Anomaly detection device

Abstract

Provided is an anomaly detection device comprising: a time series data acquisition unit that acquires time series data from a plurality of sensors included in a system; a calculation unit that calculates the degree of abnormality of the sensors according to a comparison between time series segments into which the time series data acquired by the time series data acquisition unit is divided and a representative segment which is a representative point selected in advance from time series data for learning; a change detection unit that detects a change in the state of the system; and a representative segment updating unit that, according to the result of the detection by the change detection unit, uses time series data acquired after the detection of the change to update the representative segment. When the change detection unit has detected a change in the state of the system, the calculation unit compares the time series segments with the updated representative segment to calculate the degree of abnormality. With this configuration, it is possible to properly calculate the degree of abnormality even when the state of the system changes and it is possible to properly support a user in decision making.

Description

Anomaly detection device

[0001] The present invention relates to an abnormality detection device, an abnormality detection method, and a recording medium.

[0002] Techniques used to detect anomalies based on time-series data are known.

[0003] For example, Patent Document 1 describes a time series data processing device that converts a time series data set, which is a collection of multiple time series data, into a feature vector that indicates characteristics of the time series data set, thereby enabling search. Specifically, Patent Document 1 describes a time series data processing device that includes a data conversion unit, a storage unit, and a search unit. For example, the data conversion unit converts partial time series data sets, which are obtained by dividing a time series data set, which is a collection of multiple time series data, into feature vectors that indicate characteristics of the partial time series data sets. Furthermore, the storage unit stores multiple first partial time series data sets and multiple first feature vectors converted from the multiple first partial time series data sets by the data conversion unit, in association with each other. Then, the search unit selects at least one first feature vector from the multiple first feature vectors stored in the storage unit that is similar to a second feature vector converted from an input second partial time series data set by the data conversion unit, and outputs the first partial time series data set corresponding to the selected first feature vector.

[0004] Another related document is Patent Document 2. In the technology described in Patent Document 2, a small number of representative points (representative segments) are selected in advance so that the entire time-series data for learning can be explained. Then, the degree of abnormality of the sensor is calculated by calculating the difference between the time-series data to be detected and the previously selected representative segments. For example, according to Patent Document 2, the above-described process can generate information for identifying a sensor in which an abnormality has occurred.

[0005] International Publication No. 2020 / 049666 U.S. Patent No. 11,543,808

[0006] The technology described in Patent Document 2 does not take into account changes in the system state. Therefore, when the state of the system to be detected changes, an unprecedented state occurs continuously, making it difficult for the technology described in Patent Document 2 to appropriately generate information for identifying a sensor in which an abnormality has occurred. Furthermore, the technology described in Patent Document 1 does not anticipate such changes in the system state. Therefore, even if the technologies described in Patent Documents 1 and 2 are used, there is a problem in that it may be difficult to appropriately generate information for identifying a sensor in which an abnormality has occurred.

[0007] Therefore, an object of the present invention is to provide an anomaly detection device, an anomaly detection method, and a recording medium that can solve the above-mentioned problems.

[0008] In order to achieve this object, an anomaly detection device that is one embodiment of the present disclosure includes: a time series data acquisition unit that acquires time series data from a plurality of sensors included in a system; a calculation unit that calculates the degree of anomaly of a sensor by comparing time series segments obtained by dividing the time series data acquired by the time series data acquisition unit with a representative segment that is a representative point pre-selected from time series data for learning; a change detection unit that detects a change in the state of the system; and a representative segment update unit that updates the representative segment using the time series data acquired after change detection according to a detection result by the change detection unit, wherein when the change detection unit detects a change in the system state, the calculation unit compares the time series segment with the representative segment updated by the representative segment update unit to calculate the degree of anomaly.

[0009] Furthermore, an anomaly detection method according to another aspect of the present disclosure is configured such that an information processing device acquires time series data from a plurality of sensors included in a system, calculates the degree of anomaly of the sensors by comparing time series segments obtained by dividing the acquired time series data with representative segments that are representative points pre-selected from time series data for learning, and detects a change in the state of the system, updates the representative segments using the time series data acquired after the change has been detected according to the detection result, and when calculating the degree of anomaly, if a change in the system state is detected, compares the time series segments with the updated representative segments to calculate the degree of anomaly.

[0010] Furthermore, a recording medium that is another aspect of the present disclosure is a computer-readable recording medium having recorded thereon a program for causing an information processing device to acquire time series data from a plurality of sensors included in a system, calculate the degree of abnormality of the sensors by comparing time series segments into which the acquired time series data is divided with representative segments that are representative points pre-selected from time series data for learning, and detect changes in the state of the system, and update the representative segments using the time series data acquired after the change detection according to the detection results, and when calculating the degree of abnormality, if a change in the system state is detected, compare the time series segments with the updated representative segments to calculate the degree of abnormality.

