Training device, abnormality detection device, training method, abnormality detection method, and program

Abstract

A training device according to an embodiment of the present disclosure includes: a first training unit that trains a first machine learning model using a set of normal state data of a first system serving as a source domain; and a second training unit that uses a set of normal state data of a second system serving as a target domain to train, as an abnormality detector, a second machine learning model obtained by adding neural network layers to the first machine learning model that has been trained by the first training unit.

Description

Learning device, anomaly detection device, learning method, anomaly detection method, and program

[0001] The present disclosure relates to a learning device, an anomaly detection device, a learning method, an anomaly detection method, and a program.

[0002] For operators of Information and Communication Technology (ICT) systems, identifying and quickly addressing abnormalities within the ICT system is an important task. Therefore, research into methods for early detection of abnormalities within ICT systems has been conducted. In particular, unsupervised anomaly detection methods using deep learning (DL) have been proposed, which learn normal conditions using normal ICT system data and then detect anomalies by calculating the degree of deviation from the normal condition during testing (e.g., Non-Patent Documents 1 and 2).

[0003] ICT systems provide a variety of services, and the users of those services have a variety of tendencies, so in order to learn the normal state of an ICT system using an unsupervised anomaly detection method that uses DL, a large amount of normal data is required.In general, the time when an ICT system is normal is often longer than the time when it is abnormal, so it is possible to collect a large amount of normal data for ICT systems that have been in operation for a long time.

[0004] Y.Ikeda, K. Ishibashi, Y. Nakano, K. Watanabe, K. Tajiri, and R. Kawahara, "Human-Assisted Online Anomaly Detection with Normal Outlier Retraining," ACM SIGKDD 2018 Workshop ODD v5.0, Aug. 2018.Y.Ikeda, K. Tajiri, Y. Nakano, K. Watanabe, K. Ishibashi, "Unsupervised Estimation of Dimensions Contributing to Detected Anomalies with Variational Autoencoders," AAAI-19 Workshop on Network Interpretability for Deep Learning, 2019.

[0005] However, there are cases where only a small amount of data is collected under normal circumstances. For example, immediately after a new ICT system is built, it is not possible to collect a sufficient amount of data under normal circumstances. Therefore, until a sufficient amount of data under normal circumstances is collected, anomalies cannot be detected using unsupervised anomaly detection methods.

[0006] Furthermore, for example, if the normal state of an ICT system changes due to the provision of a new service, the unsupervised anomaly detection methods used until now cannot be used, and similarly, anomalies cannot be detected until a sufficient amount of normal data has been collected.

[0007] The present disclosure has been made in consideration of the above points, and aims to achieve unsupervised anomaly detection in a target system using a small amount of normal data.

[0008] A learning device according to one aspect of the present disclosure includes a first learning unit that uses a set of normal data from a first system, which is a source domain, to learn a first machine learning model, and a second learning unit that uses a set of normal data from a second system, which is a target domain, to learn a second machine learning model as an anomaly detector, which is obtained by adding a neural network layer to the first machine learning model learned by the first learning unit.

[0009] Unsupervised anomaly detection in the target system can be achieved using a small amount of normal data.

[0010] FIG. 1 is a diagram schematically illustrating an example of an autoencoder in a source domain and a target domain. FIG. 2 is a diagram schematically illustrating an example of a variational autoencoder in a source domain and a target domain. FIG. 3 is a diagram schematically illustrating an example of a DeepSVDD in a source domain and a target domain. FIG. 4 is a diagram illustrating an example of the hardware configuration of an anomaly detection device according to an embodiment of the present invention. FIG. 5 is a diagram illustrating an example of the functional configuration of an anomaly detection device according to an embodiment of the present invention. FIG. 6 is a flowchart illustrating an example of the flow of an overall process executed by an anomaly detection device according to an embodiment of the present invention.

[0011] An embodiment of the present invention will be described below. In the following embodiment, while the configuration and functions of each ICT system are different, if two systems have similar configurations or functions, their normal states will also be similar. This focuses on this point, and describes an unsupervised anomaly detection method in which information obtained when learning the normal state of an ICT system with a large amount of normal data is transferred to an ICT system with only a small amount of normal data. This unsupervised anomaly detection method makes it possible to obtain an anomaly detector that can detect anomalies in an ICT system with only a small amount of normal data (hereinafter also referred to as a target system).

