Detection program, detection method, and detection device

Abstract

To detect the sign of an abnormality based on multiple pieces of time-series data.SOLUTION: Weighted graph structure data for multiple pieces of time-series data is generated with a partial correlation identified based on a matrix calculated by solving an optimization problem for a precision matrix for the multiple pieces of time-series data being as a weight for a side of the graph. The sign of an abnormality is detected based on the distribution of data points within a predetermined region in a persistence figure obtained by persistent homology conversion on the weighted graph structure data.SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The present invention relates to a detection program, a detection method, and a detection device.

Background Art

[0002] When a plurality of time series data are obtained, it is known to monitor the system and detect abnormalities by paying attention to the relationships between these time series data.

[0003] Time series data is data having information corresponding to the passage of time, such as the voltage, frequency, rotation speed, pressure, etc. of a certain system, which represents the state at a certain period.

[0004] As a data analysis method based on the relationships between elements (time series data) of a system of a plurality of time series data, for example, a method using sparse structure learning can be cited. In this method, the relationships between elements are mapped onto a graph using an optimization method, and when the structure of the graph changes significantly, it is regarded that an abnormality has occurred in the system.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Non-Patent Documents

[0006]

Non-Patent Document 1

[0007] Conventional data analysis methods using sparse structure learning only determine whether a state is "normal" or "abnormal." However, with this binary classification of "normal" and "abnormal," when a system state is deemed "abnormal," some kind of failure or malfunction has already occurred in the system, making it impossible to detect failures or other problems in advance.

[0008] Furthermore, there is a possibility that the detected "anomalies" are misidentifications caused by data noise or other factors, making them unreliable.

[0009] In one aspect, the present invention aims to detect signs of anomalies based on multiple time-series data. [Means for solving the problem]

[0010] Therefore, this detection program generates weighted graph structure data for multiple time series data by using partial correlations identified based on a matrix calculated by solving an optimization problem for precision matrices of multiple time series data as weights for the edges of the graph, and causes the computer to perform a process to detect signs of anomalies based on the distribution of data points in a predetermined region in a persistence diagram obtained by a persistent homology transformation of the weighted graph structure data. [Effects of the Invention]

[0011] According to one embodiment, it is possible to detect signs of anomalies based on multiple time-series data. [Brief explanation of the drawing]

[0012] [Figure 1] This is a diagram schematically showing the functional configuration of a detection device as an example of an embodiment. [Figure 2] This is a block diagram showing an example of the hardware (HW) configuration of a computer that realizes the functions of a detection device according to an embodiment. [Figure 3] This is a diagram for explaining a graph in a detection device as an example of an embodiment. [Figure 4] This is a diagram showing an example of a weighted graph in a detection device as an example of an embodiment. [Figure 5] This is a diagram showing an example of a persistence diagram in a detection device as an example of an embodiment. [Figure 6] This is a diagram for explaining the processing by an abnormality prediction detection unit of a detection device as an example of an embodiment. [Figure 7] This is a flowchart for explaining the processing in a detection device as an example of an embodiment.

Mode for Carrying Out the Invention

[0013] Hereinafter, embodiments of the present detection program, detection method, and detection device will be described with reference to the drawings. However, the embodiments shown below are merely examples, and there is no intention of excluding various modifications and applications of technologies not explicitly shown in the embodiments. That is, the present embodiment can be variously modified and implemented without departing from its gist. Also, each figure does not mean that it only includes the components shown in the figure, and can include other functions and the like.

[0014] (A) Configuration FIG. 1 is a diagram schematically showing the functional configuration of a detection device 1 as an example of an embodiment.

[0015] The detection device 1 analyzes a plurality of time-series data measured in an analysis target. The detection device 1 extracts the relationship between elements (time-series data) from these plural time-series data systems, tracks the change in the state of the analysis target, and detects a sign of abnormality. The analysis target may be any system.

[0016] Time-series data may also be obtained by measuring the object to be analyzed using a measuring device (not shown). The time-series data measured by the measuring device is stored in a storage device 7 connected to the detection device 1.