[0011] According to the above-mentioned configurations, the above-mentioned problems can be solved.

[0012] FIG. 1 is a diagram for explaining an overview of a detection system according to a first embodiment of the present disclosure. FIG. 2 is a diagram showing an example of anomaly scores according to changes in system state. FIG. 3 is a block diagram showing an example of a configuration of a detection device. FIG. 4 is a diagram for explaining an example of feature extraction and conversion. FIG. 5 is a diagram for explaining an example of a representative segment. FIG. 6 is a diagram for explaining an example of anomaly detection. FIG. 7 is a diagram for explaining an example of a calculation process of a sensor anomaly degree. FIG. 8 is a diagram for explaining an example of a calculation process of a sensor anomaly degree. FIG. 9 is a flowchart showing an example of an operation of a detection device. FIG. 10 is a flowchart showing an example of an operation of a detection device. FIG. 11 is a flowchart showing an example of an operation of a detection device. FIG. 12 is a diagram for explaining an example of an effect of the present invention. FIG. 13 is a diagram showing an example of a hardware configuration of an anomaly detection device according to a second embodiment of the present disclosure. FIG. 14 is a block diagram showing an example of a configuration of an anomaly detection device. FIG. 15 is a flowchart showing an example of an operation of an anomaly detection device.

[0013] [First Embodiment] A first embodiment of the present invention will be described with reference to FIGS. 1 to 15. FIG. 1 is a diagram illustrating an overview of a detection system 100. FIG. 2 is a diagram illustrating an example of an anomaly score according to a change in system state. FIG. 3 is a block diagram illustrating an example configuration of a detection device 200. FIG. 4 is a diagram illustrating an example of feature extraction and conversion. FIG. 5 is a diagram illustrating an example of a representative segment. FIGS. 6 and 7 are diagrams illustrating an example of anomaly detection. FIGS. 8 to 10 are diagrams illustrating an example of a process for calculating a sensor anomaly level. FIGS. 11 to 14 are flowcharts illustrating an example of the operation of a detection device. FIG. 15 is a diagram illustrating an example of an effect of the present invention. Note that in this disclosure, the drawings may be associated with one or more embodiments.

[0014] In a first embodiment of the present disclosure, as illustrated in FIG. 1 , a detection system 100 that detects anomalies based on time-series data will be described. In the present disclosure, the detection system 100 detects anomalies in the system based on pre-stored information corresponding to feature quantities obtained by converting time-series data. For example, the detection system 100 calculates an anomaly score corresponding to the distance between information corresponding to feature quantities obtained by converting the time-series data to be detected and the pre-stored information. The detection system 100 then detects an anomaly in the system based on the calculated anomaly score. Furthermore, the detection system 100 outputs information for identifying a sensor in which an anomaly has occurred using a representative segment, which is a representative point that can explain the entire learning time-series data stored in advance with a small number of segments. For example, when the detection system 100 detects a system anomaly, it can output information for identifying a sensor in which an anomaly has occurred.

[0015] Furthermore, the detection system 100 described in the present disclosure detects changes in the system state, such as changes in the network configuration of a system targeted for anomaly detection. The detection system 100 then additionally stores information corresponding to the feature quantities based on the detection results. Furthermore, the detection system 100 temporarily replaces the representative segment with one corresponding to the change in the system state based on the detection results. For example, when the system state changes, such as due to a change in the network configuration, an unprecedented state will continually occur. Therefore, if no measures are taken, the calculated anomaly score may increase, resulting in continued false alarms, as illustrated in FIG. 2 . For example, referring to FIG. 2 , the system state changes around 800 on the x-axis, which represents a value according to time, and the anomaly score accordingly increases significantly. In response to this, the detection system 100 accumulates new information in response to the detected change, as described above. As a result, system anomalies can be detected using candidates that include information accumulated after the change. Similarly, because the time-series data targeted for detection is affected by changes in the system state, using a representative segment before the change in the system state may not properly output information for identifying the sensor in which an anomaly is occurring. By replacing the representative segment after detecting a change in the system state, the detection system 100 can appropriately output information for identifying the sensor in which an abnormality is occurring, even after the change in the system state.

[0016] The detection system 100 described in the present disclosure extracts features from time-series data using a model trained in advance by machine learning. For example, the detection system 100 uses time-series data for training to train a model that extracts and outputs features that preserve local distance relationships for input time-series segments, which are time-series data corresponding to a certain time window. As an example, the detection system 100 may train the model using a method such as that described in Patent Literature 1. The detection system 100 also inputs time-series segments to the trained model, extracting features obtained as the model output. The detection system 100 then stores feature information, which is information corresponding to the extracted features, in a storage device. For example, the detection system 100 may store binary code converted from the features as feature information in a storage device.

