Anomaly detection device, processing device, anomaly detection method, and program

Abstract

To detect more abnormalities more highly accurately.SOLUTION: An abnormality detection device according to an embodiment includes a parameter set storage unit, a detection unit, an information input unit, and a processing unit. The parameter set storage unit stores a plurality of parameter sets used for detecting an abnormality in at least one piece of object data. The detection unit detects an abnormality in the at least one piece of object data using at least one parameter set selected from the parameter sets, and acquires at least one detection result. The information input unit receives an input of teaching information corresponding to the at least one detection result. The processing unit performs at least one of update, addition, and deletion of the parameter set based on the teaching information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an anomaly detection device, a processing device, an anomaly detection method, and a program. [Background technology]

[0002] Anomaly detection devices that monitor work conditions and detect abnormalities have been known for some time. For example, a technique has been known in which a user instructs the device whether the result of the abnormality detection is correct, thereby updating the algorithm for detecting abnormalities. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2020-026344 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with conventional technology, it has been difficult to detect more abnormalities with greater accuracy. [Means for solving the problem]

[0005] An anomaly detection device according to an embodiment includes a parameter set storage unit, a detection unit, an information input unit, and a processing unit. The parameter set storage unit stores a plurality of parameter sets used to detect an anomaly in at least one piece of target data. The detection unit detects an anomaly in the at least one piece of target data using at least one parameter set selected from the plurality of parameter sets and obtains at least one detection result. The information input unit receives input of instruction information for at least one of the detection results. The processing unit performs at least one of updating, adding, and deleting the parameter set based on the instruction information. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 1 is a block diagram showing an example of a schematic configuration of an anomaly detection device. [Figure 2] FIG. 1 is a block diagram showing an example of the configuration of an anomaly detection device according to a first embodiment. [Figure 3] FIG. 3 is a diagram showing an example of a plurality of parameter sets stored in a parameter set storage unit according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of a final detection result by the detection unit of the first embodiment. [Figure 5] 3 is a flowchart showing an example of a main flow of an anomaly detection method according to the first embodiment. [Figure 6] 5 is a flowchart showing an example of the operation of a processing unit in the first embodiment. [Figure 7] 5 is a flowchart showing an example of the operation of the information input unit according to the first embodiment. [Figure 8] FIG. 10 is a block diagram showing an example of the configuration of an anomaly detection device according to a second embodiment. [Figure 9] FIG. 10 is a diagram showing an example of a plurality of parameter sets stored in a parameter set storage unit according to the second embodiment. [Figure 10] 10 shows an example of a detection result in a tree structure model according to the second embodiment. [Figure 11] 10 is a flowchart showing an example of the operation of a processing unit according to the second embodiment. [Figure 12] FIG. 10 is a block diagram showing an example of the configuration of an anomaly detection device according to a third embodiment. [Figure 13] FIG. 11 is a diagram showing an example of display information (in the case of update confirmation) according to the third embodiment. [Figure 14] FIG. 11 is a diagram showing an example of display information (in the case of deletion confirmation) according to the third embodiment. [Figure 15] FIG. 2 is a diagram showing an example of the hardware configuration of an anomaly detection device according to the first to third embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, embodiments of an anomaly detection device, a processing device, an anomaly detection method, and a program will be described in detail with reference to the accompanying drawings.

[0008] There is a problem that the number of judgment algorithms (for example, data summarizing various functions and various parameters) is limited, and it may not be possible to accurately detect all abnormalities. In addition, there is a problem that it is costly to instruct the user whether all abnormality judgment results are correct or not, and if only results judged as abnormal are taught, it is not possible to collect abnormal data judged as normal, and it is not possible to prevent undetected results.

[0009] First, the schematic configuration of an anomaly detection device that solves such problems will be described.

[0010] [Example of schematic configuration] FIG. 1 is a block diagram showing an example of the schematic configuration of an anomaly detection device 100. The anomaly detection device 100 receives an input of a signal indicating target data and detects whether or not the target data has an anomaly. The anomaly detection device 100 may be disposed inside or outside a device that outputs a signal. As shown in FIG. 1, the anomaly detection device 100 includes an input unit 101, a parameter set storage unit 102, a detection unit 103, a data storage unit 104, an information input unit 105, and a processing unit 106.

[0011] The input unit 101 receives, for example, an input of a signal output from a sensor. Note that the input unit 101 may be a device itself, such as a sensor, that outputs a signal indicating measured information.

[0012] The parameter set storage unit 102 stores a plurality of parameter sets used for detecting anomalies in target data. A parameter set is data that compiles parameters that can be set for anomaly detection. The parameters included in a parameter set are adjustable parameters that affect anomaly detection, such as parameters for preprocessing input data and parameters for calculating an anomaly level that indicates the degree of anomaly.

[0013] The adjustable parameter may be, for example, a parameter for changing a threshold value, or a parameter that summarizes weights for calculations such as in a neural network (NN), or a parameter for selecting an algorithm used in calculations that affect whether an anomaly is detected.

[0014] The parameter set storage unit 102 may further store a relationship between parameter sets for constructing a tree structure model. For example, the parameter set storage unit 102 may further store a relationship such as parameter set A being a root node and parameter set B being present on its left side as a child node.

