Information processing system, information processing method, and information processing device.

Abstract

To provide a technology for assisting in determining a more appropriate feature quantity from among plural kinds of feature quantities determined based on combinations of a range employed in calculation of a feature quantity and a statistic quantity.SOLUTION: An information processing system includes an acquisition module that acquires time-series data items from a controller, a determination module that determines plural kinds of feature quantities on the basis of combinations of a first function, which defines a range employed in calculation of a feature quantity, and a second function, which defines a statistic quantity employed as a feature quantity, out of the time-series data items concerned, and an evaluation module that evaluates the time-series data items in relation to each of the plural kinds of feature quantities.SELECTED DRAWING: Figure 2

Description

Technical Field

[0004] , , , , , , , ,

[0006] , , , ,

[0005] , , , , , ,

[0001] The present invention relates to an information processing system, an information processing method, and an information processing apparatus.

Background Art

[0002] In various production sites, there is a need to improve the operating rate by predictive maintenance of equipment and machinery. Predictive maintenance means a maintenance form in which any abnormality occurring in equipment or machinery is detected and maintenance work such as on the equipment or machinery is performed before the equipment has to be stopped. In order to realize such abnormality detection, it is required to prepare an appropriate algorithm according to the detection target.

[0003] For example, Japanese Patent Application Laid-Open No. 2019-045942 (Patent Document 1) discloses a fault diagnosis system that flexibly responds to changes in the diagnosis target by using the difference in measurement data before and after maintenance as a feature quantity for fault prediction diagnosis.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In order to generate an appropriate algorithm according to the detection target, the selection of feature quantities is important. However, various feature quantities can be calculated from time-series data, and it is difficult to determine which feature quantities should be selected.

[0006] Therefore, one object of the present invention is to provide a technique for assisting in determining a more appropriate feature quantity from among a plurality of types of feature quantities determined by a combination of a range and a statistic used for calculating the feature quantity.

Means for Solving the Problems

[0007] An information processing system according to one example of the present invention includes an acquisition module that acquires time-series data from a control device, a determination module that determines multiple types of features by combining a first function that defines the range of the target time-series data to be used for calculating features and a second function that defines the statistics to be used as features, and an evaluation module that evaluates the time-series data for each of the multiple types of features.

[0008] This configuration allows for the evaluation of time-series data for each of several types of features determined by a combination of a first function that defines the range of the target time-series data used for feature calculation and a second function that defines the statistics used as features. This enables the acquisition of more appropriate feature information.

[0009] The evaluation module may calculate the separation accuracy for each of several types of features based on the labels assigned to the time-series data and the values ​​of the target type of features calculated from the time-series data. With this configuration, the most appropriate feature can be determined from among several types of features based on the separation accuracy.

[0010] The information processing system may further include a first presentation module that presents a first user interface screen containing separation accuracy calculated by an evaluation module for at least some of several types of features. With this configuration, the user can more easily determine more appropriate features by checking the first user interface screen.

[0011] The information processing system may further include an algorithm generation module that generates an anomaly detection algorithm that includes one or more selected features from among several types of features. This configuration allows for the generation of an anomaly detection algorithm using one or more features selected as more appropriate.

[0012] The algorithm generation module may also be configured to send an anomaly detection algorithm to the control unit. With this configuration, the control unit can perform anomaly detection processing according to an anomaly detection algorithm using one or more features selected as more appropriate.

[0013] The evaluation module may determine, for each of several types of features, time series data that are estimated to exhibit different characteristics from other time series data, based on the distribution of the target type of feature calculated from the time series data. This configuration makes it easier to find time series data that should be labeled as anomaly from among unlabeled time series data.

[0014] The information processing system may further include a second presentation module that presents a second user interface screen containing time series data that is estimated to exhibit different characteristics from other time series data calculated by the evaluation module, for at least some of several types of features. With this configuration, the user can more easily find time series data that should be labeled as anomaly by checking the second user interface screen.

[0015] The information processing system may further include a training data generation module that generates training data by assigning labels to time-series data in response to user operations. With this configuration, the user can automatically generate training data simply by performing operations on the labels to be assigned.

[0016] An information processing method performed by a computer according to another example of the present invention includes the steps of: acquiring time-series data from a control device; determining a plurality of types of features by combining a first function that defines the range of the target time-series data to be used for calculating features and a second function that defines the statistics to be used as features; and evaluating the time-series data for each of the plurality of types of features.

[0017] An information processing apparatus according to another example of the present invention includes an acquisition module that acquires time-series data from a control device, a first function that defines a range used for calculating a feature amount among the target time-series data, and a combination of a second function that defines a statistic used as a feature amount. A determination module that determines a plurality of types of feature amounts, and a transmission module that requests evaluation of time-series data for each of the plurality of types of feature amounts to computing resources.

Effect of the Invention

[0018] According to the present invention, it is possible to support the determination of more appropriate feature amounts from among a plurality of types of feature amounts determined by a combination of a range used for calculating a feature amount and a statistic.

Brief Description of the Drawings

[0019] [Figure 1] It is a schematic diagram showing an overall configuration example of an information processing system according to the present embodiment. [Figure 2] It is a schematic diagram showing a functional configuration example of an information processing system according to the present embodiment. [Figure 3] It is a block diagram showing a hardware configuration example of a control device of an information processing system according to the present embodiment. [Figure 4] It is a block diagram showing a hardware configuration example of an information processing apparatus of an information processing system according to the present embodiment. [Figure 5] It is a block diagram showing a hardware configuration example of a server device of an information processing system according to the present embodiment. [Figure 6] It is a diagram for explaining an example of anomaly detection in an information processing system according to the present embodiment. [Figure 7] It is a diagram for explaining an example of a group of feature amounts that can be used in an information processing system according to the present embodiment. [Figure 8] It is a diagram for explaining the separation accuracy in an information processing system according to the present embodiment. [Figure 9]This is a diagram for explaining the optimization process of feature amounts in the information processing system according to this embodiment. [Figure 10] This is a flowchart showing the procedure of the optimization process of feature amounts in the information processing system according to this embodiment. [Figure 11] This is a schematic diagram showing an example of the user interface screen provided by the information processing device of the information processing system according to this embodiment. [Figure 12] This is a diagram for explaining the generation process of learning data in the information processing system according to this embodiment. [Figure 13] This is a diagram for explaining the search process of abnormal data in the information processing system according to this embodiment. [Figure 14] This is a flowchart showing the procedure of the generation process of learning data in the information processing system according to this embodiment. [Figure 15] This is a schematic diagram showing another example of the user interface screen provided by the information processing device of the information processing system according to this embodiment.