[0017] Furthermore, after a change in the system state, it is desirable to adapt the model to the situation after the system state change. However, immediately after the system state change, there is not enough time-series data for training that is necessary to adapt the model used to extract features to the situation after the system state change. Therefore, even after the system state change, the detection system 100 provisionally extracts features using the model trained before the system state change. Furthermore, if it is determined that a sufficient number of time-series segments to be used as training data have been obtained after the system state change, the detection system 100 performs re-training using the time-series segments after the system state change as training data so that the model used to extract features adapts to the situation after the system state change. In other words, the detection system 100 performs model adaptation. For example, the detection system 100 can perform re-training by using the time-series segments after the system state change as training data and updating the weight parameters of the model. Furthermore, the detection system 100 replaces the feature information temporarily added to the storage device using the re-trained, adapted model. That is, the detection system 100 can replace the feature information provisionally extracted using the model trained before the system state change with feature information extracted using the adapted model. Furthermore, as described above, sufficient training data exists at the stage of adapting the model. Therefore, the detection system 100 can adapt the model and replace the representative segment again.

[0018] FIG. 1 shows an overview of a detection system 100. Referring to FIG. 1, the detection system 100 includes a detection device 200, which is an information processing device that performs anomaly detection using a search technique. As shown in FIG. 1, the detection device 200 can acquire time-series data from various sensors and other external devices. For example, the time-series data may be numerical data, such as observation data measured by various sensors at predetermined intervals, arranged in order of measurement time.

[0019] The detection device 200 detects an abnormality in the system using a binary code converted from the time-series segments, and outputs information for identifying a sensor in which an abnormality has occurred using the representative segment. Fig. 3 shows an example configuration of the detection device 200. Referring to Fig. 3, the detection device 200 has, as main components, for example, an operation input unit 210, a screen display unit 220, a communication I / F unit 230, a storage unit 240, and an arithmetic processing unit 250.

[0020] 3 illustrates an example in which the functions of the detection device 200 are realized using one information processing device. However, at least some of the functions of the detection device 200 may be realized using multiple information processing devices, for example, on the cloud. Furthermore, the detection device 200 may not include some of the components illustrated above, such as not having the operation input unit 210 or the screen display unit 220, or may have a configuration other than those illustrated above.

[0021] The operation input unit 210 is made up of operation input devices such as a keyboard, a mouse, etc. The operation input unit 210 detects operations of the operator who operates the detection device 200 and outputs the operations to the arithmetic processing unit 250.

[0022] The screen display unit 220 is composed of a screen display device such as a liquid crystal display, an organic electroluminescence (EL) display, etc. The screen display unit 220 can display various information stored in the storage unit 240 on the screen in response to instructions from the arithmetic processing unit 250.

[0023] The communication I / F unit 230 includes a data communication circuit, etc. The communication I / F unit 230 performs data communication with various sensors and other external devices connected via communication lines.

[0024] The storage unit 240 is a storage device such as a hard disk or memory. The storage unit 240 stores processing information and a program 245 required for various processes in the arithmetic processing unit 250. The program 245 is read into the arithmetic processing unit 250 and executed to realize various processing units. The program 245 is read in advance from an external device or recording medium via a data input / output function such as the communication I / F unit 230, and is stored in the storage unit 240. Main information stored in the storage unit 240 includes, for example, model information 241, feature amount information 242, time-series data information 243, and representative segment information 244.

[0025] The model information 241 includes information about a model that extracts and outputs features that preserve local distance relationships for input time series segments. For example, the model information 241 may include weight parameters included in the trained model described above. For example, the model included in the model information 241 is trained in advance using training time series data (time series segments) inside or outside the detection device 200 and stored in the storage unit 240. Furthermore, the model information 241 is updated by the adaptation unit 260 when, for example, the adaptation unit 260 determines that a sufficient number of time series segments to be used as training data has been obtained after detecting a system state change through processing described below.

[0026] The model included in the model information 241 may be any model capable of handling time-series data. For example, the model may be one of a 1D-CNN (1-Dimensional-Convolutional Neural Network), a GRU (Gated Recurrent Unit), a LSTM (Long Short-Term Memory), a Transformer, etc. Furthermore, the loss function used as the model training criterion may be any function that preserves the local similarity between data in the input space. For example, the loss function may be one of triplet loss, pairwise loss, contrastive loss, etc. As an example, the model included in the model information 241 may be trained using a method such as that described in Patent Document 1. For example, Patent Document 1 discloses an example of model training using triplet loss or pairwise loss.

