Anomaly detection device and anomaly detection method

Abstract

The object is to detect abnormalities in a signal even when there is little measurement data of the abnormal signal. [Solution] The anomaly detection device 1 includes a learning unit 11 configured to construct a multivariate probability model using the intensities of each of multiple frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and to generate a matrix representing the conditional dependency between the intensities of the multiple frequency components by estimating parameters of the constructed multivariate probability model, and a judgment unit 12 configured to judge an anomaly of a signal whose frequency spectrum includes the intensities of two frequency components based on a value indicating the conditional dependency between the intensities of any two of the multiple frequency components in the matrix generated by the learning unit 11.

Description

[Technical Field]

[0001] The present invention relates to an abnormality detection device and an abnormality detection method. [Background technology]

[0002] Conventionally, there have been known techniques for analyzing the characteristics of a time-series signal in the frequency domain and detecting anomalies contained in the signal. For example, Patent Document 1 discloses a technique for estimating anomalies in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of both normal and abnormal signals as training data.

[0003] However, in the technology disclosed in Patent Document 1, in order to construct a model with sufficient accuracy for detecting anomalies, it is necessary to obtain a sufficient number of anomalous signals, and the anomalous signals must be accumulated over a long period of time. Furthermore, even when detecting signal anomalies in the frequency spectrum using statistical methods, a large amount of measurement data of the anomalous signals may be required. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-027386 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, with the conventional technology, it may be difficult to detect an abnormality in a signal when there is little measurement data of the abnormal signal.

[0006] The present invention has been made to solve the above-mentioned problems, and has an object to detect an abnormality in a signal even when there is little measurement data of the abnormal signal. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems, the anomaly detection device of the present invention includes a learning unit configured to construct a multivariate probabilistic model using the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and to generate a matrix representing the conditional dependency between the intensities of the plurality of frequency components by estimating parameters of the constructed multivariate probabilistic model; and a judgment unit configured to judge an anomaly of a signal whose frequency spectrum includes the intensities of any two frequency components based on a value indicating the conditional dependency between the intensities of any two frequency components among the plurality of frequency components in the matrix generated by the learning unit.

[0008] Furthermore, in the anomaly detection device according to the present invention, the learning unit may generate a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the intensities of the plurality of frequency components by estimating, by maximum likelihood estimation, the parameters of a multivariate normal distribution model in which a sample mean is set to 0 for multivariate data in which the intensities of each of the plurality of frequency components are variables.

[0009] Furthermore, in the anomaly detection device according to the present invention, the learning unit generates a first matrix which is the matrix in a first observation period, and a second matrix which is the matrix in a second observation period after the first observation period, and the determination unit further determines whether a value of a component in the first matrix which indicates the conditional dependency between the intensities of the two frequency components has changed from a zero value to a non-zero value when compared with a value of a corresponding component in the second matrix, whether a value of a component in the first matrix which indicates the conditional dependency between the intensities of the two frequency components has changed from a non-zero value to a zero value when compared with a value of the corresponding component in the second matrix, and whether a value of the corresponding component in the second matrix has exceeded a threshold value. The abnormality of the signal may be determined based on at least one of the following conditions.

[0010] The abnormality detection device according to the present invention may further include an acquisition unit configured to acquire the intensity of each of the plurality of frequency components.

[0011] Furthermore, the abnormality detection device according to the present invention may further include a notification unit configured to issue an alarm when the determination unit determines that the signal is abnormal.

[0012] In order to solve the above-mentioned problems, the anomaly detection method of the present invention includes a learning step of constructing a multivariate probabilistic model using the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and generating a matrix representing the conditional dependency between the intensities of the plurality of frequency components by estimating parameters of the constructed multivariate probabilistic model; and a determination step of determining an anomaly in a signal whose frequency spectrum includes the intensities of any two frequency components based on a value indicating the conditional dependency between the intensities of the two frequency components in the matrix generated in the learning step.

[0013] Furthermore, in the anomaly detection method according to the present invention, the learning step may generate a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the intensities of the plurality of frequency components by estimating, by maximum likelihood estimation, the parameters of a multivariate normal distribution model in which a sample mean is set to 0 for multivariate data in which the intensities of each of the plurality of frequency components are variables.

[0014] Furthermore, in the anomaly detection method according to the present invention, the learning step may generate a first matrix, which is the matrix during a first observation period, and a second matrix, which is the matrix during a second observation period after the first observation period, and the determination step may further determine an anomaly in the signal based on at least one of the following conditions: when a value of a component in the first matrix indicating the conditional dependency between the intensities of the two frequency components is compared with a value of a corresponding component in the second matrix, the value changes from zero to a non-zero value; when a value of a component in the first matrix indicating the conditional dependency between the intensities of the two frequency components is compared with a value of the corresponding component in the second matrix, the value changes from a non-zero value to zero; or when a value of the corresponding component in the second matrix exceeds a threshold value.

