Time-series abnormality detection system

Abstract

This time-series abnormality detection system comprises: a first acquisition unit for acquiring feature information that is based on time-series data concerning a subject of abnormality detection; a change detection unit for detecting a change in a state of the subject of abnormality detection; a second acquisition unit for acquiring, on the basis of the feature information acquired by the first acquisition unit, feature information that is based on time-series data after detection of a change by the change detection unit; and an abnormality information output unit for outputting abnormality information related to an abnormality, the abnormality information being based on the feature information acquired from the second acquisition unit and the feature information acquired by the first acquisition unit.

Description

Time series anomaly detection system

[0001] The present invention relates to a time-series anomaly detection system, an output method, an output device, and a recording medium.

[0002] Techniques used to detect anomalies based on time-series data are known.

[0003] For example, Patent Literature 1 describes a machine learning system having one or more machine learning models that detects abnormalities and the like in equipment based on sensor data output by one or more sensors that detect the status of the equipment. According to Patent Literature 1, the machine learning system manages a model identifier unique to the machine learning model that identifies the machine learning model and a sensor identifier unique to the sensor that identifies the sensor that outputs the sensor data, in association with each other. Furthermore, the machine learning system calculates an impact level that represents a change in the trend of sensor data before and after the maintenance work was performed for each maintenance event identifier that identifies the maintenance work performed on the equipment, and manages this impact level in association with each sensor identifier. The machine learning system then considers sensors whose impact levels satisfy predetermined conditions to be affected by the maintenance work, and presents a model identifier associated with the sensor identifier of the sensor that satisfies the conditions.

[0004] Another related document is Patent Document 2, which describes a technology for converting a time-series data set, in which multiple pieces of time-series data are compiled, into a feature vector that indicates the characteristics of the time-series data set, and making the feature vector searchable.

[0005] JP 2022-175959 A International Publication No. 2020 / 049666

[0006] As described in Patent Literature 2, a feature vector, which is a feature obtained by converting time-series data, is searched for, and an anomaly score is calculated or an anomaly is detected based on the search results. When calculating an anomaly score or detecting an anomaly using such a search method, if the state of the system to be detected changes, a new state will continuously occur, causing the calculated anomaly score to be constantly high. As a result, there is a risk of false alarms occurring continuously.

[0007] In contrast, even if a technique such as that described in Patent Document 1 is used, it is only possible to identify models that will be affected by maintenance work, but it is not possible to take effective measures. For example, even if an attempt is made to re-learn the identified model in order to respond to changes in the system state after the model is identified, a period of time will occur during which anomalies cannot be detected due to the re-learning. For example, as described above, when detecting anomalies using a search-based method, there has been a problem in that it may be difficult to appropriately respond to changes in the system state.

[0008] Therefore, one of the objects of the present invention is to provide a time-series anomaly detection system, an output method, an output device, and a recording medium that can solve the above-mentioned problems.

[0009] In order to achieve this object, a time series anomaly detection system that is one embodiment of the present disclosure has a configuration including: a first acquisition unit that acquires feature amount information based on time series data of an anomaly detection target; a change detection unit that detects a change in the state of the anomaly detection target; a second acquisition unit that acquires feature amount information based on the time series data after change detection by the change detection unit, based on the feature amount information acquired by the first acquisition unit; and an anomaly information output unit that outputs anomaly information regarding an anomaly based on the feature amount information acquired from the second acquisition unit and the feature amount information acquired by the first acquisition unit.

[0010] Furthermore, an output method that is another aspect of the present disclosure has a configuration in which an information processing device detects a change in state in an anomaly detection target, acquires feature amount information based on time series data in the anomaly detection target, acquires feature amount information based on the time series data after change detection based on the acquired feature amount information, and outputs anomaly information regarding an anomaly based on the feature amount information based on the time series data after change detection and the feature amount information based on the time series data in the anomaly detection target.

[0011] Furthermore, an output device according to another aspect of the present disclosure has a configuration including: a first acquisition unit that acquires feature amount information based on time-series data of an abnormality detection target; a change detection unit that detects a change in the state of the abnormality detection target; a second acquisition unit that acquires feature amount information based on time-series data after change detection by the change detection unit, based on the feature amount information acquired by the first acquisition unit; and an abnormality information output unit that outputs abnormality information related to an abnormality based on the feature amount information acquired from the second acquisition unit and the feature amount information acquired by the first acquisition unit.

[0012] Furthermore, a recording medium that is another aspect of the present disclosure is a computer-readable recording medium having recorded thereon a program for causing an information processing device to perform the following processes: detect a change in state in an anomaly detection target; acquire feature amount information based on time series data in the anomaly detection target; acquire feature amount information based on the time series data after change detection based on the acquired feature amount information; and output anomaly information regarding an anomaly based on the feature amount information based on the time series data after change detection and the feature amount information based on the time series data in the anomaly detection target.

[0013] According to the above-mentioned configurations, the above-mentioned problems can be solved.

[0014] FIG. 1 is a diagram for explaining an overview of a detection system according to a first embodiment of the present disclosure. FIG. 2 is a diagram showing an example of anomaly scores according to changes in system state. FIG. 3 is a block diagram showing an example configuration of a detection device. FIG. 4 is a diagram for explaining an example of feature extraction and conversion. FIG. 5 is a diagram for explaining an example of anomaly detection. FIG. 6 is a flowchart showing an example of operation of a detection device. FIG. 7 is a flowchart showing an example of operation of a detection device. FIG. 8 is a diagram for explaining an example of an effect of the present invention. FIG. 9 is a diagram showing an example hardware configuration of a calculation device according to a second embodiment of the present disclosure. FIG. 10 is a block diagram showing an example configuration of a calculation device.