[0027] The feature amount information 242 includes feature amount information corresponding to feature amounts extracted from the time-series segments. For example, the feature amount information 242 includes, as feature amount information, binary code obtained by converting feature amounts using an arbitrary method. For example, the binary code included in the feature amount information 242 is obtained in advance using an arbitrary method, such as obtaining it from an external device via the communication I / F unit 230 or converting feature amounts extracted by the feature amount extraction unit 252 using the binary code conversion unit 253, and is then stored in the storage unit 240.

[0028] Furthermore, the feature amount information 242 additionally stores binary codes converted by the binary code conversion unit 253 in accordance with the detection result by the change detection unit 255 (described later). In other words, the feature amount information 242 stores binary codes converted from features extracted from time-series segments after a change in the system state. Here, when the change detection unit 255 detects a change, the binary codes converted by the binary code conversion unit 253 from features extracted by the feature extraction unit 252 using the model before adaptation by the adaptation unit 260 are provisionally stored as the feature amount information 242. Furthermore, after the adaptation unit 260 updates the model, the provisionally stored binary codes are replaced with binary codes corresponding to the adapted model by the update unit 261 (described later).

[0029] The time-series data information 243 includes one or more pieces of time-series data acquired by one or more sensors, etc. Here, the time-series data may be data in which numerical data such as observation data measured by a sensor at a predetermined interval is arranged in order of measurement time. For example, the time-series data information 243 is updated in response to the acquisition of time-series data by a time-series data acquisition unit 251 (described later) from a sensor or other external device, etc.

[0030] The representative segment information 244 includes representative segments selected by the representative segment selection unit 254, which will be described later. Here, a representative segment refers to a time-series segment that can explain the entire time-series data for learning with a small number of segments. For example, the representative segment information 244 is obtained in advance by obtaining it from an external device via the communication I / F unit 230, or by the representative segment selection unit 254 selecting a representative segment from the time-series data for learning, and is stored in the storage unit 240.

[0031] Furthermore, the information included in the representative segment information 244 is provisionally updated according to the detection result by the change detection unit 255. In other words, after a change in the system state, the representative segment information 244 includes the representative segment selected by the representative segment selection unit 254 from the time-series data acquired after the change in the system state. Furthermore, the provisionally updated representative segment can be updated again when the adaptation unit 260 updates the model, for example.

[0032] The arithmetic processing unit 250 includes an arithmetic device such as a CPU (Central Processing Unit) and its peripheral circuits. The arithmetic processing unit 250 reads and executes a program 245 from the storage unit 240, thereby causing the hardware and the program 245 to work together to implement various processing functions. Major processing units implemented by the arithmetic processing unit 250 include, for example, a time-series data acquisition unit 251, a feature extraction unit 252, a binary code conversion unit 253, a representative segment selection unit 254, a change detection unit 255, a storage unit 256, a representative segment update unit 257, a system anomaly detection unit 258, a sensor anomaly degree calculation unit 259, an adaptation unit 260, an update unit 261, and an output unit 262.

[0033] In addition, the arithmetic processing unit 250 may have a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination of these, instead of the above-mentioned CPU.

[0034] The time-series data acquisition unit 251 acquires time-series data from various sensors included in the detection system 100 and other external devices. For example, the time-series data acquisition unit 251 can acquire, as time-series data, biological data acquired by a sensor owned by a user in a healthcare-related system. The time-series data acquisition unit 251 may acquire any time-series data from an optical performance monitor that measures an optical signal-to-noise ratio (OSNR), an optical transponder, or the like, or may acquire time-series data from multiple sensors installed in a plant, a data center, a social infrastructure facility, or the like.

[0035] The feature extraction unit 252 inputs the time series segments into a model stored as the model information 241, thereby extracting features corresponding to the time series segments. For example, as illustrated in FIG. 4 , the feature extraction unit 252 divides the time series data acquired by the time series data acquisition unit 251 into multiple time series segments using a time window of a certain period. Then, the feature extraction unit 252 inputs each divided time series segment into a trained model, thereby extracting features. Note that the feature extraction unit 252 may divide the time series data into the time series segments using any method. For example, the size of the time window may be set arbitrarily. Furthermore, the feature extraction unit 252 may divide the time series data into multiple time series segments so that they overlap for an arbitrary period, or may divide the time series data into multiple time series segments so that the time series segments do not overlap.

[0036] For example, the feature extraction unit 252 can extract feature amounts when detecting an anomaly, etc. Furthermore, the feature amounts extracted by the feature extraction unit 252 can be used when additional storage is performed on the feature amount information 242 after the change detection unit 255 detects a change in the system state. For example, after detecting a change in the system state, the feature amounts extracted by the feature extraction unit 252 may be used both when detecting an anomaly and when additional storage is performed on the feature amount information 242.

