Anomaly detection device and anomaly detection method

Abstract

To enable detecting abnormality, not requiring a lot of data.SOLUTION: An abnormality detection device is configured to: calculate an amount of characteristic from inspection object data composed of a plurality of values in an inspection object; determine a parameter of a normal model adapted to a normal time of the inspection object and a parameter of an abnormal model adapted to an abnormal time of the inspection object on the calculated amount of characteristic; calculate an average of frequency of each of the normal model and abnormal model on the basis of the calculated amount of characteristic and the determined normal model and abnormal model; and determine which any of the normal model and abnormal model is adapted to the inspection object data on the basis of a logarithmic ratio of the calculated frequency.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to an abnormality detection device for detecting an abnormality and an abnormality detection method.

Background Art

[0002] In a device equipped with an engine, when an abnormality occurs in the engine, an abnormal sound is generated from the engine. By detecting the abnormal sound generated from the engine, the abnormality of the engine is detected. As a problem of abnormal sound detection, the frequency of occurrence of an abnormality that causes an abnormal sound is lower than normal, and it is difficult to obtain sufficient abnormal value data for performing machine learning for normal / abnormal classification. Therefore, in the field of abnormality detection, it is determined whether it is a normal value using a machine learning model (such as one-class svm) that determines the normal range from normal value data.

[0003] In order to train the abnormality detection model as described above, like other machine learning models, a large number of normal values are required, and there is a problem that a great deal of time and cost are required to collect data sufficient for practical use.

[0004] In an engine, a clearance (valve clearance) is provided between a valve and a cam that operates the valve. Patent Document 1 discloses an invention for evaluating the valve clearance. In the invention described in Patent Document 1, the valve clearance of the engine is evaluated by vibration.

[0005] Furthermore, Patent Document 2 states that, "In an abnormal sound detection system, in addition to normal data, it may be possible to collect a very small amount of data such as sound waveforms corresponding to abnormal conditions such as malfunctions ("abnormal data"). However, because the amount of data is significantly skewed between normal and abnormal, it is difficult to simply use abnormal data for learning as a discrimination problem. One technique to solve this is a technique that performs manifold learning using both types of data." In addition, Patent Document 2 states that, "the degree of abnormality is calculated from the distance between the normal distribution and the abnormal distribution." [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2004-251206 [Patent Document 2] Japanese Patent Publication No. 2020-013449 [Overview of the project] [Problems that the invention aims to solve]

[0007] As mentioned above, there is a problem in that a large amount of data is required to detect anomalies.

[0008] The objective of this invention is to enable the detection of anomalies without requiring a large amount of data. [Means for solving the problem]

[0009] The first anomaly detection device of the invention is characterized by calculating feature quantities from inspection target data consisting of multiple values ​​of the inspection target, determining the parameters of a normal model that fits the inspection target when it is normal and the parameters of an anomaly model that fits the inspection target when it is abnormal based on the calculated feature quantities, calculating the average of the likelihoods of the normal model and the anomaly model based on the calculated feature quantities and the determined normal model and anomaly model, and determining whether the inspection target data fits the normal model or the anomaly model based on the logarithmic ratio of the calculated likelihoods.

[0010] In this invention, based on features calculated from data consisting of multiple values ​​in the data being inspected, the parameters of a normal model that fits the data being inspected when it is normal, and the parameters of an abnormal model that fits the data being inspected when it is abnormal, are determined. Then, based on the calculated features and the determined normal and abnormal models, it is determined whether the data being inspected fits the normal or abnormal model based on the logarithmic ratio of the likelihoods of the calculated normal and abnormal models, respectively. In conventional machine learning, training data and corresponding ground truth labels are required, but in this invention, ground truth labels associated with training data are not required, so anomalies can be detected without requiring a large amount of data.

[0011] The abnormality detection device of the second invention is characterized in that, in the first abnormality detection device, the multiple values ​​in the object under inspection are values ​​of sound emitted from the object under inspection.

[0012] The abnormality detection device of the third invention is characterized in that, in the abnormality detection device of the first or second invention, the object to be inspected is an engine, and the multiple values ​​in the object to be inspected are values ​​of sound generated from the engine that is the object to be inspected.

