Training device, abnormality detection device, training method, abnormality detection method, and program

Abstract

A training device that is sequentially imparted with a dataset configured from input data to which there is added a label indicating whether the input data is normal or abnormal comprises: a first data generation unit that generates first input data that is normal among input data included in a dataset imparted in the past, the first input data being generated by using a decoder of a model configured from an encoder that outputs a latent vector using the input data as an input, a binary classifier that outputs a predicted value of a label of the input data using the input data as an input, and the decoder, which outputs a predicted value of the input data using the latent vector and the label as inputs; a second data generation unit that generates second input data that is abnormal among the input data included in the dataset imparted in the past, the second input data being generated by using the decoder and the binary classifier of the model; and a training unit that updates a parameter of the model using the imparted dataset, the first input data, and the second input data.

Description

Learning device, anomaly detection device, learning method, anomaly detection method, and program

[0001] The present disclosure relates to a learning device, an anomaly detection device, a learning method, an anomaly detection method, and a program.

[0002] Anomaly detection methods are known as methods for detecting data that deviates significantly from normality (hereinafter referred to as anomalous data) among observed data (e.g., Non-Patent Document 1). Many anomaly detection methods perform anomaly detection by learning an anomaly detection model that represents a normal pattern from a large amount of normal data provided as training data, and then detecting test data that deviates significantly from this normal pattern as anomalous data.

[0003] In actual anomaly detection, in addition to normal data, a small amount of abnormal data may also be used as training data. For example, the method described in Non-Patent Document 1 proposes a training method for an anomaly detection model that utilizes normal data and a small amount of abnormal data, and shows that anomaly detection performance can be improved by using even a small amount of abnormal data for training. Such an anomaly detection method in which both normal data and abnormal data are provided during training is called a supervised anomaly detection method.

[0004] Lukas Ruff and Robert A. Vandermeulen and Nico Gornitz and Alexander Binder and Emmanuel Muller and Klaus-Robert Muller and Marius Kloft, "Deep Semi-Supervised Anomaly Detection," International Conference on Learning Representations, 2020.

[0005] Conventional supervised anomaly detection methods require all training data to be provided during training. However, due to privacy and other considerations, it may not be possible to permanently store all observed data. In such cases, data acquired in the past cannot be used for training. Furthermore, if the distribution of data used for anomaly detection changes over time, training using past data may actually lead to a deterioration in anomaly detection performance. In these cases, continuous training is required, in which the anomaly detection model is trained continuously rather than all at once. However, no method for continuous training was known for conventional supervised anomaly detection methods.

[0006] The present disclosure has been made in consideration of the above points, and aims to realize a supervised anomaly detection model that can be continuously trained.

[0007] A learning device according to one aspect of the present disclosure is a learning device that is sequentially provided with datasets consisting of input data to which labels indicating whether the data is normal or abnormal are assigned, and that includes: a first data generation unit that uses a decoder included in a model consisting of an encoder that takes the input data as input and outputs a latent vector, a binary classifier that takes the input data as input and outputs a predicted value of the label of the input data, and a decoder that takes the latent vector and the label as input and outputs a predicted value of the input data, to generate first input data, which is normal data, from among input data included in a dataset that was previously provided, using the decoder and the binary classifier included in the model; a second data generation unit that uses the decoder and the binary classifier included in the model to generate second input data, which is abnormal data, from among input data included in a dataset that was previously provided; and a learning unit that updates parameters of the model using a provided dataset, the first input data, and the second input data.

[0008] It is possible to realize a supervised anomaly detection model that can be continuously trained.

[0009] FIG. 1 is a diagram schematically illustrating an example of a model; FIG. 2 is a diagram illustrating an example of a hardware configuration of an anomaly detection device according to an embodiment; FIG. 3 is a diagram illustrating an example of a functional configuration of an anomaly detection device according to an embodiment; FIG. 4 is a flowchart illustrating an example of a learning process according to an embodiment; and FIG. 5 is a flowchart illustrating an example of an anomaly detection process according to an embodiment.