[0037] As described above, the feature extraction unit 252 extracts features using a model stored as the model information 241. Therefore, before the adaptation unit 260 updates the weight parameters and the like, the feature extraction unit 252 extracts features using a model before adaptation to the change in the system state. In other words, even after the change in the system state, the feature extraction unit 252 extracts features using the model learned before the change in the system state until the adaptation unit 260 updates the model. Furthermore, once the adaptation unit 260 updates the model, the feature extraction unit 252 thereafter extracts features using the model that has been adapted to the change in the system state. Furthermore, after the adaptation unit 260 updates the model, the feature extraction unit 252 can again extract features using the adapted model for the time series segment after the change in the system state is detected. In other words, for the time series segments acquired after a change in the system state is detected and before the adaptation unit 260 completes updating, the feature extraction unit 252 can extract features using the pre-adaptation model as well as extract features using the adapted model.

[0038] The binary code conversion unit 253 converts the feature quantities extracted by the feature quantity extraction unit 252 into binary code, which is information corresponding to the feature quantities. In the present disclosure, the method of conversion into binary code is not particularly limited. The binary code conversion unit 253 may convert the feature quantities extracted by the feature quantity extraction unit 252 into binary code using any method.

[0039] 5, the representative segment selection unit 254 selects, from the learning time-series data, representative segments that are representative points that can explain the entire learning time-series data with a small number of segments. The representative segment selection unit 254 also stores the selected representative segments in the storage unit 240 as representative segment information 244.

[0040] The representative segment selection unit 254 may select a representative point using any method capable of selecting a representative point that can explain the entire training time-series data with a small number of elements. For example, the representative segment selection unit 254 outputs a short binary code from each time-series segment into which the training time-series data is divided. The representative segment selection unit 254 may then select a representative point from a cluster of time-series segments that share the same short binary code. The representative segment selection unit 254 may select the time-series segment closest to the center (e.g., the center of gravity) of the cluster as the representative segment, which is the representative point.

[0041] For example, as described above, the representative segment selection unit 254 divides the time-series segments into a plurality of clusters and selects a representative segment from each cluster. The representative segment selection unit 254 may select a representative segment using a method other than the above-described methods.

[0042] The change detection unit 255 detects a change in the system state. The change detection unit 255 may detect a change in the system state using any means.

[0043] For example, the change detection unit 255 acquires domain knowledge, such as operation information of the system that is the target of anomaly detection, from an external device, etc. Then, the change detection unit 255 detects changes in the system state, such as changes in the network configuration, based on the acquired domain knowledge. The change detection unit 255 may also detect changes in the system state based on time-series data acquired by the time-series data acquisition unit 251, etc. For example, the change detection unit 255 may detect a change in the system state when it detects a fluctuation in the distribution of the time-series data using any statistical method, etc.

[0044] For example, in a healthcare setting, a user's behavioral pattern may change, such as by incorporating regular exercise, after undergoing medical examinations, various advice, or hospitalization. Furthermore, the pattern of vital data, which is acquired time-series data, may change in response to changes in behavioral patterns. For example, the change detection unit 255 may be configured to detect such changes in behavioral patterns and vital patterns as changes in the system state. Furthermore, changes in vital patterns may occur depending on the content of the user's activities, such as sleeping, working, and eating. The change detection unit 255 may be configured to detect such changes in behavioral content as changes in the system state.

[0045] Furthermore, the change detection unit 255 may detect a change in the system state using domain knowledge or a statistical method when, for example, the network configuration of the optical network changes. The change detection unit 255 may detect a change in the system state by detecting a change in equipment installed in a plant or other environmental changes using domain knowledge or a statistical method. In this way, the change detection unit 255 may detect any state change as a change in the system state, in addition to a change in the network configuration.

[0046] In response to the detection of a change in the system state by the change detection unit 255 , the storage unit 256 stores the binary code converted by the binary code conversion unit 253 as feature amount information 242 in the memory unit 240 .

[0047] For example, the storage unit 256 does not store the binary code converted by the binary code conversion unit 253 until the change detection unit 255 detects a change in the system state. On the other hand, when the change detection unit 255 detects a change in the system state, the storage unit 256 stores the binary code converted by the binary code conversion unit 253 in the memory unit 240 as feature information 242. Note that the binary code added by the storage unit 256 at this stage is subject to updating by the update unit 261, which will be described later. Therefore, it can be said that the storage unit 256 provisionally stores the binary code as the feature information 242 in the memory unit 240. Furthermore, after the model adaptation by the adaptation unit 260, the storage unit 256 can additionally store in the memory unit 240, as the feature information 242, the binary code obtained by converting the feature extracted using the model after adaptation of the change in the system state.

[0048] The storage unit 256 may terminate the additional storage process based on any criteria. For example, the storage unit 256 may terminate the additional storage of binary code when it is determined that a predetermined number of additional storages have been performed after detecting a change in the system state.