[0015] [First Embodiment] A first embodiment of the present invention will be described with reference to Figs. 1 to 10. Fig. 1 is a diagram for explaining an overview of a detection system 100. Fig. 2 is a diagram showing an example of an anomaly score according to a change in the system state. Fig. 3 is a block diagram showing an example of the configuration of a detection device 200. Fig. 4 is a diagram for explaining an example of feature extraction and conversion. Figs. 5 and 6 are diagrams for explaining an example of anomaly detection. Figs. 7 to 9 are flowcharts showing an example of the operation of the detection device 200. Fig. 10 is a diagram for explaining an example of the effect of the present invention.

[0016] In a first embodiment of the present disclosure, as illustrated in FIG. 1 , a detection system 100 is described, which is a time series anomaly detection system that detects anomalies based on one or more time series data acquired using one or more sensors. For example, the detection system 100 uses time series segments, which are time series data corresponding to a certain time window, as training data to train a model that extracts and outputs features that preserve local distance relationships for the input time series segments. As an example, the detection system 100 may train the model using a method such as that described in Patent Document 2. Furthermore, the detection system 100 inputs the training time series segments to the trained model, thereby acquiring features obtained as the model output. The detection system 100 then stores feature information, which is information corresponding to the acquired features, in a storage device. For example, the detection system 100 may store binary codes converted from the features as the feature information in the storage device. The feature information may also be the value of the feature.

[0017] Furthermore, during anomaly detection, the detection system 100 inputs the time series segment to be detected into a model to acquire features extracted from the time series segment to be detected. The detection system 100 then acquires binary code, which is feature information, by converting the acquired features using an arbitrary method. The detection system 100 then searches the storage device for binary codes similar to the acquired binary code and calculates an anomaly score based on the distance between the acquired binary code and the search results from the storage device. The detection system 100 then detects anomalies based on the calculated anomaly score. For example, as described above, the detection system 100 performs anomaly detection using a search method, which is a method of detecting anomalies based on search results from the storage device. Furthermore, the detection system 100 can output anomaly information, such as the calculated anomaly score or an anomaly notification that notifies the user of an anomaly, based on the detection results.

[0018] In addition, in the present disclosure, the detection system 100 detects changes in the system state, such as changes in the network configuration of a system targeted for anomaly detection. The detection system 100 then additionally stores feature information in response to the detection results. That is, when the detection system 100 detects a change in the system state, it extracts features from the time-series segment following the change in the system state and initiates a process of newly storing information, such as binary code, corresponding to the extracted features in a storage device. For example, when the system state changes, such as when the network configuration changes, a new state will continually occur. Therefore, if no measures are taken, the calculated anomaly score may increase, as illustrated in FIG. 2, resulting in continued false alarms. For example, referring to FIG. 2, it can be seen that the system state changes around the x-axis, which represents a value according to time, and that the anomaly score significantly increases in response to the change in the system state. In response to this, the detection system 100 accumulates new binary code in response to the detected change, as described above. As a result, it becomes possible to perform searches from search candidates that include the binary code accumulated after the change. In this way, the detection system 100 suppresses an increase in the anomaly score after a change in the system state.

[0019] Immediately after a system state change, there is insufficient training data required to adapt the model used to extract features to the state after the system state change. Therefore, even after the system state change, the detection system 100 provisionally extracts features using the model trained before the system state change. Furthermore, if it is determined that sufficient time series segments to be used as training data have been obtained after the system state change, the detection system 100 performs re-training using the time series segments after the system state change as training data so that the model used to extract features can adapt to the state after the system state change. For example, the detection system 100 can perform re-training by using the time series segments after the system state change as training data and updating the weight parameters of the model. Furthermore, the detection system 100 replaces the feature information provisionally added to the storage device with the re-trained adapted model. In other words, the detection system 100 can replace the feature information provisionally extracted using the model trained before the system state change with the feature information extracted using the adapted model. In this way, the detection system 100 stores additional provisional binary codes and then replaces the additional provisionally stored binary codes in accordance with the adaptation of the model. With this configuration, the detection system 100 can appropriately detect anomalies even when the system state changes, while minimizing the occurrence of periods during which anomalies cannot be detected due to relearning.

[0020] FIG. 1 shows an overview of a detection system 100. Referring to FIG. 1, the detection system 100 includes a detection device 200 (output device), which is an information processing device that performs anomaly detection using a search technique. As shown in FIG. 1, the detection device 200 acquires time-series data from various sensors and other external devices. For example, the time-series data may be numerical data, such as observation data measured by various sensors at predetermined intervals, arranged in order of measurement time. Furthermore, the detection device 200 searches for information similar to feature information, which is information corresponding to feature amounts extracted from the acquired time-series data. For example, the detection device 200 searches for binary code, which is the feature information. The detection device 200 then calculates an anomaly score based on the search results and detects anomalies based on the calculated score.

[0021] Fig. 3 shows an example of the configuration of the detection device 200. Referring to Fig. 3, the detection device 200 has, as main components, for example, an operation input unit 210, a screen display unit 220, a communication I / F unit 230, a storage unit 240, and an arithmetic processing unit 250.

[0022] 3 illustrates an example in which the functions of the detection device 200 are realized using one information processing device. However, at least some of the functions of the detection device 200 may be realized using multiple information processing devices, for example, on the cloud. For example, the detection device 200 may be composed of a calculation device that calculates an anomaly score and an output device that detects an anomaly based on the anomaly score calculated by the calculation device and outputs the detection result. Furthermore, the detection device 200 may not include some of the components exemplified above, such as not having the operation input unit 210 or the screen display unit 220, or may have components other than those exemplified above.