[0015] The abnormality detection method according to the present invention may further include an acquisition step of acquiring the intensity of each of the plurality of frequency components.

[0016] The abnormality detection method according to the present invention may further include a notification step of issuing an alarm when an abnormality in the signal is determined in the determination step. [Effects of the Invention]

[0017] According to the present invention, an abnormality in a signal having a frequency spectrum including the intensities of two frequency components is determined based on a value indicating the conditional dependency between the intensities of any two frequency components among a plurality of frequency components in a matrix generated by a learning unit. Therefore, an abnormality in a signal can be detected even when there is little measurement data of the abnormal signal. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality detection system including an abnormality detection device according to an embodiment of the present invention. [Figure 2]FIG. 2 is a schematic diagram for explaining the configuration of the learning unit included in the abnormality detection device according to this embodiment. [Figure 3] FIG. 3 is a schematic diagram for explaining the configuration of the learning unit included in the abnormality detection device according to this embodiment. [Figure 4] FIG. 4 is a schematic diagram for explaining the configuration of the learning unit included in the abnormality detection device according to this embodiment. [Figure 5] FIG. 5 is a block diagram showing the hardware configuration of the abnormality detection device according to this embodiment. [Figure 6] FIG. 6 is a sequence diagram showing the operation of an abnormality detection system including an abnormality detection device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0020] [Configuration of anomaly detection system] First, with reference to FIG. 1, an overview of an abnormality detection system including an abnormality detection device 1 according to an embodiment of the present invention will be described.

[0021] The anomaly detection system includes an anomaly detection device 1, a communication terminal 2, and an operation center 3. The anomaly detection device 1, the communication terminal 2, and the operation center 3 are all connected via a network NW. The anomaly detection system according to this embodiment learns a multivariate model from observation data of the intensity of each frequency component in the frequency spectrum of a signal measured by the communication terminal 2, and detects a relationship between the intensities of frequency components that deviate from the normal pattern of the intensity of each frequency component in the frequency spectrum, thereby detecting a signal anomaly.

[0022] The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, mobile communication networks using LTE / 4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0023] The communication terminal 2 can be realized by a computer including a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output I / O, and a program that controls these hardware resources. The communication terminal 2 can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, or the like. In this embodiment, there may be multiple communication terminals 2. The communication terminal 2 includes a terminal compatible with a mobile communication network that has a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as an International Mobile Subscriber Identity (IMSI).

[0024] The communication terminal 2 also includes a terminal having an IP address and configured as an IoT terminal. The communication terminal 2 is equipped with a mobile communication module and various sensors, and is capable of detecting various physical quantities and measuring them as electrical signals. The communication terminal 2 transmits the measured signals to a gateway or the like (not shown) or to the anomaly detection device 1 via the network NW. In this embodiment, as an example, the signals to be subject to anomaly management are the reception level and signal strength of signals received from base stations, which are periodically measured and recorded by the communication terminal 2 using the mobile communication module.

[0025] As shown in area 2a of FIG. 1, communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of an abnormality in signal strength from the waveform data of signal strength shown in area 2a. For this reason, abnormality detection device 1, which will be described later, converts the time-series data of signal strength into a spectrum in the frequency domain and analyzes the frequency components to detect an abnormality in the signal.

[0026] When a communication terminal 2 measures a signal related to a frequency spectrum that includes frequency components of abnormal intensity, it is possible that a problem has occurred in the hardware or settings, or a problem in the reception environment, causing a malfunction in the communication terminal 2. For example, the malfunction may be due to a malfunction in the communication module of the communication terminal 2, a bug or incorrect settings in the measurement software, or an internal noise source.

[0027] The operation center 3 can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and input / output (I / O), and a program that controls these hardware resources. The operation center 3 is, in particular, an operation management system composed of a group of computers. Based on an alarm notification indicating an abnormality in a signal measured by the communication terminal 2 detected by the anomaly detection device 1, the operation center 3 can remotely manage the communication terminal 2 via the network NW, send additional self-diagnosis commands, and collect hardware status reports (temperature, power supply voltage, RF front-end status, etc.) from the communication terminal 2. The operation center 3 can further determine the possibility of a hardware malfunction in the communication terminal 2, and can remotely restart the communication terminal 2, change measurement conditions, restrict communication use, or notify the communication terminal 2 to repair or replace it.

[0028] [Function block of the anomaly detection device] Next, functional blocks of the anomaly detection device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the anomaly detection device 1 includes an acquisition unit 10, a learning unit 11, a determination unit 12, a notification unit 13, and a storage unit 14.