Mode for Carrying Out the Invention

[0020] Embodiments of the present invention will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals and their descriptions will not be repeated.

[0021] <A. Application Example> First, an example of a scene to which the present invention is applied will be described.

[0022] In this specification, "anomaly detection" includes a process of detecting a state different from a certain reference state, and includes detection of an anomaly in a relative sense in addition to detection of an anomaly in an absolute sense. k

[0023] Figure 1 is a schematic diagram showing an example of the overall configuration of the information processing system 1 according to this embodiment. Referring to Figure 1, the information processing system 1 according to this embodiment includes, as its main components, a control device 100, an information processing device 200 which is an example of a computer that can be connected to the control device 100, and a server device 300.

[0024] The control device 100 may be implemented as a type of computer, such as a PLC (Programmable Logic Controller). The control device 100 is connected to the field device group 10 via a fieldbus 2. The fieldbus 2 preferably employs an industrial communication protocol. Known communication protocols include EtherCAT®, EtherNet / IP®, DeviceNet®, and CompoNet®.

[0025] The field device group 10 includes a device that collects input data from the production site (hereinafter also collectively referred to as "the field") and a device that performs some action on the field based on commands (output data) generated by the control device 100.

[0026] In the configuration example shown in Figure 1, the field device group 10 includes a remote I / O (Input / Output) device 12, a relay group 14, a servo driver 18, and a servo motor 20.

[0027] As described above, input and output data are exchanged between the control device 100 and the field device group 10 via the fieldbus 2, and this exchanged data is updated at very short intervals of several hundred microseconds to several tens of milliseconds.

[0028] The control device 100 includes a PLC engine 140 for performing control calculations to control equipment and machinery in the production site, and an anomaly detection engine 150 for detecting arbitrary anomalies. The anomaly detection engine 150 calculates feature quantities from input data collected from the field according to a predetermined anomaly detection algorithm, and determines the presence or absence of an anomaly based on the calculated feature quantities.

[0029] Furthermore, the control device 100 has a time-series database (hereinafter also referred to as "TSDB (Time Series Data Base)") 160 that sequentially stores input data from the field device group 10, output data to the field device group 10, and internal data managed within the control device 100. Hereinafter, the data stored in the TSDB 160 will also be referred to as "time-series data".

[0030] The control device 100 may be connected to one or more HMIs (Human Machine Interfaces) 400 via the fieldbus 4.

[0031] The information processing device 200 provides a development environment for user programs executed on the control device 100 (program creation and editing tools, parser, compiler, etc.), a function to set parameters (configurations) of the control device 100 and various devices connected to the control device 100, a function to send generated user programs to the control device 100, and a function to modify and change user programs executed on the control device 100 online.

[0032] Furthermore, the information processing device 200 determines feature quantities and other parameters necessary to operate the anomaly detection engine 150 of the control device 100 through processing described later. The information processing device 200 may be connected to the server device 300 via the upper network 6.

[0033] The server device 300 is typically a computing resource provided via the cloud, and it performs arbitrary arithmetic processing in response to requests from the information processing device 200.

[0034] Figure 2 is a schematic diagram showing an example of the functional configuration of the information processing system 1 according to this embodiment. Referring to Figure 2, the control device 100 includes, as a functional configuration, a PLC engine 140, an anomaly detection engine 150, and a TSDB 160. The information processing device 200 includes, as a functional configuration, an acquisition module 230, a decision module 232, a learning data generation module 234, a user interface module 236, an algorithm generation module 238, and a transmission module 240.

[0035] The acquisition module 230 acquires time-series data from the TSDB 160 of the control device 100. Any protocol can be used for acquiring the time-series data.

[0036] The decision module 232 determines multiple types of features by combining a selection function (first function) that defines the range of the target time series data to be used for feature calculation, and a statistical function (second function) that defines the statistics to be used as features.

[0037] The training data generation module 234 generates training data by assigning labels to time-series data in response to user operations.

[0038] The user interface module 236 presents a user interface screen that includes the separation accuracy calculated by the evaluation module 330 for at least some of the multiple types of features, and / or a user interface screen that includes time series data estimated to exhibit different characteristics from other time series data calculated by the evaluation module 330 for at least some of the multiple types of features. Specific examples of the presented user interface screens will be described later. In addition, the user interface module 236 gives instructions to other modules in accordance with the content of user operations.

[0039] The algorithm generation module 238 generates an anomaly detection algorithm that includes one or more selected features from among several types of features.

[0040] The transmission module 240 transmits the multiple types of features determined by the decision module 232, along with the training data (a group of time-series data with labels) or the time-series data, to the server device 300.

[0041] The server device 300 includes an evaluation module 330 as part of its functional configuration. The evaluation module 330 evaluates time-series data for each of several types of features. Specific examples of time-series data evaluation will be described later.

[0042] Referring again to Figure 1, a typical processing procedure in the information processing system 1 will be explained. The information processing device 200 (acquisition module 230) acquires time-series data from the control device 100 (TSDB 160) ((1) time-series data). The information processing device 200 (decision module 232) determines multiple types of features by combining a extraction function (first function) and a statistical function (second function) ((2) multiple types of features).