[0023] The operation input unit 210 is made up of operation input devices such as a keyboard, a mouse, etc. The operation input unit 210 detects operations of the operator who operates the detection device 200 and outputs the operations to the arithmetic processing unit 250.

[0024] The screen display unit 220 is composed of a screen display device such as a liquid crystal display, an organic electroluminescence (EL) display, etc. The screen display unit 220 can display various information stored in the storage unit 240 on the screen in response to instructions from the arithmetic processing unit 250.

[0025] The communication I / F unit 230 includes a data communication circuit, etc. The communication I / F unit 230 performs data communication with various sensors and other external devices connected via communication lines.

[0026] The storage unit 240 is a storage device such as a hard disk or memory. The storage unit 240 stores processing information and a program 244 required for various processes in the arithmetic processing unit 250. The program 244 is read into the arithmetic processing unit 250 and executed to realize various processing units. The program 244 is read in advance from an external device or recording medium via a data input / output function such as the communication I / F unit 230, and is stored in the storage unit 240. Main information stored in the storage unit 240 includes, for example, model information 241, feature amount information 242, and time-series data information 243.

[0027] The model information 241 includes information about a model that extracts and outputs features that preserve local distance relationships for input time series segments. For example, the model information 241 may include weight parameters included in the trained model described above. For example, the model included in the model information 241 is trained in advance using training time series segments inside or outside the detection device 200 and stored in the storage unit 240. Furthermore, the model information 241 is updated by the model adaptation unit 257 when, for example, the model adaptation unit 257 determines that a sufficient number of time series segments to be used as training data have been obtained after detecting a system state change through processing described below.

[0028] The model included in the model information 241 may be any model capable of handling time-series data. For example, the model may be any of a 1D-CNN (1-Dimensional-Convolutional Neural Network), a GRU (Gated Recurrent Unit), an LSTM (Long Short-Term Memory), a Transformer, etc. Furthermore, the loss function used as the model training criterion may be any function that preserves local similarity between data in the input space. For example, the loss function may be any of triplet loss, pairwise loss, contrastive loss, etc. As an example, the model included in the model information 241 may be trained using a method such as that described in Patent Document 2. For example, Patent Document 2 discloses an example of model training using triplet loss or pairwise loss.

[0029] The feature amount information 242 includes feature amount information corresponding to feature amounts extracted from the time-series segments. For example, the feature amount information 242 includes, as feature amount information, binary code obtained by converting feature amounts using an arbitrary method. For example, the binary code included in the feature amount information 242 is obtained in advance using an arbitrary method, such as obtaining it from an external device via the communication I / F unit 230 or converting feature amounts extracted by the feature amount extraction unit 252 using the binary code conversion unit 253, and is then stored in the storage unit 240.

[0030] Furthermore, the feature amount information 242 additionally stores binary codes converted by the binary code conversion unit 253 in accordance with the detection result by the change detection unit 254 (described later). In other words, the feature amount information 242 stores binary codes into which features extracted from time-series segments after a change in the system state have been converted. Here, when the change detection unit 254 detects a change, the binary codes into which the binary code conversion unit 253 converts features extracted by the feature extraction unit 252 using a model before adaptation by the model adaptation unit 257 are provisionally stored as the feature amount information 242. Furthermore, after the model adaptation unit 257 updates the model, the provisionally stored binary codes are replaced with binary codes according to the adapted model by the update unit 258 (described later).

[0031] The time-series data information 243 includes one or more pieces of time-series data acquired by one or more sensors, etc. Here, the time-series data may be data in which numerical data such as observation data measured by a sensor at a predetermined interval is arranged in order of measurement time, etc. For example, the time-series data information 243 is updated in response to the acquisition of time-series data by a time-series data acquisition unit 251 (described later) from a sensor or other external device, etc.

[0032] The arithmetic processing unit 250 has an arithmetic device such as a CPU (Central Processing Unit) and its peripheral circuits. The arithmetic processing unit 250 reads and executes a program 244 from the storage unit 240, thereby causing the above hardware and the program 244 to cooperate to realize various processing units. Major processing units realized by the arithmetic processing unit 250 include, for example, a time-series data acquisition unit 251, a feature extraction unit 252, a binary code conversion unit 253, a change detection unit 254, a storage unit 255, an anomaly detection unit 256, a model adaptation unit 257, an update unit 258, and an output unit 259.

[0033] In addition, the arithmetic processing unit 250 may have a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination of these, instead of the above-mentioned CPU.

[0034] The time-series data acquisition unit 251 acquires time-series data from various sensors included in the detection system 100 and other external devices. For example, the time-series data acquisition unit 251 can acquire any time-series data from an optical transponder, an optical performance monitor that measures an optical signal to noise ratio (OSNR), etc. The time-series data acquisition unit 251 may acquire time-series data from multiple sensors installed in a plant, a data center, a social infrastructure facility, etc.

[0035] The feature extraction unit 252 extracts features based on the time series segments by inputting the time series segments to a model stored as the model information 241. For example, as illustrated in FIG. 4 , the feature extraction unit 252 divides the time series data acquired by the time series data acquisition unit 251 into multiple time series segments using a time window of a certain period. Then, the feature extraction unit 252 inputs each of the divided time series segments to a trained model to extract features. Note that the feature extraction unit 252 may divide the time series data into the time series segments using any method. For example, the size of the time window may be set arbitrarily. Furthermore, the feature extraction unit 252 may divide the time series data into multiple time series segments so that they overlap for an arbitrary period, or may divide the time series data into multiple time series segments so that the time series segments do not overlap.