[0012] An anomaly detection device 10 will be described that uses the unsupervised anomaly detection method described above to create an anomaly detector and to detect an anomaly in a target system using the anomaly detector.

[0013] <Unsupervised Anomaly Detection Method> The theoretical configuration of the unsupervised anomaly detection method according to this embodiment will be described below.

[0014] First, an ICT system with a large amount of data under normal conditions is taken as the source domain S, and an ICT system (target system) with only a small amount of data under normal conditions is taken as the target domain T.

[0015] Also, one data item obtained from the source domain S under normal conditions is converted into n-dimensional vector data x ｓ = [x １ （ｓ） , ..., x ｎ （ｓ） ], and these n-dimensional vector data x ｓ The dataset consisting of the following is assumed.

[0016] Here, n is the number of types of data obtained in the source domain S, |D Ｓ | is the dataset D Ｓ represents the number of n-dimensional vector data constituting the vector.

[0017] Similarly, one data item obtained from the target domain T under normal conditions is expressed as m-dimensional vector data x ｔ = [x １ （ｔ） , ..., x ｍ （ｔ） ], and these m-dimensional vector data x ｔ The dataset consisting of the following is assumed.

[0018] Here, m is the number of types of data available in the target domain T, |D Ｔ | is the dataset D Ｔ The number of data in the target domain T is smaller than the number of data in the source domain S, that is, |D Ｔ |<|D Ｓ Assume that |. Also assume that n≠m.

[0019] Next, a machine learning model (hereinafter also simply referred to as a "model") used in the unsupervised anomaly detection method according to this embodiment will be described. In the unsupervised anomaly detection method according to this embodiment, a DNN such as an autoencoder (e.g., Reference 1), a variational autoencoder (e.g., Reference 2), or DeepSVDD (e.g., Reference 3) can be used as a model. Here, an autoencoder and a variational autoencoder are techniques that use normal data as input data, compress and decompress the input data, and perform training to reconstruct the input data. On the other hand, DeepSVDD is a technique that projects normal data onto a hypersphere and performs training to minimize the area of ​​the hypersphere. Furthermore, a technique called fine-tuning (e.g., Reference 4) is used as a technique for transferring information obtained when learning the normal state of an ICT system that has a large amount of normal data to a target system. Fine-tuning is a technique in which a new layer is added to an already trained model and the entire model is then retrained.

[0020] In the unsupervised anomaly detection method according to this embodiment, first, a data set D Ｓ Then, a dataset D of the target domain T is trained using the following: an autoencoder consisting of a fully connected neural network (i.e., a neural network realized with one or more fully connected layers), a variational autoencoder consisting of a fully connected neural network, or a DeepSVDD consisting of a fully connected neural network. Ｔ The trained model is retrained by fine-tuning using the above method to create an anomaly detector. Here, since the number of data types in the source domain S and the target domain T is different (n ≠ m), the trained model cannot be retrained as is.

[0021] Therefore, in the case of an autoencoder, a neural network with input dimension m and output dimension n is added as the first layer of the encoder, and a neural network with input dimension n and output dimension m is added as the last layer of the decoder. Specifically, n-dimensional vector data x in the source domain S is ｓ The autoencoder with the input data is AE ｓ , the autoencoder AE ｓ The encoder that configures ｓ , decoder D ｓ At this time, as shown in FIG. ｓ The first layer of the encoder E is a neural network F with input dimension m and output dimension n. ｔ , decoder D ｓ The final layer of the decoder D is a neural network G with input dimension n and output dimension m. ｔ As the encoder E ｔ and decoder D ｔ The autoencoder composed of the m-dimensional vector data x ｔ Autoencoder AE with input data ｔ This gives the dataset D of the target domain T. Ｔ Using the autoencoder AE ｔ In FIG. 1, the symbol "^" indicates that the input data is reconstructed.

