Anomaly detection device and anomaly detection method

Abstract

The aim is to more reliably estimate anomalies contained in the frequency spectrum of a signal. [Solution] The anomaly management device 1 includes a classification unit 13 that takes input data based on the intensity of each of the multiple frequency components for each observation unit as unknown input, provides it to a trained classification model 12A that reflects the correlation between the intensities of each of the multiple frequency components for each observation unit, performs calculations on the trained classification model 12A, and outputs a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.

Description

Technical Field

[0001] The present invention relates to an abnormality management device and an abnormality management method.

Background Art

[0002] Conventionally, there has been known a technique for analyzing the characteristics of a time-series signal in the frequency domain to detect an abnormality contained in the signal. For example, Patent Document 1 discloses a technique for estimating an abnormality in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of normal signals and abnormal signals as learning data.

[0003] However, in the technique disclosed in Patent Document 1, learning and inference are performed mainly using the intensity of each frequency component of the signal in the frequency domain as an individual feature amount, and it is difficult to obtain a feature expression that sufficiently reflects the relationship between frequency components and structural features. Therefore, it may be difficult to accurately capture changes in the frequency spectrum of the signal as a whole or signs of abnormalities that appear across multiple frequency components.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] As described above, according to the conventional technique, it has been difficult to stably estimate an abnormality contained in the frequency spectrum of a signal with respect to the appearance of an abnormality and changes in the signal state.

[0006] The present invention has been made to solve the above-described problems, and an object thereof is to more stably estimate an abnormality contained in the frequency spectrum of a signal.

Means for Solving the Problems

[0007] To solve the above-mentioned problems, the anomaly management device according to the present invention comprises: an acquisition unit configured to acquire the intensity of each of a plurality of frequency components included in the frequency spectrum of a signal observed for each observation unit; and a classification unit configured to take input data based on the intensity of each of the plurality of frequency components for each observation unit acquired by the acquisition unit as an unknown input, provide it to a trained classification model that reflects the correlation between the intensities of each of the plurality of frequency components for each observation unit, perform calculations on the trained classification model, and output a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.

[0008] Furthermore, the anomaly management device according to the present invention may further include a learning unit configured to learn feature quantities relating to the correlation between the intensities of each of the multiple frequency components by a classification model, using training data in which patterns relating to the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit are attached as correct labels to the input data based on the intensity of each of the multiple frequency components for each observation unit, and a storage unit configured to store the learned classification model constructed by the learning unit.

[0009] Furthermore, the abnormality management device according to the present invention may further include an input data creation unit configured to create matrix data representing the correlation between the intensities of each of the multiple frequency components based on the intensity of each of the multiple frequency components for each observation unit, and the classification unit may provide the matrix data created by the input data creation unit as input data to the trained classification model.

[0010] Furthermore, the abnormality management device according to the present invention may also include a notification unit configured to provide notification indicating the occurrence of an abnormality when the classification result output by the classification unit indicates that an abnormality is included in the frequency spectrum of the signal.

[0011] Furthermore, in the anomaly management device according to the present invention, the classification model may include a convolutional neural network.

[0012] Furthermore, in the anomaly management device according to the present invention, the classification model may further include an attention mechanism configured to emphasize the features extracted by the convolutional neural network by weighting them based on the importance of a plurality of feature maps constituting the features.

[0013] To solve the above-mentioned problems, the anomaly management method according to the present invention comprises: an acquisition step of acquiring the intensity of each of a plurality of frequency components included in the frequency spectrum of a signal observed for each observation unit; and a classification step of providing input data based on the intensity of each of the plurality of frequency components for each observation unit acquired in the acquisition step as an unknown input to a trained classification model that reflects the correlation between the intensities of each of the plurality of frequency components for each observation unit, performing calculations on the trained classification model, and outputting a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.

[0014] Furthermore, the anomaly management method according to the present invention may further include a learning step in which a classification model learns feature quantities relating to the correlation between the intensities of each of the multiple frequency components by using training data in which patterns relating to the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit are attached as correct labels to the input data based on the intensity of each of the multiple frequency components for each observation unit, and a storage step in which the learned classification model constructed in the learning step is stored in a storage unit.

[0015] Furthermore, the anomaly management method according to the present invention further includes an input data creation step in which matrix data representing the correlation between the intensities of each of the multiple frequency components is created based on the intensity of each of the multiple frequency components for each observation unit, and the classification step may provide the matrix data created in the input data creation step as input data to the trained classification model.