[0029] The acquisition unit 10 acquires the intensity of each of multiple frequency components included in the frequency spectrum of a signal measured by the communication terminal 2. Specifically, the acquisition unit 10 acquires the frequency spectrum of the signal for each time period (e.g., one-minute cycle) set by the communication terminal 2 over a set observation period (e.g., five hours). The acquired frequency spectrum includes the intensity of each of M frequency components. The acquired frequency spectrum is also linked to the identification information of the communication terminal 2 that sent it and the time of transmission. The acquisition unit 10 collects time-series data of the signals measured by each of the multiple communication terminals 2 and performs a Fourier transform on the collected signals to obtain the frequency spectrum. Here, "intensity" is a concept that includes the amplitude, power, or physical quantities corresponding to these of each frequency component, and also includes an embodiment in which a voltage value is used as intensity.

[0030] Here, when a frequency spectrum is acquired at a 1-minute cycle, the intensity of each of the frequency components 1 to M is, for example, x = (x1, x2, x3, x4, . . . , x M ) = (-90,-65,-90,-120,...,-90). This indicates that for one minute, an intensity of -90 [dBm] was observed at frequency f1, and an intensity of -65 [dBm] was observed at frequency f2. For example, an intensity of -120 [dBm] was observed at frequency f3, indicating that noise was occurring.

[0031] The learning unit 11 constructs a multivariate probability model using the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and generates a matrix representing the conditional independence (dependence) between the intensities of each of the plurality of frequency components by estimating parameters of the constructed multivariate probability model. More specifically, the learning unit 11 estimates parameters of a multivariate normal distribution model with a sample mean of 0 for multivariate data in which the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal measured by each of a plurality of communication terminals 2 are variables, by maximum likelihood estimation, and generates a precision matrix of the multivariate normal distribution model as a matrix representing the conditional independence between the intensities of each of the plurality of frequency components.

[0032] The learning unit 11 generates a first matrix Λ, which is a precision matrix for a first observation period, and a second matrix Λ, which is a precision matrix for a second observation period after the first observation period. The observation periods are monitoring periods for anomaly detection, and the first observation period is, for example, the first five hours, and the second observation period is, for example, the five hours immediately following the first observation period.

[0033] As described above, the learning unit 11 uses the intensity patterns of multiple frequency components as variables to learn the essential dependencies between variables. Here, (a) and (b) of Figure 2 show the directed graph used by the learning unit 11. Each node a, b, and c represents a variable and the intensity of each frequency component. Each edge represents a direct probability dependency. In the directed graph of (a) of Figure 2, the value of node c is unobserved. In this case, the joint probability distribution ρ(a, b, c) of variables a, b, and c is expressed by the following equation (1).

number

[0034] By marginalizing the variable c, it can be expressed as the following equation (2).

number

[0035] In the above equation (2), the two variables a and b are not independent, since they cannot generally be expressed as ρ(a)ρ(b). On the other hand, in the directed graph of Figure 2(b), variable c is observed. The joint probability ρ(a, b|c) when variable c is observed is expressed by the following equation (3).

number

[0036] In equation (3) above, when the value of the observed variable c, which is a common condition, is taken into consideration, we can see that variables a and b do not affect each other, i.e., they are independent. This is called conditional independence. By taking conditional independence into consideration, it is possible to extract the essential or true relationship between variables. For example, even if there appears to be a correlation between the intensity of one frequency component and the intensity of another frequency component, when the intensity of yet another frequency component is taken into consideration, the intensities of these multiple frequency components do not affect each other.

[0037] Here, as mentioned above, the intensity of each frequency component is expressed as the M-dimensional observation x = (x1, x2, , x M ) A data set D consisting of N observations x is expressed as D={x (1) ,x (2) ,···,x (M)}, this multivariate normal distribution model is expressed by the following equation (4).

number

[0038] In the above equation (4), μ is the sample mean when the observed value x is a sample, Σ is the covariance matrix, and |·| is the determinant. The learning unit 11 performs maximum likelihood estimation to find μ and Σ, which are parameters of the multivariate normal distribution model, from a dataset D of observed data. The log likelihood L(μ,Σ|D) of the dataset D is expressed by the following equation (5).

number

[0039] Substituting the above equation (4) into the above equation (5) gives the following equation (6).

number

[0040] The parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) in the above equation (6) are estimated as the most likely solution. For the most likely solution of the parameters μ and Σ, μ and Σ are respectively -1 Differentiating with and setting it to 0, the maximum likelihood solutions of the parameters μ and Σ are expressed by the following equations (7) and (8), respectively.

number

number

[0041] Inverse matrix Σ of parameters Σ -1 is called the precision matrix Λ. The precision matrix Λ can be obtained by calculating the inverse matrix of the above formula (8). Note that in the maximum likelihood estimation shown in the above formulas (7) and (8), if regularization is not effective and there is a risk of overlearning, the learning unit 11 can also perform estimation by applying maximum a posteriori estimation (MAP estimation) to the parameters μ and Σ.