[0036] In the present disclosure, the feature extraction unit 252 extracts features when performing anomaly detection. In other words, the feature extraction unit 252 functions as part of a first acquisition unit that acquires feature information based on time-series data. Furthermore, the feature extracted by the feature extraction unit 252 can be used when additionally storing the feature information 242 after the change detection unit 254 detects a change in the system state. For example, after detecting a change in the system state, the feature extracted by the feature extraction unit 252 can be used both when performing anomaly detection and when additionally storing the feature information 242.

[0037] As described above, the feature extraction unit 252 extracts features using a model stored as the model information 241. Therefore, before the weight parameters and the like are updated by the model adaptation unit 257, the feature extraction unit 252 extracts features using a model before adaptation to a change in the system state. In other words, even after a change in the system state, before the weight parameters and the like are updated by the model adaptation unit 257, the feature extraction unit 252 extracts features using a model that was learned before the change in the system state. Furthermore, once the weight parameters and the like are updated by the model adaptation unit 257, the feature extraction unit 252 thereafter extracts features using a model that has been adapted to the change in the system state. Furthermore, after the weight parameters and the like are updated by the model adaptation unit 257, the feature extraction unit 252 can again extract features using the adapted model for a time series segment after a change in the system state is detected. In other words, for the time series segments acquired after a change in the system state is detected and before the model adaptation unit 257 finishes updating, the feature extraction unit 252 can extract features using the model before adaptation, and after model adaptation, can extract features using the adapted model.

[0038] The binary code conversion unit 253 converts the features extracted by the feature extraction unit 252 into binary code, which is information corresponding to the features. In the present disclosure, the method of conversion into binary code is not particularly limited. The binary code conversion unit 253 may convert the features extracted by the feature extraction unit 252 into binary code using any method. For example, the binary code conversion unit 253 can function as part of a first acquisition unit that acquires feature information based on time-series data.

[0039] The change detection unit 254 detects a change in the system state. The change detection unit 254 may detect a change in the system state using any means.

[0040] For example, the change detection unit 254 acquires domain knowledge, such as operation information of the system that is the target of anomaly detection, from an external device, etc. Then, the change detection unit 254 detects changes in the system state, such as changes in the network configuration, based on the acquired domain knowledge. The change detection unit 254 may also detect changes in the system state based on time-series data acquired by the time-series data acquisition unit 251, etc. For example, the change detection unit 254 may detect a change in the system state when it detects a fluctuation in the distribution of the time-series data using any statistical method, etc.

[0041] As an example, the change detection unit 254 detects a change in the system state using domain knowledge or statistical techniques when, for example, the network configuration of the optical network changes. The change detection unit 254 may detect a change in the system state by detecting a change in equipment installed in a plant or other environmental changes using domain knowledge or statistical techniques. In this way, the change detection unit 254 may detect any state change as a change in the system state, in addition to a change in the network configuration.

[0042] In response to the detection of a change in the system state by the change detection unit 254 , the storage unit 255 stores the binary code converted by the binary code conversion unit 253 as feature amount information 242 in the memory unit 240 .

[0043] For example, the storage unit 255 does not store the binary code converted by the binary code conversion unit 253 until the change detection unit 254 detects a change in the system state. On the other hand, when the change detection unit 254 detects a change in the system state, the storage unit 255 stores the binary code converted by the binary code conversion unit 253 in the memory unit 240 as feature amount information 242. In other words, in response to the detection of a change in the system state by the change detection unit 254, the storage unit 255 adds and stores in the memory unit 240, as feature amount information 242, binary code obtained by converting feature amounts extracted using a model before adaptation to the change in the system state. Note that the binary code added by the storage unit 255 at this stage is subject to updating by the update unit 258, which will be described later. Therefore, it can be said that the storage unit 255 provisionally stores the binary code in the memory unit 240 as feature amount information 242. Furthermore, after model adaptation by the model adaptation unit 257, the storage unit 255 can add binary code converted from features extracted using the model after adaptation to changes in the system state to the memory unit 240 as feature information 242.

[0044] The storage unit 255 may terminate the additional storage process based on any criteria. For example, the storage unit 255 may terminate the additional storage of binary codes when it is determined that a predetermined number of additional storages have been performed after detecting a change in the system state.

[0045] The anomaly detection unit 256 calculates an anomaly score based on the feature amount extracted from the time-series segment to be detected, and detects an anomaly based on the calculated result. That is, the anomaly detection unit 256 has a function as a calculation unit that calculates the anomaly score and a function as a detection unit that detects an anomaly based on the calculated result.

[0046] For example, the anomaly detection unit 256 acquires, from the binary code conversion unit 253, a binary code corresponding to a feature extracted from a time-series segment to be detected. That is, the anomaly detection unit 256 acquires a binary code serving as detection target information from the binary code conversion unit 253. Then, the anomaly detection unit 256 searches the feature information 242 for a binary code similar to the acquired binary code. In the present disclosure, the anomaly detection unit 256 may perform the search using any method. For example, the anomaly detection unit 256 calculates the distance between the acquired binary code and each binary code included in the feature information 242. Then, the anomaly detection unit 256 acquires, as a binary code similar to the acquired binary code, a binary code that satisfies any condition, such as a binary code with the smallest calculated distance, from among the binary codes included in the feature information 242. In this way, the anomaly detection unit 256 can function as a second acquisition unit that acquires a binary code serving as feature information based on the binary code acquired by the binary code conversion unit 253, which is the first acquisition unit.

