation of the feature extraction unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the learning unit and the derivation unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0018] The anomaly management system includes an anomaly management device 1 and a communication terminal 2. The anomaly management device 1 and the communication terminal 2 are connected via a network NW. The anomaly management system according to this embodiment extracts the characteristic direction of normal data, derives the probability distribution of abnormal data based on the probability distribution of normal data estimated by learning a probabilistic model, and sets the maximum singular value based on the probability distribution of normal data and abnormal data as a threshold for determining an anomaly in a signal containing abnormal intensity.

[0019] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0020] The communication terminal 2 can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, or the like. In this embodiment, there are n (n is a positive integer of 2 or more) communication terminals 2. The communication terminals 2 include terminals compatible with a mobile communication network that have a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as an International Mobile Subscriber Identity (IMSI).

[0021] The communication terminal 2 also includes a terminal having an IP address and configured as an IoT terminal. The communication terminal 2 is equipped with a mobile communication module and various sensors, and is capable of detecting various physical quantities and measuring them as electrical signals. The communication terminal 2 transmits the measured signals to a gateway or the like (not shown) or to the abnormality management device 1 via the network NW. In this embodiment, as an example, the signals to be subject to abnormality management are the reception level and signal strength of signals received from base stations, which are periodically measured and recorded by the communication terminal 2 using the mobile communication module.

[0022] As shown in area 2a of FIG. 1, communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of an abnormality in signal strength from the waveform data of signal strength shown in area 2a. Therefore, an abnormality management device 1 (described later) converts the time-series data of signal strength into a spectrum in the frequency domain and analyzes the frequency components to detect an abnormality in the signal.

[0023] FIG. 2 is a diagram illustrating abnormal data showing a frequency spectrum containing frequency components of abnormal intensity. In FIG. 2, the horizontal axis represents frequency and the vertical axis represents intensity. Curve a1 represents a frequency spectrum in which the intensity of each frequency component of a signal measured by one communication terminal 2 is normal, while curve b1 represents a frequency spectrum in which the intensity of each frequency component of a signal measured by another communication terminal 2 is normal and contains frequency components of abnormal intensity. Frequency spectrum b1 contains an intensity peak in section c on the frequency axis that is not present in normal frequency spectrum a1, and contains abnormal intensity. Therefore, an abnormality has occurred in the signal having frequency spectrum b1.

[0024] A communication terminal 2 that has measured a signal related to a frequency spectrum containing such an abnormally strong frequency component is experiencing a problem with its hardware or settings, or a problem with the reception environment. For example, there may be a malfunction in the communication module of the communication terminal 2, a bug or incorrect settings in the measurement software, or the influence of an internal noise source. Therefore, it is assumed that a malfunction has occurred in a communication terminal 2 that has measured a signal related to a frequency spectrum containing an abnormally strong frequency component.

[0025] [Function block of the abnormality management device] Next, functional blocks of the fault management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the fault management device 1 includes a collection unit 10, a feature extraction unit 11, a learning unit 12, a derivation unit 13, a calculation unit 14, a setting unit 15, a determination unit 16, a notification unit 17, and a storage unit 18.

[0026] The collection unit 10 collects, via the network NW, the normal intensity of each frequency component contained in the frequency spectrum of a normal signal measured at each of the multiple communication terminals 2 and observed at each time. The collection unit 10 collects time-series data of the signal measured at each of the multiple communication terminals 2, and performs a Fourier transform on the signal on the collection unit 10 side to obtain the frequency spectrum. The signal time-series data and its frequency spectrum are associated with identification information of the communication terminal 2 that measured the signal. The frequency spectrum of the signal collected by the collection unit 10 has a set number of frequency components, for example, 1,000. "Intensity" is a concept that includes the amplitude and power of each frequency component, or physical quantities corresponding to these, and also includes aspects in which a voltage value is used as intensity.