[0010] An embodiment of the present invention will be described below.

[0011] <Supervised anomaly detection method using continuous learning> Hereinafter, we propose a supervised anomaly detection method using continuous learning as a method for anomaly detection using a supervised anomaly detection model that can be continuously learned. Hereinafter, the supervised anomaly detection method using continuous learning will also be referred to as the proposed method.

[0012] Notation and definitions Let X be the M-dimensional Euclidean space R Ｍ (where R is the set of all real numbers.) Let T be the number of tasks, and N ｔ Let be the number of data items in the t-th task, where t∈{1, 2, ..., T}. For simplicity, the t-th task will also be referred to as "task t" below.

[0013] The dataset for task t is D ｔ = {(x ｊ （ｔ） , y ｊ （ｔ） ) |j=1,...,N ｔ} ⊂ X × {0, 1}, where x ｊ （ｔ） is the jth input data of task t, y ｊ （ｔ） is its label (i.e., the input data x ｊ （ｔ） has label y ｊ （ｔ） The label is x ｊ （ｔ） If y is abnormal data, ｊ （ｔ） = 1, x ｊ （ｔ） If is normal data, then y ｊ （ｔ） = 0. Also, let pＤ （ｔ） Let (x, y).

[0014] In this case, during learning, column D of the dataset １ , D ２ , ..., D Ｔ are sequentially given, and the t-th data set D ｔ When using the t-th data set, it is not possible to use a data set other than the t-th data set.

[0015] Model: This section explains the model used as an anomaly detection model in the proposed method. Since the task number of the model itself is not important, the following explanation of the model will ignore the identifier t, which indicates the task number.

[0016] Let K be the number of dimensions of the latent vector space, and let Z = R Ｋ In this case, the model used in the proposed method is shown in Figure 1. As shown in Figure 1, the model used in the proposed method has a structure similar to a variational autoencoder, and the encoder q φ (z|x) and decoder p θ (x|z, y), where the encoder q φ (z|x) and decoder p θ (x|z, y) are all realized by a neural network, which is a machine learning model (particularly, a deep learning model), and θ and φ represent parameters of the neural network.

[0017] Encoder Q φ (z|x) outputs a latent vector z∈Z given an input x. On the other hand, the decoder p θ (x|z, y) predicts the input x given the latent vector z and the label y. Note that in the example shown in FIG. θ The input x predicted by (x|z, y) is represented by adding a hat symbol "^" directly above it. Hereinafter, when a symbol with a hat symbol "^" directly above it is represented in the text of this specification, for convenience, the hat symbol will be represented by adding it immediately before it, not directly above it. For example, when the decoder p θAn input x predicted by (x|z, y) is denoted as "^x" in the text of this specification.

[0018] As shown in Figure 1, the model used in the proposed method includes a binary classifier r that predicts a label y from an input x when the input x is given. φ (y|x), where the binary classifier r φ (y|x) is also realized by a neural network, and its parameter φ is the encoder q φ (z|x). In the example shown in FIG. φ The label y predicted by (y|x) is denoted as ^y.

[0019] Data distribution p Ｄ Given (x, y), the expected loss for updating the parameters of the model used in the proposed method is given by the following equation (1):

[0020] Here, E represents the expected value, KL represents the Kullback-Leibler divergence, and p(z) represents the prior distribution for the latent vector z. Any appropriate prior distribution can be used for p(z), such as a normal distribution.

[0021] In model learning, the model parameters θ and φ are updated so as to reduce the expected loss shown in the above formula (1). For this update, a known optimization method such as stochastic gradient descent may be used.

[0022] Degree of Anomaly: Given the learned parameters θ and φ, the degree of anomaly of the input x is defined by the following equation (2).

[0023] Here, the first term in the above equation (2) represents the reconstruction error, and the second term represents the binary classifier r φ (y|x). The reconstruction error is the logarithmic likelihood obtained from the decoder p θ This is the error between the predicted x in (x|z, y) and the original input x.