[0016] Furthermore, the abnormality management method according to the present invention may also include a notification step that provides notification indicating the occurrence of an abnormality when the classification result output in the classification step indicates that an abnormality is included in the frequency spectrum of the signal. [Effects of the Invention]

[0017] According to the present invention, input data based on the intensity of each of multiple frequency components for each observation unit is given as an unknown input to a trained classification model that reflects the correlation between the intensities of each of the multiple frequency components for each observation unit. The trained classification model is then used to perform calculations and output a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. Therefore, it is possible to estimate anomalies in the frequency spectrum of the signal more stably. [Brief explanation of the drawing]

[0018] [Figure 1] Figure 1 is a block diagram showing the configuration of an abnormality management system equipped with an abnormality management device according to an embodiment of the present invention. [Figure 2] Figure 2 is a diagram illustrating the overview of the abnormality management system according to this embodiment. [Figure 3] Figure 3 is a diagram illustrating the configuration of the learning unit of the abnormality management device according to this embodiment. [Figure 4] Figure 4 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 5] Figure 5 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 6]Figure 6 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Modes for carrying out the invention]

[0019] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to Figures 1 to 6.

[0020] [Configuration of the anomaly management system] First, with reference to Figure 1, an overview of an anomaly management system comprising an anomaly management device 1 according to an embodiment of the present invention will be described. The anomaly management system comprises an anomaly management device 1 and a communication terminal 2. The anomaly management device 1 and the communication terminal 2 are connected via a network NW. The anomaly management system estimates anomalies contained in the frequency spectrum of an observed signal.

[0021] The network NW includes, for example, wired networks such as LAN, WAN or the Internet, ISDN, mobile communication networks using wireless LAN, LTE / 4G, 5G, 6G wireless communication systems, and wireless networks such as Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

[0022] The communication terminal 2 can be implemented as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, etc. In this embodiment, there are n units of the communication terminal 2 (where n is a positive integer of 1 or more). The communication terminal 2 includes a terminal that is compatible with a mobile communication network and has a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as the subscriber identification number (IMSI: International Mobile Subscriber Identity).

[0023] Furthermore, the communication terminal 2 includes devices that have an IP address and are configured as IoT terminals. The communication terminal 2 is equipped with a mobile communication module and various sensors, and can detect various physical quantities and measure them as electrical signals. The communication terminal 2 transmits the measured signals via the network NW to a gateway (not shown) or to the anomaly management device 1. In this embodiment, as an example, the reception level and signal strength of signals received from the base station, which are periodically measured and recorded by the mobile communication module of the communication terminal 2, are used as the signals to be monitored for anomalies.

[0024] As shown in region 2a of Figure 1, the communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of anomalies from the signal strength waveform data shown in region 2a. Therefore, the anomaly management device 1, described later, converts the time-series data of signal strength into a frequency domain spectrum and detects signal anomalies by analyzing the frequency components.

[0025] In this specification, "anomaly" refers to a state in which the frequency spectrum of a signal exhibits characteristics different from those expected under normal conditions, including cases where the intensity of frequency components shows an unusual distribution or where significant changes occur in a particular frequency band. Such anomalies are not limited to appearing as changes in the intensity of a single frequency component, but may also appear as changes in the behavior of the entire frequency spectrum.

[0026] Figure 2 illustrates anomalous data showing a frequency spectrum containing frequency components of abnormal intensity. In Figure 2, the horizontal axis represents frequency and the vertical axis represents intensity. Curve a1 shows the normal frequency spectrum of a signal measured by one communication terminal 2, while curve b1 shows the frequency spectrum of a signal measured by another communication terminal 2, which contains frequency components of abnormal intensity. Frequency spectrum b1 contains an intensity peak in the frequency axis interval c that is not present in the normal frequency spectrum a1, indicating an anomalous frequency spectrum with abnormal intensity. Therefore, an anomaly is occurring in the signal having frequency spectrum b1. Note that "intensity" is a concept that includes the amplitude, power, or corresponding physical quantities of each frequency component, and also includes the use of voltage values ​​as intensity.

[0027] The communication terminal 2 that measured the signal containing such abnormally strong frequency components in its frequency spectrum is experiencing hardware or configuration problems, or problems in the receiving environment. For example, this could be due to a malfunction in the communication module of communication terminal 2, a bug or misconfiguration in the measurement software, or interference from an internal noise source. Therefore, it can be concluded that the communication terminal 2 that measured the signal containing such abnormally strong frequency components in its frequency spectrum is malfunctioning.