[0027] The collection unit 10 collects frequency spectra containing frequency components of normal intensity above a certain level and passes them to the feature extraction unit 11. The collection unit 10 also collects frequency spectra including the intensity of each frequency component of the signal of the management target, which is the target of abnormality determination by the determination unit 16. More specifically, the collection unit 10 collects a first frequency spectrum of the signal of the management target observed at a first time and a second frequency spectrum of the signal of the management target observed at a second time after the first time. The signal of the management target observed at each time is the same signal measured by a single communication terminal 2. The collection unit 10 can collect time series data of the measurement signal from each communication terminal 2 via the network NW or frequency spectra converted from this, as well as time series data of the measurement signal from each communication terminal 2 collected by network devices (e.g., routers and access points) and convert it into frequency spectra.

[0028] The feature extraction unit 11 extracts the feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal intensities for each frequency component included in the frequency spectrum of a normal signal. More specifically, the feature extraction unit 11 extracts a transformation matrix U of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix composed of a plurality of observation vectors representing the normal data. Each normal data is data indicating the intensity for each of M frequency components.

[0029] The feature extraction unit 11 also extracts feature directions of the first frequency spectrum and the second frequency spectrum based on a first data matrix composed of observation vectors representing the intensities of each frequency component included in the first frequency spectrum and a second data matrix composed of observation vectors representing the intensities of each frequency component included in the second frequency spectrum. The first frequency spectrum and the second frequency spectrum each include intensities of M frequency components. The feature extraction unit 11 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first frequency spectrum including a group of orthonormal basis vectors as the feature direction of the first frequency spectrum. Similarly, the feature extraction unit 11 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second frequency spectrum including a group of orthonormal basis vectors as the feature direction of the second frequency spectrum.

[0030] 3 is a diagram for explaining the feature directions of normal data extracted by the feature extraction unit 11. Data points f1 to f2 shown by white circles in FIG. N indicates the intensity observed at each frequency component collected by the collecting unit 10, and here, a normal intensity frequency spectrum is shown. Therefore, the intensity observed at the nth frequency component is expressed as f nThe feature extraction unit 11 uses a sliding window with a window width of M to convert a frequency spectrum containing the intensities of normal frequency components into a set of M-dimensional vectors indicated by the arrows of each window into multiple observation vectors. The frequency spectrum consisting of observed values ​​of the intensities of frequency components with length L is expressed as L=N-M+1.

[0031] The observation vector, which is the frequency spectrum of a subsequence of length M sequentially extracted by the feature extraction unit 11 from a frequency spectrum containing normal intensity by moving a sliding window from left to right, is expressed by the following equation (1). Also, as mentioned above, the observation vector is expressed as L=N-M+1, and the observation vector expressed by the following equation (1) is created for each time.

number

[0032] Here, the data matrix X=[x (1) ,…,x (L) ] (an M×L-dimensional real-valued matrix), consider the linear combination Xν of the following equation (2).

number

[0033] From the above equation (2), ν T Under the constraint ν=1, ||Xν|| 2 This can be achieved by introducing the Lagrangian function of the following equation (3) obtained using the multiplier γ.

number

[0034] In order for the above equation (3) to be maximized, 2X differentiated with respect to the vector ν T The value of Xν-2γν is 0. Therefore, the following conditional expression (4) is obtained.

number

[0035] From the above equation (4), X T It can be seen that the eigenvalue of X is γ and the eigenvector is ν. Furthermore, the vector μ is defined by the following equation (5).

number

[0036] Using the above equations (5) and (4), the relationship shown in the following equation (6) can be found.

number

[0037] Furthermore, multiplying both sides of the above equation (4) by X and using the above equation (5) yields the following relational equation (7).

number

[0038] By applying the above equation (5) to the above equation (7), the following relational expression (8) is obtained.

number

[0039] Here, U and V are set as follows:

number

[0040] The above equation (9) can be expressed as the following equation (10).

number

[0041] U is an orthogonal matrix, and U T By multiplying and transposing both sides of the above equation (10), the relationship of the following equation (11) is obtained.

number

[0042] The above equation (11) is called the singular value decomposition of X. Let U be the left singular vector, V be the right singular vector, and Γ 1 / 2 are called singular values. That is, U is a transformation matrix that represents the feature direction, which is the main direction or pattern of normal data. V represents the axis transformation, which is the direction to which the vector is projected. Γ represents the importance of each feature direction.