[0043] The information processing device 200 then transmits multiple types of features and training data (or time-series data) to the server device 300 ((3) Multiple types of features and training data).

[0044] The server device 300 (evaluation module 330) evaluates the time series data for each of several types of features ((4) Evaluation of time series data). Then, the server device 300 transmits the evaluation results to the information processing device 200 ((5) Evaluation results).

[0045] The information processing device 200 (user interface module 236) presents a user interface screen based on the evaluation result from the server device 300 ((6) user interface screen). Further, the information processing device 200 (algorithm generation module 238) generates an anomaly detection algorithm ((7) anomaly detection algorithm generation). The generated anomaly detection algorithm is transmitted to the control device 100 ((8) anomaly detection algorithm).

[0046] The control device 100 configures the anomaly detection engine 150 according to the anomaly detection engine from the information processing device 200.

[0047] Thus, in the information processing system 1 according to the present embodiment, by evaluating time series data from the perspective of various types of feature quantities determined by the combination of a cutout function (first function) that defines the range used for calculating feature quantities in the target time series data and a statistical function (second function) that defines the statistic used as a feature quantity, more appropriate feature quantities can be determined. By determining more appropriate feature quantities, the accuracy of the anomaly detection algorithm can also be improved.

[0048] <B. Hardware Configuration Example> Next, a hardware configuration example of the main devices of the information processing system 1 according to the present embodiment will be described.

[0049] (b1: Control Device 100) Figure 3 is a block diagram showing an example of the hardware configuration of the control device 100 of the information processing system 1 according to this embodiment. Referring to Figure 3, the control device 100 includes a processor 102 such as a CPU (Central Processing Unit) or MPU (Micro-Processing Unit), a chipset 104, a main memory 106, a secondary memory 108, a higher-level network controller 110, a USB (Universal Serial Bus) controller 112, a memory card interface 114, an internal bus controller 122, fieldbus controllers 118, 120, and I / O units 124-1, 124-2, ...

[0050] The processor 102 reads various programs stored in the secondary memory 108, loads them into the main memory 106, and executes them to realize the processing required by the control unit 100. The chipset 104 controls data transmission between the processor 102 and each component.

[0051] The secondary storage device 108 stores a system program 131 for implementing the PLC engine, a user program 132 executed using the PLC engine, and an anomaly detection program 133 for implementing the anomaly detection engine 150. A portion of the secondary storage device 108 may be used as the TSDB 160.

[0052] The higher-level network controller 110 controls data exchange with other devices via the higher-level network 6. The USB controller 112 controls data exchange with the information processing device 200 via the USB connection.

[0053] The memory card interface 114 is configured to allow the insertion and removal of the memory card 116, enabling data to be written to the memory card 116 and various types of data (such as user programs and trace data) to be read from the memory card 116.

[0054] The internal bus controller 122 is an interface for exchanging data with the I / O units 124-1, 124-2, ... mounted on the control device 100.

[0055] The fieldbus controller 118 controls data exchange with other devices via fieldbus 2. Similarly, the fieldbus controller 120 controls data exchange with other devices via fieldbus 4.

[0056] Figure 3 shows an example configuration in which the processor 102 provides the necessary functions by executing a program. However, some or all of these provided functions may be implemented using dedicated hardware circuits (for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)). Alternatively, the main part of the control device 100 may be implemented using hardware that conforms to a general-purpose architecture (for example, an industrial PC based on a general-purpose PC). In this case, virtualization technology may be used to run multiple operating systems (OS) with different purposes in parallel, and to run the necessary applications on each OS.

[0057] (b2: Information processing device 200) The information processing device 200 according to this embodiment can be implemented, for example, by executing a program using hardware that follows a general-purpose architecture (for example, a general-purpose personal computer).

[0058] Figure 4 is a block diagram showing an example of the hardware configuration of the information processing device 200 of the information processing system 1 according to this embodiment. Referring to Figure 4, the information processing device 200 includes a processor 202 such as a CPU or MPU, an optical drive 204, a main memory 206, a secondary memory 208, a USB controller 212, a network controller 214, an input unit 216, and a display unit 218. These components are connected via a bus 220.

[0059] The processor 202 reads various programs stored in the secondary memory 208, loads them into the main memory 206, and executes them, thereby realizing various processes as described later.

[0060] The secondary storage device 208 is composed of, for example, an HDD (Hard Disk Drive) or an SSD (Flash Solid State Drive). Typically, the secondary storage device 208 stores the OS 222, a PLC interface program 224 for exchanging data related to the anomaly detection function with the control device 100, a development program 226 for creating user programs executed in the information processing device 200, debugging the created user programs, defining the system configuration, setting various parameters, and an anomaly detection setting generation program 228 for making the necessary settings for the anomaly detection engine 150. The secondary storage device 208 may also store other necessary programs besides those shown in Figure 4.

[0061] The information processing device 200 has an optical drive 204, and a program stored in a recording medium 205 (for example, an optical recording medium such as a DVD (Digital Versatile Disc)) that non-transiently stores computer-readable programs is read and installed into a secondary storage device 208 or the like.

[0062] The various programs executed by the information processing device 200 may be installed via a computer-readable recording medium 205, or they may be installed by downloading them from a server device on a network. Furthermore, the functions provided by the information processing device 200 according to this embodiment may be implemented by utilizing some of the modules provided by the OS 222.

[0063] The USB controller 212 controls data exchange with the control device 100 via the USB connection. The network controller 214 controls data exchange with other devices via any network.

[0064] The input unit 216 consists of a keyboard, mouse, etc., and accepts user input. The display unit 218 consists of a display, various indicators, printer, etc., and outputs processing results from the processor 202.

[0065] Figure 4 shows an example configuration in which the processor 202 provides the necessary functions by executing a program. However, some or all of these provided functions may be implemented using dedicated hardware circuits (e.g., ASIC or FPGA).