[0015] The detection unit 103 detects the presence or absence of an abnormality based on the signal input to the input unit 101 and multiple parameter sets stored in the parameter set storage unit 102. The detection unit 103 outputs multiple detection results using each parameter set. Note that the detection unit 103 may output not only individual detection results using each parameter set, but also a detection result that combines detection results from multiple parameter sets, or may output a detection result that combines detection results from multiple tree structure models. One possible method for combining multiple detection results is, for example, taking a majority vote of multiple detection results that indicate an abnormality or normality.

[0016] The data storage unit 104 stores the detection results output from the detection unit 103. The data storage unit 104 also receives instruction information input from the information input unit 105, which will be described later, and stores the information together with the detection results output from the detection unit 103. The detection results may be output directly to the information input unit 105, which will be described later. The detection results may also be output to the information input unit 105 when an instruction is received from the information input unit 105.

[0017] The information input unit 105 receives instruction information as a result of a user's judgment as to whether the detection result is correct. The information input unit 105 stores the instruction information in the data storage unit 104. The information input unit 105 receives instruction information input from an external terminal equipped with, for example, a display device and an input device. The information input unit 105 may have both the functions of a display device and an input device. The information input unit 105 may also directly receive input detection results from the detection unit 103. The information input unit 105 may also preferentially receive detection results with higher instruction priority from the data storage unit 104. Furthermore, the information input unit 105 may transmit an instruction to the data storage unit 104 and receive detection results from the data storage unit 104 in accordance with the instruction.

[0018] The processing unit 106 performs at least one of update, addition, and deletion processes on each parameter set stored in the parameter set storage unit 102 based on the detection results and teaching information stored in the data storage unit 104. The update process is performed with the aim of improving the detection accuracy of the parameter set. The addition process is performed with the aim of correctly detecting data that is difficult to correctly detect using only the existing parameter set. The deletion process is performed with the aim of not using memory capacity for unnecessary parameter sets.

[0019] The parameter set storage unit 102 and the data storage unit 104 may be realized by a single storage unit.

[0020] (First embodiment) 2 is a block diagram showing an example of the configuration of an anomaly detection device 100-1 according to the first embodiment. The anomaly detection device 100-1 according to the first embodiment includes an input unit 101, a parameter set storage unit 102, a detection unit 103, a data storage unit 104, an information input unit 105, and a processing unit 106.

[0021] The input unit 101 accepts an input of a signal. For example, a signal representing an image is input to the input unit 101 from one imaging device once per second. The signal input to the input unit 101 is first stored in the data storage unit 104 as raw data.

[0022] 2, the detection unit 103 of the first embodiment includes a preprocessing unit 1031 and a determination unit 1032. The preprocessing unit 1031 and the determination unit 1032 each perform processing based on each parameter set stored in the parameter set storage unit 102 and a detection algorithm that performs detection using each parameter set.

[0023] The preprocessing unit 1031 calculates feature amounts from an image based on each parameter set in the parameter set storage unit 102. The preprocessing unit 1031 calculates feature amounts based on weight parameters learned using deep learning, for example.

[0024] The determination unit 1032 determines whether or not an abnormality has occurred from the feature values ​​calculated by the preprocessing unit 1031 based on each parameter set in the parameter set storage unit 102. The determination unit 1032 determines, for example, an outlier from the distribution of normal data as an abnormality. Details of the abnormality detection method using multiple parameter sets will be described later.

[0025] The detection results based on each parameter set are stored in the data storage unit 104.

[0026] The information input unit 105 receives an instruction from the user to output the detection results stored in the data storage unit 104. For example, when the user wants to provide instruction information regarding whether the detection results are correct, the user inputs an instruction to output the detection results to the information input unit 105. The information input unit 105 has a function of receiving the detection results from the data storage unit 104 and displaying the detection results to the user, and receives instruction information regarding the detection results from the user. The information input unit 105 transmits the instruction information to the data storage unit 104 and stores it together with the detection results.

[0027] The data storage unit 104 also has a function of storing a teaching priority for teaching the detection results, and transmits the detection results to the information input unit 105 according to the teaching priority. That is, the information input unit 105 displays the detection results of the target data according to the teaching priority, and accepts input of teaching information for the displayed detection results of the target data. The method for determining the teaching priority will be described later.

[0028] The processing unit 106 first executes the following update process for all parameter sets and determines whether to update the parameter sets. For example, the processing unit 106 updates the parameter sets if a predetermined condition is met. The update condition is, for example, whether the number of pieces of teaching information stored in the data storage unit 104 has increased by a certain number or more since the previous update.

[0029] If the update condition is met, the processing unit 106 calculates the score of the parameter set based on a predetermined score function and updates the parameter set in the parameter set storage unit 102 with the parameter set with the higher score. The predetermined score function is, for example, detection accuracy. Furthermore, the processing unit 106 stores the detection accuracy of the updated parameter set together with the updated parameter set in the parameter set storage unit 102.

[0030] For example, the processing unit 106 searches for a parameter set from parameter sets near the current parameter set (parameter sets with values ​​close to the current parameter set). The processing unit 106 uses the searched parameter set to detect anomalies in the raw data in the data storage unit 104 and calculates a score for the parameter set based on the instruction information. The processing unit 106 updates the current parameter set with the parameter set with the highest score.

[0031] Next, after executing the parameter set update process, the processing unit 106 deletes the parameter set or adds new parameters based on whether the change in score before and after the update is smaller than a certain value. A parameter set is deleted when the change in score is small and updating the parameter set is not expected to improve the score.