[0042] Here, the correlation structure in a multivariate normal distribution is expressed by a graph model. Such a graph model is called a Gaussian graphic model. Below, we will explain how to calculate conditional probability when applying a multivariate normal distribution model to graph theory. In the multivariate normal distribution model of the above formula (4), the inverse matrix Σ of the parameter Σ is -1 When the precision matrix Λ is used and the parameter μ is set to 0, it is expressed by the following equation (9).

number

[0043] The ρ(x) in the above equation (9) is called a Gaussian graphic model. Under a multivariate normal distribution, the conditional probability ρ(x1,x2|x3,...,x M ) is expressed by the following equation (10).

number

[0044] The function of variables x1 and x2 in the above equation (10) is ρ(x) in the above equation (9), that is, N(x|0,Λ -1 ), so if we extract all the parts of the above equation (9) related to the variables x1 and x2, we obtain the relationship in the following equation (11).

number

[0045] where the conditional independence ρ(x1|x3, ,x M )ρ(x2|x3, ,x M The condition for satisfying this is given by the following equation (12):

number

[0046] Equation (12) above indicates that the values ​​of the first and second components of the precision matrix Λ are 0, i.e., there is no edge between variables x1 and x2, as in the directed graph of Figure 2, between variables a and b. Figures 3 and 4(a) and (b) are schematic diagrams showing the relationship between the correlation between variables on a Gaussian graphical model graph and the precision matrix Λ. The nodes in Figures 3(a) and 4(a) correspond to frequency components 1 to M and represent the intensity observed at each frequency component. Figure 3(a) also shows the correlation between variables based on the intensity of each of multiple frequency components, which are observed values ​​during a first observation period, and Figure 4(a) shows the correlation between variables based on the intensity of each of multiple frequency components, which are observed values ​​during a second observation period following the first observation period.

[0047] Figure 3(a) shows that there is a correlation between the second and ninth nodes, and between the third and thirteenth nodes, that is, between the intensities of these two frequency components, in the first observation period (solid edge). Also, in the precision matrix Λ shown in Figure 3(b), in addition to the diagonal components, there are at least two, nine components Λ. 2,9 , and ,3,13 components Λ 3,13 In the precision matrix Λ in Figure 3(b) and Figure 4(b), non-zero values ​​are represented by "*".

[0048] On the other hand, Figure 4(a) shows that in the second observation period, which follows the first observation period, the correlation between the third node and the thirteenth node, that is, the correlation between the intensities of the two frequency components corresponding to these nodes, has disappeared (the disappeared edge shown by the dotted line). Furthermore, Figure 4(a) shows that in the second observation period, the correlation between the intensities of the two frequency components corresponding to the second node and the ninth node is maintained (the solid edge). It also shows that in the second observation period, a new correlation has appeared between the intensities of the two frequency components corresponding to the third node and the M-3 node (the thick edge). At this time, the 3rd and 13th components Λ of the precision matrix Λ 3,13 changes from non-zero to zero, and the 2,9 component Λ 2,9 maintains non-zero values, and furthermore, the 3,M-3 component Λ 3,M-3 changes from a zero value to a non-zero value.

[0049] When there is no correlation between the intensities of two frequency components corresponding to two nodes under normal conditions where no abnormalities are occurring in the signal, a change in the value of the corresponding component of the precision matrix Λ from zero to a non-zero value indicates that the relationship between specific frequency components has been disrupted. The emergence of a new correlation between frequency components that are originally independent can be interpreted as an abnormal combination, such as the combination of originally unrelated spectral components, caused by a front-end abnormality or a disturbance in the filter characteristics, for example, when noise or the like increases inside the communication terminal 2. Furthermore, a subsequent change (return) of the value of the component from a non-zero value to zero can be interpreted as the elimination of the effects of noise or the like inside the communication terminal 2, and the respective relationships between these frequency components have returned to normal.

[0050] When there is a correlation between the intensities of two frequency components corresponding to two nodes in a normal state where no signal abnormality occurs, a change in the value of the corresponding component of the precision matrix Λ from a non-zero value to a zero value can be said to indicate that the relationship between specific frequency components that were originally correlated has been disrupted. For example, this would occur if a part of the receiving unit of the communication terminal 2 malfunctioned, causing the relationship between specific frequency components to be lost because the communication terminal 2 did not properly perform its original signal processing. In this way, in this embodiment, the disappearance of the correlation between frequency components that were originally correlated is considered to be the occurrence of a signal abnormality.