[0047] The anomaly detection unit 256 also calculates an anomaly score according to the distance between the acquired binary code and the binary code searched from the storage device. The anomaly detection unit 256 then detects an anomaly based on the calculated anomaly score. For example, the anomaly detection unit 256 compares the calculated anomaly score with a predetermined threshold. The anomaly detection unit 256 then detects an anomaly when the calculated anomaly score exceeds the threshold. In this manner, the anomaly detection unit 256 calculates an anomaly score to be used when detecting an anomaly and detects an anomaly based on the calculated anomaly score. The anomaly detection unit 256 may calculate the anomaly score according to the distance using any method. For example, the anomaly detection unit 256 may calculate the anomaly score so that the longer the distance, the larger the value. When calculating the anomaly score in this manner, a larger anomaly score indicates a higher likelihood of an anomaly occurring. The threshold to be compared with the anomaly score may be determined using any method.

[0048] The search target and other parameters used by the anomaly detection unit 256 to detect an anomaly change depending on various processes, such as the detection of a system state change by the change detection unit 254, model adaptation by the model adaptation unit 257, and replacement by the update unit 258. For example, as illustrated in FIG. 5 , before the change detection unit 254 detects a system state change, the anomaly detection unit 256 performs anomaly detection based on binary code obtained by converting feature quantities extracted using the pre-adaptation model and pre-stored feature quantity information 242. After the change detection unit 254 detects a system state change, the anomaly detection unit 256 performs anomaly detection based on binary code obtained by converting feature quantities extracted using the pre-adaptation model and feature quantity information 242 in which the binary code has been additionally stored by the storage unit 255. It is desirable for the anomaly detection unit 256 to perform anomaly detection before the storage unit 255 additionally stores the binary code to be detected. After the model adaptation by the model adaptation unit 257 is performed, the update unit 258 replaces the temporarily added binary code. As a result, as illustrated in FIG. 6 , the anomaly detection unit 256 performs anomaly detection based on the binary code obtained by converting the features extracted using the adapted model and the feature information 242 obtained by replacing the temporarily added binary code.

[0049] The model adaptation unit 257 checks whether the conditions for performing model adaptation are met. Then, the model adaptation unit 257 performs model adaptation according to the storage result. For example, as a condition for performing model adaptation, the model adaptation unit 257 checks whether a sufficient number of time-series segments to be used as learning data have been obtained after the system state change. Then, if it is determined that a sufficient number of time-series segments have been obtained after the system state change, the model adaptation unit 257 performs model adaptation by updating the model information 241.

[0050] For example, the model adaptation unit 257 performs model adaptation by using the time-series segments acquired after detecting a change in the system state as learning data to update the weight parameters of the model, etc. The model adaptation unit 257 may update the weight parameters using a learning criterion based on a distance learning loss using a triplet loss, a pairwise loss, or the like, as described in Patent Document 2.

[0051] The model adaptation unit 257 may check whether the conditions for performing model adaptation are satisfied using any method. For example, the criterion for determining whether a sufficient number of time-series segments to be used as learning data have been obtained may be set arbitrarily. The model adaptation unit 257 may check whether the conditions for performing model adaptation are satisfied at any timing, such as by performing the above check at predetermined intervals after the change detection unit 254 detects a change in the system state.

[0052] The update unit 258 replaces the binary code that was provisionally added after the model adaptation by the model adaptation unit 257. For example, after the model adaptation by the model adaptation unit 257, the update unit 258 acquires binary code corresponding to the adapted model from the binary code conversion unit 253. In response to this, the update unit 258 replaces the binary code that was provisionally added and stored as the feature amount information 242 with the acquired binary code.

[0053] The output unit 259 (abnormality information output unit) outputs the detection result by the abnormality detection unit 256. For example, the output unit 259 can output abnormality information such as an abnormality score calculated by the abnormality detection unit 256 or an abnormality notification notifying that an abnormality has occurred, in accordance with the detection result by the abnormality detection unit 256. For example, the output unit 259 may transmit the abnormality information to an external device via the communication I / F unit 230, or may display the abnormality information on the screen display unit 220, etc.

[0054] The above is an example of the configuration of the detection device 200. Next, an example of the operation of the detection device 200 will be described with reference to Figs.

[0055] 7 is a flowchart showing an example of the operation of the detection device 200 when the system state changes. Referring to FIG. 7 , the change detection unit 254 detects a change in the system state (step S101). For example, the change detection unit 254 detects a change in the system state, such as a change in the network configuration, based on domain knowledge, such as operation information of the system that is the target of anomaly detection. The change detection unit 254 may also detect a change in the system state based on time-series data acquired by the time-series data acquisition unit 251.

[0056] When a change in the system state is detected (step S101, Yes), the storage unit 255 starts additional storage of binary code (step S102). For example, after starting the additional storage, the storage unit 255 provisionally stores the binary code converted by the binary code conversion unit 253 as feature information 242 in the storage unit 240 until model adaptation is performed by the model adaptation unit 257. Furthermore, after model adaptation is performed by the model adaptation unit 257, the storage unit 255 stores the binary code as feature information 242 in the storage unit 240 until an arbitrary termination criterion is satisfied.

[0057] On the other hand, if a change in the system state cannot be detected (No at step S101), the storage unit 255 does not perform the process at step S102.

[0058] The above is an example of the operation of the detection device 200 when the system state changes. Next, an example of the operation of the detection device 200 when performing model adaptation will be described with reference to FIG.