[0032] [Delete parameter set] For example, if the change in score between before and after updating a parameter set is smaller than a first threshold and the score after updating the parameter set is smaller than a second threshold, processing unit 106 deletes the parameter set from parameter set storage unit 102. This is to reduce memory capacity by deleting parameter sets that have low scores and are unlikely to improve through updating.

[0033] Furthermore, for example, if the change in score after updating multiple parameter sets is smaller than a certain value and the rate at which the detection results match between those parameter sets is equal to or greater than a certain value, processing unit 106 deletes one of the parameter sets. This is because the score cannot be improved by updating and there is no need for multiple parameter sets that return the same detection results.

[0034] [Add new parameter set] Next, if the parameter set has not been deleted, processing unit 106 determines whether to add a new parameter set. If the score of the updated parameter set is equal to or greater than a certain value, processing unit 106 adds the new parameter set to parameter set storage unit 102. When adding a parameter set, a parameter set different from the existing parameter sets is searched for, and a parameter set with a score equal to or greater than a certain value is added.

[0035] For example, when the additional condition is satisfied, the processing unit 106 adds a new parameter set for redetecting target data that has been detected as normal in order to prevent non-detection of an abnormality. Furthermore, when the additional condition is satisfied, the processing unit 106 adds a new parameter set for redetecting target data that has been determined to be abnormal in order to prevent overdetection of an abnormality. The additional condition is, for example, when the change in score between before and after updating the parameter set is smaller than a first threshold, and the score after updating the parameter set is equal to or greater than a second threshold.

[0036] [Anomaly detection using multiple parameter sets] Fig. 3 is a diagram showing an example of a plurality of parameter sets stored in the parameter set storage unit of the first embodiment. Fig. 4 is a diagram showing an example of a final detection result by the detection unit of the first embodiment.

[0037] An example of an anomaly detection method using a plurality of parameter sets in the detection unit 103 (preprocessing unit 1031 and determination unit 1032) will be described using the examples of Figures 3 and 4. Figure 3 shows an example of each parameter set stored in the parameter set storage unit 102. In the example of Figure 3, the detection accuracy of each parameter set is stored along with the plurality of parameter sets. Here, the detection accuracy will be used as an example of a score calculated from a predetermined score function.

[0038] Fig. 4 shows the flow of data when anomaly detection is performed using the multiple parameter sets in Fig. 3. In the example of Fig. 4, the determination unit 1032 performs anomaly detection using multiple parameter sets and determines the final detection result by majority vote. Other methods for determining the final detection result include, for example, weighted majority vote using the accuracy of each parameter set.

[0039] [Data Teaching Priority] Similarly, an example of a method for determining the teaching priority of the detection result of the teaching target will be described using the example of Fig. 3. The determination unit 1032 determines a score for the corresponding parameter set based on the detection result using each parameter set, and determines a higher teaching priority as the score becomes lower. Here, the description will be given using detection accuracy as an example of the score calculated by a predetermined score function.

[0040] Specifically, first, when an abnormality is determined using parameter set A, which has the highest detection accuracy, the determination unit 1032 determines the teaching priority using the detection accuracy of parameter set A. Next, when a normality is determined using parameter set A and an abnormality is determined using parameter set B, the determination unit 1032 determines the teaching priority using the detection accuracy of parameter set B. Finally, when a normality is determined using parameter sets A and B and an abnormality is determined using parameter set C, the determination unit 1032 determines the teaching priority using the detection accuracy of parameter set C. If an abnormality is detected only using parameter sets with low detection accuracy, the target data has low reliability, and by giving priority to the target data and instructing the user, it becomes possible to efficiently update parameter sets with low detection accuracy. When a normality is determined using A, B, and C, the determination unit 1032 determines the teaching priority to be 0.

[0041] An example of an anomaly detection method by the anomaly detection device 100-1 of FIG. 2 will be described with reference to FIGS.

[0042] [An example of the main flow of anomaly detection] 5 is a flowchart showing an example of a main flow of the anomaly detection method according to the first embodiment. First, the input unit 101 receives an input of a signal representing an image (step S1), and the data storage unit 104 stores the image as raw data (step S2). Next, the detection unit 103 (preprocessing unit 1031 and determination unit 1032) acquires multiple parameter sets from the parameter set storage unit 102 (step S3), and performs anomaly detection based on each parameter set (step S4). The detection unit 103 stores the detection results based on each parameter set in the data storage unit 104 (step S5).

[0043] If the detection result is abnormal (step S6, Yes), the information input unit 105 accepts input of instruction information from the user (step S7), the data storage unit 104 stores the instruction information (step S8), and the process proceeds to step S9. If the detection result is not abnormal (step S6, No), that is, if the detection result is normal, the process proceeds to step S9.

[0044] The processes of steps S6 to S8 are not essential, and the process may proceed from step S5 to step S9.

[0045] Next, the processing unit 106 determines whether or not to update the parameter set (step S9). If the parameter set is not to be updated (step S9, No), the processing ends. If the parameter set is to be updated (step S9, Yes), the processing proceeds to A1 in FIG.