[0022] Similarly, in the case of a variational autoencoder, a neural network with input dimension m and output dimension n is added as the first layer of the encoder, and a neural network with input dimension n and output dimension m is added as the last layer of the decoder. Specifically, n-dimensional vector data x in the source domain S is ｓ The VAE is a variational autoencoder with the input data ｓ , and its variational autoencoder VAE ｓ The encoder that configures φ ｓ , decoder p θ ｓHere, φ represents an encoder parameter, and θ represents a decoder parameter. In this case, as shown in FIG. φ ｓ The first layer of the encoder q is a neural network F with input dimension m and output dimension n. φ ｔ , decoder p θ ｓ The final layer of the decoder p is a neural network G with input dimension n and output dimension m. θ ｔ As the encoder q φ ｔ and decoder p θ ｔ The variational autoencoder consisting of ｔ Variational autoencoder VAE with input data ｔ This gives the dataset D of the target domain T. Ｔ Using the above, we obtain the variational autoencoder VAE. ｔ In FIG. 2, the symbol "^" indicates that the input data is reconstructed.

[0023] On the other hand, in the case of DeepSVDD, a neural network with input dimension m and output dimension n is added as the first layer of DeepSVDD. Specifically, n-dimensional vector data x ｓ DeepSVDD with input data is ψ ｓ At this time, as shown in FIG. ｓ The first layer of the neural network F with input dimension m and output dimension n is added to the target domain T for n-dimensional vector data x ｔ DeepSVDDψ with input data ｔ This gives the dataset D of the target domain T. Ｔ DeepSVDDψ ｔ It is possible to re-learn.

[0024] In DeepSVDD, the distance between c, which is a constant given before learning and represents the center of the hypersphere, and DeepSVDDψ(x, W) is calculated. Here, W is a parameter of DeepSVDDψ. In FIG. 3, DeepSVDDψ ｓ The parameters of W ｓ , DeepSVDDψ ｔ The parameters of W ｔ It is expressed as follows.

[0025] Next, we define the loss function for the above models (autoencoder, variational autoencoder, or DeepSVDD).

[0026] When the model is an autoencoder, the loss function is defined by the following equation (1).

[0027] where x is the input data of the autoencoder, AE(·,θ ＡＥ ) is the autoencoder, θ ＡＥ represents the parameters of the autoencoder. Also, D represents the autoencoder AE(·,θ ＡＥ ) is the dataset used for learning, and D = {x １ , ..., x ｜Ｄ｜}.

[0028] Dataset D of source domain S Ｓ Using the autoencoder AE ｓ When learning, in the above formula (1), D = D Ｓ , x∈D Ｓ , AE=AE ｓ , θ ＡＥ = θ ＡＥ ｓ However, θ ＡＥ ｓ is the autoencoder AE ｓ On the other hand, the data set D of the target domain T Ｔ Using the autoencoder AE ｔ When re-learning, in the above formula (1), D = D Ｔ , x∈D Ｔ , AE=AE ｔ , θ ＡＥ = θ ＡＥｔ However, θ ＡＥ ｔ is the autoencoder AE ｔ are the parameters of the dataset D Ｓ The trained parameters θ ＡＥ ｓ Includes:

[0029] When the model is a variational autoencoder, the loss function is defined by the following equation (2).

[0030] where x is the input data of the variational autoencoder VAE, q φ is the encoder of the variational autoencoder VAE, p θ represents the decoder of the variational autoencoder VAE. φ represents the encoder parameters of the variational autoencoder VAE, and θ represents the decoder parameters of the variational autoencoder VAE. D is the dataset used for training the variational autoencoder VAE, and D = {x １ , ..., x ｜Ｄ｜}, where KL(·||·) is the Kullback-Leibler divergence (see, for example, Reference 5). １ , ..., z ｜Ｄ｜ are x respectively １ , ..., x ｜Ｄ｜ Encoder q φ is the sequence of vectors that are output when input is made to q (i.e., the sequence of vectors that represent latent variables). φ (z １ , ..., z ｜Ｄ｜ |x １ , ..., x ｜Ｄ｜ ) is x １ , ..., x ｜Ｄ｜ Given an encoder q φ to vector sequence z １ , ..., z ｜Ｄ｜ Similarly, p θ (x １ , ..., x ｜Ｄ｜ |z １ , ..., z ｜Ｄ｜ ) is z １ , ..., z ｜Ｄ｜Given a decoder p θ to vector sequence x １ , ..., x ｜Ｄ｜ It represents the conditional probability distribution where x ｉ The one with the hat symbol "^" attached to it is x ｉ means the data reconstructed by the variational autoencoder VAE.