[0059] 8 is a flowchart showing an example of the operation of the detection device 200 when performing model adaptation. Referring to FIG. 8, the model adaptation unit 257 checks whether a condition for performing model adaptation is satisfied (step S201). For example, as a condition for performing model adaptation, the model adaptation unit 257 checks whether a sufficient number of time-series segments to be used as learning data after a system state change has been obtained.

[0060] If it is confirmed that the condition is satisfied (Yes in step S201), the model adaptation unit 257 performs model adaptation (step S202). For example, the model adaptation unit 257 can perform model adaptation by updating the weight parameters of the model using the time-series segments acquired after detecting a change in the system state as learning data.

[0061] After the process of step S202, the update unit 258 replaces the binary code that was temporarily added (step S203). For example, after the process of step S202, the update unit 258 acquires binary code corresponding to the adapted model from the binary code conversion unit 253. In response to this, the update unit 258 replaces the binary code that was temporarily added and stored as the feature amount information 242 with the acquired binary code.

[0062] On the other hand, if the condition is not satisfied (Yes at step S201), the model adaptation unit 257 and the update unit 258 do not perform the processes from step S202 onwards.

[0063] The above is an example of the operation of the detection device 200 when performing model adaptation. Next, an example of the operation of the detection device 200 when performing anomaly detection will be described with reference to FIG.

[0064] 9 is a flowchart showing an example of the operation of the detection device 200 when performing anomaly detection. Referring to Fig. 9, the feature extraction unit 252 extracts features by inputting a time-series segment to be detected to a model stored as model information 241. Furthermore, the binary code conversion unit 253 converts the features extracted by the feature extraction unit 252 into binary code, which is information corresponding to the features (step S301).

[0065] The anomaly detection unit 256 detects anomalies based on feature amounts extracted from the time-series segment to be detected. For example, the anomaly detection unit 256 acquires binary codes corresponding to the feature amounts extracted from the time-series segment to be detected from the binary code conversion unit 253 (step S302). For example, the anomaly detection unit 256 calculates the distance between the acquired binary code and each binary code included in the feature amount information 242. Then, the anomaly detection unit 256 acquires a binary code that satisfies an arbitrary condition, such as a binary code with the smallest calculated distance, from among the binary codes included in the feature amount information 242, as a binary code similar to the acquired binary code.

[0066] The anomaly detection unit 256 also calculates an anomaly score according to the distance between the acquired binary code and the binary code searched for in the storage device (step S303). The anomaly detection unit 256 may calculate the anomaly score using any method.

[0067] If the calculated anomaly score exceeds a predetermined threshold (Yes at step S304), the anomaly detection unit 256 detects an anomaly (step S305). On the other hand, if the calculated anomaly score is equal to or less than the threshold, the anomaly detection unit 256 does not detect an anomaly.

[0068] The above is an example of the operation of the detection device 200 when detecting an anomaly. The output unit 259 may output anomaly information after the process of step S305. Note that, as illustrated in FIGS. 5 and 6 , the search target when the anomaly detection unit 256 detects an anomaly changes depending on various processes such as the detection of a change in the system state by the change detection unit 254, the model adaptation by the model adaptation unit 257, and the replacement by the update unit 258.

[0069] As described above, the detection device 200 includes the change detection unit 254, the storage unit 255, and the anomaly detection unit 256. With this configuration, the storage unit 255 can additionally store binary code in response to a change in the system state detected by the change detection unit 254. As a result, the anomaly detection unit 256 can perform a search that includes the additionally stored results and detect an anomaly. In other words, with the above configuration, it is possible to search for binary code based on the time-series data after the change and detect an anomaly based on the search results. This makes it possible to suppress an increase in the anomaly score even when the system state changes.

[0070] For example, FIG. 10 shows an example of anomaly score calculation when additional binary code is stored. In the example shown in FIG. 10, the anomaly score is calculated using the results of additional storage from around 900 on the x-axis. As shown in FIG. 10, it can be seen that additional storage of binary code reduces the anomaly score value compared to the example shown in FIG. 2. Note that in the example shown in FIG. 10, for the sake of explanation, there is a period between 800 and 900 on the x-axis during which the anomaly score is not calculated. However, the detection device 200 may continue to calculate the anomaly score while starting additional storage of binary code. As shown in the example shown in FIG. 10, the detection device 200 may be configured to resume calculation of the anomaly score after a predetermined number of additional storages have been performed.

[0071] The detection device 200 also includes a model adaptation unit 257 and an update unit 258. With this configuration, the update unit 258 replaces the temporarily added binary code after the model adaptation by the model adaptation unit 257. As a result, the anomaly detection unit 256 can perform more appropriate anomaly detection using the results of the model adaptation. In other words, with the above configuration, the temporary additional storage by the storage unit 255 temporarily suppresses an increase in the anomaly score, while allowing for appropriate anomaly detection.

[0072] Second Embodiment Next, a second embodiment of the present disclosure will be described with reference to Fig. 11 and Fig. 12. Fig. 11 is a diagram illustrating an example of the hardware configuration of an output device 300. Fig. 12 is a block diagram illustrating an example of the configuration of the output device 300.

[0073] In a second embodiment of the present disclosure, an output device 300 that is a time-series anomaly detection system that calculates an anomaly score based on time-series data will be described. Fig. 11 shows an example of the hardware configuration of the output device 300. Referring to Fig. 11, the output device 300 has the following hardware configuration, for example: a CPU (Central Processing Unit) 301 (arithmetic unit); a ROM (Read Only Memory) 302 (storage device); a RAM (Random Access Memory) 303 (storage device); a group of programs 304 loaded into the RAM 303; a storage device 305 that stores the group of programs 304; a drive device 306 that reads and writes data from and to a storage medium 310 external to the information processing device; a communication interface 307 that connects to a communication network 311 external to the information processing device; an input / output interface 308 that inputs and outputs data; and a bus 309 that connects the various components.