[0017] Furthermore, a measuring device may be connected to the detection device 1, and time-series data may be input to the detection device 1 from this measuring device. The detection device 1 may also perform analysis on the time-series data input from the measuring device.

[0018] (A-1) Example Hardware Configuration Figure 2 is a block diagram showing an example of the hardware (HW) configuration of a computer 10 that implements the functions of a detection device 1 according to one embodiment. If multiple computers are used as HW resources to implement the functions of the detection device 1, each computer may have the HW configuration illustrated in Figure 2.

[0019] As shown in Figure 2, the computer 10 may, as an example of its hardware configuration, include a processor 10a, a graphics processing unit 10b, a memory 10c, a storage unit 10d, an IF (Interface) unit 10e, an IO (Input / Output) unit 10f, and a read unit 10g.

[0020] The processor 10a is an example of an arithmetic processing unit that performs various controls and calculations, and is a control unit that executes various processes. The processor 10a may be connected to each block in the computer 10 via a bus 10j so as to be able to communicate with each other. The processor 10a may be a multiprocessor that includes multiple processors, a multicore processor that has multiple processor cores, or a configuration that has multiple multicore processors.

[0021] Examples of processor 10a include integrated circuits (ICs) such as CPUs, MPUs, APUs, DSPs, ASICs, and FPGAs. Note that two or more combinations of these integrated circuits may be used as processor 10a. CPU stands for Central Processing Unit, MPU for Micro Processing Unit, APU for Accelerated Processing Unit, DSP for Digital Signal Processor, ASIC for Application Specific IC, and FPGA for Field-Programmable Gate Array.

[0022] The graphics processing unit 10b controls the screen display for output devices such as monitors, which are part of the I / O unit 10f. The graphics processing unit 10b can be various types of processing units, such as integrated circuits (ICs) including GPUs (Graphics Processing Units), APUs, DSPs, ASICs, or FPGAs.

[0023] Memory 10c is an example of hardware that stores various data and program information. Examples of memory 10c include volatile memory such as DRAM (Dynamic Random Access Memory) and non-volatile memory such as PM (Persistent Memory), or both.

[0024] The storage unit 10d is an example of hardware that stores various data and program information. Examples of storage units 10d include magnetic disk devices such as HDDs (Hard Disk Drives), semiconductor drive devices such as SSDs (Solid State Drives), and various storage devices such as non-volatile memory. Examples of non-volatile memory include flash memory, SCM (Storage Class Memory), and ROM (Read Only Memory).

[0025] The memory unit 10d may store a program 10h (detection program) that implements all or part of the various functions of the computer 10.

[0026] For example, the processor 10a of the detection device 1 can implement the time-series data analysis function described later by loading the program 10h stored in the storage unit 10d into the memory 10c and executing it. Alternatively, the storage unit 10d may function as the storage device 7 shown in Figure 1.

[0027] The IF unit 10e is an example of a communication interface that controls the connection and communication between this computer 10 and other computers. For example, the IF unit 10e may include an adapter compliant with LAN (Local Area Network) such as Ethernet®, or optical communication such as FC (Fibre Channel). The adapter may support wireless, wired, or both communication methods.

[0028] For example, the detection device 1 may be connected to a storage device 7 as illustrated in Figure 1, a measuring device (not shown), or other information processing devices via the IF unit 10e and a network, enabling communication. The program 10h may be downloaded from the network to the computer 10 via the communication IF and stored in the storage unit 10d.

[0029] The I / O unit 10f may include one or both of an input device and / or an output device. Examples of input devices include a keyboard, mouse, and touch panel. Examples of output devices include a monitor, projector, and printer. The I / O unit 10f may also include a touch panel that integrates an input device and a display device. The output device may be connected to the graphics processing unit 10b.

[0030] The reading unit 10g is an example of a reader that reads data and program information recorded on the recording medium 10i. The reading unit 10g may include a connection terminal or device to which the recording medium 10i can be connected or inserted. Examples of the reading unit 10g include an adapter compliant with USB (Universal Serial Bus), a drive device for accessing a recording disk, and a card reader for accessing flash memory such as an SD card. The recording medium 10i may store a program 10h, and the reading unit 10g may read the program 10h from the recording medium 10i and store it in the storage unit 10d.