[0046] [Example of operation of the processing unit 106] Fig. 6 is a flowchart showing an example of the operation of the processing unit 106 in the first embodiment. The processing flow of the processing unit 106 from A1 in Fig. 6 will be described. First, the processing unit 106 executes the above-mentioned update processing for all parameter sets (step S21). Next, the processing unit 106 repeats the processing from step S23 onwards for each parameter set.

[0047] If the processing from step S23 onwards has not been performed for all parameter sets (step S22, No), the processing unit 106 determines whether the difference in score between the parameter set before and after the update is smaller than a certain value (first threshold) for the unprocessed parameter set (step S23).

[0048] If the difference in score between before and after the update of the parameter set is not smaller than a certain value (No at step S23), the process returns to step S22.

[0049] If the difference in scores is smaller than a certain value (step S23, Yes), the processing unit 106 determines whether or not to delete the parameter set (step S24). If the parameter set is to be deleted (step S24, Yes), the processing unit 106 deletes the parameter set (step S25), and the process returns to step S22.

[0050] If a parameter set is not to be deleted (step S24, No), the processing unit 106 determines whether or not to add a new parameter set (step S26). If a new parameter set is to be added (step S26, Yes), the processing unit 106 adds the new parameter set (step S27), and the process returns to step S22. If a new parameter set is not to be added (step S26, No), the process returns to step S22.

[0051] If the processes from step S23 onwards have been executed for all parameter sets (step S22, Yes), the process proceeds to A2 in FIG. 5 described above, and the process ends.

[0052] [Example of operation of information input unit 105] 7 is a flowchart showing an example of operation when the information input unit 105 of the first embodiment receives an instruction from a user to display the detection results. First, the information input unit 105 acquires the detection results from the data storage unit 104 according to the instruction priority of the detection results of the target object (step S41). Next, the information input unit 105 accepts instruction information from the user regarding the detection results acquired in step S41 (step S42), and stores the instruction results in the data storage unit 104 (step S43).

[0053] Next, the information input unit 105 determines whether or not to end the reception of the instruction information (step S44). If the reception of the instruction information is not to end (step S44, No), the process returns to step S41. If the reception of the instruction information is to end (step S44, Yes), the process ends. For example, when the information input unit 105 receives an instruction from the user indicating the end of input of the instruction information, the information input unit 105 ends the reception of the instruction information.

[0054] The main flow of anomaly detection in FIG. 5 and the flow of the information input unit 207 in FIG. 7 are independent of each other, and for example, while anomaly detection is being performed, the user can input instruction information all at once at the timing he or she wishes to provide instruction.

[0055] As described above, in the anomaly detection device 100-1 of the first embodiment, the parameter set storage unit 102 stores a plurality of parameter sets used to detect an anomaly in at least one piece of target data. The detection unit 103 detects an anomaly in at least one piece of target data using at least one parameter set selected from the plurality of parameter sets and obtains at least one detection result. The information input unit 105 accepts input of instruction information for at least one detection result. The processing unit 106 performs at least one of updating, adding, and deleting the parameter set based on the instruction information.

[0056] As a result, the anomaly detection device 100-1 of the first embodiment can detect more anomalies with higher detection accuracy. For example, when a user provides correct information for a detection result, the above-mentioned score is calculated, and the parameter set is repeatedly updated, thereby improving detection accuracy. In addition, when the detection accuracy does not improve simply by updating the existing parameter set, a new parameter set is added, and multiple parameter sets including the new parameter set are updated, thereby making it possible to detect more anomalies with higher detection accuracy. Furthermore, by efficiently targeting important data according to the teaching priority rather than targeting all target data as teaching targets, the effort required for teaching by the user can be reduced and detection accuracy can be efficiently improved.

[0057] The information input unit 105 and the processing unit 106 may be realized as independent processing devices. For example, a processing device may be configured that processes parameter sets of an anomaly detection device that uses multiple parameter sets to detect an anomaly in at least one piece of target data, and that includes the information input unit 105 that accepts input of instruction information for the detection result of the target data from a user, and the processing unit 106 that performs at least one of updating and adding the parameter set based on the input instruction information.

[0058] (Second embodiment) Next, a second embodiment will be described. In the description of the second embodiment, the same description as in the first embodiment will be omitted, and only differences from the first embodiment will be described. In the anomaly detection of the second embodiment, a tree structure model constructed from a plurality of parameter sets and the relationships between the parameter sets from the parameter set storage unit 102 is used.

[0059] 8 is a block diagram showing an example of the configuration of an anomaly detection device 100-2 according to the second embodiment. The anomaly detection device 100-2 according to the second embodiment includes an input unit 101, a parameter set storage unit 102, a detection unit 103, a data storage unit 104, an information input unit 105, and a processing unit 106. As shown in FIG. 8, the detection unit 103 according to the second embodiment further includes a construction unit 1033 in addition to a preprocessing unit 1031 and a determination unit 1032.

[0060] The constructing unit 1033 is not essential, and the function of the constructing unit 1033 may be realized as one of the functions of the parameter set storage unit 102.

[0061] In the second embodiment, the parameter set storage unit 102 stores a plurality of parameter sets using a tree structure model that indicates the relationships between the plurality of parameter sets. The detection unit 103 then detects an anomaly in at least one piece of target data using at least one parameter set selected based on the tree structure model.