[0066] (b3: Server device 300) The server device 300 according to this embodiment is typically a computing resource provided via the cloud.

[0067] Figure 5 is a block diagram showing an example of the hardware configuration of the server device 300 of the information processing system 1 according to this embodiment. Referring to Figure 5, the server device 300 includes one or more processors 302 such as a CPU or GPU (Graphics Processing Unit), one or more main memory devices 306, a secondary memory device 308, one or more network controllers 314, an input unit 316, and a display unit 318. These components are connected via a bus 320.

[0068] The secondary storage device 308 typically stores the OS 322, a hypervisor 324 for managing multiple virtual computers, and a deployment manager 326 for deploying application programs 328 to run on each virtual computer. The secondary storage device 308 may also store other necessary programs besides those shown in Figure 5.

[0069] Although FIG. 5 shows a configuration example using the processor 302, some or all of the provided functions may be implemented using dedicated hardware circuits (such as ASICs or FPGAs).

[0070] <C. Realization of Abnormality Detection> Next, an explanation will be given regarding the realization of abnormality detection in the information processing system 1 according to the present embodiment.

[0071] FIG. 6 is a diagram for explaining an example of abnormality detection in the information processing system 1 according to the present embodiment. FIG. 6 shows examples of time-series data of measurement values indicating two types of abnormalities in addition to the time-series data (normal) of the measurement values used for abnormality detection.

[0072] The time-series data of the measurement values corresponding to Abnormality 1 shows overall higher values compared to the normal time-series data. Therefore, for Abnormality 1, it can be detected by using the average value over the entire range as a feature quantity.

[0073] On the other hand, the time-series data of the measurement values corresponding to Abnormality 2 is greatly deviated at two locations (abnormalities have occurred on the upper side and the lower side) compared to the abnormal time-series data. For such time-series data, even if the average value over the entire range is used, it will be the same as the average value calculated for the normal time-series data. That is, when using the average value over the entire range, it is impossible to distinguish between normal and Abnormality 2.

[0074] Therefore, for Abnormality 2, it can be detected, for example, by using the average value over the first half and the average value over the second half respectively.

[0075] Thus, as the feature quantity used for abnormality detection, various ones can be adopted according to the combination of (1) which range to focus on and (ii) which statistic to use. That is, it is necessary to explore and determine which feature quantity is appropriate according to the characteristics and states of the abnormalities to be detected (also referred to as feature quantity engineering).

[0076] Such feature extraction often depends on individual experience and skills, making it difficult to determine appropriate features. Therefore, it is desirable to provide a mechanism that allows for easy extraction of features to be used in anomaly detection.

[0077] Figure 7 is a diagram illustrating an example of a set of features that can be used in the information processing system 1 according to this embodiment. Referring to Figure 7, multiple types of features can be defined by combining the extraction function 30 and the statistical function 40.

[0078] The extraction function 30 is a function that defines the range of the target time series data to be used for calculating features. The extraction function 30 can also be called a preprocessing function or a filter function. Examples of the extraction function 30 include "full range" which targets the entire range of the target time series data, "first half only" which targets the first half of the target time series data, "second half only" which targets the second half of the target time series data, "first quarter only" which targets the first quarter of the target time series data, and "last data" which targets the end of the target time series data.

[0079] Statistical function 40 is a function that defines the statistics used as features. Examples of statistical functions 40 include "mean" which shows the mean of the range, "variance" which shows the variance of the range, "median" which shows the median of the range, "kurtosis" which shows the kurtosis of the range, and "peak frequency" which shows the frequency of the principal component obtained by frequency analysis of the time series data of the range.

[0080] By combining extraction functions 30 (N types) and statistical functions 40 (M types), a feature set 50 consisting of multiple features (N × M types) can be defined. By evaluating the separation accuracy for each of the feature set 50, one or more features suitable for the desired anomaly detection can be determined.

[0081] FIG. 8 is a diagram for explaining the separation accuracy in the information processing system 1 according to the present embodiment. FIG. 8 shows examples of feature amounts calculated from samples (time series data) to which normal (OK) labels or abnormal (NG: No Good) labels are assigned.

[0082] In the example shown in FIG. 8(A), the set of samples to which OK labels are assigned and the set of samples to which NG labels are assigned are separated. Thus, in the feature amount space, a state where feature amounts assigned with different labels can be separated can be regarded as a state with high separation accuracy.

[0083] On the other hand, in the example shown in FIG. 8(B), the set of samples to which OK labels are assigned and the set of samples to which NG labels are assigned are mixed. Thus, in the feature amount space, a state where feature amounts assigned with different labels cannot be separated can be regarded as a state with low separation accuracy.

[0084] The information processing system 1 according to the present embodiment can search for appropriate feature amounts by evaluating the separation accuracy of feature amounts and the like according to the learning data. For calculating the separation accuracy, for example, AUC (Area Under the Curve), discriminability d' (average distance between distributions), within-class variance, between-class variance, etc. can be used.

[0085] <D. Optimization of Feature Amounts> Next, a process for optimizing feature amounts using learning data will be described.

[0086] FIG. 9 is a diagram for explaining the optimization process of feature amounts in the information processing system 1 according to the present embodiment. Referring to FIG. 9, the information processing device 200 acquires the time series data group stored in the TSDB 160 of the control device 100. An arbitrary method is used to assign labels (for example, OK labels or NG labels) to each of the acquired time series data group. The time series data group to which labels are assigned is used as the learning data 60.

[0087] Users may manually label time-series data. This typically assumes that the time-series data to be detected as anomalies is known in advance.

[0088] The control device 100 transmits the training data 60 to the server device 300, and also transmits information about the feature set 50 defined by a combination of the extraction function 30 and the statistical function 40 to the server device 300.

[0089] The server device 300 has a separation accuracy evaluation algorithm 350 as an example of an evaluation module 330, and calculates the separation accuracy for each of the feature set 50 (feature 1, feature 2, ...).