[0028] [Functional blocks of the anomaly management device] As shown in Figure 1, the abnormality management device 1 comprises an acquisition unit 10, an input data creation unit 11, a learning unit 12, a classification unit 13, a notification unit 14, and a storage unit 15.

[0029] The acquisition unit 10 acquires the intensity of each of a plurality of frequency components included in the frequency spectrum of the signal observed for each observation unit. Specifically, the acquisition unit 10 acquires the intensity of M (M is a positive integer of 2 or more) frequency components included in the frequency spectrum of the signal measured by the communication terminal 2 to be managed via the network NW. The observation unit is the minimum unit in which a set of M-dimensional vectors can be acquired under the same conditions, and for example, an observation unit corresponding to the characteristics of the target signal such as a time interval, an operation cycle unit, an event unit, etc. can be adopted. The acquisition unit 10 can further acquire the intensity of each of a plurality of frequency components included in the frequency spectrum of the signal observed for each observation unit, which is used as training data for learning by the learning unit 12.

[0030] The acquisition unit 10 acquires the intensity x of each of the M frequency components observed for each observation unit (hereinafter referred to as "observation unit t" k "). The acquisition unit 10 acquires the intensity x of each of the M frequency components acquired in each observation unit t m (k = 1,..., K). A set having the intensity x of each of the M frequency components as elements is defined as the intensity group D k of the M frequency components in the observation unit t m and acquired as D k = {x1, x2,... x k}. M

[0031] The input data creation unit 11 creates matrix data representing the correlation between the intensities of each of the plurality of frequency components based on the intensity of each of the plurality of frequency components for each observation unit acquired by the acquisition unit 10. The matrix data created by the input data creation unit 11 is used as input data for the classification model 12A provided in the learning unit 12 and the classification unit 13 described later. More specifically, the input data creation unit 11 creates matrix data representing the correlation between the intensities of each of the M frequency components based on the intensity group D k of the M frequency components in each observation unit t k acquired by the acquisition unit 10, where D M = {x1, x2,... x

[0032] The input data creation unit 11 generates vector D from the intensity data of each of the M frequency components. k Treated as such, vector D k and its transpose vector D k T Based on the product of the two, we create an M×M matrix data represented by the following equation (1).

number

[0033] In equation (1) above, × represents the cross product, and matrix X k The elements are x ij =x i x j Furthermore, each element of the matrix data reflects the relationship of simultaneous fluctuations between the intensities of each of the M frequency components. Such matrix data is used as a feature representing the correlation between the intensities of the frequency components in the classification model 12A described later. The input data creation unit 11 generates the matrix data of equation (1) above (hereinafter referred to as "input matrix" or "input matrix X") k The observation unit t k Create a total of K items for each (k=1,...,K) value.

[0034] The input data creation unit 11 further generates the input matrix X k Using this, the training data used by the learning unit 12 is created. More specifically, the input data creation unit 11 creates the observation unit t k The input matrix X in equation (1) above, created for each (k=1,...,K) k For this purpose, training data is created by assigning correct labels to each of the following patterns regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit: normal patterns 1 to O, which indicate a state where there are no anomalies in the frequency spectrum, and anomaly patterns 1 to P, which indicate an abnormal state where the frequency spectrum deviates from the normal range.

[0035] Normal patterns 1-O are input matrix X kIn this context, the correlation between the intensities of each frequency component is within the range expected under normal conditions, and the behavior of the frequency spectrum is stable, representing a normal pattern. In particular, patterns in which the intensities of each frequency component fluctuate independently, as seen under normal conditions, or predefined patterns in which they fluctuate in a stable, constant relationship, are predefined as normal patterns 1 to 0.

[0036] On the other hand, abnormal patterns 1 to P are represented by the input matrix X k In this context, the correlation of the intensity between some or more frequency components exhibits a state different from normal, indicating an abnormality in the frequency spectrum. This unusual correlation includes patterns where the intensity of a specific frequency component and other frequency components simultaneously increases or decreases, patterns where synchronous fluctuations occur across multiple frequency components, and patterns where the intensity of other frequency components changes in response to changes in a specific frequency component. Each pattern corresponds to a different classification class in classification model 12A. These patterns belonging to each normal and abnormal class are pre-set according to the characteristics of the signal, etc.