[0074] 12 . The program group 304 is stored in advance in the storage device 305 or the ROM 302, for example, and is loaded into the RAM 303 or the like and executed by the CPU 301. The program group 304 may be supplied to the CPU 301 via the communication network 311, or may be stored in advance in the recording medium 310, and the drive device 306 may read out the program and supply it to the CPU 301.

[0075] 11 shows an example of the hardware configuration of the output device 300. The hardware configuration of the output device 300 is not limited to the above-described case. For example, the output device 300 may be configured with only a part of the above-described configuration, such as excluding the drive device 306. Furthermore, the CPU 301 may be the GPU exemplified in the first embodiment.

[0076] The first acquisition unit 321 acquires feature amount information based on time-series data of an anomaly detection target.

[0077] The change detection unit 322 detects a change in the state of the anomaly detection target. For example, the change detection unit 322 may detect a change in the state based on time-series data.

[0078] The second acquisition unit 323 acquires feature amount information based on the time-series data after change detection by the change detection unit 322, based on the feature amount information acquired by the first acquisition unit 321. For example, the second acquisition unit 323 may acquire feature amount information based on the time-series data after change detection by the change detection unit 322 by searching a storage device for feature amount information similar to the feature amount information acquired by the first acquisition unit 321.

[0079] The anomaly information output unit 324 outputs anomaly information related to an anomaly based on the feature amount information acquired from the second acquisition unit 323 and the feature amount information acquired by the first acquisition unit 321. For example, the anomaly information output unit 324 may output an anomaly score, an anomaly notification notifying that an anomaly has occurred, or the like, as the anomaly information.

[0080] As described above, the output device 300 includes the first acquisition unit 321, the change detection unit 322, the second acquisition unit 323, and the anomaly information output unit 324. With this configuration, the anomaly information output unit 324 can output anomaly information related to an anomaly based on the feature amount information acquired from the second acquisition unit 323 and the feature amount information acquired by the first acquisition unit 321. This makes it possible to suppress an increase in the calculated anomaly score even when the system state changes.

[0081] The output device 300, which is the above-described time series anomaly detection system, can be realized by incorporating a predetermined program into an information processing device such as the output device 300. Specifically, a program according to another aspect of the present invention is a program for causing an information processing device such as the output device 300 to implement processing of detecting a change in the state of an anomaly detection target, acquiring feature amount information based on time series data of the anomaly detection target, acquiring feature amount information based on time series data after change detection based on the acquired feature amount information, and outputting anomaly information related to an anomaly based on the feature amount information based on the time series data after change detection and the feature amount information based on the time series data of the anomaly detection target.

[0082] Furthermore, an output method executed by an information processing device such as the output device 300 described above is a method in which the information processing device detects a change in the state of an anomaly detection target, acquires feature amount information based on time-series data of the anomaly detection target, acquires feature amount information based on the time-series data after change detection based on the acquired feature amount information, and outputs anomaly information related to an anomaly based on the feature amount information based on the time-series data after change detection and the feature amount information based on the time-series data of the anomaly detection target.

[0083] Even if the invention is a program having the above-described configuration, or a computer-readable recording medium having the program recorded thereon, or an output method, it can achieve the same functions and effects as the above-described time series anomaly detection system and output device 300, and therefore can achieve the above-described objective of the present disclosure.

[0084] <Supplementary Notes> Part or all of the above-described embodiments can be described as follows: An outline of the output device and the like according to the present invention will be described below. However, the present invention is not limited to the following configuration.

[0085] (Supplementary Note 1) A time series anomaly detection system comprising: a first acquisition unit that acquires feature amount information based on time series data of an anomaly detection target, a change detection unit that detects a change in the state of the anomaly detection target, a second acquisition unit that acquires feature amount information based on time series data after change detection by the change detection unit based on the feature amount information acquired by the first acquisition unit, and an anomaly information output unit that outputs anomaly information related to an anomaly based on the feature amount information acquired from the second acquisition unit and the feature amount information acquired by the first acquisition unit. (Supplementary Note 2) The time series anomaly detection system according to Supplementary Note 1, further comprising: a storage unit that stores feature amount information based on the time series data after change detection in a storage device according to a detection result by the change detection unit, (Supplementary Note 3) The time series anomaly detection system according to Supplementary Note 2, wherein the storage device pre-stores feature amount information based on the time series data before a change is detected, and the storage unit additionally stores feature amount information based on the time series data after a change is detected in the storage device according to a detection result by the change detection unit. (Supplementary Note 4) The time series anomaly detection system according to Supplementary Note 2, further comprising a model adaptation unit that adapts a model used when extracting features from the time series data to a state after a change, based on the time series data after a change is detected by the change detection unit. (Supplementary Note 5) The time series anomaly detection system according to Supplementary Note 4, wherein the storage unit stores feature amount information acquired using a model before adaptation by the model adaptation unit in the storage device according to a detection result by the change detection unit. (Supplementary Note 6) The time series anomaly detection system according to Supplementary Note 5, further comprising an update unit that replaces, in response to model adaptation by the model adaptation unit, feature information acquired using a model before adaptation by the model adaptation unit, which feature information is stored in the storage device by the storage unit, with feature information acquired using a model after adaptation.(Supplementary Note 7) The time series anomaly detection system according to Supplementary Note 6, wherein the output unit outputs anomaly information based on feature amount information acquired by the first acquisition unit using the model after adaptation by the model adaptation unit and feature amount information acquired by the second acquisition unit from the storage device including feature amount information after replacement by the update unit. (Supplementary Note 8) The time series anomaly detection system according to any one of Supplementary Notes 1 to 7, wherein the change detection unit detects a change in a state of the anomaly detection target based on time series data acquired from the anomaly detection target. (Supplementary Note 9) An output method, wherein an information processing device detects a change in a state of the anomaly detection target, acquires feature amount information based on the time series data of the anomaly detection target, acquires feature amount information based on the time series data after change detection based on the acquired feature amount information, and outputs anomaly information related to an anomaly based on the feature amount information based on the time series data after change detection and the feature amount information based on the time series data of the anomaly detection target. (Supplementary Note 10) An output device comprising: a first acquisition unit that acquires feature amount information based on time series data of an anomaly detection target, a change detection unit that detects a change in the state of the anomaly detection target, a second acquisition unit that acquires feature amount information based on time series data after change detection by the change detection unit based on the feature amount information acquired by the first acquisition unit, and an anomaly information output unit that outputs anomaly information related to an anomaly based on the feature amount information acquired from the second acquisition unit and the feature amount information acquired by the first acquisition unit. (Supplementary Note 11) A computer-readable recording medium having recorded thereon a program for causing an information processing device to perform processes of: detecting a change in the state of the anomaly detection target, acquiring feature amount information based on the time series data of the anomaly detection target, acquiring feature amount information based on the time series data after change detection based on the acquired feature amount information, and outputting anomaly information related to an anomaly based on the feature amount information based on the time series data after change detection and the feature amount information based on the time series data of the anomaly detection target.