[0062] In the second embodiment, a tree structure model constructed from multiple parameter sets is processed, and therefore the anomaly detection method by the preprocessing unit 1031 and the judgment unit 1032, the method of determining the teaching priority stored in the data storage unit 104, and the processing of updating, adding, and deleting parameter sets by the processing unit 106 are different from those in the first embodiment.

[0063] [An example of an anomaly detection method using a tree structure model] First, an example of an anomaly detection method using a tree structure model will be described using the examples of Fig. 9 and Fig. 10. Fig. 9 is a diagram showing an example of a plurality of parameter sets stored in the parameter set storage unit 102 of the second embodiment. In the example of Fig. 9, the detection accuracy and relationship of the parameter sets are stored together with the plurality of parameter sets. For example, the relationship "A: normal, abnormal" of parameter set B indicates that the parameter set is used to prevent undetected abnormalities when parameter set A is determined to be normal.

[0064] 10 shows an example of a detection result in the tree structure model of the second embodiment. The example in Fig. 10 shows a case where an abnormality is detected by the tree structure model constructed from the parameter set in Fig. 9.

[0065] The purpose of parameter set A is to detect anomalies from all input data. The purpose of parameter set B is to suppress overdetection by parameter set A, and the detection target is data that is determined to be normal by parameter set A. The purpose of parameter set C is to suppress overdetection by parameter set A, and the detection target is data that is determined to be abnormal by parameter set A.

[0066] For these reasons, the anomaly detection in the second embodiment uses a tree-structured model constructed as shown in the example of Fig. 10. In this tree-structured model, each node directly receives raw data, calculates the feature space, and determines an anomaly, which is different from a normal decision tree. When multiple tree-structured models are constructed, the final detection result is determined by majority vote from the results of each tree-structured model, as in a random forest, for example.

[0067] [An example of a method for determining teaching priorities using a tree structure model] Similarly, an example of a method for determining the teaching priority of the detection result of the teaching target will be described using the examples of Figures 9 and 10. The tree structure model shown in Figure 10 is used for anomaly detection. The detection unit 103 (determination unit 1032) determines the detection accuracy of the corresponding parameter set based on the detection result of the tree structure model, and determines a higher teaching priority as the detection accuracy becomes lower.

[0068] For example, the detection unit 103 determines a higher teaching priority of the teaching information for the detection result of target data that is detected as normal by the parameter set of a parent node in the tree structure model and is detected as abnormal by the parameter set of a child node of the parent node.Furthermore, for example, the detection unit 103 determines a higher teaching priority of the teaching information for the detection result of target data that is detected as abnormal by the parameter set of a parent node in the tree structure model and is detected as normal by the parameter set of a child node of the parent node.

[0069] 10, parameter set B detects data that is determined to be normal in parameter set A. Therefore, data that is determined to be normal in parameter set A and abnormal in parameter set B becomes an important detection result in parameter set B, and the teaching priority of the detection result is determined using the detection accuracy of B.

[0070] Considering parameter set C in the same way, data that is detected as abnormal in parameter set A and normal in parameter set C becomes an important detection result in C, and the teaching priority of that detection result is determined using the detection accuracy of C.

[0071] Parameter set A targets all data for detection, but if parameter set A detects an abnormality, parameter set C may detect the data as normal. Therefore, only the teaching priority of data that is detected as abnormal by parameter set A and also as abnormal by parameter set C is determined using the detection accuracy of parameter set A.

[0072] The teaching priority of data other than the above, that is, data detected as normal in parameter set A and normal in parameter set B, is set to 0.

[0073] In this way, even in a tree structure model, it is possible to determine the teaching priority for important data for each parameter set. By giving priority to important data detected using a parameter set with lower detection accuracy as the teaching target, detection accuracy can be improved efficiently.

[0074] [Example of parameter set update process] Similarly, an example of processing by the processing unit 106 using a tree structure model will be described using the examples of Figures 9 and 10. First, the parameter set update processing is performed in order from the root to the leaves of the tree structure. In the example of Figure 10, parameter set A is the root. Therefore, the processing unit 106 determines whether to update the parameter set starting from parameter set A.

[0075] First, processing unit 106 does not update parameter set A because parameter set A has child nodes. This is to avoid changing the data detected by lower-level nodes. Although it is possible to update parameter set A, an example in which no update is performed will be described here.

[0076] Next, moving to the next node below, parameter sets B and C are leaf nodes with no child nodes, so parameter sets B and C are updated. The purpose of parameter set B is to detect, as an anomaly, data that was detected as normal by parameter set A. Therefore, processing unit 106 searches for parameter sets using data that was detected as normal by parameter set A, which is the node above, and selects the parameter set with the highest score. Processing unit 106 then updates parameter set storage unit 102 and the parameter sets of the tree structure model with the selected parameter set.

[0077] The same applies to parameter set C. That is, processing unit 106 searches for parameter sets using data detected as abnormal in parameter set A, selects the parameter set with the highest score, and updates parameter set storage unit 102 and the parameter sets of the tree structure model with the selected parameter set.

[0078] [Example of parameter set deletion process] Next, if the change between the score of the leaf node before the update and the score of the leaf node after the update is equal to or greater than a certain value, the processing unit 106 proceeds to a process of determining whether to delete the leaf node. If the score of the leaf node after the update is smaller than a certain value, the processing unit 106 deletes the parameter set from the parameter set storage unit 102 and the tree structure model. This is to delete nodes that have low detection accuracy and for which updating is not expected to improve detection accuracy. Since this is a tree structure model, it is also possible to delete higher-level nodes, but because this would have a significant impact on child nodes, an example is shown here in which only leaf nodes are deleted.