[0031] Dataset D of source domain S Ｓ Using the variational autoencoder VAE ｓ When learning, in the above equation (2), D = D Ｓ , x∈D Ｓ , VAE=VAE ｓ (That is, q φ =q φ ｓ , p θ = p θ ｓ ), φ=φ ｓ , θ=θ ｓ However, φ ｓ is the encoder q φ ｓ parameter, θ ｓ is the decoder p θ ｓ On the other hand, the data set D of the target domain T Ｔ Using the variational autoencoder VAE ｓ When re-learning, in the above equation (2), D = D Ｔ , x∈D Ｔ , VAE=VAE ｔ (That is, q φ =q φ ｔ , p θ = p θ ｔ ), φ=φ ｔ , θ=θ ｔ However, φ ｔ is the encoder q φ ｔ are the parameters of the dataset D Ｓ The trained parameters φ are trained using ｓ Similarly, θ ｔ is the decoder pθ ｔ are the parameters of the dataset D Ｓ The trained parameters θ ｓ Includes:

[0032] When the model is DeepSVDD, the loss function is defined by the following equation (3).

[0033] Here, x represents the input data of DeepSVDD, ψ(·,W) represents DeepSVDD, and W represents the (weight) parameter of DeepSVDDψ. D is a data set used for learning DeepSVDDψ, and D={x １ , ..., x ｜Ｄ｜}, where L is the number of fully connected layers that make up DeepSVDDψ, and W ｌ is a (weight) parameter of the l-th fully connected layer of the neural network that realizes DeepSVDDψ among the parameters W, and λ is a hyperparameter that adjusts the regularization term for the weight parameter. c is a constant given in advance before learning the model, and represents the center of the hypersphere mapped by DeepSVDDψ(·,W). The constant c is, for example, Ｓ and D Ｔ It is calculated from

[0034] Dataset D of source domain S Ｓ DeepSVDDψ ｓ When learning, in the above equation (3), D = D Ｓ , x∈D Ｓ , ψ = ψ ｓ , W=W ｓ However, W ｓ is DeepSVDDψ ｓ On the other hand, the data set D of the target domain T Ｔ DeepSVDDψ ｔ When re-learning, in the above equation (3), D = D Ｔ , x∈D Ｔ , ψ = ψ ｔ , W=W ｔ However, W ｔ eepSVDDψｔ is a parameter of

[0035] When detecting an anomaly, the data x of the target domain T is used to perform the anomaly detection by the anomaly detector.

[0036] Autoencoder AE with anomaly detector retrained ｔ For example, if １ ||x-AE ｔ (x, θ ＡＥ ) || ２ If it exceeds a predetermined threshold, it is determined to be abnormal, and if it does not, it is determined to be normal. １ is a hyperparameter.

[0037] Anomaly detector retrained variational autoencoder (VAE) ｔ For example, if ２ ||x-^x|| ２ If it exceeds a predetermined threshold, it is determined to be abnormal, and if it does not, it is determined to be normal. ２ is a hyperparameter. Also, ^x is a variational autoencoder VAE ｔ This is data reconstructed by

[0038] The anomaly detector has been retrained. DeepSVDDψ ｔ For example, if ３ |c-ψ ｔ (x, W ｔ ) | ２ If it exceeds a predetermined threshold, it is determined to be abnormal, and if it does not, it is determined to be normal. ３ is a hyperparameter.

[0039] <Example of Hardware Configuration of Anomaly Detection Device 10> Next, an example of a hardware configuration of the anomaly detection device 10 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram illustrating an example of the hardware configuration of the anomaly detection device 10 according to this embodiment.

[0040] 4, the anomaly detection device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a random access memory (RAM) 105, a read only memory (ROM) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0041] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the anomaly detection device does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0042] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0043] The communication I / F 104 is an interface for connecting the anomaly detection device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is a computing device such as a central processing unit (CPU) or a graphic processing unit (GPU).