[0086] The programs described in the above embodiments and appendices may be stored in a storage device or a computer-readable recording medium, such as a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

[0087] Although the present invention has been described above with reference to the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0088] 100 Detection system 200 Detection device 210 Operation input unit 220 Screen display unit 230 Communication I / F unit 240 Storage unit 241 Model information 242 Feature information 243 Time series data information 244 Program 250 Arithmetic processing unit 251 Time series data acquisition unit 252 Feature extraction unit 253 Binary code conversion unit 254 Change detection unit 255 Storage unit 256 Anomaly detection unit 257 Model adaptation unit 258 Update unit 259 Output unit 300 Output device 301 CPU 302 ROM 303 RAM 304 Program group 305 Storage device 306 Drive device 307 Communication interface 308 Input / output interface 309 Bus 310 Recording medium 311 Communication network 321 First acquisition unit 322 Change detection unit 323 Second acquisition unit 324 Abnormality information output unit

Claims

1. a first acquisition unit that acquires feature amount information based on time-series data of an anomaly detection target; a change detection unit that detects a change in state of an anomaly detection target; a second acquisition unit that acquires feature amount information based on time-series data after change detection by the change detection unit, based on the feature amount information acquired by the first acquisition unit; an abnormality information output unit that outputs abnormality information related to an abnormality based on the feature amount information acquired from the second acquisition unit and the feature amount information acquired by the first acquisition unit; have Time series anomaly detection system.

2. The time series anomaly detection system according to claim 1, a storage unit configured to store feature amount information based on time-series data after change detection in a storage device in accordance with a detection result by the change detection unit; The second acquisition unit searches the storage device for feature amount information similar to the feature amount information acquired by the first acquisition unit, thereby acquiring feature amount information based on the time-series data after the change detection by the change detection unit. Time series anomaly detection system.

3. The time series anomaly detection system according to claim 2, The storage device pre-stores feature amount information based on time-series data before change detection, The storage unit additionally stores feature amount information based on the time-series data after the change detection in the storage device according to the detection result by the change detection unit. Time series anomaly detection system.

4. The time series anomaly detection system according to claim 2, and a model adaptation unit that adapts a model used when extracting features from time-series data to a state after the change based on the time-series data after the change detection unit has detected the change. Time series anomaly detection system.

5. The time-series anomaly detection system according to claim 4, The storage unit stores, in the storage device, feature information acquired using the model before adaptation by the model adaptation unit, in accordance with the detection result by the change detection unit. Time series anomaly detection system.

6. The time-series anomaly detection system according to claim 5, an update unit that replaces feature information acquired using a model before adaptation by the model adaptation unit, which feature information is stored in the storage device by the storage unit, with feature information acquired using a model after adaptation, in response to adaptation of the model by the model adaptation unit; Time series anomaly detection system.

7. The time series anomaly detection system according to claim 6, The anomaly information output unit outputs anomaly information based on the feature amount information acquired by the first acquisition unit using the model after adaptation by the model adaptation unit and the feature amount information acquired by the second acquisition unit from the storage device including the feature amount information after replacement by the update unit. Time series anomaly detection system.

8. The time series anomaly detection system according to claim 1, The change detection unit detects a change in a state of the abnormality detection target based on time-series data acquired from the abnormality detection target. Time series anomaly detection system.

9. The information processing device Detecting a change in the state of the anomaly detection target, Acquire feature information based on time-series data of the anomaly detection target, Based on the acquired feature information, feature information based on the time-series data after change detection is acquired; Outputting anomaly information based on feature amount information based on time series data after change detection and feature amount information based on time series data of anomaly detection target Output method.

10. In the information processing device, Detecting a change in the state of the anomaly detection target, Acquire feature information based on time-series data of the anomaly detection target, Based on the acquired feature information, feature information based on the time-series data after change detection is acquired; Outputting anomaly information based on feature amount information based on time series data after change detection and feature amount information based on time series data of anomaly detection target A program to realize the processing.