[0051] If the value of a specific component of the precision matrix Λ is zero, it means that the two corresponding variables are conditionally independent. Therefore, it is possible to determine anomalies in a signal by looking only at the direct relationship between the variables in the precision matrix Λ, without being affected by noise or indirect relationships. Note that, in order to be able to use the above formula (9), the learning unit 11 may construct a multivariate normal distribution model after setting the sample mean μ to 0. In this case, the learning unit 11 calculates the n-th element x of the data set D. (n) (n=1 N) (observation value) m-th element (m=1 M)x m (n) After performing a standardization transformation expressed by the following equation (13) on (the intensity of multiple frequency components), the observed value x (n)A multivariate normal distribution model can be constructed using the following as a sample.

number

number

[0052] 1, the determination unit 12 determines an abnormality in a signal of a frequency spectrum including the intensities observed at each of two arbitrary frequency components among a plurality of frequency components, based on the value of a component indicating a conditional independence relationship between the intensities of these two frequency components in the precision matrix Λ (matrix) of the multivariate normal distribution model constructed by the learning unit 11 with the sample mean set to 0. The determination unit 12 determines a change in the correlation between the intensities of these two frequency components as an abnormality in the signal.

[0053] More specifically, the determination unit 12 compares the first matrix Λ for the first observation period with the second matrix Λ for the second observation period, and determines that an abnormal correlation has occurred between the intensities of these two frequency components and that an abnormality has occurred in the signal of the frequency spectrum including the intensities of these frequency components if a change in the value of the component indicating conditional independence between the intensities of two frequency components satisfies the following condition 1 or condition 2, or if the value of the component indicating conditional independence of the second matrix Λ for the second observation period satisfies condition 3. The determination unit 12 can determine that an abnormality has occurred in the signal if at least one of conditions 1 to 3 is satisfied.

[0054] More specifically, when comparing the value of a component in the first matrix Λ for the first observation period that indicates conditional independence between the intensities of two frequency components with the value of the corresponding component in the second matrix Λ for the second observation period, if the value changes from zero (0) to a non-zero value (other than 0), the determination unit 12 determines that an abnormality has occurred in the signal containing the intensities of these two frequency components (Condition 1). As shown in FIG. 3(a), the 3,M-3 component Λ of the precision matrix Λ (first matrix Λ) for the first observation period 3,M-3 was zero, whereas the 3 and M-3 components Λ of the precision matrix Λ (second matrix Λ) in the second observation period in Figure 4(a) 3,M-3 has changed to a non-zero value, satisfying condition 1. In condition 1, the intensity of frequency f3 and frequency f M-3 The occurrence of a new correlation between the intensity of the signal and the intensity of the signal is detected as an abnormality in the signal.

[0055] Furthermore, when comparing the value of a component in the first matrix Λ for the first observation period that indicates conditional independence between the intensities of two frequency components with the value of the corresponding component in the second matrix Λ for the second observation period, if the value changes from a non-zero value (other than 0) to a zero value (0), the determination unit 12 determines that an abnormality has occurred in the signal of the frequency spectrum that includes the intensities of these two frequency components (Condition 2). 3,13 was a non-zero value, whereas the 3rd and 13th components Λ of the precision matrix Λ (second matrix Λ) in the second observation period in Figure 4(a) 3,13 has changed to zero, which corresponds to condition 2. In condition 2, the intensity of frequency f3 and the intensity of frequency f 13 The loss of correlation between frequency components that are normally correlated is detected as a signal abnormality.

[0056] Furthermore, when the value of a component in the first matrix Λ for the first observation period that indicates conditional independence between the intensities of two frequency components is compared with the value of the corresponding component in the second matrix Λ for the second observation period, if the value of the corresponding component in the second matrix Λ for the second observation period exceeds a set threshold, the determination unit 12 determines that an abnormality has occurred in the signal of the frequency spectrum that includes the intensities of these frequency components (condition 3). As shown in (a) of Figure 3, the 2nd and 9th components of the precision matrix Λ (first matrix Λ) for the first observation period are 2,9 , and the 2nd and 9th components Λ of the precision matrix Λ (second matrix Λ) in the second observation period in Figure 4(a). 2,9 Even if both are non-zero, the second and ninth components Λ 2,9 exceeds the threshold, condition 3 is met. That is, the third condition is determined by using the value of the component in the first observation period as a reference and determining whether the value of the corresponding component in the second observation period exceeds the threshold.

[0057] The determination unit 12 may, for example, set the conditional expression of the third condition as follows: i,j ) / (first observation period component Λ i,j ) ≧2 can be used. The threshold value in the conditional expression can be set arbitrarily. In condition 3, a stronger correlation between the intensity of frequency f2 and the intensity of frequency f9 is detected as a signal abnormality. In determining based on condition 3, condition 3 can be set to be met when the intensities of the same two frequencies match a certain number of times in succession (for example, 10 times in succession).

[0058] In this way, the determination unit 12 determines whether or not there is an abnormality between frequency components by focusing on non-zero elements that are sparse representations of the precision matrix Λ. Note that the determination unit 12 can perform the determination process taking into consideration the cases where the values ​​of components other than the diagonal components of the precision matrix Λ are non-zero, as well as the possibility that component values ​​that are essentially zero may take on slightly non-zero values ​​due to noise, sampling error, etc.