[0044] 4 is an example, and the hardware configuration of the anomaly detection device 10 is not limited to this. The anomaly detection device 10 may have, for example, multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0045] <Example of Functional Configuration of Anomaly Detection Device 10> Next, an example of the functional configuration of the anomaly detection device 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram illustrating an example of the functional configuration of the anomaly detection device 10 according to this embodiment.

[0046] As shown in FIG. 5 , the anomaly detection device 10 according to this embodiment includes a model learning unit 201, a transfer learning unit 202, an inference unit 203, and a user interface unit 204. These units are implemented, for example, by a processor 108 or the like executing one or more programs installed in the anomaly detection device 10. The anomaly detection device 10 according to this embodiment also includes a source domain DB 205, a trained model DB 206, a target domain DB 207, and a retrained model DB 208. Each of these DBs (databases) is implemented, for example, by the auxiliary storage device 107. Note that at least one of these DBs may be implemented, for example, by a database server or the like connected to the anomaly detection device 10 via a communication network.

[0047] The model learning unit 201 uses the data set D stored in the source domain DB 205. Ｓ Using the model (autoencoder AE ｓ , variational autoencoder VAE ｓ or DeepSVDDψ ｓ ) to learn.

[0048] In addition, the model learning unit 201 stores the learned model in the learned model DB 206.

[0049] The transfer learning unit 202 uses the data set D stored in the target domain DB 207 ＴUsing this, a trained model (trained autoencoder AE) is trained using Fine-tuning, which is one of the transfer learning methods. ｓ , trained variational autoencoder VAE ｓ or learned DeepSVDDψ ｓ ) is retrained. That is, the model is retrained using the autoencoder AE. ｓ If so, the transfer learning unit 202 transfers the trained autoencoder AE ｓ From autoencoder AE ｔ After creating the dataset D Ｔ Using the autoencoder AE ｔ Similarly, if the model is a variational autoencoder (VAE), ｓ If so, the transfer learning unit 202 performs the trained variational autoencoder VAE ｓ From the variational autoencoder VAE ｔ After creating the dataset D Ｔ Using the above, we obtain the variational autoencoder VAE. ｔ Also, the model is retrained. ｓ , the transfer learning unit 202 calculates the trained DeepSVDDψ ｓ From DeepSVDDψ ｔ After creating the dataset D Ｔ DeepSVDDψ ｔ Relearn.

[0050] Furthermore, the transfer learning unit 202 stores the retrained model in the retrained model DB 208 .

[0051] The inference unit 203 uses the retrained model stored in the retrained model DB 208 as an anomaly detector and determines whether an anomaly has occurred in the target system using this anomaly detector and data x that is the target of anomaly detection in the target domain T.

[0052] The user interface unit 204 outputs to the user the determination result made by the inference unit 203. For example, the user interface unit 204 outputs the determination result to a terminal or the like used by an operator or the like of the target system.

[0053] The source domain DB 205 stores the data set D of the source domain S. Ｓ The trained model DB 206 stores trained models trained by the model training unit 201. The target domain DB 207 stores a dataset D of the target domain T. Ｔ The retrained model DB 208 stores the retrained model that has been retrained by the transfer learning unit 202.

[0054] 5 is merely an example, and other functional configurations may be used. For example, each functional unit and each DB may be arranged in a plurality of devices.

[0055] <Overall Processing Flow Executed by Anomaly Detection Device 10> The overall processing flow executed by the anomaly detection device 10 according to this embodiment will be described with reference to FIG. 6. FIG. 6 is a flowchart showing an example of the overall processing flow executed by the anomaly detection device 10 according to this embodiment. Here, steps S101 to S104 in FIG. 6 are the processing of the learning phase, and steps S105 to S106 are the processing of the inference phase. Note that the learning phase is the phase in which a model is learned, while the inference phase is the phase in which inference (i.e., anomaly detection) is performed using the trained model. The learning phase is performed in advance of the inference phase.