[0043] The matrix U of left singular vectors is expressed by the following equation (12).

number

[0044] For example, if there are 10,000 normal data sets, that is, M=1000, indicating the intensities of 1,000 frequency components, then 10,000 left singular vectors U are obtained. Each component vector μ of the left singular vector U in the normal data is xx The probability distribution of is obtained by the learning unit 12 using the maximum likelihood estimation method.

[0045] The learning unit 12 uses the feature directions of the normal data extracted by the feature extraction unit 11 as training data to learn, by maximum likelihood estimation, parameters of a probability model that outputs the posterior probability that the intensity of each frequency component corresponding to each feature direction of the normal data is normal. In a situation where there is little abnormal data, the learning unit 12 learns the probability model by maximum likelihood estimation using the feature directions of the normal data.

[0046] Here, each element μ of the matrix of the left singular vector U xx Let x be the intensity of a frequency component at a certain observation point (μ xx = x). In addition, the density function of normal data is expressed as ρ d (μ xx ), and the density function of the abnormal data is ρ g (μ xx ) are defined as follows:d (μ xx )=ρ d (x), ρ g (μ xx )=ρ g (x).

number

[0047] In the above equation (13), y=1 indicates the normal class, and y=0 indicates the abnormal class. d (μ xx ) is the intensity μ when it belongs to the normal class y=1 xx shows the tendency of appearance of ρ g (x) is the strength μ when it belongs to the abnormal class y=0 xx The probability distribution of both normal and abnormal data follows a normal distribution.

[0048] The density ratio γ(μ xx ) is expressed by the following equation (14).

number

[0049]

number

[0050] Here, if π=ρ(y=1), the above equation (15) can be further expressed as the following equation (16).

number

[0051] Therefore, first, the observed value μ xx The posterior probability ρ(y=1|μ xx ) is calculated. Observed value μ xx If there is a large amount of xx )≒ρ(μ xx |y=1) can be approximated. In other words, the posterior probability ρ(y=1|μ xx ) can be estimated. For the sake of explanation, we will use the observed value μ xx is denoted as x. At an observation point x n Assuming that the normal distribution is assumed, it is defined as shown in the following equation (17).

number

[0052] Furthermore, the output of the probabilistic model f(x n ) can be expressed as a linear combination as shown in the following equation (18).

number

[0053]

number

[0054]

number

[0055] Furthermore, the strength f(x n ) and the actual normal intensity t n The average error from the (teacher signal) is the variance σ of the normal distribution shown in the following equation (21). 2 The value becomes

number

[0056] In this way, when a linear combination of probability models estimates the posterior probability that the intensity is normal for an input x, each observation t is calculated based on the estimated value f(x n ) is assumed to follow a normal distribution with mean x n ,t n ) by maximum likelihood estimation, we can obtain the parameters w and error variance σ of the probability model. 2 Estimate.

[0057] 4 is a diagram for explaining the configuration of the learning unit 12 and the derivation unit 13. As shown in FIG. xx Therefore, the learning unit 12 calculates each component μ of the matrix U of left singular vectors obtained by performing singular value decomposition on the data matrix of normal data. xx Probability distribution ρ for d (μ xx ) is calculated. If there is a matrix U of 10,000 left singular vectors, each component μ xx Ten thousand normal probability distributions are calculated. The learning unit 12 calculates the components μ xx As described above, there are as many matrices U of left singular vectors as there are normal data. Therefore, the learning unit 12 performs maximum likelihood estimation the number of times corresponding to the number of matrices U of left singular vectors.

[0058] Here, again μ xx By expressing x as the normal data posterior probability ρ(y=1|x), we can approximately estimate ρ(y=1|x)≒q w The relationship is (y=1|x). The estimated posterior probability that the input intensity x is normal is q w Based on (y=1|x), the cross entropy is defined as the loss function L as shown in the following equation (22).

number

[0059] The convergence value (minimum value) of the loss function L in the above equation (22) is expressed by the following equation (23).

number

[0060] The derivation unit 13 transforms the above equation (23) into the following equation (24), and calculates the density function ρ g Derive (x).

number

[0061] x to μ xx When substituted, the above equation (24) becomes the following equation (25).

number

[0062] In the above equation (25), the probability distribution of normal data, i.e., the density function of normal data, ρ d (μ xx ) is calculated from the normal data collected by the collection unit 10. The prior probability π of normal data is much larger than the prior probability (1-π) of abnormal data, so it can be set to, for example, 0.99. Furthermore, the observed value μ xx For (=x), the log likelihood lnq when y=1 w (y=1|μ xx ) is calculated by maximum likelihood estimation based on a large amount of normal data (teacher signal), as shown in the above equations (18) to (21). In this way, even if there is a small amount of abnormal data, the probability distribution of abnormal data can be calculated from the normal data.