[0031] Examples of recording media 10i include non-temporary computer-readable recording media such as magnetic / optical discs and flash memory. Examples of magnetic / optical discs include flexible discs, CDs (Compact Discs), DVDs (Digital Versatile Discs), Blu-ray discs, and HVDs (Holographic Versatile Discs). Examples of flash memory include semiconductor memory such as USB memory and SD cards.

[0032] The hardware configuration of computer 10 described above is illustrative. Therefore, the addition or deletion of hardware within computer 10 (for example, adding or deleting arbitrary blocks), division, integration in any combination, or addition or deletion of buses may be performed as appropriate.

[0033] (A-2) Example of Functional Configuration As shown in Figure 1, the detection device 1 may, for example, include functions as a graph generation unit 2, a partial correlation matrix generation unit 3, a weighted graph generation unit 4, a persistence diagram generation unit 5, and an anomaly prediction detection unit 6. These functions may be implemented by the hardware (processor 10a: control unit) of the computer 10 (see Figure 2).

[0034] The graph generation unit 2 creates a graph that represents the relationships between multiple time-series data based on these multiple time-series data. Time-series data can simply be referred to as data.

[0035] The graph creation unit 2 reads multiple time-series data stored in the memory device 7 and creates a graph based on these multiple time-series data.

[0036] Figure 3 is a diagram illustrating a graph in detection device 1 as an example of an embodiment.

[0037] In Figure 3, symbol A represents multiple (n) time-series data #1 to #n, and symbol B represents multiple (m) graphs #1 to #m generated based on the time-series data shown in symbol A.

[0038] A graph has multiple vertices (nodes) and edges that represent the relationships between these vertices. Each vertex corresponds to a single time-series data point. The edges represent the relationships between these vertices (time-series data points) through the connection status of the vertices (for example, whether or not the vertices are connected). In the example shown in Figure 3, each graph is an undirected graph.

[0039] The graph creation unit 2 cuts out portions of multiple time-series data arranged so that the time progression coincides, using rectangular regions that include portions of each time-series data, and creates a graph based on each time-series data contained within these rectangular regions. The rectangular regions from which time-series data is cut out can be called windows. In the example shown with the label A in Figure 3, the left-right direction in the figure is the time axis direction and indicates elapsed time.

[0040] The graph creation unit 2 sets multiple windows for multiple time-series data, shifting them along the time axis. The length of each window along the time axis corresponds to the unit time (time range) for creating the graph, and it is desirable that the size (length along the time axis) of each window is the same. The graph creation unit 2 creates one graph for each window.

[0041] The graph is composed of a matrix obtained as a solution to an optimization problem, and the components of this matrix represent the strength of the relationships between elements of the time series data.

[0042] The graph generation unit 2 calculates a matrix for constructing the graph by solving an optimization problem from multiple time-series data contained in the window. The optimization problem may be a graphical Lasso. The matrix that constitutes the graph is denoted by the symbol Λ. The matrix Λ is expressed by the following equation (1).

[0043]

number

[0044] The matrix Λ is calculated by solving an optimization problem (graphical Lasso) for precision matrices over multiple time series data. The precision matrix is ​​a matrix used to construct graphs and is the inverse of the covariance matrix.

[0045] Graph creation unit 2 creates a graph based on matrix Λ. Graph creation unit 2 considers that the elements of matrix Λ are λ ij The parts where =0 are represented in the graph as having no edge between vertex i and vertex j. Also, in matrix Λ, the element λ ij The non-zero parts are represented in the graph as having an edge between vertex i and vertex j.

[0046] The partial correlation matrix generation unit 3 calculates the partial correlation matrix Λ′ by applying partial correlation to the matrix Λ. The partial correlation matrix Λ′ is expressed by the following equation (2).

[0047]

number

[0048] The calculation of the partial correlation matrix Λ′ by the partial correlation matrix generation unit 3 can be achieved using known methods, and their explanation is omitted.