[0056] Step S101: The model learning unit 201 learns the data set D stored in the source domain DB 205. Ｓ Using the model (autoencoder AE ｓ , variational autoencoder VAE ｓ or DeepSVDDψ ｓ ) is learned. That is, the model is an autoencoder AE. ｓ If D=D Ｓ , x∈D Ｓ , AE=AE ｓ , θ ＡＥ = θ ＡＥ ｓ The loss function L of Equation (1) ＡＥ The autoencoder AE is ｓparameter θ ＡＥ ｓ Similarly, if the model is a variational autoencoder (VAE), ｓ If D=D Ｓ , x∈D Ｓ , VAE=VAE ｓ (That is, q φ =q φ ｓ , p θ = p θ ｓ ), φ=φ ｓ , θ=θ ｓ The loss function L of Equation (2) ＶＡＥ The variational autoencoder VAE is ｓ parameter φ ｓ and θ ｓ Also, if the model is DeepSVDDψ ｓ If D=D Ｓ , x∈D Ｓ , ψ = ψ ｓ , W=W ｓ The loss function L of Equation (3) ＤｅｅｐＳＶＤＤ DeepSVDDψ ｓ The parameter W ｓ In order to learn parameters so as to minimize the loss function, a known optimization method such as Adam's may be used.

[0057] Step S102: The model learning unit 201 stores the trained model trained in the above step S102 in the trained model DB 206.

[0058] Step S103: The transfer learning unit 202 uses the data set D stored in the target domain DB 207 Ｔ The trained model is retrained by Fine-tuning, which is one of the transfer learning methods, using the autoencoder AE. ｓ If so, the transfer learning unit 202 transfers the trained autoencoder AE ｓ From autoencoder AE ｔ After creating D = D Ｔ , x∈D Ｔ , AE=AEｔ , θ ＡＥ = θ ＡＥ ｔ The loss function L of Equation (1) ＡＥ The autoencoder AE is ｔ parameter θ ＡＥ ｔ Similarly, if the model is a variational autoencoder (VAE), ｓ If so, the transfer learning unit 202 performs the trained variational autoencoder VAE ｓ From the variational autoencoder VAE ｔ After creating D = D Ｔ , x∈D Ｔ , VAE=VAE ｔ (That is, q φ =q φ ｔ , p θ = p θ ｔ ), φ=φ ｔ , θ=θ ｔ The loss function L of Equation (2) ＶＡＥ The variational autoencoder VAE is ｔ parameter φ ｔ and θ ｔ Also, the model is retrained. ｓ , the transfer learning unit 202 calculates the trained DeepSVDDψ ｓ From DeepSVDDψ ｔ After creating D = D Ｔ , x∈D Ｔ , ψ = ψ ｔ , W=W ｔ The loss function L of Equation (3) ＤｅｅｐＳＶＤＤ DeepSVDDψ ｔ The parameter W ｔ Relearn.

[0059] Step S104: The transfer learning unit 202 stores the retrained model retrained in step S103 in the retrained model DB 208.

[0060] Step S105: The inference unit 203 uses the retrained model stored in the retrained model DB 208 as an anomaly detector and determines whether an anomaly has occurred in the target system by using the anomaly detector and the data x of the anomaly detection target in the target domain T. That is, the anomaly detector determines whether an anomaly has occurred in the target system by using the retrained autoencoder AE ｔ , the inference unit 203 calculates, for example, β １ ||x-AE ｔ (x, θ ＡＥ ) || ２ If the error exceeds a predetermined threshold, it is determined to be abnormal, otherwise it is determined to be normal. ｔ , the inference unit 203 calculates, for example, β ２ ||x-^x|| ２ If the anomaly detector detects the retrained DeepSVDDψ, it is determined that the anomaly is abnormal, and if it is not, it is determined that the anomaly detector detects the retrained DeepSVDDψ ｔ , the inference unit 203 calculates, for example, β ３ |c-ψ ｔ (x, W ｔ ) | ２ If it exceeds a predetermined threshold, it is determined to be abnormal, and if not, it is determined to be normal.

[0061] Step S106: The user interface unit 204 outputs the determination result (normal or abnormal) of the above step S105 to the user. Note that the user interface unit 204 may output the determination result of the above step S105 to the user only if the determination result is abnormal, for example.