[0037] The learning unit 12 includes a classification model 12A. The learning unit 12 uses training data, in which patterns indicating the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit are assigned as ground truth labels, to input data based on the intensity of each of the multiple frequency components for each observation unit. The classification model 12A then learns features relating to the correlation between the intensities of each of the multiple frequency components.

[0038] More specifically, the learning unit 12 processes the input matrix X created by the input data creation unit 11. k Classification model 12A is trained using training data with correct labels assigned to it. Features are defined as the input matrix X k A concept that includes each element contained in and the features extracted based on them, for example, the input matrix X kEach element included, i.e., each frequency component, contains individual numerical values ​​that represent the correlation between their intensities. Based on the combinations and distribution trends of these multiple features, the learning unit 12 learns patterns to identify differences in distribution states formed according to the manner of fluctuations in the intensities of multiple frequency components.

[0039] Figure 3 is a block diagram showing an example of a classification model 12A provided by the learning unit 12. As shown in Figure 3, the classification model 12A includes a convolutional neural network (CNN). The classification model 12A further includes an attention mechanism that weights the features related to the correlation between the intensities of multiple frequency components extracted by the CNN based on the importance of multiple feature maps that constitute the features, thereby emphasizing the features. In this embodiment, SENet (Squeeze-and-Excitation Network) is adopted as the classification model 12A. SENet includes an attention mechanism that weights the feature maps extracted by the hidden layer 121 of the CNN.

[0040] The classification model 12A consists of three main stages: a hidden layer 121 which is a feature extraction unit using a CNN, an SE block 122 which is a feature enhancement unit using SENet, and an output layer 124 which is a classification output unit. In the classification model 12A shown in Figure 3, the input layer 120 and the hidden layer 121 are configured to correspond to a CNN.

[0041] The input layer 120 uses the observation unit t. k The intensity D of each of the M frequency components k ={x1,x2,...x M The input matrix X in equation (1) above, based on} k Enter the input matrix X. k This is a matrix created by the input data creation unit 11. Input matrix X k This is input to the hidden layer 121 via the input layer 120.

[0042] The hidden layer 121 includes a convolutional layer that performs convolutional processing on the data input from the input layer 120, an activation layer that uses the ReLU function as the activation function, and a pooling layer that aggregates features, with the input matrix X k A set of feature maps consisting of multiple feature maps is extracted from the input matrix X. Furthermore, processing blocks including convolutional layers and pooling layers may be provided in L stages from the input layer 120 to the output layer 124. These input layer 120 and hidden layer 121 process the input matrix X. k The correlation between the intensities of multiple frequency components contained within is expressed as a spatial feature.

[0043] On the other hand, the SE block 122 and the multiplier 123 are configured to support an attention mechanism that enhances features in the channel direction, taking into account the importance of the feature maps extracted by the CNN. The SE block 122 takes the feature maps output from the hidden layer 121 of the CNN as input and performs global average pooling to aggregate spatial information for each channel.

[0044] SE block 122 performs linear transformations using multiple connected layers and nonlinear transformations using an activation function (ReLU) on the aggregated input vector x, and calculates weight coefficients representing the importance of each channel for each number of feature maps extracted by the hidden layer 121 of the CNN. SE block 122 can be applied to the feature map group output from the final stage of the L-stage convolutional and pooling layers of the hidden layer 121 of the CNN, or to intermediate stages of multiple stages. The transformation process of SE block 122 is expressed by the following equation (2).

number

[0045] In equation (2) above, W is the weight matrix in the fully connected layer, b is the bias term, and f is an activation function such as the ReLU function or Sigmoid function. This allows the calculation of a weight coefficient vector y representing the importance of each channel. SE block 122 outputs the calculated weight coefficient vector y, which is then input to the subsequent multiplication unit 123.

[0046] The multiplication unit 123 further weights the features extracted by the CNN by multiplying the weight coefficients calculated by the SE block 122 by the corresponding channels in the feature map set output from the hidden layer 121 of the CNN. The multiplication unit 123 emphasizes features that contribute to classification by highlighting features of high-importance channels and suppressing features of low-importance channels.

[0047] The output layer 124 takes a set of feature maps, further weighted by the multiplication unit 123, as input and outputs a classification result that shows the pattern regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. Output values ​​y1~y O ,y O+1 ~y O+P Each output value y i (i=1~O+P) is the input matrix X based on the intensities of multiple input frequency components. k This value represents the probability or likelihood of belonging to each classification class, and is output as a normalized value using, for example, the Softmax function. In this case, each output value y i The value can be between 0 and 1, and the sum of all output values ​​is 1.