[0013] The anomaly detection device of the fourth invention is characterized in that, in the anomaly detection device of any of the first to third inventions, the inspection target data, which consists of multiple values ​​in the inspection target, is recorded data of sound values ​​generated from the inspection target.

[0014] The fifth invention is an anomaly detection device, which is an anomaly detection device according to any of the first to fourth inventions, wherein the object to be inspected is an engine, and the object to be inspected data, which consists of a plurality of values ​​in the object to be inspected, is recorded data of sound values ​​generated from the engine that is the object to be inspected.

[0015] The anomaly detection device of the sixth invention is characterized in that, in the anomaly detection device of any of the first to fifth inventions, a Gaussian mixed model is used for the normal model and the anomaly model.

[0016] The abnormality detection device of the seventh invention is characterized in that, in the abnormality detection device of any one of the first to sixth inventions, when the ratio of the abnormality model to the normal model of the calculated likelihood is equal to or greater than a predetermined value, it is determined that the abnormality model is conformed to.

[0017] The abnormality detection device of the eighth invention is characterized in that, in the abnormality detection device of any one of the first to sixth inventions, when the ratio of the normal model to the abnormality model of the calculated likelihood is equal to or less than a predetermined value, it is determined that the abnormality model is conformed to.

[0018] The abnormality detection method of the ninth invention calculates a feature amount from inspection target data composed of a plurality of values in an inspection target, and based on the calculated feature amount, determines parameters of a normal model that conforms to the inspection target in a normal state and parameters of an abnormality model that conforms to the inspection target in an abnormal state, calculates an average of likelihoods of the normal model and the abnormality model respectively based on the calculated feature amount and the determined normal model and abnormality model, and determines whether the inspection target data conforms to either the normal model or the abnormality model based on the calculated logarithmic ratio of the likelihoods.

Advantages of the Invention

[0019] According to the present invention, an abnormality can be detected without requiring a large amount of data.

Brief Description of the Drawings

[0020] [Figure 1] It is a diagram showing recording data of an engine. [Figure 2] It is a diagram for explaining abnormality detection according to an embodiment of the present invention. [Figure 3] It is a diagram showing a determination result of abnormal noise of valve clearance in the present embodiment.

Embodiments for Carrying Out the Invention

[0021] Hereinafter, embodiments of the present invention will be described. A personal computer (PC) or the like functions as an abnormality detection device that detects abnormalities. In this embodiment, a case where an abnormality is detected by detecting abnormal noise (abnormal sound) generated from the engine during an abnormality will be described. When there is an abnormality in the valve clearance of the engine, abnormal sound occurs when the cylinder with the abnormality is operating. Therefore, a normal period (a period during which no abnormal sound is generated) and a period during which abnormal sound is generated occur. FIG. 1 is a diagram showing recording data of the engine. The horizontal axis represents time (seconds), and the vertical axis represents frequency (Hz). Abnormal sound is generated in the section where a vertical line occurs.

[0022] FIG. 2 is a diagram for explaining abnormality detection according to an embodiment of the present invention. First, engine sound is recorded from the engine to be inspected, and feature amounts are calculated from the recorded engine sound. The algorithm for calculating feature amounts from the recording data uses mel-spectgram.

[0023] Next, using a Gaussian mixture model (GMM), parameters of a model that fits during an abnormality and a model that fits during normal operation are determined (learned) from the recording data. That is, based on the feature tones obtained from the recording data, a normal model and an abnormal model are learned. GMM is used for each model. GMM is a method of expressing a given data set as a superposition of a plurality of normal distributions. The parameters of GMM are calculated using the EM algorithm.

[0024] GMM is represented by the following formula.

Equation

[0025] Next, the average (sum) of the likelihoods of each model is calculated from the constructed model and a certain number of features, and the model that best fits is determined from its log-likelihood ratio. If the normal model obtained from equation 1 above is Pn(x) and the abnormal model is Pa(x), then the average of the log-likelihood ratios of each feature is calculated by the following formula.

number

[0026] Figure 3 shows the results of determining abnormal valve clearance noise in this embodiment. In Figure 3, the file name is any file name in the recorded data. The score (likelihood ratio) is L(x) as described above. In the file name "834420(1)", the score (likelihood ratio) is "7.7", which exceeds a predetermined value, and is therefore determined to be abnormal.