[0024] - Data generation to prevent catastrophic forgetting It is known that in continuous learning of neural networks, when learning on the current task t, the performance of past tasks t'<t that have already been learned drops significantly. This is called catastrophic forgetting. To prevent catastrophic forgetting, the proposed method generates data for past tasks from the model, and then mixes the generated data with the data for the current task during learning. This prevents catastrophic forgetting.

[0025] For normal data from past tasks, we simply use the distribution p θ (x|z, y=0) where the latent vector z is sampled from the prior distribution p(z).

[0026] On the other hand, for abnormal data among past task data, the distribution p θ Sampling from (x|z, y = 1) may not work well. This is because the number of normal data is overwhelmingly greater than the number of abnormal data during learning, and normal data may be generated depending on the sampled latent vector z even if the condition y = 1 is set. Therefore, a latent vector ^z that can generate abnormal data is found using the following equation (3).

[0027] The latent vector ^z shown in the above formula (3) can be obtained by a known optimization method such as the gradient descent method. θ Anomalous data can be generated by sampling from (x|^z, y=1).

[0028] The flow of learning the objective function model is explained below. Let us consider the case where the tth (where t>1) task is learned. Therefore, the parameter θ after learning the t-1th task is already （ｔ－１） and φ （ｔ－１） It is assumed that the following has been obtained.

[0029] The number of normal data to be generated to prevent catastrophic forgetting about past tasks is N. ｎｏ , the number of abnormal data is N ａｎｏIn this case, first, normal data and abnormal data are generated using the method described above in "Data generation to prevent catastrophic forgetting" to obtain a normal data set {(x ｎｏ，ｉ , y ｉ =0) |i=1,...,N ｎｏ} and the abnormal dataset {(x ａｎｏ，ｊ , y ｊ =1) |j=1,...,N ａｎｏ}. Then, these datasets are combined into the dataset D for the current task t. ｔ Data set D:=D ｔ ∪{(x ｎｏ，ｉ , y ｉ =0) |i=1,...,N ｎｏ} ∪ {(x ａｎｏ，ｊ , y ｊ =1) |j=1,...,N ａｎｏ Then, this data set D is used as a data set for learning, and the empirical loss shown in the following equation (4) is used as an objective function, and the parameter θ （ｔ－１） and φ （ｔ－１） and update the parameter θ （ｔ） and φ （ｔ） get.

[0030] Here, β≧0 is a hyperparameter.

[0031] The following describes an anomaly detection device 10 that performs model learning and anomaly detection using the above-mentioned proposed method. Here, the anomaly detection device 10 described below has a "learning time" in which the model parameters θ and φ are updated, and an "anomaly detection time" in which the degree of anomaly is calculated and anomaly detection is actually performed. During learning, the column D of the dataset １ , D ２ , ..., D Ｔ are sequentially given, and the t-th data set D ｔ When using the t-th data set, data other than the t-th data set cannot be used. On the other hand, when detecting an anomaly, data x to be subjected to anomaly detection (hereinafter also referred to as anomaly detection target data) is given.

[0032] <Example of Hardware Configuration of Anomaly Detection Device 10> Next, an example of a hardware configuration of the anomaly detection device 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram illustrating an example of the hardware configuration of the anomaly detection device 10 according to this embodiment.

[0033] 2, the anomaly detection device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a random access memory (RAM) 105, a read only memory (ROM) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0034] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the anomaly detection device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0035] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0036] The communication I / F 104 is an interface for connecting the anomaly detection device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is a computing device such as a central processing unit (CPU) or a graphic processing unit (GPU).

[0037] 2 is an example, and the hardware configuration of the anomaly detection device 10 is not limited to this. The anomaly detection device 10 may have, for example, multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0038] <Example of Functional Configuration of Anomaly Detection Device 10> Next, an example of the functional configuration of the anomaly detection device 10 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram illustrating an example of the functional configuration of the anomaly detection device 10 according to this embodiment.