[0059] The notification unit 13 issues an alarm when the determination unit 12 determines that a signal abnormality has occurred. Specifically, the notification unit 13 issues an alarm to the operation center 3 via the network NW, the alarm including time information of the determination target period, values ​​of two frequency components included in the signal determined to be abnormal, their intensities, and information indicating which of conditions 1 to 3 the signal corresponds to.

[0060] The storage unit 14 stores the parameters μ and Σ of the multivariate normal distribution model estimated by the learning unit 11 through learning, and the precision matrix Λ generated by the learning unit 11 .

[0061] [Hardware configuration of the anomaly detection device] Next, an example of a hardware configuration for realizing the abnormality detection device 1 having the above-described functions will be described with reference to FIG.

[0062] 5, the abnormality detection device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) device 106, all of which are connected via a bus 101, and a program that controls these hardware resources. The abnormality detection device 1 further includes a display device 107.

[0063] The processor 102 is a circuit or device that performs arithmetic processing, and is realized by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. Alternatively, the processor 102 may be configured by combining some or all of these.

[0064] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the anomaly detection device 1, such as the acquisition unit 10, learning unit 11, determination unit 12, and notification unit 13 shown in FIG.

[0065] The communication interface 104 is an interface circuit for connecting the abnormality detection device 1 and various external electronic devices via a network. The communication interface 104 realizes at least a part of the configuration of the notification unit 13.

[0066] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0067] The auxiliary storage device 105 has a program storage area for storing the anomaly detection program. The auxiliary storage device 105 also has a program storage area for storing a learning program that estimates parameters using a multivariate normal distribution model executed by the anomaly detection device 1 and generates a precision matrix. The auxiliary storage device 105 realizes the storage unit 14 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0068] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0069] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display the spectrum of the signal in which an abnormality has occurred and information about the communication terminal 2 on the screen.

[0070] [Operation of the anomaly detection device] Next, the operation of the abnormality detection system including the abnormality detection device 1 having the above-described configuration will be described with reference to the sequence of FIG.

[0071] 6, first, the abnormality detection device 1 periodically receives the frequency spectrum of a signal from the communication terminal 2 (step S1). Next, the acquisition unit 10 of the abnormality detection device 1 acquires the intensity of each of a plurality of frequency components included in the frequency spectrum received in step S1 (step S2).

[0072] In step S2, the acquiring unit 10 acquires the intensity of each frequency component of the frequency spectrum for each set time period (e.g., one-minute cycle) over a set observation period (e.g., five hours). The acquiring unit 10 acquires the intensity of the frequency spectrum for the first five hours as a first observation period and the immediately following five hours as a second observation period, thereby sequentially acquiring the intensity of each frequency component for each observation period. Next, the acquiring unit 10 creates a data set D of the observation value x from the intensities of 1 to M frequency components for each time period acquired in step S2 (step S3).

[0073] In step S3, the acquisition unit 10 acquires the intensities of the frequency components for each time period (1-minute period) over an observation period (5 hours) as M-dimensional observation values ​​x=(x1, x2, . . . , x M ) based on the data set D consisting of N observations x, let D={x (1) ,x (2) ,···,x (M) For example, if the intensity of each frequency component is obtained in one-minute increments over a five-hour observation period, then observed values ​​x, which are the intensities of N=300 frequency components 1 to M, are obtained.

[0074] Next, the learning unit 11 estimates the parameters μ and Σ of a multivariate normal distribution model by maximum likelihood estimation, with the sample mean set to 0 for a dataset D, which is multivariate data with the intensities of each of a plurality of frequency components as variables (step S4). In step S4, the learning unit 11 uses the above equation (6) to estimate the parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) as the maximum likelihood solution (the above equations (7) and (8)).

[0075] Next, the learning unit 11 generates a precision matrix Λ of the multivariate normal distribution model as a matrix indicating the conditional independence between the intensities of the two frequency components (step S5). In step S5, the learning unit 11 generates an inverse matrix Σ of the parameters Σ estimated in step S4. -1 Since steps S4 and S5 are processes performed for each dataset D created for each observation period, a precision matrix Λ is generated for each observation period, and here a first matrix Λ is generated for the dataset D of the first observation period, and a second matrix Λ is generated for the dataset D of the second observation period.

[0076] Next, the determination unit 12 compares the first matrix Λ, which is the precision matrix Λ for the first observation period generated in step S5, with the second matrix Λ, which is the precision matrix Λ for the second observation period, and determines that an abnormality has occurred in the signal containing the intensity of the frequency component whose correlation has changed if at least one of conditions 1 to 3 is satisfied (step S6). In step S6, a determination process is performed for each pair of frequency components represented by each component of the precision matrix Λ.

