Information processing device, information processing method, and program

Abstract

To execute detection of a state based on time-series data with higher accuracy.SOLUTION: An information processing device incudes a similarity calculation unit and a determination unit. The similarity calculation unit calculates first similarities between a plurality of probabilistic models each obtained by modeling a probability of a value, at each time, of time-series data whose data length is a specific value, and a plurality of pieces of partial time-series data whose data length is the specific value, the plurality of pieces of partial time series data being contained in target time-series data to be diagnosed. The determination unit determines a plurality of pieces of matching information including positions of the partial time-series data in the target time-series data, first probabilistic models whose first similarities with respect to the partial-time series data at the positions are larger than other probabilistic models, and the first similarities to the first probabilistic models.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Technologies for detecting conditions such as anomalies in time-series data such as industrial data and biological data are required not only to simply detect conditions (anomalies) but also to clarify the basis for determining the conditions (anomalies).A known anomaly detection technology that can present the basis for determining an anomaly is one that learns partial time-series patterns contained in normal time-series data, and when diagnosing an anomaly, detects differences from the learned partial time-series patterns and presents them as the basis for determining an anomaly. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6877245 [Patent Document 2] International Publication No. 2022 / 054256 Summary of the Invention [Problem to be solved by the invention]

[0004] An object of the present invention is to provide an information processing device, an information processing method, and a program that can detect a state based on time-series data with higher accuracy. [Means for solving the problem]

[0005] According to an embodiment, an information processing apparatus includes a similarity calculation unit and a determination unit. The similarity calculation unit calculates a first similarity between a plurality of probability models, each of which models a probability of a value at each time instant of time-series data having a specific data length, and a plurality of partial time-series data having a specific data length that is included in target time-series data to be diagnosed. The determination unit determines a plurality of matching information, each of which includes a first probability model having a higher first similarity between a position of the partial time-series data in the target time-series data and the partial time-series data at the position than other probability models, and the first similarity for the first probability model. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 10 is a diagram for explaining an example of anomaly detection when fluctuations are not taken into consideration. [Figure 2] FIG. 10 is a diagram for explaining an example of anomaly detection when fluctuations are taken into consideration. [Figure 3] FIG. 1 is a block diagram of an information processing apparatus according to a first embodiment. [Figure 4] 4 is a flowchart of a learning process according to the first embodiment. [Figure 5] 4 is a flowchart of a diagnostic process according to the first embodiment. [Figure 6] FIG. 10 is a diagram showing an example of output information. [Figure 7] FIG. 10 is a block diagram of an information processing apparatus according to a second embodiment. [Figure 8] 10 is a flowchart of a learning process according to the second embodiment. [Figure 9] FIG. 1 is a hardware configuration diagram of an information processing apparatus according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0007] A preferred embodiment of an information processing device according to the present invention will be described in detail below with reference to the accompanying drawings. The following describes an example in which an anomaly is detected as a state of time-series data. The detected state is not limited to an anomaly, and any state may be detected.

[0008] In time series data that is the target of anomaly detection, even normal time series data can have areas with large and small fluctuations. Conventional anomaly detection technology that uses partial time series does not reflect the magnitude of fluctuations when calculating the degree of anomaly, which can result in overestimating differences from partial time series with large fluctuations and underestimating differences from partial time series with small fluctuations.

[0009] Figure 1 is a diagram illustrating an example of anomaly detection when fluctuations are not taken into consideration. In the graph in Figure 1, the dotted line data shows an example of normal time-series data (data showing changes in detected values ​​over time). The solid line data shows an example of time-series data that is the subject of diagnosis. The upper graph corresponds to an example where there is a small difference between the two overall. The lower graph corresponds to an example where there is a large difference in the center, but where there is almost no difference between the two in other areas.

[0010] If fluctuations are not taken into consideration, for example, the time series data in the lower graph, which includes areas with large differences, will be diagnosed as having an abnormality, while the time series data in the upper graph, which includes only areas with small differences, will be diagnosed as not having an abnormality. However, for example, the central part may correspond to an area with large fluctuations, and there may be cases where an abnormality should not be determined even if the difference is large. Also, there may be cases where an abnormality should be determined even if the difference is small, and there may be cases where an abnormality should be determined even if the difference is small, because areas other than the central part correspond to areas with small fluctuations.

[0011] Therefore, in the following embodiment, it is possible to diagnose an abnormality by taking into account fluctuations in values ​​at each point in time of time series data. Fig. 2 is a diagram for explaining an example of abnormality detection when fluctuations are taken into account.