[0090] More specifically, the server device 300 selects one type of feature from the feature set 50 and calculates the selected type of feature for each of the time series data sets included in the training data 60. Furthermore, the server device 300 calculates the separation accuracy based on the label-specific distribution of each feature calculated from the time series data sets.

[0091] The server device 300 repeats the above process for all types of features included in the feature set 50.

[0092] The server device 300 responds to the information processing device 200 with the optimal feature based on the separation accuracy calculated for all types of features included in the feature set 50. The information processing device 200 presents the calculation results from the server device 300 to the user and, in response to user input, generates an anomaly detection algorithm 70 using one or more selected types of features. In other words, the information processing device 200 generates an anomaly detection algorithm 70 that includes one or more selected features from among multiple types of features. Finally, the information processing device 200 transmits the generated anomaly detection algorithm 70 to the control device 100.

[0093] Thus, in the information processing system 1, by calculating the separation accuracy for all types of features included in the feature set 50 defined by the combination of the extraction function 30 and the statistical function 40, it is possible to determine appropriate features according to the characteristics and states of anomalies to be detected.

[0094] Generally, since the feature set 50 contains multiple types of features, the computational load can become enormous. Therefore, it is preferable to use a server device 300 (for example, computing resources provided via the cloud) rather than the information processing device 200 alone. However, if the information processing device 200 has sufficient computing resources, all calculations may be performed by the information processing device 200 alone.

[0095] For example, by preparing the extraction function 30 and the statistical function 40 as software components (e.g., user-defined functions), the features used in the anomaly detection algorithm 70 can be described at the level of a high-level language. Furthermore, the information of the feature set 50 transmitted to the server device 300 may also be defined using these prepared software components.

[0096] The anomaly detection algorithm 70 also requires a threshold value to determine whether or not something is an anomaly. Therefore, the information processing device 200 may calculate the threshold value by inputting the training data 60 into the anomaly detection algorithm 70, which uses one or more determined features. In this case, the anomaly detection algorithm 70 and the threshold value are transmitted to the control device 100.

[0097] Furthermore, by including log information such as the number of uses in the anomaly detection algorithm 70, it is possible to perform detection according to the nature of the anomaly.

[0098] Figure 10 is a flowchart showing the procedure for feature optimization processing in the information processing system 1 according to this embodiment. Referring to Figure 10, the information processing device 200 acquires multiple time-series data (time-series data group) from the control device 100 (step S100). That is, the information processing device 200 executes the process of acquiring time-series data from the control device 100.

[0099] The information processing device 200 accepts labels for each of the time-series data in response to user operations (step S102). This generates training data 60 consisting of a group of time-series data to which labels have been assigned.

[0100] Furthermore, the information processing device 200 determines multiple types of features (feature group 50) in combination with the extraction function 30 and the statistical function 40 in response to user operation (step S104). That is, the information processing device 200 performs a process to determine multiple types of features by combining the extraction function 30 (first function), which defines the range of the target time series data to be used for calculating features, and the statistical function 40 (second function), which defines the statistics to be used as features.

[0101] The information processing device 200 then transmits information about the training data 60 and the feature set 50 to the server device 300 (step S106). In other words, the information processing device 200 requests a computing resource (typically the server device 300) to evaluate the time series data for each of the multiple types of features. The server device 300, which is an example of a computing resource, then performs the process of evaluating the time series data for each of the multiple types of features.

[0102] More specifically, the server device 300 selects one type of feature from the feature set 50 received from the information processing device 200 (step S108), and calculates the selected type of feature for each of the time series data included in the training data 60 (step S110). Then, the server device 300 calculates the separation accuracy based on the label-specific distribution of the calculated features (step S112), and associates the selected type of feature with the calculated separation accuracy (step S114). Note that the calculated separation accuracy may be a value quantified as a separation score, as described later.

[0103] Next, the server device 300 determines whether there are any unselected features remaining from the received feature set 50 (step S116). If there are any unselected features remaining from the received feature set 50 (YES in step S116), the server device 300 selects one other type of feature from the feature set 50 received from the information processing device 200 (step S118), and repeats the process from step S110 onward.

[0104] In this way, the server device 300 calculates the separation accuracy for each of several types of features based on the labels assigned to the time-series data and the values ​​of the feature quantities of the target type calculated from the time-series data.

[0105] If there are no unselected features remaining from the received feature group 50 (NO in step S116), the server device 300 transmits the type of feature and the corresponding separation accuracy to the information processing device 200 (step S120).

[0106] The information processing device 200 presents the information received from the server device 300 to the user (step S122). Then, the information processing device 200 generates an anomaly detection algorithm 70 using one or more selected feature quantities in response to the user's operation (step S124). Finally, the information processing device 200 transmits the generated anomaly detection algorithm 70 to the control device 100 (step S126).

[0107] Figure 11 is a schematic diagram showing an example of a user interface screen provided by the information processing device 200 of the information processing system 1 according to this embodiment. Referring to Figure 11, the information processing device 200 provides a user interface screen 250 including calculation results.

[0108] In other words, the information processing device 200 presents a user interface screen 250 that includes the separation accuracy (separation score) calculated by the server device 300 (evaluation module 330) for at least some of the multiple types of features.

[0109] More specifically, the user interface screen 250 includes results ranked based on the calculated separation accuracy. More specifically, the user interface screen 250 includes the calculation results of the separation accuracy for each type of feature. The user refers to the user interface screen 250 to select the type of feature to be used in the anomaly detection algorithm 70.

[0110] More specifically, the user interface screen 250 includes a check column 251, a rank column 252, a extraction function column 253, a statistical function column 254, a separation score column 255, and a processing load column 256.

[0111] The check column 251 accepts the user's selection of the type of feature to be used in the anomaly detection algorithm 70. The rank column 252 shows the ranked position for each type of feature based on the separation accuracy (separation score).