[0039] 3 , the anomaly detection device 10 according to this embodiment includes an input unit 201, a data generation unit 202, a learning unit 203, an anomaly degree calculation unit 204, and an anomaly detection unit 205. These units are realized, for example, by a process in which one or more programs installed in the anomaly detection device 10 are executed by the processor 108 or the like. The anomaly detection device 10 according to this embodiment also includes a model parameter storage unit 206. The model parameter storage unit 206 is realized, for example, by a storage area of ​​the auxiliary storage device 107. However, the model parameter storage unit 206 may also be realized, for example, by a storage area of ​​a storage device connected to the anomaly detection device 10 so as to be able to communicate with it.

[0040] During learning, the input unit 201 receives a given data set D ｔ Furthermore, the input unit 201 inputs the given anomaly detection target data x at the time of anomaly detection.

[0041] When learning the tth (where t>1) task, the data generation unit 202 generates normal data and abnormal data using the method described above in "Data generation to prevent catastrophic forgetting" to generate a normal data set D ｔ ｎｏ :={(x ｎｏ，ｉ （ｔ） , y ｉ （ｔ） =0) |i=1,...,N ｎｏ （ｔ）} and the abnormal data set D ｔ ａｎｏ :={(x ａｎｏ （ｔ） ，ｊ , y ｊ （ｔ） =1) |j=1,...,N ａｎｏ （ｔ） That is, the data generating unit 202 generates the parameters after learning the t-1th task as θ=θ （ｔ－１） and φ = φ （ｔ－１） As a result, the distribution p θ (x|z, y=0) to N ｎｏ （ｔ） Sampling data items and ｎｏ （ｔ） By generating normal data, a normal data set D ｔ ｎｏ In addition, the data generation unit 202 obtains the latent vector ^z by the above formula (3) and then generates the distribution p θ (x|^z, y=1) to N ａｎｏ （ｔ） Sampling data items and ａｎｏ （ｔ） By generating abnormal data, the abnormal data set D ｔ ａｎｏ where N ｎｏ （ｔ）is the number of normal data to be generated in task t to prevent catastrophic forgetting about past tasks. ａｎｏ （ｔ） is the number of abnormal data to be generated in task t to prevent catastrophic forgetting of past tasks. ｎｏ （ｔ） and N ａｎｏ （ｔ） The value of is set in advance for each task t, for example.

[0042] The learning unit 203 determines that D=D when t=1. １ , if t>1, D=D ｔ ∪D ｔ ｎｏ ∪D ｔ ａｎｏ is used as a data set for learning, and the empirical loss shown in the above formula (4) is used as an objective function. The parameters θ （ｔ－１） and φ （ｔ－１） This updates the updated parameter θ （ｔ－１） and φ （ｔ－１） is the parameter θ after learning the t-th task. （ｔ） and φ （ｔ） where θ （０） and φ （０） are initial values ​​that are appropriately initialized by an arbitrary method (for example, initial values ​​that are initialized to random values, etc.).

[0043] When an abnormality is detected, the abnormality degree calculation unit 204 calculates the abnormality degree s of the abnormal object data x by the above formula (2) using the parameters θ and φ stored in the model parameter storage unit 206. θ，φ Here, θ and φ are parameters after learning a certain t-th task, for example, the parameters θ=θ after learning the t=T-th task. （Ｔ） and φ = φ （Ｔ） is.

[0044] The abnormality detection unit 205 detects the abnormality level s θ，φ Determine whether (x) exceeds a predetermined threshold γ∈R, and determine the abnormality degree s θ，φIf (x) exceeds the threshold γ, an abnormality is detected, and if not, a normality is detected.

[0045] The model parameter storage unit 206 stores the model parameters θ and φ. When learning the t=1st task, the initial value θ=θ （０） and φ = φ （０） When learning the t-th task (where t>1), the parameter θ after learning the t-1-th task is θ = θ （ｔ－１） and φ = φ （ｔ－１） On the other hand, when detecting an anomaly, the parameter θ = θ after learning a certain t-th task is （ｔ） and φ = φ （ｔ） is.