[0012] Lines 201a and 201b in Figure 2 are lines that indicate the upper and lower limits of the fluctuation, respectively. This means that for each time, fluctuation occurs in the range from the lower limit on line 201b that indicates the value at that time to the upper limit on line 201a that indicates the value at that time. For example, if differences within the fluctuation range are not judged to be abnormal, and differences beyond the fluctuation range are judged to be abnormal, the upper graph is judged to be abnormal because there is a difference that exceeds the fluctuation range at the early time point. The lower graph is not judged to be abnormal because the differences at all times are within the fluctuation range.

[0013] (First embodiment) The information processing device according to the first embodiment detects an abnormality by taking into consideration fluctuations in a partial time series included in time series data to be diagnosed (hereinafter referred to as target time series data). For example, the information processing device according to this embodiment has the following functions. (F1) A function to learn various partial time series patterns of similar time series data as a group of probabilistic models. (F2) A function to calculate the similarity between a partial time series (partial time series data) of the target time series data and a probabilistic model (F3) A function for referencing the similarity between a group of probability models and a group of partial time series data within a certain range of the target time series data, and determining the probability model and partial time series data at a position where the similarity is greater than (e.g., maximum) other probability models. (F4) A function to detect anomalies based on the similarity between target time series data and a group of probabilistic models

[0014] The target time series data is time series data of a single variable (univariate). For example, the target time series data is sensor data obtained by a sensor that detects physical quantities such as current and pressure of a certain device, and biological signal data such as ECG (ElectroCardioGram) and EEG (ElectroEncephaloGram). The target time series data is not limited to these, and may be any time series data.

[0015] The sensor data may be the sensor's detected value itself, a statistical value of the detected value (average, maximum, minimum, standard deviation, etc.), or a calculated value of the detected values ​​of multiple sensors of the same or different types (for example, power obtained by multiplying current and voltage).

[0016] 3 is a block diagram showing an example of the configuration of the information processing device 100 according to the first embodiment. As shown in FIG. 3, the information processing device 100 includes a receiving unit 101, a learning unit 102, a similarity calculation unit 103, a determining unit 104, a detecting unit 105, an output control unit 106, and a storage unit 121.

[0017] The information processing device 100 has two operation phases: a learning phase and a diagnosis phase. In the learning phase, a plurality of probabilistic models (a group of probabilistic models) are learned by probabilistically modeling a plurality of representative partial time series patterns from a group of similar time series data. In the diagnosis phase, the trained group of probabilistic models is used to diagnose anomalies in the target time series data.

[0018] In the learning phase, mainly used are the reception unit 101, the learning unit 102, and the storage unit 121. In the diagnosis phase, mainly used are the reception unit 101, the similarity calculation unit 103, the determination unit 104, the detection unit 105, and the output control unit 106.

[0019] The receiving unit 101 receives input of various data used in the information processing device 100. For example, the receiving unit 101 receives input of learning data used for learning by the learning unit 102, target time-series data, and the like.

[0020] The learning unit 102 learns a plurality of probability models using a plurality of time-series data (a group of time-series data) input as learning data ((F1) above). For example, the learning unit 102 learns a plurality of probability models using a plurality of time-series data for learning. Through learning, a probability model is obtained that models the probability of values ​​at each time of time of time-series data whose data length is a specific value L. For example, each probability model is a multidimensional probability distribution model defined using a mean and a variance, where L is the number of dimensions. The data length represents the length of the time-series data, and is, for example, the number of elements included in the time-series data. When each element is obtained at regular intervals, the data length may be represented by the length of time.

[0021] The storage unit 121 stores various data used in the information processing device 100. For example, the storage unit 121 stores data accepted by the accepting unit 101 and data related to the probabilistic model learned by the learning unit .

[0022] The storage unit 121 can be configured from any commonly used storage medium such as a flash memory, a memory card, a RAM (Random Access Memory), an HDD (Hard Disk Drive), and an optical disk.

[0023] The similarity calculation unit 103 calculates the similarity (first similarity) between the plurality of probability models obtained in the learning phase and the plurality of partial time series data included in the target time series data ((F2) above). For example, the similarity calculation unit 103 calculates the similarity between each of the plurality of probability models and the plurality of partial time series data with a data length of L included in the target time series data.