[0112] The extraction function column 253 indicates the type of extraction function selected. The statistical function column 254 indicates the type of statistical function selected.

[0113] The separation score column 255 shows the separation score, which is a numerical representation of the separation accuracy calculated for the corresponding feature. The processing load column 256 shows a numerical value representing the processing load involved in calculating the corresponding feature.

[0114] When any one of a plurality of types of feature amounts displayed on the user interface screen 250 is selected, the feature amount distribution graph 260 used for calculating the separation accuracy may be displayed. A threshold value 262 determined in the process of calculating the separation accuracy may be displayed on the feature amount distribution graph 260.

[0115] By referring to the feature amount distribution graph 260, the user can confirm the calculated separation accuracy and may appropriately change the determined threshold value 262.

[0116] When any one of the feature amounts displayed on the feature amount distribution graph 260 is selected, a time series data graph 270 showing the time series data for calculating the selected feature amount may be displayed. For example, the user can confirm time series data that produced an outlier by selecting an outlier or the like included in the feature amount distribution graph 260.

[0117] As described above, when it is possible to prepare the learning data 60 (a group of time series data with labels), appropriate types of feature amounts can be determined by evaluating using various types of feature amounts.

[0118] <E. Generation of Learning Data> In the process of optimizing the above-described feature amounts, it is necessary to prepare in advance the learning data 60 (a group of time series data with labels). Hereinafter, the process of generating the learning data 60 will be described.

[0119] Generally, most of the time series data group collected by the control device 100 is normal (OK) data, and there is little abnormal (NG) data. Therefore, it is efficient to more easily extract abnormal data included in the time series data group by evaluating with different types of feature amounts.

[0120] In this specification, "anomalous data" means time series data that exhibits characteristics different from other time series data. Therefore, the extraction of anomalous data includes the process of determining time series data that are presumed to exhibit characteristics different from other time series data.

[0121] Figure 12 is a diagram illustrating the data generation process in the information processing system 1 according to this embodiment. Referring to Figure 12, the information processing device 200 acquires the time-series data group 62 stored in the TSDB 160 of the control device 100. Each of the time-series data group 62 is not labeled.

[0122] If the amount of time-series data included in time-series data group 62 becomes too large, it becomes virtually impossible for users to review everything, and there is a possibility of missing anomalous data.

[0123] The control device 100 transmits the time-series data set 62 to the server device 300, and also transmits information about the feature set 50, which is defined by a combination of the extraction function 30 and the statistical function 40, to the server device 300.

[0124] The server device 300 has an anomaly data search algorithm 352 as an example of the evaluation module 330, and searches for anomaly data from the perspective of each of the feature set 50 (feature 1, feature 2, ...).

[0125] More specifically, the server device 300 selects one type of feature from the feature set 50 and calculates the selected type of feature for each time series data set included in the time series data set 62. Furthermore, the server device 300 searches for time series data that is presumed to be anomalous data based on the distribution of each feature calculated from the time series data sets.

[0126] Figure 13 is a diagram illustrating the abnormal data search process in the information processing system 1 according to this embodiment.

[0127] In the example shown in Figure 13(A), the distribution of feature A has two separate sets, and it can be determined that one of these sets is a candidate for anomalous data. In other words, if the distribution of any feature includes separate sets like those shown in Figure 13(A), it can be determined that there is a high probability that anomalous data can be extracted by using that feature.

[0128] In the example shown in Figure 13(B), the distribution of feature B does not have a separated set, but it does contain values ​​that are outside the set (outliers), and these outliers can be determined to be candidates for anomalous data. In other words, if the distribution of any feature contains outliers like those shown in Figure 13(B), it can be concluded that there is a high probability that anomalous data can be extracted by using that feature.

[0129] In this way, the anomaly data detection algorithm 352 uses methods such as clustering to determine whether the distribution contains separated sets, and whether there are any data points (outliers) in the distribution that are relatively large in deviation from the center of the distribution. Then, the anomaly data detection algorithm 352 determines one of the separated sets and the outlier as candidates for anomaly data.

[0130] The server device 300 repeats the above process for all types of features included in the feature set 50.

[0131] The server device 300 responds to the information processing device 200 with the results of its search for all types of features included in the feature set 50. The information processing device 200 presents the search results from the server device 300 to the user. That is, the information processing device 200 presents the user with information 72 for labeling. The information processing device 200 assigns labels to the time series data set 62 according to the user's operation. The time series data set 62 with labels assigned is used as training data 60.

[0132] Thus, in the information processing system 1, anomaly data included in the time series data set 62 is searched for by calculating the distribution of all types of features included in the feature set 50 defined by a combination of the extraction function 30 and the statistical function 40.

[0133] Generally, since the feature set 50 contains multiple types of features, the computational load can become enormous. Therefore, it is preferable to use a server device 300 (for example, computing resources provided via the cloud) rather than the information processing device 200 alone. However, if the information processing device 200 has sufficient computing resources, all calculations may be performed by the information processing device 200 alone.

[0134] Figure 14 is a flowchart showing the procedure for generating training data in the information processing system 1 according to this embodiment. Referring to Figure 14, the information processing device 200 acquires the time-series data group 62 from the control device 100 (step S200). That is, the information processing device 200 executes the process of acquiring time-series data from the control device 100.

[0135] Furthermore, the information processing device 200 determines multiple types of features (feature group 50) in combination with the extraction function 30 and the statistical function 40 in response to user operation (step S202). That is, the information processing device 200 performs a process to determine multiple types of features by combining the extraction function 30 (first function), which defines the range of the target time series data to be used for calculating features, and the statistical function 40 (second function), which defines the statistics to be used as features.

[0136] The information processing device 200 then transmits information about the time-series data group 62 and the feature group 50 to the server device 300 (step S204). In other words, the information processing device 200 requests a computing resource (typically the server device 300) to evaluate the time-series data for each of the multiple types of features. The server device 300, which is an example of a computing resource, then performs the process of evaluating the time-series data for each of the multiple types of features.