[0048] Classification model 12A uses output values ​​y1~y O The normal pattern group shown and the output value y O+1 ~y O+P By distinguishing the abnormal pattern group shown by the input matrix X k However, it determines which pattern class it belongs to.

[0049] Here, the training data that the learning unit 12 uses to train the classification model 12A is, as mentioned above, the input matrix X kThis is given as a label vector corresponding to the number of classes (O+P) consisting of pre-defined normal patterns 1-O and abnormal patterns 1-P (hereinafter referred to as "C" (=O+P)).

[0050] In this embodiment, the example given is that the correct label y is given as a probability distribution for multiple classes, but it may also be expressed in one-hot notation. That is, the correct label y is y=(y1,y2,…,y C ) is expressed as, and each element y c The value can be between 0 and 1, and the sum of all elements in all correct labels is 1.

[0051] The learning unit 12 uses the input matrix X of the training data. k The values ​​are input to the classification model 12A, and the classification model 12A calculates the estimated value vector y^(y-hat) represented by the following equation (3) through forward propagation.

number

[0052] In equation (3) above, each element y C ^ represents the input matrix X k This indicates the probability that belongs to class C. The learning unit 12 calculates the objective function based on the difference between the correct label y and the estimated value vector y^. A loss function based on multi-level cross-entropy is used as the objective function. For example, the loss L is expressed by the following equation (4).

number

[0053] In the loss function L of equation (4) above, K is the input matrix X, which is the input data used for training. k y represents the total number, and C represents the total number of classes to be classified. c (i) This is the i-th input matrix X k This shows the probability of a given answer belonging to class c. c ^ (i) This is the i-th input matrix X kThis shows the predicted probabilities belonging to class c, obtained by inputting an (M×M dimension input matrix X) into a CNN.

[0054] The learning unit 12 calculates the gradient by backpropagation or the like to minimize the value of the loss L in equation (4) above, and updates the parameters of each layer included in the classification model 12A. At this time, not only the filter coefficients of the convolutional layers and the weight coefficients of the fully connected layers of the CNN, but also the weight parameters of the fully connected layers included in the SE block 122 are updated. In other words, in this embodiment, SENet, a network configuration combining a CNN (input layer 120, hidden layer 121, output layer 124) and an SE block 122, is learned integrally based on a single objective function. The learned classification model 12A is stored in the storage unit 15, which will be described later.

[0055] The classification unit 13 takes the input data, which is based on the intensities of multiple frequency components for each observation unit and acquired by the acquisition unit 10, as an unknown input and provides it to a trained classification model 12A that reflects the correlation between the intensities of multiple frequency components. The trained classification model 12A then performs calculations and outputs a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. More specifically, the classification unit 13 uses the input matrix X of equation (1) above, created by the input data creation unit 11, based on the intensities of M frequency components for each observation unit acquired by the acquisition unit 10. k This is provided to the trained classification model 12A as input data to be classified.

[0056] The classification unit 13 is the observation unit t. k For each K input matrix X of equation (1) above k This is then sequentially input into the pre-trained classification model 12A, and the observation unit t k Input matrix X for each input matrix k The system can output classification results for normal patterns 1-O and abnormal patterns 1-P. This allows for sequential output of classification results regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.

[0057] The notification unit 14 issues a notification indicating the occurrence of an anomaly when the classification result output by the classification unit 13 indicates that the signal's frequency spectrum contains an anomaly. More specifically, if the classification result is one of the anomaly patterns 1 to P, the notification unit 14 can send an alarm along with information about the anomaly patterns 1 to P related to the classification result to an externally located operation center (not shown). Alternatively, the notification unit 14 may send a notification via the network NW to the communication terminal 2 where the anomaly was detected.

[0058] The memory unit 15 stores the trained classification model 12A constructed by the learning unit 12.

[0059] [Hardware configuration of the anomaly management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the functions described above will be explained using Figure 4.

[0060] As shown in Figure 4, the error management device 1 can be implemented, for example, by a computer equipped with a processor 102, main memory 103, communication interface 104, auxiliary storage device 105, and input / output I / O 106 connected via a bus 101, and a program that controls these hardware resources. The error management device 1 also includes a display device 107 connected via the bus 101.

[0061] The processor 102 is a circuit or device that performs arithmetic processing, and can be implemented by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc. Alternatively, some or all of these may be combined to form the processor.