[0049] The representative segment update unit 257 updates the representative segment stored in the storage unit 240 as the representative segment information 244 in response to the detection of a change in the system state by the change detection unit 255 .

[0050] For example, in response to detection of a system state change by the change detection unit 255, the representative segment update unit 257 provisionally replaces the representative segment stored in the storage unit 240 as the representative segment information 244 with the representative segment selected after the detection of the system state change. The representative segment update unit 257 may select a representative segment from the time-series data acquired after the detection of the system state change using a method similar to that used by the representative segment selection unit 254. Note that immediately after a system state change, the amount of time-series data acquired after the change detection is small. Therefore, the representative segment update unit 257 may select, as the representative segment, all of the time-series segments obtained by dividing the time-series data acquired after the detection of the system state change, or some of the time-series segments extracted using any method from the divided time-series segments.

[0051] Furthermore, after the change detection unit 255 detects a change in the system state, if the representative segment update unit 257 determines that sufficient time-series data has been acquired, it can select a representative segment from the acquired time-series data and thereby re-replace the provisionally replaced representative segment. For example, the representative segment update unit 257 can re-replace the representative segment if the adaptation unit 260 determines to perform model adaptation. The representative segment update unit 257 may also determine whether to re-replace the representative segment depending on whether any condition other than those exemplified above is satisfied.

[0052] The system anomaly detection unit 258 calculates an anomaly score based on the feature amount extracted from the time-series segment to be detected, and detects a system anomaly based on the calculated result. That is, the system anomaly detection unit 258 has a function as a calculation unit that calculates the anomaly score and a function as a detection unit that detects a system anomaly based on the calculated result.

[0053] For example, the system anomaly detection unit 258 acquires, from the binary code conversion unit 253, a binary code corresponding to a feature extracted from a time-series segment to be detected. Then, the system anomaly detection unit 258 searches the feature information 242 for a binary code similar to the acquired binary code. In the present disclosure, the system anomaly detection unit 258 may perform the search using any method. For example, the system anomaly detection unit 258 calculates the distance between the acquired binary code and each binary code included in the feature information 242. Then, the system anomaly detection unit 258 acquires, as a binary code similar to the acquired binary code, a binary code that satisfies any condition, such as a binary code with the smallest calculated distance, from among the binary codes included in the feature information 242.

[0054] The system anomaly detection unit 258 also calculates an anomaly score according to the distance between the acquired binary code and the binary code searched for in the storage unit 240. The system anomaly detection unit 258 then detects an anomaly based on the calculated anomaly score. For example, the system anomaly detection unit 258 compares the calculated anomaly score with a predetermined threshold. The system anomaly detection unit 258 then detects an anomaly when the calculated anomaly score exceeds the threshold. In this manner, the system anomaly detection unit 258 calculates an anomaly score and detects a system anomaly based on the calculated anomaly score. The system anomaly detection unit 258 may calculate the anomaly score using any method. For example, the system anomaly detection unit 258 may calculate the anomaly score so that the longer the distance between the binary codes, the larger the anomaly score. When calculating the anomaly score in this manner, a larger anomaly score indicates a higher likelihood of an anomaly occurring. The threshold used for comparing the anomaly score may be determined using any method.

[0055] The search target, etc., when the system anomaly detection unit 258 detects an anomaly changes depending on various processes, such as the detection of a system state change by the change detection unit 255, the model adaptation by the adaptation unit 260, and the replacement by the update unit 261. For example, as illustrated in FIG. 6 , before the change detection unit 255 detects a system state change, the system anomaly detection unit 258 detects a system anomaly based on binary code obtained by converting feature quantities extracted using the pre-adaptation model and pre-stored feature quantity information 242. After the change detection unit 255 detects a system state change, the system anomaly detection unit 258 detects a system anomaly based on binary code obtained by converting feature quantities extracted using the pre-adaptation model and feature quantity information 242 in which the binary code has been additionally stored by the storage unit 256. In this case, it is desirable for the system anomaly detection unit 258 to perform anomaly detection before the storage unit 256 additionally stores the binary code itself to be detected. Furthermore, when the adaptation unit 260 performs model adaptation, the update unit 261 replaces the binary code that was temporarily added. As a result, the system anomaly detection unit 258 performs anomaly detection based on the feature amount information 242 in which the provisionally added binary code has been replaced, as illustrated in FIG.

[0056] The sensor anomaly degree calculation unit 259 calculates the degree of anomaly for each sensor according to the comparison result between the time-series segment to be detected and the representative segment included in the representative segment information 244. Then, the sensor anomaly degree calculation unit 259 generates ranking information, which is information for identifying a sensor in which an abnormality has occurred, according to the calculation result. In other words, the sensor anomaly degree calculation unit 259 has a function as an anomaly degree calculation unit that calculates the degree of anomaly and a function as a generation unit that generates ranking information based on the calculation result.