[0049] The partial correlation matrix generation unit 3 calculates a partial correlation matrix Λ′ for each matrix Λ. The partial correlation matrix generation unit 3 stores the information of the calculated partial correlation matrix Λ′ in a predetermined memory area of ​​the memory unit 10d.

[0050] The weighted graph creation unit 4 creates a weighted graph based on the partial correlation matrix Λ′ calculated by the partial correlation matrix creation unit 3. Based on the partial correlation matrix Λ′, the weighted graph creation unit 4 generates data (weighted graph structure data) for constructing the weighted graph.

[0051] Figure 4 shows an example of a weighted graph in the detection device 1 as an example of an embodiment.

[0052] A weighted graph has multiple vertices (nodes) and edges that represent the relationships between these vertices. Each vertex corresponds to a single time-series data point. The edges represent the relationships between these vertices (time-series data points) through the connection status of the vertices (for example, whether or not the vertices are connected). Each edge is assigned a weight that represents the relationship between the vertices.

[0053] The weighted graph generation unit 4 generates the element λ′ in the partial correlation matrix Λ′. ij A weighted graph is created by using the weight of the edge connecting vertex i and vertex j as the weight.

[0054] The weighted graph generation unit 4 generates weighted graph structure data for multiple time series data by using partial correlations identified based on a matrix Λ calculated by solving an optimization problem (graphical Lasso) for the precision matrix of multiple time series data as weights for the edges of the graph.

[0055] A weighted graph is a simplified graph created by extracting only the edges with strong relationships from the graph created by graph creation unit 2, and can be described as a graph in which a weight representing the relationship is assigned to each edge.

[0056] The weighted graph creation unit 4 stores the information of the created weighted graph in a predetermined storage area of ​​the storage unit 10d.

[0057] The persistence diagram creation unit 5 creates a persistence diagram by applying a persistence homology transformation to the weighted graph created by the weighted graph creation unit 4.

[0058] The persistence diagram generation unit 5 generates a persistence diagram by applying a persistent homology transformation using superior level filtration, thereby reflecting the strength of the relationships between vertices in the weighted graph.

[0059] The persistence diagram generation unit 5 obtains a persistence diagram by performing a persistent homology transformation on the weighted graph structure data.

[0060] In a weighted graph, decreasing the threshold for edge weights increases the number of edges reflected in the weighted graph, while increasing the threshold decreases the number of edges reflected. In other words, in a weighted graph, changing the threshold for edge weights changes the shape of the weighted graph after the threshold is applied.

[0061] The persistence diagram creation unit 5 applies persistent homology to the edges of the weighted graph to create a persistence diagram.

[0062] The persistence diagram creation unit 5 creates a persistence diagram by plotting the occurrence and disappearance times of specific shapes in the weighted graph as data points, which are obtained by sequentially changing the threshold for the edge weights of the weighted graph during the persistent homology transformation of the weighted graph.

[0063] The creation of the persistence diagram by the persistence diagram creation unit 5 can be achieved using known methods, and therefore, a detailed explanation will be omitted.

[0064] Figure 5 shows an example of a persistence diagram in a detection device 1 as an example of an embodiment.

[0065] In persistence diagrams, the occurrence and disappearance of specific shapes in a weighted graph are represented as data points by sequentially changing the threshold values ​​for the edge weights of the weighted graph.

[0066] As described above, persistence diagrams are created based on weighted graphs, which are created for each window extracted from multiple time-series data points within a specific time range. Therefore, multiple persistence diagrams created based on multiple windows have a temporal relationship.

[0067] Furthermore, the persistence diagram creation unit 5 may create persistence diagrams for multiple windows set in multiple time series data, in chronological order from oldest to newest.

[0068] In persistence diagrams, data points farther from the diagonal are considered to represent essential data characteristics, and by observing changes in the distribution of these data points, it is possible to track changes in the system's state.

[0069] The persistence diagram creation unit 5 stores the information of the created persistence diagram in a predetermined storage area of ​​the storage unit 10d.

[0070] The anomaly prediction detection unit 6 detects anomalies in the target of analysis based on the persistence diagram created by the persistence diagram creation unit 5.