[0062] The main memory 103 is composed of, for example, volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory 103 work together to realize the various functions of the abnormality management device 1, such as the acquisition unit 10, input data creation unit 11, learning unit 12, classification unit 13, and notification unit 14 shown in Figure 1.

[0063] The communication interface 104 is an interface circuit for networking the abnormality management device 1 with various external electronic devices.

[0064] The auxiliary storage device 105 consists of a read / write storage medium and a drive device for reading and writing various information such as programs and data to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0065] The auxiliary storage device 105 has a program storage area for storing the error management program. The auxiliary storage device 105 also has a program storage area for storing the learning program executed by the error management device 1. The storage unit 15 described in Figure 1 is realized by the auxiliary storage device 105. Furthermore, it may have, for example, a backup area for backing up the aforementioned data and programs.

[0066] The I / O106 is an input / output device that accepts signals from external devices and outputs signals to external devices.

[0067] The display device 107 is composed of an organic EL display, a liquid crystal display, or the like. The display device 107 displays information related to the classification result on the screen.

[0068] [Anomaly detection device operation] Next, the operation of the abnormality management device 1 having the above-described configuration will be explained with reference to the flowcharts in Figures 5 and 6.

[0069] First, as shown in Figure 5, the acquisition unit 10 acquires data on the intensity of M frequency components included in the frequency spectrum of the signal observed at each observation unit (step S1). In step S1, the acquisition unit 10 can acquire data such as past history prepared in advance from an external server. Also, in step S1, each observation unit t k The intensity D of M frequency components (k=1,...,K) k ={x1,x2,...x M Get}.

[0070] Next, the input data creation unit 11 processes each observation unit t acquired in step S1. k The intensity D of the M frequency components at (k=1,...,K) k ={x1,x2,...x M Based on}, K M×M dimensional input matrices X of the above equation (1) k The input data creation unit 11 creates the input matrix X to create the training data (step S2). k Training data is created by assigning a correct label to each of the pre-defined normal patterns 1-O and abnormal patterns 1-P, corresponding to one of the classes.

[0071] Next, the learning unit 12 uses the training data created in step S2 to learn features related to the correlation between the intensities of multiple frequency components using the classification model 12A (step S3). More specifically, the learning unit 12 uses the training data created in step S2 to perform supervised learning of the classification model 12A, which is composed of a CNN and SE Net with SE blocks 122. The learning unit 12 calculates the gradient by backpropagation or the like to minimize the value of the loss function L in equation (4) above, and updates the parameters of each layer included in the classification model 12A. At this time, not only the filter coefficients of the convolutional layers and the weight parameters of the fully connected layers are updated, but also the weight parameters of the fully connected layers included in the SE block 122.

[0072] The memory unit 15 stores the trained classification model 12A constructed in the learning process of step S3 (step S4). The learning processes from steps S1 to S4 are performed based on data from each communication terminal 2.

[0073] Next, the inference process of the anomaly management device 1 will be explained with reference to the flowchart shown in Figure 6. First, the acquisition unit 10 acquires the intensities of M frequency components contained in the frequency spectrum of the signal for each observation unit measured and recorded by the communication terminal 2 (step S10). More specifically, in step S10, the acquisition unit 10 can acquire the intensities of M frequency components contained in the frequency spectrum of the signal observed in a predetermined time interval as one observation unit, via the network NW from the communication terminal 2. Alternatively, the acquisition unit 10 may acquire the signal for each observation unit from the communication terminal 2, convert it into a frequency spectrum on the anomaly management device 1 side, and then acquire the intensities of M frequency components.

[0074] Next, each observation unit t obtained in step S10 k The intensity D of M frequency components (k=1,...,K) k ={x1,x2,...x M Based on}, the input matrix X in equation (1) above k These are created sequentially (step S11).

[0075] Next, the classification unit 13 reads the learned classification model 12A from the memory unit 15, and the observation unit t created in step S11 k Input matrix X for each input matrix k The unknown input to be classified is given to a trained classification model 12A that has learned the correlation between the intensities of multiple frequency components, and the trained classification model 12A performs calculations to output a classification result that shows one of the patterns, either normal patterns 1 to O or abnormal patterns 1 to P (step S12).

[0076] In step S12, the classification unit 13 processes each observation unit t k The intensity D of M frequency components (k=1,...,K) k ={x1,x2,...xM The input matrix X is sequentially created based on}. k By sequentially inputting these data into the pre-trained classification model 12A, the system outputs a classification result that indicates one of the following classes: normal patterns 1-O or abnormal patterns 1-P.