[0079] [Example of adding a parameter set] Finally, the processing unit 106 determines whether or not to add a child node to the leaf node. If a child node does not exist when an abnormality is detected, the processing unit 106 adds a child node. A child node when an abnormality is detected is added with the aim of preventing overdetection (mistaken detection of normality as abnormal) by the parent node. The same applies to a child node when a normality is detected. A child node when a normality is detected is added with the aim of preventing underdetection (mistaken detection of abnormality as normal) by the parent node.

[0080] Specifically, if the score of the leaf node after updating is equal to or greater than a certain value, the processing unit 106 adds a new parameter set to the parameter set storage unit 102 and the tree structure model in order to suppress non-detection. The condition for the parameter set to be added is, for example, whether or not a certain number of pieces of data are detected as abnormal when data detected as normal at the parent node is input.

[0081] Furthermore, if the score of the leaf node after updating is smaller than a certain value, the processing unit 106 adds a new parameter set to the parameter set storage unit 102 and the tree structure model in order to suppress overdetection. The condition for the parameter set to be added is, for example, whether or not a certain number of pieces of data are detected as normal when data detected as abnormal in the parent node is input.

[0082] An example of an anomaly detection method by the anomaly detection device 100-2 of the second embodiment will be described with reference to Figures 5 and 11. In the main flow of anomaly detection in the second embodiment, a step of constructing a tree structure model is added after step S3 in Figure 5, which is the main flow of the first embodiment. Then, the process of performing anomaly detection using each parameter set in step S4 in Figure 5 is changed to a process of performing anomaly detection using each tree structure model.

[0083] [Example of operation of the processing unit 106] Fig. 11 is a flowchart showing an example of the operation of the processing unit of the second embodiment. The processing flow of the processing unit 106 from A1 in Fig. 11 will be described. First, the processing unit 106 executes the above-mentioned update processing (update of leaf nodes) for all tree structure models (step S51). Next, the processing unit 106 repeats the processing from step S53 onwards for all tree structure models and all leaf nodes.

[0084] If the processing from step S53 onwards has not been performed for all tree structure models and all leaf nodes (step S52, No), the processing unit 106 determines whether the difference (change) in score between before and after the update of the leaf node for the unprocessed tree structure models and leaf nodes is smaller than a certain value (first threshold) (step S53).

[0085] If the difference in score between the leaf node before and after the update is not smaller than a certain value (No at step S53), the process returns to step S52.

[0086] If the difference in scores is smaller than a certain value (step S53, Yes), the processing unit 106 determines whether to delete the leaf node (step S54). If the leaf node is to be deleted (step S54, Yes), the processing unit 106 deletes the parameter set corresponding to the leaf node (step S55), and the process returns to step S52.

[0087] If the leaf node is not to be deleted (step S54, No), the processing unit 106 determines whether to add a leaf node (new parameter set) for suppressing non-detection (step S56). If the new parameter set is to be added (step S56, Yes), the processing unit 106 adds a leaf node that detects data detected as normal by the parent node as a new parameter set for suppressing non-detection (step S57), and the process returns to step S52.

[0088] If a new parameter set for suppressing non-detection is not to be added (step S56, No), the processing unit 106 determines whether to add a leaf node (new parameter set) for suppressing overdetection (step S58). If the new parameter set is to be added (step S58, Yes), the processing unit 106 adds a leaf node for detecting data detected as abnormal by the parent node as a new parameter set for suppressing overdetection (step S59), and the process returns to step S52.

[0089] If the processing from step S53 onwards has been executed for all tree structure models and all leaf nodes (step S52, Yes), the process proceeds to A2 in FIG. 5 above, and the process ends.

[0090] As described above, in the second embodiment, by constructing a tree-structured model, it is possible to suppress non-detection and overdetection by parent nodes. For each node of a tree-structured model constructed from multiple parameter sets, it is possible to add a node to the tree-structured model in order to suppress overdetection and non-detection. Leaf nodes perform detection only when the parent node determines a normal or abnormal state. Therefore, it is sufficient to learn only the data corresponding to the normal or abnormal state determined by the parent node. Therefore, the determination unit 1032 determines the teaching priority of the detection results of the learning target, and by increasing the teaching priority of important data as described above, it is possible to efficiently improve detection accuracy. This reduces the user's effort.

[0091] (Third embodiment) Next, a third embodiment will be described. In the description of the third embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. In the third embodiment, when a parameter set is updated, added, or deleted, the results are displayed, allowing the user to confirm the results and select whether or not to perform the processing.

[0092] 12 is a block diagram showing an example of the configuration of an anomaly detection device 100-3 according to the third embodiment. The anomaly detection device 100-3 according to the third embodiment includes an input unit 101, a parameter set storage unit 102, a detection unit 103 (a preprocessing unit 1031 and a determination unit 1032), a data storage unit 104, an information input unit 105, and a processing unit 106.

[0093] 12, the detection unit 103 of the third embodiment has an additional path (input interface) from the processing unit 106 to the information input unit 105, and an additional path from the information input unit 105 to the processing unit 106. This is also applicable to the second embodiment shown in FIG. 8, and these paths may be added to the configuration of the second embodiment.