[0071] The anomaly prediction detection unit 6 counts how many data points exist within a specific region (predetermined region) set at a predetermined distance from the diagonal in the persistence diagram, and detects an anomaly based on that number. For example, the anomaly prediction detection unit 6 may detect an anomaly based on a change in the number of data points within a specific region in the persistence diagram.

[0072] In a persistence diagram, a specific region may have a circular shape to simplify calculations. However, the shape of the specific region is not limited to a circle and can be changed as appropriate. For example, the specific region may have a shape other than a circle, such as a rectangle, or it may have a strip shape that is positioned parallel to the diagonal at a predetermined distance from the diagonal.

[0073] The anomaly prediction detection unit 6 may detect anomalies based on changes in the number of data points within a specific region in multiple persistence diagrams that have a temporal relationship.

[0074] For example, the anomaly prediction detection unit 6 may detect an anomaly when, in two consecutive (temporarily preceding and succeeding) persistence diagrams in a time series, the number of data points in a specific region in the later persistence diagram decreases by a first threshold or more compared to the number of data points in a specific region in the earlier persistence diagram.

[0075] Here, the first threshold may be a predetermined percentage (predetermined percentage value) of the number of data points in a specific area in the persistence diagram mentioned earlier. For example, the anomaly prediction detection unit 6 may detect an anomaly when the number of data points in a specific area in the later persistence diagram decreases by 30% or more compared to the number of data points in a specific area in the earlier persistence diagram. The first threshold may also be a predetermined fixed value and can be changed as appropriate.

[0076] Furthermore, the anomaly prediction detection unit 6 may detect an anomaly if, in two consecutive (temporarily preceding and succeeding) persistence diagrams in a time series, the number of data points in a specific region in the later persistence diagram decreases by a second threshold or more compared to the number of data points in the specific region in the earlier persistence diagram. The second threshold is a higher value than the first threshold.

[0077] Furthermore, the anomaly prediction detection unit 6 may detect an anomaly by comparing the number of data points in a specific area of ​​the persistence diagram with a third threshold, and may detect an anomaly if the number of data points in a specific area of ​​the persistence diagram is equal to or greater than the third threshold.

[0078] Figure 6 is a diagram illustrating the processing performed by the abnormality prediction detection unit 6 of the detection device 1 as an example of an embodiment.

[0079] In Figure 6, the symbols A, B, C, and D represent persistence diagrams, respectively. Symbol A represents a normal state, and symbol D represents an abnormal state. Symbols B and C represent abnormal warning states.

[0080] In each of these persistence diagrams illustrated in Figure 6, the black circles represent data points that indicate the occurrence and disappearance of specific shapes in the weighted graph. Furthermore, each of these persistence diagrams shows an example where a specific region is circular.

[0081] In the normal state, indicated by symbol A, all three data points are within a specific region. On the other hand, in the abnormal state, indicated by symbol D, all three data points are outside the predetermined region.

[0082] In the abnormal warning state indicated by code B, one of the three data points is outside the specified area, and in the abnormal warning state indicated by code C, two of the three data points are outside the specified area.

[0083] Here, for example, if the window that formed the basis of the persistence diagram indicated by symbol B follows the window that formed the basis of the persistence diagram indicated by symbol A on the time axis, that is, if the persistence diagram indicated by symbol B was created after the persistence diagram indicated by symbol A.

[0084] In such cases, as shown in the persistence diagram labeled A, three data points were initially within the specified region, but as shown in the persistence diagram labeled B, one data point moved outside the specified region, resulting in a decrease of approximately 33% in the number of data points within the specified region.

[0085] The anomaly prediction detection unit 6 detects an anomaly when it determines that the number of data points (2) in a specific area in the later persistence diagram (see symbol B in Figure 6) has decreased by a first threshold (for example, 30%) or more compared to the number of data points (3) in a specific area in the earlier persistence diagram (see symbol A in Figure 6).

[0086] Furthermore, for example, if the window that formed the basis of the persistence diagram indicated by symbol C follows the window that formed the basis of the persistence diagram indicated by symbol A on the time axis, that is, if the persistence diagram indicated by symbol C was created after the persistence diagram indicated by symbol A.