[0077] In step S6, when the value of a component indicating conditional independence between the intensities of two frequency components in the first matrix Λ for the first observation period is compared with the value of the corresponding component in the second matrix Λ for the second observation period, if the value changes from 0 to a value other than 0, the determination unit 12 determines that an abnormality has occurred in the signal of the frequency spectrum including the intensities of the two frequency components whose correlation has changed (condition 1).

[0078] Furthermore, in step S6, when the value of a component indicating conditional independence of the intensities of two frequency components in the first matrix Λ for the first observation period is compared with the value of the corresponding component in the second matrix Λ for the second observation period, if the value changes from non-zero to 0, the judgment unit 12 judges that an abnormality has occurred in the signal of the frequency spectrum including the intensities of the two frequency components whose correlation has changed (condition 2).

[0079] Furthermore, in step S6, the determination unit 12 compares the value of a component in the first matrix Λ for the first observation period that indicates conditional independence between the intensities of two frequency components with the value of the corresponding component of the second matrix Λ for the second observation period, and if the value of the corresponding component of the second matrix Λ for the second observation period exceeds a threshold, the determination unit 12 determines that an abnormality has occurred in the signal of the frequency spectrum that includes the intensities of the two frequency components whose correlation has changed (condition 3). For example, the determination unit 12 sets the conditional expression for the third condition as follows: i,j ) / (first observation period component Λ i,j ) ≧2 can be used.

[0080] Next, the notification unit 13 notifies the operation center 3 via the network NW of an alarm including time information of the determination period, the values ​​of two frequency components whose correlation has changed and which are included in the frequency spectrum of the signal determined to have an abnormality, the intensities of these frequency components, and information indicating which of conditions 1 to 3 has been met (step S7). In step S7, an alarm is notified if any one of conditions 1 to 3 is met in the determination process in step S6. In addition, in the case of condition 3, an alarm can be notified if the intensities of the same two frequency components exceed a threshold value a certain number of times in succession (for example, 10 times in succession).

[0081] As explained in Figs. 3 and 4, the 3rd and 13th components Λ of the first matrix Λ and the second matrix Λ 3,13 has changed from a zero value to a non-zero value, satisfying Condition 1. Therefore, in step S7, the notification unit 13 notifies the time information of the observation period to be determined, the frequencies f3 and f M-3 An alarm including the intensity of these frequency components and information indicating that condition 1 is met is notified to the operation center 3.

[0082] On the other hand, if conditions 1 to 3 are not satisfied for any of the components of the first matrix Λ and the second matrix Λ, no signal abnormality has occurred during the observation period being determined, so no alarm notification is issued (step S7: NO), and the process returns to step S2. In this way, the precision matrix Λ is generated based on the observation values ​​during the observation periods that are acquired sequentially over time, and a determination is made as to whether or not there is a signal abnormality for each observation period, and an alarm is issued.

[0083] Next, upon receiving the alarm notification, the operations center 3 remotely performs management, including remote diagnosis, of the communications terminal 2 in which a signal abnormality may have occurred (step S8). For example, the operations center 3 can send an additional self-diagnosis command to collect hardware status reports (temperature, power supply voltage, RF front-end status, etc.) from the communications terminal 2. The operations center 3 can determine whether there is a possible hardware malfunction in the communications terminal 2, and can remotely reboot the communications terminal 2, change measurement conditions, restrict communications use, or notify the communications terminal 2 to request repair or replacement.

[0084] Similarly, if the intensities of the two frequency components satisfy condition 2 and condition 3, an abnormality occurs in the measured signal, and management including remote diagnosis is performed on the communication terminal 2 that is at risk of malfunction. In this way, the abnormality detection system sequentially repeats steps S2 to S8 each time a precision matrix Λ is generated for each observation period, and monitors abnormalities in the signal measured by the communication terminal 2.

[0085] As described above, the anomaly detection device 1 according to this embodiment constructs a multivariate model based on the intensity of each frequency component included in the frequency spectrum of a signal for each observation period, and determines the precision matrix Λ, which represents the conditional independence between the intensities of each of the multiple frequency components. This determines whether an abnormal correlation has occurred between the intensities of any two frequency components that should normally be independent, and detects a signal anomaly based on the result. Therefore, it is possible to detect a signal anomaly even when there is little measurement data of the abnormal signal.

[0086] Furthermore, the anomaly detection device 1 according to this embodiment performs a time-series comparison of each component of the precision matrix Λ generated for each monitoring period in response to the time-dependent acquisition of the frequency spectrum, and detects signal anomalies based on changes in the correlation between the intensities of the frequency components. This makes it possible to respond to measurement signals that change in real time and detect signal anomalies in real time.