[0137] More specifically, the server device 300 selects one type of feature from the feature set 50 received from the information processing device 200 (step S206), and calculates the selected type of feature for each of the time series data included in the training data 60 (step S208). Then, the server device 300 determines whether or not there are candidates for anomalous data based on the distribution of the calculated features (step S210). If there are candidates for anomalous data (YES in step S210), the server device 300 associates the selected type of feature with the candidates for anomalous data (step S212). The server device 300 may also associate the separation accuracy calculated when searching for candidates for anomalous data with the selected type of feature.

[0138] Next, the server device 300 determines whether there are any unselected features remaining from the received feature set 50 (step S214). If there are any unselected features remaining from the received feature set 50 (YES in step S214), the server device 300 selects one other type of feature from the feature set 50 received from the information processing device 200 (step S216), and repeats the process from step S208 onwards.

[0139] In this way, the server device 300 determines, for each of the multiple types of features, the time series data that is estimated to exhibit different characteristics from other time series data, based on the distribution of the target type of feature calculated from the time series data.

[0140] If there are no unselected features remaining from the received set of features 50 (NO in step S214), the server device 300 transmits the type of feature and the corresponding candidate for abnormal data to the information processing device 200 (step S218).

[0141] The information processing device 200 presents the user with information 72 for labeling based on the information received from the server device 300 (step S220). Then, the information processing device 200 labels the time series data included in the time series data group 62 in response to user operations (step S222). In other words, the information processing device 200 generates training data 60 by labeling time series data in response to user operations.

[0142] Figure 15 is a schematic diagram showing another example of a user interface screen provided by the information processing device 200 of the information processing system 1 according to this embodiment. Referring to Figure 15, the information processing device 200 provides a user interface screen 280 that includes information for labeling.

[0143] In other words, the information processing device 200 presents a user interface screen 280 that includes time series data (candidates for abnormal data) which are estimated to exhibit different characteristics from other time series data calculated by the server device 300 (evaluation module 330) for at least some of the multiple types of features.

[0144] More specifically, user interface screen 280 includes results ranked based on the calculated separation accuracy. More specifically, user interface screen 280 includes the calculation results of the separation accuracy for each type of feature. The user refers to user interface screen 280 and assigns labels.

[0145] More specifically, the user interface screen 280 includes an attention rank column 281, a extraction function column 282, a statistical function column 283, and a separation score column 284.

[0146] The attention rank column 281 shows the ranking based on the presence of potential anomalous data, according to the separation accuracy (separation score).

[0147] The extraction function column 282 indicates the type of extraction function selected. The statistical function column 283 indicates the type of statistical function selected. The separation score column 284 shows the separation score, which is a numerical representation of the separation accuracy calculated for the corresponding feature.

[0148] The user interface screen 280 may be configured so that when one of the multiple types of features displayed is selected, the feature distribution graph 290 used to calculate the separation accuracy is displayed.

[0149] The user selects a target feature or set while referring to the feature distribution graph 290 and assigns an OK label or an NG label. The feature distribution graph 290 displays a labeling diagram 292 in response to user actions. The user selects a set or outlier included in the feature distribution and manipulates the labeling diagram 292 to assign an OK label or an NG label.

[0150] If any of the features displayed in the feature distribution graph 290 is selected, a time series data graph 270 showing the time series data from which the selected feature was calculated may be displayed. By displaying the time series data graph 270, the user can more reliably confirm whether or not the data is abnormal.

[0151] Furthermore, for samples (time-series data) that have already been labeled, the display may be made different. By making the display different in this way, it is possible to prevent the user from having to repeatedly check the details of the same sample (time-series data).

[0152] Through the above process, training data 60 (a group of labeled time-series data) can be prepared without depending on experience or skills.

[0153] <Supplementary Note> The present embodiment as described above includes the following technical ideas.

[0154] [Configuration 1] An acquisition module (230) that acquires time-series data from a control device (100), A determination module (232) that determines a plurality of types of feature quantities (50) by a combination of a first function (30) that defines a range used for calculating a feature quantity among the target time-series data and a second function (40) that defines a statistic used as the feature quantity, An information processing system including an evaluation module (330) that evaluates the time-series data for each of the plurality of types of feature quantities.

[0155] [Configuration 2] The evaluation module (330, 350) calculates a separation accuracy for each of the plurality of types of feature quantities based on a label assigned to the time-series data and a value of a feature quantity of a target type calculated from the time-series data. The information processing system according to Configuration 1.

[0156] [Configuration 3] The information processing system according to Configuration 1 or 2, further including a first presentation module (236) that presents a first user interface screen (250) including the separation accuracy calculated by the evaluation module for at least a part of the plurality of types of feature quantities.

[0157] [Configuration 4] The information processing system according to any one of Configurations 1 to 3, further including an algorithm generation module (238) that generates an anomaly detection algorithm including one or more selected feature quantities from the plurality of types of feature quantities.

[0158] [Configuration 5] The algorithm generation module transmits the anomaly detection algorithm to the control device. The information processing system according to Configuration 4.

[0159] [Composition 6] The evaluation module (330,352) determines, for each of the multiple types of features, time series data that is estimated to exhibit different characteristics from other time series data, based on the distribution of the target type of feature calculated from the time series data, according to the information processing system described in any one of configurations 1 to 5.

[0160] [Composition 7] The information processing system according to configuration 6, further comprising a second presentation module (236) that presents a second user interface screen (280,290) containing time series data that is estimated to exhibit different characteristics from other time series data calculated by the evaluation module for at least some of the aforementioned multiple types of features.

[0161] [Structure 8] The information processing system according to configuration 7, further comprising a learning data generation module (234) that generates learning data by assigning labels to the time-series data in response to user operations.