[0063] The derivation unit 13 calculates the estimated value q of the posterior probability of normal data estimated by the probability model learned by the learning unit 12. w (y=1|μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) and the prior probability of normality π, the density function ρ for the feature direction of the abnormal data that indicates abnormal intensities of frequency components outside the normal intensity range is calculated. g (μ xx) is derived. As mentioned above, the posterior probability estimate of normal data, q w (y=1|μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) is normally distributed, the density function ρ g (μ xx ) is also normally distributed.

[0064] The derivation unit 13 calculates the estimated value q of the posterior probability of normal data. w (y=1|μ xx ) (for example, 10,000) and the same number of abnormal data density functions ρ g (μ xx ) of the density function ρ g (μ xx ) is the sum of the anomalous data density function ρ g (μ xx ) is the final solution. Also, the density function ρ of normal data that is normally distributed is d (μ xx ) is the density function ρ d (μ xx ) is the final solution.

[0065] Here, the density function ρ for the feature direction of normal data is d (μ xx ) and the density function ρ for the feature direction of the abnormal data g (μ xx ) are expressed by the following matrix (26).

number

[0066] The calculation unit 14 calculates the density function ρ g (μ xx ) (probability distribution) and the density function ρ for the feature direction of normal data d (μ xx) (probability distribution) for the characteristic direction of the abnormal data. g (μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) as the first index value. Specifically, the calculation unit 14 calculates the maximum singular value of the matrix formed based on the matrix 2-norm ∥ρ d (μ xx ) T ρ g (μ xx )||2 is calculated as the first index value.

[0067]

number

[0068] The sum of the vector components of each column in the above equation (27) is S1, ,S M Then, the matrix 2-norm is calculated by the following equation (28).

number

[0069] The calculation unit 14 also calculates a second index value indicating the degree of spatial coincidence formed between the feature direction of the first frequency spectrum of the signal to be managed and the feature direction of the second frequency spectrum extracted by the feature extraction unit 11. More specifically, the calculation unit 14 calculates, as the second index value, the matrix 2 norm of the transposed matrix U1 of the left singular vectors of the first frequency spectrum and the matrix U2 of the left singular vectors of the second frequency spectrum.

[0070] The setting unit 15 sets the first index value calculated by the calculation unit 14 as a threshold value for determining abnormality of a signal having an abnormal intensity.

[0071] If the second index value calculated by the calculation unit 14 exceeds the threshold value, the determination unit 16 determines that an abnormality has occurred in the signal to be managed in the second section.

[0072] When the determining unit 16 determines that an abnormality has occurred in the signal, the notifying unit 17 notifies the user that an abnormality has occurred in the signal being managed. The notifying unit 17 can send an alarm to an external management server. Alternatively, the notifying unit 17 may send a notification via the network NW to the communication terminal 2 in which the abnormality has been detected.

[0073] The storage unit 18 stores the threshold value set by the setting unit 15.

[0074] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0075] 5, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0076] The processor 102 is realized by a general-purpose processor such as a CPU or a GPU, or by dedicated hardware such as an FPGA or an ASIC.

[0077] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, feature extraction unit 11, learning unit 12, derivation unit 13, calculation unit 14, setting unit 15, determination unit 16, and notification unit 17 shown in FIG.

[0078] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0079] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a hard disk or semiconductor memory such as a flash memory as the storage medium.

[0080] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a feature extraction program for extracting characteristic directions of normal data using the subspace method executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a learning program for a probability model executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 18 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0081] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0082] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display the frequency spectrum of the observation data on a screen.