[0024] The determining unit 104 repeatedly performs a process of matching the partial time series data with the most similar probability model until the partial time series data covers the entire target time series data. The determining unit 104 determines and outputs a plurality of pieces of matching information as information indicating the matching result, including the position of the partial time series data within the target time series data, a probability model (first probability model) whose similarity between the partial time series data at that position is greater than that of other probability models, and the similarity to the first probability model. A similarity greater than that of other probability models means, for example, that the similarity is maximum. The following describes the case where the similarity is maximum as an example.

[0025] For example, the determination unit 104 determines partial time series data that has the maximum similarity with one of multiple probability models from multiple partial time series data that each start at multiple positions within the range from the most recently set position to a specific value. The determination unit 104 determines matching information including the determined partial time series data, the probability model that has the maximum similarity between the determined partial time series data, and the maximum similarity. The determination unit 104 repeatedly performs this process multiple times so that the determined partial time series data covers the entire target time series data, and outputs multiple pieces of matching information.

[0026] The process by the determination unit 104 can be interpreted as a process of sequentially determining a plurality of probability models that best fit the target time-series data from among various patterns of probability models obtained in advance ((F3) above).

[0027] The detection unit 105 detects an anomaly in the target time series data using the multiple similarities included in the multiple matching information ((F4) above). For example, the detection unit 105 detects an anomaly in the target time series data when the minimum value of the multiple similarities is smaller than a threshold value.

[0028] The output control unit 106 controls the output of various data used in the information processing device 100. For example, the output control unit 106 outputs the detection result by the detection unit 105. The output control unit 106 may output output information including a normal range in which the time-series data is assumed to be normal. The normal range can be determined using, for example, the mean and variance of a probability model.

[0029] The output method by the output control unit 106 may be any method, but for example, a method of displaying on a display device such as an LCD display, a method of outputting to a recording medium using an image forming device such as a printer, or a method of transmitting data to an external device (a server, another information processing device, etc.) can be applied.

[0030] Each of the above units (reception unit 101, learning unit 102, similarity calculation unit 103, determination unit 104, detection unit 105, and output control unit 106) is realized, for example, by one or more processors. For example, each of the above units may be realized by having a processor such as a CPU (Central Processing Unit) execute a program, i.e., by software. Each of the above units may be realized by a processor such as a dedicated IC (Integrated Circuit), i.e., by hardware. Each of the above units may be realized by a combination of software and hardware. When multiple processors are used, each processor may realize one of the units, or two or more of the units.

[0031] The above-mentioned units may be distributed across multiple physically different devices. For example, the components used in the learning phase (receiving unit 101, learning unit 102, storage unit 121, etc.) and the components used in the diagnosis phase (receiving unit 101, similarity calculation unit 103, determination unit 104, detection unit 105, output control unit 106, storage unit 121, etc.) may be configured to be provided in different devices (two servers, etc.). Some or all of the above-mentioned units may be provided in a server built in a cloud environment.

[0032] Next, a learning process performed by the information processing device 100 according to the first embodiment will be described. The learning process is a process executed in the learning phase. Fig. 4 is a flowchart showing an example of the learning process according to the first embodiment.

[0033] The receiving unit 101 receives input of learning data from an external device or the like (step S101). The learning data is, for example, a time-series data group X, which is a collection of similar time-series data. The time-series data group X does not have teacher information such as normal labels and abnormal labels. The time-series data group X includes N univariate time-series data x. Each time-series data x has a data length of T. That is, each time-series data x includes T points. Each element of each time-series data x is denoted by x1,...,x T It is expressed as:

[0034] The learning unit 102 receives the time-series data group X and learns K probabilistic models M that probabilistically model the patterns of partial time-series data with a data length L included in the time-series data group X (step S102). K is specified in advance as, for example, the number of probabilistic models M to be obtained by learning.

[0035] Below, we refer to each probability model as M k (k=1, ,K). The probabilistic model M k is expressed as a multidimensional probability distribution with the number of dimensions equal to the data length L of the partial time series data. In this embodiment, a normal distribution with mean μ and covariance matrix Σ is assumed. Here, each dimension of the mean μ and covariance matrix Σ corresponds to each data point of the partial time series data. Each data point, i.e., each dimension, is independent, and the covariance matrix Σ is a diagonal matrix. In other words, the probability model M is trained to be a multidimensional probability distribution with the number of dimensions L, where each dimension (each data point) is independent and the covariance matrix Σ is a diagonal matrix.