[0062] <Summary> As described above, with the anomaly detection device 10 according to this embodiment, even if there is only a small amount of data on the target system when it is normal, by using fine-tuning, which is a type of transfer learning, to transfer information on the normal state of an ICT system that has a large amount of data on when it is normal, it is possible to detect anomalies in the target system using an unsupervised anomaly detection method that uses DL. This makes it possible, for example, to start monitoring the target system early.

[0063] As described above, the anomaly detection device 10 has a learning phase and an inference phase, and in this embodiment, the same anomaly detection device 10 executes the learning phase and the inference phase, but these phases may be executed by different devices. Furthermore, the anomaly detection device 10 in the learning phase may be called a "learning device" or the like.

[0064] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0065] [References] Reference 1: Mayu Sakurada and Takehisa Yairi. 2014. Anomaly Detection Using Autoencoders with Nonlinear Dimensionality Reduction. In Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis (MLSDA'14). Association for Computing Machinery, New York, NY, USA, 4-11. https: / / doi.org / 10.1145 / 2689746.2689747 Reference 2: Kingma, Diederik P., and Max Welling. "Auto-encoding variational bayes." arXiv preprint arXiv:1312.6114 (2013). Reference 3: Ruff, Lukas, et al. "Deep one-class classification." International conference on machine learning. PMLR, 2018. Reference 4: L. Borawar and R. Kaur, "Anomaly Detection Methods in Surveillance Videos: A Survey," 2022 International Conference on Smart Generation Computing, Communication and Networking (SMART GENCON), Bangalore, India, 2022, pp. 1-7, doi: 10.1109 / SMARTGENCON56628.2022.10084028. Reference 5: Shlens, Jonathon. "Notes on kullback-leibler divergence and likelihood." arXiv preprint arXiv:1404.2000 (2014).

[0066] 10 Anomaly detection device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Model learning unit 202 Transfer learning unit 203 Inference unit 204 User interface unit 205 Source domain DB 206 Trained model DB 207 Target domain DB 208 Retrained model DB

Claims

1. A learning device having: a first learning unit that learns a first machine learning model using a collection of normal data of a first system that is a source domain; and a second learning unit that learns a second machine learning model as an anomaly detector by adding a neural network layer to the first machine learning model learned by the first learning unit using a collection of normal data of a second system that is a target domain.

2. The learning device of claim 1, wherein the first machine learning model is an autoencoder or a variational autoencoder, and the second learning unit learns as the anomaly detector a second machine learning model in which a first neural network layer is added as a first layer of an encoder of the autoencoder or variational autoencoder learned by the first learning unit, and a second neural network layer is added as a last layer of a decoder of the autoencoder or variational autoencoder.

3. The learning device described in claim 2, wherein the second learning unit learns a second machine learning model as the anomaly detector, the second machine learning model being obtained by adding the first neural network layer having an input dimension of n and an output dimension of n as a first layer of the encoder and adding the second neural network layer having an input dimension of n and an output dimension of m as a last layer of the decoder, when normal data of the first system is represented by an n-dimensional vector and normal data of the second system is represented by an m-dimensional vector.

4. The learning device according to claim 1, wherein the first machine learning model is DeepSVDD, and the second learning unit learns a second machine learning model as the anomaly detector, the second machine learning model being obtained by adding the neural network layer as a first layer of the DeepSVDD learned by the first learning unit.

5. An anomaly detection device having an anomaly detector trained by the learning device described in claim 1 and an anomaly detection unit that uses data of the second system to determine whether or not the second system is abnormal.

6. A learning method executed by a computer, comprising: a first learning procedure for learning a first machine learning model using a set of data from a first system (a source domain) under normal conditions; and a second learning procedure for learning a second machine learning model, which is obtained by adding a neural network layer to the first machine learning model learned by the first learning procedure, as an anomaly detector using a set of data from a second system (a target domain) under normal conditions.

7. An anomaly detection method in which a computer executes an anomaly detection procedure that uses an anomaly detector trained by the learning device described in claim 1 and data of the second system to determine whether the second system is abnormal.

8. A program for causing a computer to function as the learning device according to any one of claims 1 to 4, or the anomaly detection device according to claim 5.

Images