[0046] Note that the anomaly detection device 10 during learning may not have the anomaly degree calculation unit 204 and the anomaly detection unit 205. On the other hand, the anomaly detection device 10 during anomaly detection may not have the data generation unit 202 and the learning unit 203. Furthermore, the anomaly detection device 10 during learning may be called, for example, a "learning device." Furthermore, the anomaly detection device 10 during learning and the anomaly detection device 10 during anomaly detection may be realized by different devices.

[0047] <Learning Process> An example of the learning process according to this embodiment will be described below with reference to Fig. 4. Fig. 4 is a flowchart showing an example of the learning process according to this embodiment. The learning process shown in Fig. 4 is executed by the anomaly detection device 10 during learning. The learning process shown in Fig. 4 is executed sequentially for t = 1, ..., T (i.e., executed in order from t = 1 to t = T while incrementing t by 1), and when executed for a certain t, a data set D ｔ It is assumed that the data set D ｔ When a dataset D is given, ｔ' (t'ε{1, . . . , T}\{t}) cannot be used. In the following, a case where the learning process is performed for a certain tε{1, . . . , T} will be described.

[0048] The input unit 201 receives a given data set D ｔ is input (step S101).

[0049] The learning unit 203 determines whether t>1 holds (step S102).

[0050] If it is not determined that t>1 in step S102 (that is, if t=1), the learning unit 203 ｔ A learning dataset D is created as follows (step S103).

[0051] On the other hand, if it is determined in step S102 that t>1, the data generation unit 202 generates normal data and abnormal data using the method described in the above section "Data generation to prevent catastrophic forgetting" to generate a normal data set D ｔ ｎｏ and abnormal dataset D ｔ ａｎｏ and are created (step S104).

[0052] Next, the learning unit 203 uses the normal data set D created in step S104 above. ｔ ｎｏ and abnormal dataset D ｔ ａｎｏ Using this, D←D ｔ ∪D ｔ ｎｏ ∪D ｔ ａｎｏ A learning dataset D is created as follows (step S105).

[0053] Then, the learning unit 203 uses the learning data set D created in step S103 or step S105 to calculate the parameters θ stored in the model parameter storage unit 206 so as to minimize the empirical loss shown in the above equation (4). （ｔ－１） and φ （ｔ－１） (step S106). As a result, the updated parameter θ （ｔ－１） and φ （ｔ－１） is the parameter θ after learning the t-th task. （ｔ） and φ （ｔ） is obtained as:

[0054] <Anomaly Detection Processing> An example of an anomaly detection processing according to this embodiment will be described below with reference to Fig. 5. Fig. 5 is a flowchart showing an example of an anomaly detection processing according to this embodiment. In the following, a parameter θ = θ after learning a certain t-th task (for example, t = T-th task) is （ｔ） and φ = φ （ｔ） is stored in the model parameter storage unit 206.

[0055] The input unit 201 receives the given anomaly detection target data x (step S201).

[0056] Next, the abnormality degree calculation unit 204 calculates the parameter θ=θ （ｔ） and φ = φ （ｔ） Using the above formula (2), the abnormality s θ，φ (x) is calculated (step S202).

[0057] Next, the abnormality detection unit 205 calculates the abnormality degree s calculated in step S202. θ，φ It is determined whether (x) exceeds a predetermined threshold value γ (step S203).

[0058] In step S203, the abnormality level s θ，φ If it is determined that (x) exceeds the threshold value γ, the anomaly detection unit 205 detects an anomaly (step S204). At this time, the anomaly detection unit 205 may notify, for example, a terminal or the like that is communicably connected to the anomaly detection device 10 that an anomaly has been detected.

[0059] On the other hand, in step S203, the abnormality degree s θ，φ If it is determined that (x) does not exceed the threshold value γ, the anomaly detection unit 205 detects normality (step S205). At this time, the anomaly detection unit 205 may notify, for example, a terminal or the like that is communicably connected to the anomaly detection device 10 that normality has been detected.