[0094] In the third embodiment, a path from the processing unit 106 to the information input unit 105 is added, so that when processing such as updating, adding, or deleting a parameter set is performed, the results can be displayed to the user for the user to check. Also, by adding a path from the information input unit 105 to the processing unit 106, the user can check the displayed results and then select whether or not to actually perform the processing. Furthermore, by transmitting a user instruction from the information input unit 105 to the processing unit 106, it becomes possible to operate the processing unit 106 at any timing.

[0095] When updating a parameter set, the processing unit 106 of the third embodiment inputs the detection results before and after the update to the information input unit 105. This allows the user to check the detection results before and after the update, thereby preventing the parameter set from being updated in a direction unintended by the user.

[0096] [Example of update confirmation information entry] FIG. 13 is a diagram showing an example of display information (in the case of update confirmation) in the third embodiment. Using FIG. 13 as an example, an example of information input in which detection results before and after an update are displayed and a selection is accepted from the user will be described. The example in FIG. 13 displays an example in which detection results for the same data are different before and after updating the parameter set. The detection accuracy when an abnormality is detected with each parameter set is also displayed. Since the detection accuracy is determined based on the instruction information taught by the user, there is a possibility that abnormal data (misdetected data) may be included in data that has not been taught, and even if the detection accuracy is higher, there may be cases in which an abnormality is not correctly detected in data that has not been taught.

[0097] As described above, the information input unit 105 of the third embodiment displays the detection results before and after the parameter set is updated by the processing unit 106, and receives input from the user indicating whether or not to update the parameter set. By allowing the user to check the data in which the detection results have changed due to the update, it is possible to prevent the parameter set from being updated in a direction unintended by the user. Furthermore, by receiving instruction information from the user regarding abnormal data, it becomes possible to calculate the detection accuracy more accurately. When the processing unit 106 receives instruction information from the user regarding the abnormal data, it performs processing again, starting with searching for a parameter set that improves the detection accuracy, including for the abnormal data.

[0098] [Example of deletion confirmation information entry] Fig. 14 is a diagram showing an example of display information (in the case of deletion confirmation) in the third embodiment. When the deletion of a parameter set is confirmed, the information input unit 105 displays the detection results using that parameter set. The example in Fig. 14 shows an example of display information that displays the detection results of the parameter set to be deleted and accepts input from the user to select whether or not to delete it. By providing information input as shown in Fig. 14, it is possible to prevent parameter sets necessary for the user from being deleted.

[0099] [Example of additional confirmation information entry] When adding a new parameter set, the results of the parameter set can be displayed and confirmed by the user, thereby preventing the user from adding an unintended parameter set. By using additional confirmation information input similar to that shown in Fig. 14, the user can be allowed to select whether or not to add a new parameter set.

[0100] As described above, in the third embodiment, a path from the processing unit 106 to the information input unit 105 and a path from the information input unit 105 to the processing unit 106 are added, allowing the user to check the results and select whether to perform update, deletion, or addition processing of the processing unit 106. If the detection accuracy is calculated and processed based on instruction information provided by the user, the calculation of the detection accuracy may become unstable if there is little instruction information or if inaccurate instruction information is mixed in. Therefore, in the third embodiment, the user can check the results and avoid the update, deletion, or addition processing of the processing unit 106 proceeding in a direction unintended by the user.

[0101] Finally, an example of the hardware configuration of the abnormality detection device 100 (100-1 to 100-3) according to the first to third embodiments will be described.

[0102] [Example of hardware configuration] 15 is a diagram showing an example of the hardware configuration of the anomaly detection device 100 (100-1 to 100-3) according to the first to third embodiments. The anomaly detection device 100 includes a processor 301, a main storage device 302, an auxiliary storage device 303, a display device 304, an input device 305, and a communication IF 306. The processor 301, the main storage device 302, the auxiliary storage device 303, the display device 304, the input device 305, and the communication IF 306 are connected via a bus 310.

[0103] The processor 301 executes a program read from the auxiliary storage device 303 to the main storage device 302. The main storage device 302 is memory such as a read-only memory (ROM) and a random access memory (RAM). The auxiliary storage device 303 is a hard disk drive (HDD), a solid state drive (SSD), a memory card, or the like.

[0104] The display device 304 displays the state of the anomaly detection device 100. The input device 305 accepts input from a user. Note that the anomaly detection device 100 does not necessarily have to include the display device 304 and the input device 305.

[0105] The communication IF 306 is an interface for communicating with other devices. If the anomaly detection device 100 does not have the display device 304 and the input device 305, for example, the display function and input function of an external terminal connected via the communication IF 306 may be used.

[0106] The program executed by the anomaly detection device 100 is provided as a computer program product stored in an installable or executable file format on a computer-readable storage medium such as a CD-ROM, memory card, CD-R, or DVD (Digital Versatile Disc).

[0107] Furthermore, the program executed by the anomaly detection device 100 may be stored on a computer connected to a network such as the Internet, and may be provided by being downloaded via the network.

[0108] Furthermore, the program executed by the anomaly detection device 100 may be configured to be provided via a network such as the Internet without being downloaded.

[0109] Furthermore, the program executed by the anomaly detection device 100 may be provided by being pre-installed in a ROM or the like.