[0057] 8 , for example, the sensor anomaly degree calculation unit 259 calculates the absolute difference between the value of each sensor included in the time-series segment to be detected and the value of each sensor included in the representative segment. For example, the sensor anomaly degree calculation unit 259 executes a process of calculating the absolute difference for each representative segment included in the representative segment information 244. Thereafter, the sensor anomaly degree calculation unit 259 identifies the minimum value of the absolute differences calculated for each sensor. Then, the sensor anomaly degree calculation unit 259 sets the identified minimum value as the sensor anomaly degree. For example, as described above, the sensor anomaly degree calculation unit 259 calculates the anomaly degree for each sensor based on the result of comparing the time-series segment to be detected with the representative segment.

[0058] Furthermore, the sensor anomaly degree calculation unit 259 generates information for identifying a sensor in which an abnormality has occurred, according to the calculated abnormality degree. For example, the sensor anomaly degree calculation unit 259 generates ranking information, which is information for identifying a sensor in which an abnormality has occurred, by listing the calculated abnormality degrees in descending order of value. Note that the information for identifying a sensor in which an abnormality has occurred may be the abnormality degree itself calculated by the sensor anomaly degree calculation unit 259.

[0059] As with the system anomaly detection unit 258, the representative segment that the sensor anomaly degree calculation unit 259 compares changes depending on, for example, before and after the change detection unit 255 detects a change in the system state. For example, as illustrated in FIG. 9 , before the change detection unit 255 detects a change in the system state, the sensor anomaly degree calculation unit 259 calculates the degree of anomaly by comparing the sensor with the representative segment selected in advance by the representative segment selection unit 254. After the change detection unit 255 detects a change in the system state, the sensor anomaly degree calculation unit 259 calculates the degree of anomaly by comparing the sensor with the representative segment that has been provisionally updated by the representative segment update unit 257. After the change detection unit 255 detects a change in the system state, if sufficient time-series data has been acquired, the sensor anomaly degree calculation unit 259 calculates the degree of anomaly by comparing the sensor with the representative segment that has been replaced again by the representative segment update unit 257, as shown in FIG. 10 .

[0060] Furthermore, the sensor anomaly degree calculation unit 259 may be configured to calculate the degree of anomaly and generate information in accordance with any condition. For example, the sensor anomaly degree calculation unit 259 may be configured to calculate the degree of anomaly on the condition that the system anomaly detection unit 258 detects a system anomaly. The sensor anomaly degree calculation unit 259 may calculate the degree of anomaly regardless of the processing of the system anomaly detection unit 258.

[0061] The adaptation unit 260 checks whether the conditions for performing model adaptation are met. Then, the adaptation unit 260 performs model adaptation according to the check result. For example, as a condition for performing model adaptation, the adaptation unit 260 checks whether a sufficient number of time-series segments to be used as learning data have been obtained after the system state change. Then, when it is determined that a sufficient number of time-series segments have been obtained after the system state change, the adaptation unit 260 performs model adaptation by updating the model information 241.

[0062] The adaptation unit 260 can perform model adaptation by updating the weight parameters of the model using the time-series segments acquired after detecting a change in the system state as learning data. The adaptation unit 260 may update the weight parameters using a learning criterion based on a distance learning loss using a triplet loss, a pairwise loss, or the like, as described in Patent Document 1.

[0063] The adaptation unit 260 may check whether the conditions for performing model adaptation are satisfied using any method. For example, the criteria for whether a sufficient number of time-series segments to be used as learning data have been obtained may be set arbitrarily. The adaptation unit 260 may check whether the conditions for performing model adaptation are satisfied at any timing, such as by performing the above check at predetermined intervals after the change detection unit 255 detects a change in the system state.

[0064] The update unit 261 replaces the binary code that was provisionally added after the adaptation unit 260 has adapted the model. For example, after the adaptation unit 260 has adapted the model, the update unit 261 acquires binary code corresponding to the adapted model from the binary code conversion unit 253. In response to this, the update unit 261 replaces the binary code that was provisionally added and stored as the feature amount information 242 with the acquired binary code.

[0065] The output unit 262 outputs the detection result by the system anomaly detection unit 258, the degree of anomaly calculated by the sensor anomaly degree calculation unit 259, the generated ranking information, etc. For example, the output unit 262 may transmit the detection result, the ranking information, etc. to an external device via the communication I / F unit 230, or may display the detection result, the ranking information, etc. on the screen display unit 220, etc.