[0087] Furthermore, according to the anomaly detection device 1 of this embodiment, even if there is little observation data related to the intensities of abnormal frequency components contained in the frequency spectrum, learning can be performed without using the intensities of the frequency components of the abnormal signal by using only the observation data of the intensities of each frequency component in the frequency spectrum of the signal in a normal state where no abnormality has occurred as the learning target and modeling the statistical relationship (conditional dependency) between the intensities of the frequency components in the normal state. As a result, when a change in the correlation between the intensities of frequency components that is different from normal is observed, it becomes possible to detect an abnormality in the signal from the inconsistency with the model of the pattern of the intensities of the frequency components in the normal state.

[0088] In the embodiment described above, the learning unit 11 employs a Gaussian graphic model to analyze conditional independence through a precision matrix, which is the inverse matrix of the covariance matrix. However, the algorithm employed by the learning unit 11 is not limited to the Gaussian graphic model. For example, in sparse estimation such as Graphical Lasso, it can be employed in combination with Maximum A Posteriori Estimation (MAP). Alternatively, Bayesian network structure learning can be employed.

[0089] The above describes embodiments of the anomaly detection device and anomaly detection method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0090] 1...anomaly detection device, 2...communication terminal, 3...operation center, 10...acquisition unit, 11...learning unit, 12...judgment unit, 13...notification unit, 14...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, NW...network.

Claims

1. a learning unit configured to construct a multivariate probabilistic model using the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and to generate a matrix representing a conditional dependency between the intensities of the plurality of frequency components by estimating parameters of the constructed multivariate probabilistic model; a determination unit configured to determine an abnormality in a signal of a frequency spectrum including intensities of any two frequency components based on a value indicating the conditional dependency between the intensities of the two frequency components among the plurality of frequency components in the matrix generated by the learning unit; and An abnormality detection device comprising:

2. 2. The abnormality detection device according to claim 1, The learning unit estimates the parameters of a multivariate normal distribution model, in which a sample mean is set to 0 for multivariate data having the intensities of the plurality of frequency components as variables, by maximum likelihood estimation, to generate a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the intensities of the plurality of frequency components. An abnormality detection device characterized by:

3. 3. The abnormality detection device according to claim 2, the learning unit generates a first matrix that is the matrix in a first observation period and a second matrix that is the matrix in a second observation period after the first observation period; The determination unit further a change from a zero value to a non-zero value when comparing the value of an element in the first matrix that indicates the conditional dependency between the intensities of the two frequency components with the value of a corresponding element in the second matrix; a change from a non-zero value to a zero value when comparing the value of an element in the first matrix that indicates the conditional dependency between the intensities of the two frequency components with the value of the corresponding element in the second matrix; the value of the corresponding element of the second matrix exceeds a threshold value; and determining an anomaly in the signal based on at least one of the following conditions: An abnormality detection device characterized by:

4. 2. The abnormality detection device according to claim 1, Further, an acquisition unit configured to acquire the intensity of each of the plurality of frequency components. An abnormality detection device characterized by:

5. 2. The abnormality detection device according to claim 1, Further, a notification unit configured to notify an alarm when the determination unit determines that the signal is abnormal is included. An abnormality detection device characterized by:

6. a learning step of constructing a multivariate probabilistic model using the intensities of each of a plurality of frequency components included in the frequency spectrum of a signal observed in each time period within an observation period, and estimating parameters of the constructed multivariate probabilistic model to generate a matrix representing the conditional dependence between the intensities of the plurality of frequency components; a determining step of determining an abnormality in a signal of a frequency spectrum including intensities of any two frequency components based on a value indicating the conditional dependency between the intensities of the two frequency components among the plurality of frequency components in the matrix generated in the learning step; An anomaly detection method comprising:

7. 7. The anomaly detection method according to claim 6, The learning step generates a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the intensities of the plurality of frequency components by estimating the parameters of the multivariate normal distribution model by maximum likelihood estimation, with a sample mean of 0 for multivariate data in which the intensities of the plurality of frequency components are variables.

1. An anomaly detection method comprising:

8. The anomaly detection method according to claim 7, the learning step generates a first matrix that is the matrix in a first observation period and a second matrix that is the matrix in a second observation period after the first observation period; The determining step further comprises: a change from a zero value to a non-zero value when comparing the value of an element in the first matrix that indicates the conditional dependency between the intensities of the two frequency components with the value of a corresponding element in the second matrix; a change from a non-zero value to a zero value when comparing the value of an element in the first matrix that indicates the conditional dependency between the intensities of the two frequency components with the value of the corresponding element in the second matrix; the value of the corresponding element of the second matrix exceeds a threshold value; The abnormality of the signal is determined based on at least one of the following conditions:

1. An anomaly detection method comprising:

9. 7. The anomaly detection method according to claim 6, Further, an acquisition step of acquiring the intensity of each of the plurality of frequency components is provided.

1. An anomaly detection method comprising:

10. 7. The anomaly detection method according to claim 6, Further, the method includes a notification step of issuing an alarm when an abnormality in the signal is determined in the determination step.

1. An anomaly detection method comprising:

Images