[0027] As explained above, in this embodiment, based on feature quantities calculated from recording data of sounds generated from the engine under inspection, the parameters of the normal model that fits the engine when it is functioning normally and the parameters of the abnormal model that fits the engine when it is malfunctioning are determined. Then, based on the calculated feature quantities and the determined normal and abnormal models, it is determined whether the recording data fits the normal or abnormal model based on the logarithmic ratio of the likelihoods of the calculated normal and abnormal models, respectively. In this embodiment, since it does not require training data and the corresponding ground truth labels, and determines whether the data under inspection fits the normal or abnormal model, it is possible to detect abnormalities without requiring a large amount of data.

[0028] Furthermore, the aforementioned Patent Documents 1 and 2 neither describe nor suggest determining whether a model fits either an abnormal model or a normal model based on likelihood.

[0029] Although embodiments of the present invention have been described above, the embodiments to which the present invention can be applied are not limited to those described above, and modifications can be made as appropriate without departing from the spirit of the invention, as illustrated below.

[0030] In the above-described embodiment, an engine was used as an example of the object to be inspected, and an example of detecting an engine abnormality was provided. However, the object to be inspected is not limited to an engine.

[0031] In the above embodiment, the model is determined to fit the abnormal model if the ratio of the calculated likelihood of the abnormal model to the normal model is greater than or equal to a predetermined value. However, it is not limited to this, and the model may be determined to fit the abnormal model if the ratio of the calculated likelihood of the abnormal model to the normal model is less than or equal to a predetermined value. [Industrial applicability]

[0032] The present invention can be suitably adopted in an abnormality detection device and an abnormality detection method for detecting abnormalities.

Claims

1. Features are calculated from the test target data, which includes both normal and abnormal conditions, composed of multiple values ​​for the test target. Based on the calculated feature quantities of the data to be inspected, the parameters of the normal model that fit the normal state of the data to be inspected and the parameters of the abnormal model that fit the abnormal state of the data to be inspected are determined. Based on the calculated features of the data to be tested and the determined normal and abnormal models, the mean likelihood of each model is calculated. Based on the logarithmic ratio of the likelihoods of the normal model and the abnormal model calculated, it is determined whether the data under test fits the normal model or the abnormal model. Gaussian mixed models are used for both the normal and abnormal models. An anomaly detection device characterized in that the normal model is represented by a single normal distribution, and the abnormal model is represented by two normal distributions.

2. The anomaly detection device according to claim 1, characterized in that the inspection target data, which consists of multiple values ​​in the inspection target, is recording data of sound generated from the inspection target.

3. The object of inspection is the engine. The abnormality detection device according to claim 1 or 2, characterized in that the inspection target data, which consists of multiple values ​​in the inspection target, is recording data of sound generated from the engine that is the inspection target.

4. An anomaly detection device according to any one of claims 1 to 3, characterized in that it determines that the device fits the anomaly model if the ratio of the calculated likelihood of the anomaly model to the normal model is greater than or equal to a predetermined value.

5. An anomaly detection device according to any one of claims 1 to 3, characterized in that it determines that the device fits the anomaly model when the ratio of the calculated likelihood of the normal model to the anomaly model is less than or equal to a predetermined value.

6. Features are calculated from the test target data, which includes both normal and abnormal conditions, composed of multiple values ​​for the test target. Based on the calculated feature quantities of the data to be inspected, the parameters of the normal model that fit the normal state of the data to be inspected and the parameters of the abnormal model that fit the abnormal state of the data to be inspected are determined. Based on the calculated features of the data to be tested and the determined normal and abnormal models, the mean likelihood of each model is calculated. Based on the logarithmic ratio of the likelihoods of the normal model and the abnormal model calculated, it is determined whether the data under test fits the normal model or the abnormal model. Gaussian mixed models are used for both the normal and abnormal models. An anomaly detection method characterized in that the normal model is represented by a single normal distribution, and the abnormal model is represented by two normal distributions.

Images