[0060] <Summary> As described above, the anomaly detection device 10 according to this embodiment uses the sequentially provided data set D ｔWhen training the parameters of an anomaly detection model implemented by a neural network using (t = 1, ..., T), past data is generated and then used to train the parameters of the anomaly detection model. This prevents catastrophic forgetting of the neural network and enables training without degrading anomaly detection performance for past data. For example, even when training is difficult all at once due to privacy concerns or physical issues such as storage capacity, training can be performed without degrading anomaly detection performance for past data.

[0061] Therefore, the anomaly detection device 10 according to this embodiment can perform anomaly detection while sequentially updating the parameters of the anomaly detection model. That is, for example, after performing anomaly detection for a certain t-th task using the learned parameters, it is possible to learn the t+1-th or later task and perform anomaly detection again using the learned parameters.

[0062] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0063] REFERENCE SIGNS LIST 10 Anomaly detection device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Input unit 202 Data generation unit 203 Learning unit 204 Anomaly degree calculation unit 205 Anomaly detection unit 206 Model parameter storage unit

Claims

1. A learning device which is sequentially provided with a dataset consisting of input data to which a label indicating whether the data is normal or abnormal is assigned, the learning device comprising: a first data generation unit which generates first input data which is normal data from among input data included in a previously provided dataset using a decoder included in a model consisting of an encoder which takes the input data as an input and outputs a latent vector, a binary classifier which takes the input data as an input and outputs a predicted value of the label of the input data, and a decoder which takes the latent vector and the label as input and outputs a predicted value of the input data; a second data generation unit which generates second input data which is abnormal data from among input data included in a previously provided dataset using the decoder and the binary classifier included in the model; and a learning unit which updates parameters of the model using a provided dataset, the first input data, and the second input data.

2. The learning device described in claim 1, wherein the first data generation unit generates the first input data as the output of the decoder by inputting a latent vector generated from a prior distribution and a label indicating that the data is normal to the decoder.

3. The learning device described in claim 1 or 2, wherein the second data generation unit calculates a latent vector that can generate input data that is anomalous when input to the decoder together with a label indicating that the data is anomalous, and generates the second input data as the output of the decoder by inputting the calculated latent vector and the label indicating that the data is anomalous to the decoder.

4. The learning device described in claim 3, wherein the second data generation unit determines a latent vector that maximizes the sum of the expected value at which a label indicating that the data is abnormal is output when input data output when a label indicating that the data is abnormal and a latent vector are input to the decoder, and the log-likelihood of the prior distribution of the latent vector, as a latent vector that can generate input data that is abnormal when input to the decoder together with the label indicating that the data is abnormal.

5. An anomaly detection device having an anomaly degree calculation unit that uses parameters updated by the learning device described in claim 1 to calculate the degree of anomaly of input data that is to be subject to anomaly detection using the encoder, the binary classifier, and the decoder included in the model.

6. A learning method in which a computer is sequentially given a dataset consisting of input data to which a label indicating whether the data is normal or abnormal is attached, the computer executing: a first data generation step of generating first input data, which is normal data, from input data included in a previously given dataset, using a decoder included in a model consisting of an encoder that takes the input data as input and outputs a latent vector, a binary classifier that takes the input data as input and outputs a predicted value of the label of the input data, and a decoder that takes the latent vector and the label as input and outputs a predicted value of the input data; a second data generation step of generating second input data, which is abnormal data, from input data included in a previously given dataset, using the decoder and the binary classifier included in the model; and a learning step of updating parameters of the model using a given dataset, the first input data, and the second input data.

7. An anomaly detection method in which a computer executes an anomaly calculation procedure for calculating the degree of anomaly of input data that is to be subject to anomaly detection using parameters updated by the learning device described in claim 1, using the encoder, the binary classifier, and the decoder included in the model.

8. A program for causing a computer to function as the learning device according to claim 1 or the anomaly detection device according to claim 5.

Images