[0036] The learning method may be any method that can learn the above-described probability model M from the time-series data group X. For example, the learning unit 102 may use a machine learning method such as Gaussian mixture model clustering, or may use a method that combines a k-means method, a statistical method, and an optimization method. Furthermore, the probability model is not limited to a normal distribution, and other probability distributions such as an exponential distribution may also be used.

[0037] The learning unit 102 stores the learned K probability models in the storage unit 121 (step S103), and ends the learning process.

[0038] Next, a description will be given of the diagnostic processing by the information processing device 100 according to the first embodiment. The diagnostic processing is processing executed in the diagnostic phase. Fig. 5 is a flowchart showing an example of the diagnostic processing according to the first embodiment.

[0039] The receiving unit 101 receives input of target time series data x from an external device or the like (step S201). The target time series data x is the same type of data with a data length T as the time series data group X used as learning data.

[0040] The similarity calculation unit 103 sets a matching range (step S202). The matching range refers to a certain range that is determined as a range that includes the starting point of the partial time series data that is the target of calculating the similarity with the probabilistic model. The matching range is set, for example, as a range from the most recently set position (matching position) to the data length L. The matching position refers to the position of the starting point of the partial time series data that was determined in the most recent iterative process as the partial time series data that maximizes the similarity with one of the multiple probabilistic models. Note that in the first iterative process, only the beginning of the target time series data is set as the matching range.

[0041] The flow of the iterative process in this embodiment is similar to, for example, the flow of the fitting process described in Patent Document 1. The fitting process differs from this embodiment in that it does not use a probabilistic model that models the probability of values ​​at each time of time series data.

[0042] The similarity calculation unit 103 calculates the similarity between one or more partial time series data pieces that start within the matching range and are included in the target time series data x, and each of the plurality of probability models included in the probability model group (step S203).

[0043] Below, the partial time series data from the i-th point to the i+L-1-th point of the target time series data x is expressed as x [i , i+L-1] =[x i ,···,x i+L-1 ]. Also, x [i , i+L] and the kth (1≦k≦K) probability model M k The similarity between and is D i , k It is expressed as:

[0044] In the first iteration, the similarity calculation unit 103 calculates one partial time series data x from the first point to the Lth point of the target time series data x. [1 , L] =[x1, ,x L ] and K probabilistic models M1,...,M K K similarities (group of similarities) between each 1,1 ···,D 1,K Calculate.

[0045] The similarity may be any information indicating the degree of similarity between the partial time-series data and the probabilistic model. For example, the similarity calculation unit 103 may calculate a value based on a distance of a probability distribution, such as the Kullback-Leibler distance or the Pearson distance, as the similarity.

[0046] The similarity calculation unit 103 extends the partial time series data to a probabilistic model, and compares the extended probabilistic model with a plurality of probabilistic models M kFor example, when the Kullback-Leibler distance is used, the similarity calculation unit 103 calculates a value based on the distance between the partial time series data x [1 , L] = partial time series data x [i,i+L-1] and covariance matrix Σ k The normal probability distribution P=N(x [i,i+L-1] ,Σ k The similarity calculation unit 103 calculates the expanded probability distribution (an example of a probability model) and the probability model M k The probability distribution Q=N(x [i,i+L-1] ,Σ k ) and calculate the Kullback-Leibler distance KL(P,Q).

[0047] The larger the Kullback-Leibler distance, the smaller the similarity. Therefore, the similarity calculation unit 103 uses, as the similarity, a value obtained by a calculation to find the reciprocal of the Kullback-Leibler distance, or by a calculation to convert the Kullback-Leibler distance to a negative value and input the result into an exponential function with the Napier's number as the base.

[0048] The similarity calculation unit 103 may calculate the similarity by a method using logarithmic likelihood without using the distance of the probability distribution. For example, if the probability density function of a multivariate normal distribution with mean μ and covariance matrix Σ as parameters is f(x|μ,Σ), the similarity calculation unit 103 calculates the similarity by a method using logarithmic likelihood without using the distance of the probability distribution. [i,i+L-1] and Model M K The similarity between [i,i+L-1] |μ,Σ).

[0049] The determining unit 104 determines the probability model with the maximum similarity and the position (matching position) of the partial time series data, and outputs matching information including the partial time series data starting from the determined position, the probability model with the maximum similarity to the partial time series data, and the maximum similarity (step S204). For example, the determining unit 104 first 1,1 ···,D 1,KThe probabilistic model with the largest similarity is selected. The probabilistic model with the largest similarity represents the model that is closest to the target time series data x. The determination unit 104 outputs the matching information to the similarity calculation unit 103 and the detection unit 105. Note that in the first iteration of the process, the matching position is 1.