[0077] Next, if the classification result in step S12 is one of the abnormal patterns 1 to P, the notification unit 14 sends an alarm along with information on abnormal patterns 1 to P to an externally located operation center (step S13). In step S13, the notification unit 14 receives multiple observation units t k Regarding each observation unit t, k In the classification results of step S12, an alarm is triggered when any of the abnormal patterns 1 to P are classified.

[0078] As described above, the anomaly management device 1 according to this embodiment provides input data based on the intensity of M frequency components for each observation unit as unknown input to a trained classification model 12A that reflects the correlation between the intensities of multiple frequency components. The trained classification model 12A performs calculations and outputs a classification result of either normal patterns 1 to O or abnormal patterns 1 to P, indicating the presence or absence of anomalies in the frequency spectrum. Therefore, it is possible to estimate anomalies contained in the frequency spectrum of a signal more stably.

[0079] Furthermore, according to the abnormality management device 1 of this embodiment, the intensity of M frequency components in each observation unit is treated as a vector, and the vector D and its transpose vector D T Based on the cross product of the two variables, the correlation matrix generated allows for the extraction of the fluctuations between the intensities of M frequency components as multidimensional features. This enables a highly accurate understanding of the characteristics of the fluctuations of multiple frequency components involved in the behavior of the frequency spectrum, and allows for the appropriate determination of the presence or absence of anomalies in the frequency spectrum.

[0080] Furthermore, according to the abnormality management device 1 of this embodiment, the input matrix X is based on the intensity of multiple frequency components included in the frequency spectrum of signals observed by multiple observation units. k The data is sequentially fed to a pre-trained classification model 12A according to the observed units, and a classification result regarding the presence or absence of anomalies in the frequency spectrum is output. Therefore, it is possible to grasp the constantly changing signal in near real time, and in particular, it is possible to estimate the occurrence of anomalies that arise in conjunction with changes in the signal state with high accuracy.

[0081] Furthermore, according to the abnormality management device 1 of this embodiment, the input matrix X k By implementing SENet for multiple features representing the correlation between the intensities of multiple frequency components contained in the spectrum, it becomes possible to dynamically adjust the importance of each feature. As a result, features that contribute to the relationship between the intensities of frequency components that characterize anomalies in the frequency spectrum are relatively emphasized, while the influence of features that do not contribute to anomaly detection is suppressed. Consequently, even when the signal state or the surrounding environment fluctuates, it becomes possible to stably extract features that represent anomalies and estimate anomalies in the frequency spectrum with high accuracy.

[0082] In the above-described embodiment, the case in which SENet is used as the classification model 12A was explained. However, the classification model 12A is not limited to SENet; for example, it may be a CNN-only configuration without a self-attention mechanism. Alternatively, the classification model 12A may be composed of a recurrent neural network (RNN) and a Transformer, autoencoder, or graph neural network (GNN) equipped with a self-attention mechanism.

[0083] Furthermore, the above-described embodiment explained the case in which both the learning unit 12, which performs learning processing, and the classification unit 13, which performs classification processing, are mounted on the abnormality management device 1. However, in addition to the case in which the learning unit 12 and the classification unit 13 are provided as the same hardware configuration, the learning processing and classification processing can also be distributed by multiple servers, etc., on separate servers on a network NW. When the learning unit 12 is provided on the learning server and the classification unit 13 is provided on the operation server, the present invention can also stand independently as a learning device in which the learning server is equipped only with the learning unit 12 and the purpose is to generate and output a trained classification model 12A.

[0084] Furthermore, in the embodiment described, the example given was that the signal measured by the communication terminal 2 is time-series data of signal intensity. However, the time-series signal that is the target of anomaly detection is not limited to signal intensity, as long as it is a signal that can be subjected to frequency analysis. For example, the communication terminal 2 may be equipped with a biosensor and configured to measure time-series data of biological signals such as the user's heart rate, blood pressure, and body temperature. Alternatively, the communication terminal 2 may be equipped with various sensors such as a vibration sensor, a sound sensor, and a pressure sensor, and can measure time-series data of physical quantities such as vibration, sound, and pressure.

[0085] Furthermore, while the described embodiment illustrates a case where learning and inference processes are performed based on data from each communication terminal 2, it is also possible to integrate data collected from multiple communication terminals 2 to perform learning and construct a common, applicable, pre-trained classification model 12A for multiple communication terminals 2. Alternatively, after constructing a common model, the classification model 12A may be retrained or fine-tuned to suit each communication terminal 2 using additional data from each communication terminal 2.