[0110] The programs executed by the anomaly detection device 100 have a modular configuration that includes functions that can be realized by the programs, among the above-described functional configuration of the anomaly detection device 100. The functions realized by the programs are loaded into the main memory device 302 by the processor 301 reading and executing the programs from a storage medium such as the auxiliary memory device 303. In other words, the functions realized by the programs are generated on the main memory device 302.

[0111] Note that some or all of the functions of the anomaly detection device 100 may be implemented by hardware such as an integrated circuit (IC). The IC is, for example, a processor that executes dedicated processing.

[0112] Furthermore, when each function is realized using a plurality of processors, each processor may realize one of the functions, or may realize two or more of the functions.

[0113] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0114] 100 Anomaly detection device 101 Input section 102 Parameter set storage unit 103 Detection unit 104 Data storage unit 105 Information input section 106 Processing section 301 processor 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input Device 306 Communication Interface 310 Bus 1031 Pre-processing section 1032 Judgment section 1033 Construction Department

Claims

1. a parameter set storage unit that stores a plurality of parameter sets used for detecting an abnormality in at least one target data; a detection unit that detects an anomaly in the at least one target data by using at least one parameter set selected from the plurality of parameter sets and obtains at least one detection result; an information input unit that receives input of teaching information for at least one of the detection results; a processing unit that performs at least one of updating, adding, and deleting the parameter set based on the teaching information, When an update condition is satisfied, the processing unit calculates a score of the parameter set based on a predetermined score function, and when a change in the score before and after updating the parameter set is smaller than a first threshold and the score after updating the parameter set is smaller than a second threshold, deletes the parameter set. Anomaly detection device.

2. further comprising a data storage unit that stores the teaching information; the update condition is that the number of pieces of teaching information stored in the data storage unit has increased by a certain number or more; The anomaly detection device according to claim 1 .

3. When the additional condition is satisfied, the processing unit adds a new parameter set for re-detecting the target data detected as normal in order to suppress non-detection of the abnormality. The anomaly detection device according to claim 1 .

4. When the additional condition is satisfied, the processing unit adds a new parameter set for re-detecting the target data determined to be abnormal in order to suppress overdetection of the abnormality. The anomaly detection device according to claim 1 .

5. The additional condition is that a change in the score before and after updating the parameter set is smaller than a first threshold, and the score after updating the parameter set is equal to or greater than a second threshold. The abnormality detection device according to claim 3 or 4.

6. the parameter set storage unit stores the plurality of parameter sets using a tree structure model that indicates a relationship between the plurality of parameter sets; the detection unit detects an anomaly in the at least one target data by using at least one parameter set selected based on the tree structure model; The anomaly detection device according to claim 1 .

7. the detection unit determines a higher teaching priority of teaching information for a detection result of target data that is detected as normal by a parameter set of a parent node and detected as abnormal by a parameter set of a child node of the parent node in the tree structure model; The anomaly detection device according to claim 6.

8. the detection unit determines a higher teaching priority of teaching information for a detection result of target data that is detected as abnormal in a parameter set of a parent node and is detected as normal in a parameter set of a child node of the parent node in the tree structure model; The anomaly detection device according to claim 6.

9. the information input unit displays the detection results of the target data in accordance with the instruction priority and accepts input of instruction information for the displayed detection results of the target data; The abnormality detection device according to claim 7 or 8.

10. the information input unit displays, before the processing unit updates the parameter set, a detection result before the parameter set is updated and a detection result after the parameter set is updated, and receives an input from a user indicating whether or not to update the parameter set. The anomaly detection device according to claim 9.

11. A processing device that processes a plurality of parameter sets of an anomaly detection device that detects an anomaly in at least one piece of target data using the parameter sets, an information input unit that receives, from a user, instruction information regarding the detection result of the target data; a processing unit that performs at least one of updating and adding the parameter set based on the input teaching information, When an update condition is satisfied, the processing unit calculates a score of the parameter set based on a predetermined score function, and when a change in the score before and after updating the parameter set is smaller than a first threshold and the score after updating the parameter set is smaller than a second threshold, deletes the parameter set. Processing equipment.

12. The anomaly detection device stores a plurality of parameter sets used for detecting an anomaly in at least one target data; the anomaly detection device detecting an anomaly in the at least one target data using at least one parameter set selected from the plurality of parameter sets, and obtaining at least one detection result; receiving, by the anomaly detection device, input of teaching information for at least one of the detection results; the anomaly detection device performing at least one of updating, adding, and deleting the parameter set based on the teaching information; When the update condition is satisfied, the anomaly detection device calculates a score of the parameter set based on a predetermined score function, and when a change in the score before and after updating the parameter set is smaller than a first threshold and the score after updating the parameter set is smaller than a second threshold, deletes the parameter set; An anomaly detection method comprising:

13. Computer, a parameter set storage unit that stores a plurality of parameter sets used for detecting an abnormality in at least one target data; a detection unit that detects an anomaly in the at least one target data by using at least one parameter set selected from the plurality of parameter sets and obtains at least one detection result; an input unit that receives input of teaching information for at least one of the detection results; a processing unit that performs at least one of updating, adding, and deleting the parameter set based on the teaching information; When an update condition is satisfied, the processing unit calculates a score of the parameter set based on a predetermined score function, and when a change in the score before and after updating the parameter set is smaller than a first threshold and the score after updating the parameter set is smaller than a second threshold, deletes the parameter set. program.

Images