[0050] The determining unit 104 determines whether the processing has been completed up to the final position of the target time series data (step S205). For example, when the matching position is the TL-th point of the target time series data, the determining unit 104 determines that the processing has been completed up to the final position. This determination corresponds to determining whether the processing of matching the partial time series data with the most similar probabilistic model has been completed until the partial time series data covers the entire target time series data.

[0051] If the processing has not been performed up to the final position of the target time series data (step S205: No), the process returns to step S202, the next matching range is set, and the processing is repeated. The second and subsequent repeated processing is performed, for example, as follows.

[0052] The similarity calculation unit 103 sets a matching range by referring to the matching position output immediately before by the determination unit 104. If the matching position output immediately before is j, the range from j+1 to the position plus the data length L is set as the matching range (step S202).

[0053] The similarity calculation unit 103 calculates a set of L partial time series data x in the target time series data x, with any point within the matching range as the starting point (start position). [j+1,j+L] ,···,x [j+L,j+2L-1] and a set of K probabilistic models M1,...,M K The similarity is calculated for all combinations of (L×K) (step S203). As a result, L×K similarities are calculated.

[0054] However, if j+2L exceeds the time series length T of x, the similarity calculation unit 103 calculates the partial time series data set x [j+1,j+1+L] ,···,x [T-L,T]and a set of K probabilistic models M1,...,M K The similarity groups are calculated for all combinations of

[0055] The determining unit 104 determines the calculated similarity group D i,k The maximum similarity among (i=j+1, . . . , j+L, k=1, . . . , K) is determined, and matching information is output (step S204).

[0056] If it is determined in step S205 that the processing has been completed up to the final position of the target time series data (step S205: Yes), the detection unit 105 refers to the matching sequence and detects whether or not there is an abnormality in the target time series data (step S206). The matching sequence is, for example, information in which the matching information output so far is arranged in order.

[0057] For example, the detection unit 105 calculates the degree of anomaly from the matching sequence. The degree of anomaly may be, for example, a statistical value regarding the multiple similarities (similarity sequence) included in the matching sequence, or a value calculated for the multiple similarities. The statistical value may be, for example, the minimum value among the multiple similarities, the maximum value among the multiple similarities, or the average value among the multiple similarities. If the calculated degree of anomaly is smaller than a predetermined threshold, the detection unit 105 determines that an anomaly has occurred.

[0058] The output control unit 106 outputs the abnormality detection result (step S207). The output control unit 106 may output only the determination result indicating whether the abnormality is normal or abnormal, or may output information based on the matching information in addition to the determination result. For example, when the minimum value among multiple similarities is used as the abnormality degree, the output control unit 106 outputs the matching position corresponding to the similarity with the minimum value among the matching positions included in the matching information as the abnormal location.

[0059] As described above, the output control unit 106 may output output information including a normal range. For example, when the probability model is a normal distribution, the output control unit 106 may add the diagonal components (σ) of the covariance matrix Σ to the mean parameter μ of the probability model. 2 1, ,σ2 L ) times p (p is a real number greater than 0) is subtracted from the normal range as the lower limit, and the mean parameter μ is multiplied by the diagonal components of the covariance matrix Σ (σ 2 1, ,σ 2 L ) multiplied by p is used as the upper limit of the normal range to determine the normal range. The output control unit 106 outputs the normal range in the target time-series data x based on the matching position included in the matching information. In this way, the output control unit 106 can output information including the normal range as the basis for determining an abnormality.

[0060] Fig. 6 is a diagram showing an example of output information 600. As shown in Fig. 6, the output information 600 includes target time series data 601, a matching position 602 including an abnormality, and a normal range 611. The target time series data 601 is data in which the right direction represents time and the upward direction represents values. The normal range 611 corresponds to a range surrounded by an upper limit taken in the upward direction and a lower limit taken in the downward direction, with the value of each time of the target time series data 601 at the center.

[0061] In this way, in the first embodiment, an anomaly in the target time series data to be diagnosed is detected using a probabilistic model that takes into account fluctuations at each point in time in the time series data, thereby enabling anomaly detection based on time series data to be performed with higher accuracy.