[0087] In such cases, as shown in the persistence diagram labeled A, three data points were initially within the specified region, but as shown in the persistence diagram labeled C, two data points moved outside the specified region, resulting in a reduction of approximately 66% in the number of data points within the specified region.

[0088] The anomaly prediction detection unit 6 detects an anomaly when it determines that the number of data points (1) in a specific area in the later persistence diagram (see symbol C in Figure 6) has decreased by a first threshold (for example, 30%) or more compared to the number of data points (3) in the specific area in the earlier persistence diagram (see symbol A in Figure 6).

[0089] Furthermore, in two consecutive persistence plots over time, the change in the number of data points within a specific region can be said to represent the degree (extent) of the anomaly.

[0090] For example, in two consecutive persistence plots over time, if the number of data points in a specific region of the later persistence plot is small compared to the number of data points in the earlier persistence plot (for example, below a predetermined threshold), it indicates a low degree of anomaly. Conversely, if the number of data points in a specific region of the later persistence plot is large compared to the number of data points in the earlier persistence plot (for example, above a predetermined threshold), it indicates a high degree of anomaly.

[0091] The anomaly prediction detection unit 6 determines the degree (extent) of an anomaly based on the distribution of data points in a specific region in multiple persistence diagrams.

[0092] Furthermore, when the abnormality prediction detection unit 6 detects an abnormality, it outputs a notification to the user or other relevant party that an abnormality has been detected.

[0093] The abnormality prediction detection unit 6 may, for example, display a message on an output device such as a monitor indicating that an abnormality has been detected. Furthermore, the notification method for detecting an abnormality is not limited to this and can be modified as appropriate.

[0094] Furthermore, in Figure 6, for example, if the window that formed the basis of the persistence diagram indicated by symbol D follows the window that formed the basis of the persistence diagram indicated by symbol A on the time axis, that is, if the persistence diagram indicated by symbol D is created after the persistence diagram indicated by symbol A.

[0095] In such cases, as shown in the persistence diagram labeled A, three data points were initially within a specific region, but as shown in the persistence diagram labeled D, all three data points are now outside the specific region, resulting in a 100% reduction in the number of data points within the specific region.

[0096] The anomaly prediction detection unit 6 detects an anomaly when it determines that the number of data points (0) in a specific area in the later persistence diagram (see symbol D in Figure 6) has decreased by a second threshold (for example, 80%) or more compared to the number of data points (3) in a specific area in the earlier persistence diagram (see symbol A in Figure 6).

[0097] The abnormality prediction detection unit 6 outputs a notification to the user or other relevant party if it detects an abnormality.

[0098] The abnormality prediction detection unit 6 may, for example, display a message indicating that an abnormality has been detected on an output device such as a monitor. Furthermore, the notification method for detecting an abnormality is not limited to this and can be modified as appropriate.

[0099] (B) Operation The processing in the detection device 1, as an example of the embodiment configured as described above, will be explained according to the flowchart (steps S1 to S7) shown in Figure 7.

[0100] In step S1, the graph creation unit 2 reads out multiple time-series data stored in the memory device 7.

[0101] In step S2, the graph creation unit 2 sets multiple windows for multiple time-series data, shifting them along the time axis.

[0102] In step S3, the graph generation unit 2 calculates a matrix Λ for each window by solving an optimization problem (graphical Lasso) from multiple time series data contained in each window.

[0103] In step S4, the partial correlation matrix generation unit 3 calculates the partial correlation matrix Λ′ by applying partial correlation to the matrix Λ.

[0104] In step S5, the weighted graph creation unit 4 creates a weighted graph based on the partial correlation matrix Λ′ calculated by the partial correlation matrix creation unit 3.

[0105] In step S6, the persistence diagram creation unit 5 creates a persistence diagram by applying persistence homology to the weighted graph created by the weighted graph creation unit 4.

[0106] In step S7, the anomaly prediction detection unit 6 determines whether there are signs of an anomaly in the data being analyzed, based on the persistence diagram created by the persistence diagram creation unit 5. For example, the anomaly prediction detection unit 6 detects signs of an anomaly based on changes in the number of data points within a specific region in multiple persistence diagrams that have a temporal sequence. After that, the process ends.