[0162] [Composition 9] A method of information processing performed by a computer (200), Steps (S100; S200) include acquiring time-series data from the control device (100), Steps (S104; S202) include determining multiple types of features (50) by combining a first function (30) that defines the range of the target time series data to be used for calculating features, and a second function (40) that defines the statistics to be used as features, An information processing method comprising the steps of evaluating the time series data for each of the aforementioned multiple types of features (S108-S118; S206-S216).

[0163] [Configuration 10] An acquisition module (230) that acquires time-series data from a control device (100), A determination module (232) that determines a plurality of types of feature amounts (50) by a combination of a first function (30) that defines a range used for calculating feature amounts in the target time-series data and a second function (40) that defines a statistic used as a feature amount, An information processing apparatus including a transmission module (240) that requests the evaluation of the time-series data from a computing resource (300) for each of the plurality of types of feature amounts.

[0164] <G. Advantages> For anomalies targeted for anomaly detection, there can exist various types of time waveforms (time-series data). In the present embodiment, when calculating feature amounts used for anomaly detection from time-series data, feature amounts determined by a combination of a cut-out function (first function) that defines a range used for calculating feature amounts in the target time-series data and a statistical function (second function) that defines a statistic used as a feature amount are used.

[0165] However, since the number of types of feature amounts determined by a combination of the cut-out function and the statistical function can be enormous, it is practically impossible to evaluate all feature amounts manually. Therefore, feature amounts determined depending on personal experience, skills, etc. are often used, but there is no guarantee that the determined feature amounts are optimal.

[0166] In contrast, the information processing system according to the present embodiment can support the determination of appropriate feature amounts by evaluating time-series data for each of a plurality of types of feature amounts using computer resources.

[0167] The embodiments disclosed this time should be considered as illustrative in all respects and not restrictive. The scope of the present invention is shown not by the above description but by the claims, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.

Description of Reference Numerals

[0168] 1 Information processing system, 2,4 Fieldbus, 6 Higher-level network, 10 Field device group, 12 Remote I / O device, 14 Relay group, 18 Servo driver, 20 Servo motor, 30 Extraction function, 40 Statistical function, 50 Feature set, 60 Training data, 62 Time series data set, 70 Anomaly detection algorithm, 72 Information, 100 Control device, 102,202,302 Processor, 104 Chipset, 106,206,306 Main memory, 108,208,308 Secondary memory, 110 Higher-level network controller, 112,212 USB controller, 114 Memory card interface, 116 Memory card, 118,120 Fieldbus controller, 122 Internal bus controller, 124 I / O unit, 131 System program, 132 User program, 133 Anomaly detection program, 140 PLC engine, 150 Anomaly detection engine, 160 TSDB, 200 Information processing device, 204 Optical drive, 205 Recording medium, 214,314 Network controller, 216,316 Input unit, 218,318 Display unit, 220,320 Bus, 222,322 OS, 224 Interface program, 226 Development program, 228 Anomaly detection setting generation program, 230 Acquisition module, 232 Decision module, 234 Training data generation module, 236 User interface module, 238 Algorithm generation module, 240 Transmission module, 250,280 User interface screen, 251 Check column, 252 Rank column, 253,282 Extraction function column, 254,283 Statistical function column, 255,284 Separation score column, 256 Processing load column, 260,290 Feature distribution graph, 262 Threshold, 270 Time series data graphs, 281 attention rank columns, 292 labeling diagrams, 300 server devices, 324 hypervisors, 326 deployment managers, 328 application programs, 330 evaluation modules, 350 isolation accuracy evaluation algorithms, 352 anomaly detection algorithms.

Claims

1. An acquisition module that acquires time-series data from the control unit, A decision module that determines multiple types of features by combining a first function selected from multiple types of first functions that define the range of the target time series data used for calculating features, and a second function selected from multiple types of second functions that define the statistics used as features, An information processing system comprising an evaluation module that evaluates the time-series data for each of the aforementioned multiple types of features.

2. The information processing system according to claim 1, wherein the evaluation module calculates the separation accuracy for each of the plurality of types of features based on the labels assigned to the time series data and the values ​​of the feature quantities of the target type calculated from the time series data.

3. The information processing system according to claim 1, further comprising a first presentation module that presents a first user interface screen including the separation accuracy calculated by the evaluation module for at least some of the plurality of types of feature quantities.

4. The information processing system according to any one of claims 1 to 3, further comprising an algorithm generation module that generates an anomaly detection algorithm including one or more features selected from the aforementioned plurality of types of features.

5. The information processing system according to claim 4, wherein the algorithm generation module transmits the anomaly detection algorithm to the control device.

6. The information processing system according to any one of claims 1 to 3, wherein the evaluation module determines, for each of the plurality of types of features, time series data that is estimated to exhibit different characteristics from other time series data, based on the distribution of the target type of feature calculated from the time series data.

7. The information processing system according to claim 6, further comprising a second presentation module that presents a second user interface screen containing time series data estimated to exhibit different characteristics from other time series data calculated by the evaluation module for at least some of the aforementioned plurality of types of features.

8. The information processing system according to claim 7, further comprising a learning data generation module that generates learning data by assigning labels to the time-series data in response to user operations.

9. A method of information processing performed by a computer, Steps include acquiring time-series data from the control device, The steps include determining multiple types of features by combining a first function selected from multiple types of first functions that define the range of the target time series data used for calculating features, and a second function selected from multiple types of second functions that define the statistics to be used as features, An information processing method comprising the step of evaluating the time series data for each of the aforementioned plurality of types of features.

10. An acquisition module that acquires time-series data from the control unit, A decision module that determines multiple types of features by combining a first function selected from multiple types of first functions that define the range of the target time series data used for calculating features, and a second function selected from multiple types of second functions that define the statistics used as features, An information processing device comprising a transmission module that requests a computing resource to evaluate the time-series data for each of the aforementioned multiple types of features.

Images