[0062] (Second embodiment) The information processing device according to the second embodiment further considers a chain model that models a chain pattern that represents the characteristics of the appearance order of a probabilistic model. For example, the information processing device according to the present embodiment is additionally provided with a function for learning the chain model and a function for calculating the similarity taking the chain model into consideration.

[0063] Fig. 7 is a block diagram showing an example of the configuration of an information processing device 100-2 according to the second embodiment. As shown in Fig. 7, the information processing device 100-2 includes a receiving unit 101, a learning unit 102-2, a similarity calculation unit 103-2, a determining unit 104, a detecting unit 105, an output control unit 106, and a storage unit 121-2.

[0064] In the second embodiment, the functions of the learning unit 102-2, the similarity calculation unit 103-2, and the storage unit 121-2 are different from those in the first embodiment. The other configurations and functions are the same as those in FIG. 3, which is a block diagram of the information processing device 100 according to the first embodiment, so the same reference numerals are used and the description thereof will be omitted here.

[0065] The learning unit 102-2 differs from the learning unit 102 of the first embodiment in that it further includes a function for learning a chain model. For example, the learning unit 102-2 models the probability that another probability model MB appears after a certain probability model MA as a discrete distribution (e.g., a categorical distribution), and learns using Bayesian estimation. The method for learning the chain model is not limited to this, and any method may be used as long as it models and learns the pattern of the order in which probability models appear.

[0066] The similarity calculation unit 103-2 differs from the similarity calculation unit 103 of the first embodiment in that it takes into account the similarity with the chain model when calculating the similarity. The similarity with the chain model is calculated independently from the similarity with the probabilistic model. For example, the similarity between the partial time series data and the chain model is the likelihood with respect to the chain model.

[0067] The similarity calculation unit 103-2 calculates the similarity SA (first similarity) between the partial time series data and the probability model, for example, as follows. First, the similarity calculation unit 103-2 calculates the similarity SB (second similarity) between each of the partial time series data DA (first data) included in the L partial time series data groups and a plurality of probability models. Furthermore, the similarity calculation unit 103-2 refers to the probability model output from the immediately previous matching information, and calculates the likelihood of a chain model when a plurality of probability models match with the chain model as the similarity SC (third similarity). For example, if the immediately previous matching probability model is M, k1 , the probability model to be calculated is M k2 Then, the conditional probability p(M k2 |M k1 ) value (or its logarithm) is used as the likelihood. In the first loop where there is no previously matched probability model, the unconditional probability p(M k2 ) is used as the likelihood. The similarity calculation unit 103-2 then calculates the similarity SA by performing an operation using the similarity SB and the similarity SC. Any operation may be used at this time, and examples include addition, weighted addition, and multiplication.

[0068] The storage unit 121-2 further stores data relating to the chain model learned by the learning unit 102-2.

[0069] Next, the learning process by the information processing device 100-2 according to the second embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the learning process according to the second embodiment.

[0070] Step S301 is the same process as step S101 in the information processing device 100 according to the first embodiment, and therefore a description thereof will be omitted.

[0071] The learning unit 102-2 first learns K probability models M using the time-series data group X in the same procedure as in the first embodiment. Thereafter, the learning unit 102-2 learns a chain model that models a chain pattern that represents the characteristics of the appearance order of the probability models M (step S302). The learning unit 102-2 may acquire learning data including information indicating the order of the plurality of probability models from an external device or the like, and learn the chain pattern using this learning data.

[0072] The learning unit 102-2 stores the learned K probability models and the learned chain model in the storage unit 121-2 (step S303), and ends the learning process.

[0073] Next, a description will be given of a diagnostic process by the information processing device 100-2 according to the second embodiment. This embodiment differs from the first embodiment in that similarity with a chain model is taken into consideration when calculating similarity. In the diagnostic process of Fig. 5, the process of calculating similarity is changed in step S203. The flow of the process other than step S203 is the same as in the first embodiment, and therefore description thereof will be omitted.

[0074] For example, the similarity calculation unit 103-2 first calculates the similarity SB between each of a plurality of partial time series data that start within the matching range and each of a plurality of probabilistic models included in the probabilistic model group, for each of the partial time series data x. The similarity calculation unit 103-2 calculates the similarity SC between a chain model and a plurality of partial time series data that appear consecutively with respect to the partial time series data for which the similarity SB was calculated. The similarity calculation unit 103-2 calculates the similarity SA by calculating the similarity SB and the similarity SC.

[0075] In this way, in the second embodiment, anomalies based on time-series data can be detected by taking into consideration a chain model that models the order of appearance of probability models.