[0107] (C) Effects As described above, according to the detection device 1 as an example of the embodiment, the weighted graph creation unit 4 generates multiple weighted graphs based on multiple graphs created by the graph creation unit 2 from multiple time-series data. Then, the persistence diagram creation unit 5 analyzes these weighted graphs using persistent homology, thereby tracking and analyzing changes in the structure of the weighted graphs.

[0108] This allows for a detailed representation of the state and changes in the state of the system being analyzed, and also indicates whether the state is normal or abnormal. In particular, the abnormality prediction unit 6 can detect signs of abnormality by capturing the change in state from normal to abnormal, enabling early detection of abnormalities and preventing failures in the system being analyzed. Furthermore, it can mitigate resource and financial losses associated with failures in the system being analyzed.

[0109] Compared to conventional methods that only make binary judgments of either normal or abnormal, this method can detect early signs of abnormalities, prevent abnormalities from occurring, and enable early detection of abnormalities, thereby minimizing damage when abnormalities do occur.

[0110] Furthermore, the persistence diagram creation unit 5 creates a persistence diagram by applying persistence homology to the weighted graph created by the weighted graph creation unit 4. As a result, the noise resistance of the persistence diagram can suppress false detections even in cases of anomalies where noise is added to the time series data.

[0111] (D) Other The disclosed technology is not limited to the embodiments described above and can be implemented in various modified forms without departing from the spirit of this embodiment.

[0112] Furthermore, the above disclosure makes it possible for those skilled in the art to implement and manufacture this embodiment.

[0113] (E) Note The following additional information is disclosed regarding the embodiments described above.

[0114] (Note 1) By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection program characterized by having a computer perform the processing.

[0115] (Note 2) In the persistent homology transformation described above, the persistence diagram is created by plotting the occurrence and disappearance times of specific shapes in the weighted graph as data points, obtained by sequentially changing the threshold values ​​for the edge weights of the weighted graph. The detection program described in Appendix 1, characterized in that it causes the computer to perform the processing.

[0116] (Note 3) By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection method characterized by having a computer perform the processing.

[0117] (Note 4) In the persistent homology transformation described above, the persistence diagram is created by plotting the occurrence and disappearance times of specific shapes in the weighted graph as data points, obtained by sequentially changing the threshold values ​​for the edge weights of the weighted graph. The detection method according to Appendix 3, characterized in that the processing is performed by the computer.

[0118] (Note 5) By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection device characterized by having a control unit that performs processing.

[0119] (Note 6) The control unit, In the persistent homology transformation described above, the persistence diagram is created by plotting the occurrence and disappearance times of specific shapes in the weighted graph as data points, obtained by sequentially changing the threshold values ​​for the edge weights of the weighted graph. The detection device described in Appendix 5, characterized by the above. [Explanation of symbols]

[0120] 1. Detection device 2. Graph Creation Section 3. Partial Correlation Matrix Creation Section 4. Weighted Graph Creation Section 5. Persistence Diagram Creation Section 6. Anomaly Prediction Detection Unit 7 Storage device 10 Computers 10a processor 10b Graphics Processing Unit 10c memory 10d storage section 10e IF section 10f IO section 10g reading unit 10-hour program 10i recording media 10j bus

Claims

1. By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection program characterized by having a computer perform the processing.

2. In the persistent homology transformation described above, the persistence diagram is created by plotting the occurrence and disappearance times of specific shapes in the weighted graph as data points, obtained by sequentially changing the threshold values ​​for the edge weights of the weighted graph. The detection program according to claim 1, characterized in that it causes the computer to perform the processing.

3. By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection method characterized by having a computer perform the processing.

4. By solving an optimization problem for precision matrices of multiple time series data, partial correlations identified based on the resulting matrix are used as edge weights for the graph to generate weighted graph structure data for multiple time series data. Anomaly predictions are detected based on the distribution of data points in a predetermined region in the persistence diagram obtained by the persistent homology transformation of the weighted graph structure data. A detection device characterized by having a control unit that performs processing.

Images