[0086] Although embodiments of the abnormality management device and abnormality management method of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications that a person skilled in the art can envision are possible within the scope of the invention described in the claims. [Explanation of Symbols]

[0087] 1...Anomaly management device, 2...Communication terminal, 10...Acquisition unit, 11...Input data creation unit, 12...Learning unit, 13...Classification unit, 14...Notification unit, 15...Storage unit, 101...Bus, 102...Processor, 103...Main memory, 104...Communication interface, 105...Auxiliary memory, 106...Input / output I / O, 107...Display device, 120...Input layer, 121...Hidden layer, 122...SE block, 123...Multiplication unit, 124...Output layer, NW...Network.

Claims

1. An acquisition unit configured to acquire the intensity of each of the multiple frequency components contained in the frequency spectrum of the signal observed for each observation unit, A classification unit is configured to take input data based on the intensity of each of the multiple frequency components for each observation unit acquired by the acquisition unit as unknown input, provide it to a trained classification model that has learned a pattern for identifying differences in distribution states based on the trend of the distribution of feature quantities relating to the correlation between the intensities of each of the multiple frequency components for each observation unit, perform calculations on the trained classification model, and output a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. An abnormality management device equipped with the following features.

2. In the abnormality management device according to claim 1, Furthermore, the learning unit is configured to learn patterns that identify differences in distribution states based on the trend of the distribution of the feature quantities relating to the correlation between the intensities of each of the multiple frequency components, using training data in which a correct label indicating the presence or absence of anomalies in the frequency spectrum of the signal for each of the observation units is attached to the input data based on the intensity of each of the multiple frequency components for each observation unit, and a classification model. A storage unit configured to store the learned classification model constructed by the learning unit, An abnormality management device equipped with the following features.

3. In the abnormality management device described in claim 1, Furthermore, the system includes an input data creation unit configured to create matrix data representing the correlation between the intensities of each of the multiple frequency components based on the intensity of each of the multiple frequency components for each observation unit. The classification unit provides the matrix data created by the input data creation unit as input data to the trained classification model. An abnormality management device characterized by the following features.

4. In the abnormality management device described in claim 1, Furthermore, the system includes a notification unit configured to provide notification indicating the occurrence of an anomaly when the classification result output by the classification unit indicates that the frequency spectrum of the signal contains an anomaly. An abnormality management device characterized by the following features.

5. In the abnormality management device according to claim 2, The aforementioned classification model includes a convolutional neural network. An abnormality management device characterized by the following features.

6. In the abnormality management device according to claim 5, The classification model further includes an attention mechanism configured to weight the features extracted by the convolutional neural network based on the importance of multiple feature maps constituting the features, thereby emphasizing the features. An abnormality management device characterized by the following features.

7. An acquisition step to obtain the intensity of each of the multiple frequency components contained in the frequency spectrum of the signal observed for each observation unit, A classification step in which input data based on the intensity of each of the multiple frequency components for each observation unit acquired in the acquisition step is given as an unknown input to a trained classification model that has learned a pattern for identifying differences in distribution states based on the trend of the distribution of feature quantities relating to the correlation between the intensities of each of the multiple frequency components for each observation unit, and the trained classification model performs calculations to output a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. An abnormality management method comprising the following features.

8. In the abnormality management method described in claim 7, Furthermore, the learning step involves using training data, which is based on the intensity of each of the multiple frequency components for each observation unit, to learn patterns that identify differences in distribution states based on the trend of the distribution of the feature quantities relating to the correlation between the intensities of each of the multiple frequency components, using a classification model. A storage step in which the learned classification model constructed in the learning step is stored in the memory unit. An abnormality management method comprising the following features.

9. In the abnormality management method described in claim 7, Furthermore, the system includes an input data creation step that creates matrix data representing the correlation between the intensities of each of the multiple frequency components based on the intensity of each of the multiple frequency components for each observation unit, The classification step provides the matrix data created in the input data creation step to the trained classification model as input data. An abnormality management method characterized by the following.

10. In the abnormality management method described in claim 7, Furthermore, the system includes a notification step that provides notification of the occurrence of an anomaly if the classification result output in the classification step indicates that the frequency spectrum of the signal contains an anomaly. An abnormality management method characterized by the following.

Images