[0076] As described above, according to the first and second embodiments, it is possible to detect a state based on time-series data with higher accuracy.

[0077] Next, the hardware configuration of the information processing device according to the first or second embodiment will be described with reference to Fig. 9. Fig. 9 is an explanatory diagram showing an example of the hardware configuration of the information processing device according to the first or second embodiment.

[0078] The information processing device according to the first or second embodiment includes a control device such as a CPU (Central Processing Unit) 51, a storage device such as a ROM (Read Only Memory) 52 or a RAM (Random Access Memory) 53, a communication I / F 54 that connects to a network and communicates, and a bus 61 that connects each part.

[0079] The program executed by the information processing device according to the first or second embodiment is provided in advance in the ROM 52 or the like.

[0080] The program executed by the information processing device according to the first or second embodiment may be configured to be provided as a computer program product by being recorded in an installable or executable file format on a computer-readable recording medium such as a CD-ROM (Compact Disk Read Only Memory), a flexible disk (FD), a CD-R (Compact Disk Recordable), or a DVD (Digital Versatile Disk).

[0081] Furthermore, the program executed by the information processing device according to the first or second embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Also, the program executed by the information processing device according to the first or second embodiment may be provided or distributed via a network such as the Internet.

[0082] The program executed by the information processing device according to the first or second embodiment can cause a computer to function as each unit of the information processing device described above. In this computer, the CPU 51 can read the program from a computer-readable storage medium onto a main storage device and execute the program.

[0083] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims.

[0084] A configuration example of the embodiment will be described below. (Configuration example 1) a similarity calculation unit that calculates a first similarity between a plurality of probability models that respectively model the probability of values ​​at each time point of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and that are included in the target time-series data to be diagnosed; a determination unit that determines a plurality of pieces of matching information, including a position of the partial time series data within the target time series data, a first probability model having a first similarity between the partial time series data at the position that is greater than other probability models, and the first similarity for the first probability model; An information processing device comprising: (Configuration example 2) Each of the plurality of probability models is a multidimensional probability distribution model defined using a mean and a variance, with the specific value as the number of dimensions. The information processing device according to configuration example 1. (Configuration example 3) an output control unit that uses the mean and the variance to determine a normal range in which the time-series data is assumed to be normal, and outputs output information including the normal range; The information processing device according to configuration example 2. (Configuration Example 4) the similarity calculation unit extends the partial time-series data to a probabilistic model, and calculates, as the first similarity, a value based on a distance between the extended probabilistic model and the plurality of probabilistic models. The information processing device according to any one of configuration examples 1 to 3. (Configuration Example 5) The similarity calculation unit For each of the first data included in the plurality of partial time series data, Calculating a second similarity between the plurality of probabilistic models; calculating a third similarity between a chain model that models the pattern of the appearance order of the plurality of probabilistic models and a plurality of the partial time series data that includes the first data among the plurality of the partial time series data; calculating the first similarity by an operation using the second similarity and the third similarity; The information processing device according to any one of configuration examples 1 to 4. (Configuration Example 6) a detection unit that detects a state of the target time series data using the plurality of first similarities included in the plurality of pieces of matching information; 6. The information processing device according to any one of configuration examples 1 to 5. (Configuration Example 7) the detection unit detects that there is an abnormality in the target time-series data when a minimum value of the plurality of first similarities included in the plurality of pieces of matching information is smaller than a threshold value. The information processing device according to configuration example 6. (Configuration Example 8) Further comprising a learning unit that learns the plurality of probability models using a plurality of time-series data for learning. The information processing device according to any one of configuration examples 1 to 7. (Configuration Example 9) the determination unit determines, from among the plurality of partial time series data each having a start point at a plurality of positions included in the range from the most recently set position to the specific value, the partial time series data having the maximum first similarity with any of the plurality of probabilistic models, and repeatedly executes a process of determining the matching information including the determined partial time series data, the probabilistic model having the maximum first similarity between the determined partial time series data, and the maximum first similarity, and outputs the plurality of pieces of matching information. The information processing device according to any one of configuration examples 1 to 8. (Configuration Example 10) the first probability model is the probability model having the largest first similarity with the partial time series data of the location; The information processing device according to any one of configuration examples 1 to 9. (Configuration Example 11) An information processing method executed by an information processing device, a similarity calculation step of calculating a first similarity between a plurality of probability models each modeling a probability of a value at each time of time of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and included in the target time-series data to be diagnosed; a determining step of determining a plurality of matching information including a position of the partial time series data in the target time series data, a first probability model having a first similarity between the partial time series data at the position and the first similarity to the first probability model that is greater than other probability models; and An information processing method including: (Configuration Example 12) On the computer, a similarity calculation step of calculating a first similarity between a plurality of probability models each modeling a probability of a value at each time of time of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and included in the target time-series data to be diagnosed; a determining step of determining a plurality of matching information including a position of the partial time series data in the target time series data, a first probability model having a first similarity between the partial time series data at the position and the first similarity to the first probability model that is greater than other probability models; and A program to execute. [Explanation of symbols]