[0083] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0084] 6, first, the collection unit 10 collects a plurality of frequency spectra containing a certain amount or more of normal data (step S1). The collection unit 10 collects a plurality of frequency spectra in which, for example, 99% or more of the data is normal. The collection unit 10 can collect the frequency spectra of signals measured by each communication terminal 2 via the network NW.

[0085] Next, the feature extraction unit 11 extracts the feature directions of the normal data based on a data matrix composed of a plurality of observation vectors representing the normal data (step S2). The feature extraction unit 11 first extracts the data matrix X=[x (1) ,…,x (L) ] (an M×L-dimensional real-valued matrix). Specifically, in step S2, the feature extraction unit 11 extracts multiple observation vectors in the frequency spectrum of the subsequence by shifting a sliding window with a window width of M for each frequency component of the frequency spectrum of the normal data, as shown in FIG. 3. Furthermore, the feature extraction unit 11 performs singular value decomposition on the time-unit data matrix X that compiles the observation vectors expressed by the above formula (1), and extracts the transformation matrix U expressed by the above formulas (11) and (12). In step S2, for example, if there are 10,000 normal data pieces with intensities of 1,000 frequency components (M=1,000), 10,000 transformation matrices U are calculated.

[0086] Next, the learning unit 12 uses the feature directions of the normal data extracted by the feature extraction unit 11 in step S2 as training data to learn parameters of a probability model that outputs the posterior probability that the intensity of each frequency component corresponding to each of the feature directions of the normal data is normal by maximum likelihood estimation (step S3).After that, the derivation unit 13 derives a probability distribution for the feature directions of the abnormal data, which indicates an abnormal intensity of a frequency component that deviates from a normal intensity range, based on the posterior probability of the normal data estimated by the probability model learned by the learning unit 12 in step S3, the probability distribution for the feature directions of the normal data, and the prior probability of normality (step S4).

[0087] 7 is a flowchart illustrating steps S3 and S4 in more detail. As shown in step S30 of FIG. 7, the learning unit 12 uses the transformation matrix U of the normal data obtained in step S2 as training data, and calculates the components μ xx For each, intensity μ xx The posterior probability estimate q is normal w (y=1|μ xx) parameters w,σ of the probabilistic model that outputs 2 is learned by maximum likelihood estimation (step S30). If there are 10,000 transformation matrices U of normal data, 10,000 estimated values ​​q w (y=1|μ xx ) is obtained. In step S30, the learning unit 12 performs learning by maximum likelihood estimation in accordance with the above equations (18) to (21).

[0088] Furthermore, the learning unit 12 calculates the components μ of the transformation matrix U of the normal data. xx The normal intensity of each frequency component μ xx Based on the normal data density function ρ d (μ xx ) (normal distribution) is estimated (step S31). In step S31, as shown in FIG. 4, maximum likelihood estimation is performed for each column vector of the transformation matrix U, and each component μ xx The density function ρ of normal data for d (μ xx In step S31, maximum likelihood estimation is performed for each of the multiple transformation matrices U.

[0089] Next, the derivation unit 13 adds the log likelihood lnq of the posterior probability calculated in step S30 to the above equation (25). w (y=1|μ xx ), the density function ρ of the normal data obtained in step S31 d (μ xx ), and the prior probability of normal data π (e.g., 0.99) to obtain the density function ρ of the abnormal data. g (μ xx ) is derived (step S33). The density function ρ g (μ xx ) is calculated by the log likelihood lnq w (y=1|μ xx ) is the same number as the number of

[0090] Thereafter, the process proceeds to step S5 in Fig. 6. Subsequently, in step S4, the calculation unit 14 calculates the density function ρ g (μ xx) (probability distribution) and the density function ρ for the feature direction of normal data d (μ xx ) (probability distribution) for the characteristic direction of the abnormal data is calculated (step S5). g (μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) is the maximum singular value of the matrix constructed based on the matrix 2-norm ||ρ d (μ xx ) T ρ g (μ xx )||2 is calculated as the first index value.