[0085] 100, 100-2 Information processing device 101 Reception 102, 102-2 Learning Department 103, 103-2 Similarity calculation part 104 Decision Section 105 Detection unit 106 Output control section 121, 121-2 Storage section

Claims

1. a similarity calculation unit that calculates a first similarity between a plurality of probability models that respectively model the probability of values ​​at each time point of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and that are included in the target time-series data to be diagnosed; a determination unit that determines a plurality of pieces of matching information, the matching information including a position of the partial time series data within the target time series data, a first probability model having a first similarity between the partial time series data at the position and the first similarity to the first probability model that is greater than other probability models, and the similarity calculation unit extends the partial time-series data to a probabilistic model, and calculates, as the first similarity, a value based on a distance between the extended probabilistic model and the plurality of probabilistic models. Information processing device.

2. Each of the plurality of probability models is a multidimensional probability distribution model defined using a mean and a variance, with the specific value as the number of dimensions. The information processing device according to claim 1 .

3. an output control unit that uses the mean and the variance to determine a normal range in which the time-series data is assumed to be normal, and outputs output information including the normal range; The information processing device according to claim 2 .

4. The similarity calculation unit For each of the first data included in the plurality of partial time series data, Calculating second similarities between the plurality of probabilistic models; calculating a third similarity between a chain model that models the pattern of the appearance order of the plurality of probabilistic models and a plurality of the partial time series data that includes the first data among the plurality of the partial time series data; calculating the first similarity by an operation using the second similarity and the third similarity; The information processing device according to claim 1 .

5. a detection unit that detects a state of the target time-series data by using the plurality of first similarities included in the plurality of pieces of matching information; The information processing device according to claim 1 .

6. the detection unit detects that there is an abnormality in the target time-series data when a minimum value of the plurality of first similarities included in the plurality of pieces of matching information is smaller than a threshold value; The information processing device according to claim 5 .

7. Further comprising a learning unit that learns the plurality of probability models using a plurality of time-series data for learning. The information processing device according to claim 1 .

8. the determination unit determines, from among the plurality of partial time series data each having a start point at a plurality of positions included in the range from the most recently set position to the specific value, the partial time series data having the maximum first similarity with any of the plurality of probabilistic models, and repeatedly executes a process of determining the matching information including the determined partial time series data, the probabilistic model having the maximum first similarity between the determined partial time series data, and the maximum first similarity, and outputs the plurality of pieces of matching information. The information processing device according to claim 1 .

9. the first probability model is the probability model having the largest first similarity with the partial time-series data of the position; The information processing device according to claim 1 .

10. An information processing method executed by an information processing device, a similarity calculation step of calculating a first similarity between a plurality of probability models each modeling a probability of a value at each time of time of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and which are included in the target time-series data to be diagnosed; determining a plurality of pieces of matching information including a first probability model having a position of the partial time series data within the target time series data and the first similarity between the partial time series data at the position that is greater than other probability models, and the first similarity to the first probability model; the similarity calculation step includes extending the partial time-series data to a probabilistic model, and calculating, as the first similarity, a value based on a distance between the extended probabilistic model and the plurality of probabilistic models; Information processing methods.

11. On the computer, a similarity calculation step of calculating a first similarity between a plurality of probability models each modeling a probability of a value at each time of time of time-series data whose data length is a specific value and a plurality of partial time-series data whose data length is the specific value and which are included in the target time-series data to be diagnosed; determining a plurality of pieces of matching information including a first probability model having a first similarity between a position of the partial time series data in the target time series data and the partial time series data at the position that is greater than other probability models, and the first similarity to the first probability model; the similarity calculation step includes extending the partial time-series data to a probabilistic model, and calculating, as the first similarity, a value based on a distance between the extended probabilistic model and the plurality of probabilistic models; program.

Images