[0091] Next, the setting unit 15 sets the matrix 2-norm calculated in step S5 as a threshold for determining abnormality in a signal containing abnormal intensities of frequency components (step S6). Thereafter, the collection unit 10 collects the frequency spectrum of the signal to be managed (step S7). Specifically, as shown in FIG. 8, the collection unit 10 collects the frequency spectrum of the signal to be managed measured at the first time (time T1) from frequency components f1 to f M Furthermore, the collecting unit 10 collects a first frequency spectrum including the intensities of frequency components f1 to f2 of the signal to be managed measured at a second time (time T2) immediately after the first time (time T1). M Collect a second frequency spectrum containing intensities up to

[0092] Next, the feature extraction unit 11 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first frequency spectrum, which includes a group of orthonormal basis vectors, as the feature direction of the first frequency spectrum. Similarly, the feature extraction unit 11 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second frequency spectrum, which includes a group of orthonormal basis vectors, as the feature direction of the second frequency spectrum (step S8). Here, as shown in "step S8" in FIG. 8, the feature extraction unit 11 performs singular value decomposition on the first data matrix and the second data matrix at the first time (time T1) and the second time (time T2), respectively. Furthermore, FIG. 8 shows that the transformation matrices U1 and U2 are extracted as matrices of left singular vectors. In this way, the feature extraction unit 11 performs singular value decomposition on the data matrix of the frequency spectrum of the signal to be managed, observed at two adjacent times, to extract the transformation matrices U1 and U2.

[0093] Next, the calculation unit 14 calculates a second index value indicating the degree of spatial coincidence formed between the feature direction of the first frequency spectrum observed at the first time (time T1) extracted in step S8 and the feature direction of the second frequency spectrum observed at the second time (time T2) (step S9). The calculation unit 14 calculates the maximum singular value, i.e., the matrix 2-norm ||U1 T U2∥2 is calculated as the second index value (“Step S9” in FIG. 8).

[0094] Next, in step S9, if the second index value calculated by the calculation unit 14 exceeds the threshold value set in step S6, the determination unit 16 determines that a signal abnormality has occurred at the second time (step S10). As shown in Fig. 8, adjacent times T1 and T2 are set as the first and second times, and steps S7 to S10 are executed, and then adjacent times T2 and T3, which are shifted by one time, are set as the first and second times, and steps S7 to S10 are executed, and further adjacent times T3 and T4, which are shifted by one time, are set as the first and second times, and the processing from step S7 to step S10 (steps S8' to S10' in Fig. 8) is repeated each time.

[0095] Next, the notification unit 16 notifies an external management server or the like that an abnormality has occurred in the communication terminal 2 that measured the signal in which it was determined that an abnormality has occurred (step S11).

[0096] As described above, the anomaly management device 1 according to this embodiment performs singular value decomposition on the data matrix of normal data using the subspace method, and estimates the posterior probability that the intensity is normal by learning the parameters of a probabilistic model that outputs the posterior probability that the intensity is normal using maximum likelihood estimation with the matrix U of the obtained left singular vectors as training data. Furthermore, the device derives a density function for abnormal data based on the estimated posterior probability, the density function for normal data, and the prior probability of normal data. Furthermore, the maximum singular value of the matrix of the derived density function for the abnormal data and the density function for normal data is set as a threshold for determining an anomaly for signals containing abnormal intensities. Therefore, the object is to manage signal anomalies even when there is little measurement data for the abnormal signal.

[0097] In the embodiment described above, the anomaly management system has been described as a system conforming to the 5G standard, but the communication standard may be 3G, 4G / LTE, 6G, etc. Furthermore, the anomaly management system is not limited to a mobile communication network, and may be a network using a fixed line as described above. In this case, the anomaly management system may be configured to collect measurement signals from the communication terminal 2 via a wireless router or a wireless access point.

[0098] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0099] 1...abnormality management device, 2...communication terminal, 3...base station, 4...core network, 10...collection unit, 11...feature extraction unit, 12...learning unit, 13...derivation unit, 14...calculation unit, 15...setting unit, 16...judgment unit, 17...notification unit, 18...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, NW...network.

Claims

1. a feature extraction unit configured to extract a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal intensities for each frequency component included in a frequency spectrum of a normal signal observed at each time; a learning unit configured to learn, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the intensity of each frequency component corresponding to each of the feature directions of the normal data is normal, using the feature directions of the normal data extracted by the feature extraction unit as training data; and a derivation unit configured to derive a probability distribution for a feature direction of abnormal data that indicates an abnormal intensity of a frequency component that deviates from the normal intensity range, based on the posterior probability estimated by the probability model learned by the learning unit, a probability distribution for the feature direction of the normal data, and a prior probability of normality; a calculation unit configured to calculate a first index value indicating a spatial degree of coincidence formed between the probability distribution for the characteristic direction of the abnormal data derived by the derivation unit and the probability distribution for the characteristic direction of the normal data; a setting unit configured to set the first index value calculated by the calculation unit as a threshold value for determining abnormality of the signal including the abnormal intensity; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, further comprising a collection unit configured to collect a first frequency spectrum of the signal under management observed at a first time and a second frequency spectrum of the signal under management observed at a second time after the first time; the feature extraction unit extracts a feature direction of the first frequency spectrum and a feature direction of the second frequency spectrum based on a first data matrix configured from observation vectors representing intensities of respective frequency components included in the first frequency spectrum and a second data matrix configured from observation vectors representing intensities of respective frequency components included in the second frequency spectrum, the calculation unit calculates a second index value indicating a degree of spatial coincidence between the extracted characteristic direction of the first frequency spectrum and the extracted characteristic direction of the second frequency spectrum; The signal processing device further includes a determination unit configured to determine that an abnormality has occurred in the signal to be managed at the second time when the second index value calculated by the calculation unit exceeds the threshold value. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, Further, a notification unit configured to notify the occurrence of an abnormality when the determination unit determines that an abnormality has occurred in the signal to be managed. An abnormality management device characterized by:

4. 2. The abnormality management device according to claim 1, The feature extraction unit extracts a transformation matrix of the normal data including a group of orthonormal basis vectors as a feature direction of the normal data by performing singular value decomposition on the data matrix. An abnormality management device characterized by:

5. a feature extraction step of extracting a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating normal intensities for each frequency component included in the frequency spectrum of a normal signal observed at each time; a learning step of learning, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the intensity of each frequency component corresponding to each of the feature directions of the normal data is normal, using the feature directions of the normal data extracted in the feature extraction step as training data; a derivation step of deriving a probability distribution for a feature direction of abnormal data that indicates an abnormal intensity of a frequency component that deviates from the normal intensity range, based on the posterior probability estimated by the probability model learned in the learning step, a probability distribution for the feature direction of the normal data, and a prior probability of normality; a calculation step of calculating a first index value indicating a spatial degree of coincidence formed between the probability distribution for the characteristic direction of the abnormal data derived in the derivation step and the probability distribution for the characteristic direction of the normal data; a setting step of setting the first index value calculated in the calculation step as a threshold value for determining abnormality of the signal including the abnormal intensity; An abnormality management method comprising:

6. 6. The abnormality management method according to claim 5, further comprising a collecting step of collecting a first frequency spectrum of the signal under management observed at a first time and a second frequency spectrum of the signal under management observed at a second time after the first time, the feature extraction step extracts a feature direction of the first frequency spectrum and a feature direction of the second frequency spectrum based on a first data matrix configured from an observation vector representing an intensity of each frequency component included in the first frequency spectrum and a second data matrix configured from an observation vector representing an intensity of each frequency component included in the second frequency spectrum, the calculating step calculates a second index value indicating a degree of spatial coincidence formed between the extracted characteristic direction of the first frequency spectrum and the extracted characteristic direction of the second frequency spectrum; Further, the method includes a determination step of determining that an abnormality has occurred in the signal to be managed at the second time when the second index value calculated in the calculation step exceeds the threshold value. An abnormality management method characterized by:

7. 7. The abnormality management method according to claim 6, Further, the method includes a notification step of issuing a notification indicating the occurrence of an abnormality when it is determined in the determination step that an abnormality has occurred in the signal to be managed. An abnormality management method characterized by:

8. 6. The abnormality management method according to claim 5, The feature extraction step extracts a transformation matrix of the normal data including a group of orthonormal basis vectors as a feature direction of the normal data by performing singular value decomposition on the data matrix. An abnormality management method characterized by:

Images