[0066] The above is an example of the configuration of the detection device 200. Next, an example of the operation of the detection device 200 will be described with reference to Figs.

[0067] 11 is a flowchart showing an example of the operation of the detection device 200 when the system state changes. Referring to FIG. 11 , the change detection unit 255 detects a change in the system state (step S101). For example, the change detection unit 255 detects a change in the system state, such as a change in the network configuration, based on domain knowledge, such as operation information of the system that is the target of anomaly detection. The change detection unit 255 may also detect a change in the system state based on time-series data acquired by the time-series data acquisition unit 251.

[0068] When a change in the system state is detected (step S101, Yes), the storage unit 256 starts additional storage of binary code (step S102). The representative segment update unit 257 starts updating the representative segment (step S103). Note that the processing of step S102 and the processing of step S103 may be executed either first or simultaneously.

[0069] On the other hand, if a change in the system state cannot be detected (No at step S101), the storage unit 256 does not perform the process at step S102.

[0070] The above is an example of the operation of the detection device 200 when the system state changes. Next, an example of the operation of the detection device 200 when performing model adaptation will be described with reference to FIG.

[0071] 12 is a flowchart showing an example of the operation of the detection device 200 when performing model adaptation. Referring to FIG. 12, the adaptation unit 260 checks whether a condition for performing model adaptation is satisfied (step S201). For example, the adaptation unit 260 checks, as a condition for performing model adaptation, whether a sufficient number of time-series segments to be used as learning data after a system state change has been obtained.

[0072] If it is confirmed that the condition is satisfied (Yes in step S201), the adaptation unit 260 performs model adaptation (step S202). For example, the adaptation unit 260 can perform model adaptation by updating the weight parameters of the model using the time-series segments acquired after detecting a change in the system state as learning data.

[0073] After the process of step S202, the update unit 261 replaces the binary code that was temporarily added (step S203). For example, after the process of step S202, the update unit 261 acquires binary code corresponding to the adapted model from the binary code conversion unit 253. In response to this, the update unit 261 replaces the binary code that was temporarily added and stored as the feature amount information 242 with the acquired binary code.

[0074] Furthermore, the representative segment update unit 257 can update the provisionally updated representative segment again (step S204). The process of step S204 may be executed before the processes of steps S202 and S203, or may be executed simultaneously with these processes.

[0075] On the other hand, if the condition is not satisfied (No at step S201), the processes from step S202 onwards are not performed.

[0076] The above is an example of the operation of the detection device 200 when performing model adaptation. Next, an example of the operation of the detection device 200 when performing anomaly detection will be described with reference to FIG.

[0077] 13 is a flowchart showing an example of the operation of the detection device 200 when performing anomaly detection. Referring to Fig. 13, the feature extraction unit 252 extracts features by inputting a time-series segment to be detected to a model stored as model information 241. Furthermore, the binary code conversion unit 253 converts the features extracted by the feature extraction unit 252 into binary code, which is information corresponding to the features (step S301).

[0078] The system anomaly detection unit 258 detects a system anomaly based on feature amounts extracted from the time-series segment to be detected. For example, the system anomaly detection unit 258 acquires binary codes corresponding to the feature amounts extracted from the time-series segment to be detected from the binary code conversion unit 253 (step S302). The system anomaly detection unit 258 also calculates the distance between the acquired binary code and each binary code included in the feature amount information 242. The system anomaly detection unit 258 then acquires, as a binary code similar to the acquired binary code, a binary code that satisfies an arbitrary condition, such as a binary code with the smallest calculated distance, from among the binary codes included in the feature amount information 242.

[0079] The system anomaly detection unit 258 also calculates an anomaly score according to the distance between the acquired binary code and the binary code searched for in the storage device (step S303). The system anomaly detection unit 258 may calculate the anomaly score using any method.

[0080] If the calculated anomaly score exceeds a predetermined threshold (Yes at step S304), the system anomaly detection unit 258 detects an anomaly in the system (step S305). On the other hand, if the calculated anomaly score is equal to or less than the threshold, the system anomaly detection unit 258 does not detect an anomaly in the system.

[0081] The above is an example of the operation of the detection device 200 when detecting an anomaly. Note that the search target when the system anomaly detection unit 258 detects a system anomaly changes depending on various processes such as the detection of a change in the system state by the change detection unit 255, the model adaptation by the adaptation unit 260, and the replacement by the update unit 261.

[0082] Next, an example of the operation of the detection device 200 when generating information for identifying a sensor in which an abnormality has occurred will be described with reference to Fig. 14. Fig. 14 is a flowchart showing an example of the operation of the detection device 200 when generating information for identifying a sensor in which an abnormality has occurred. Referring to Fig. 14, the sensor abnormality degree calculation unit 259 calculates the absolute difference between the values ​​of each sensor included in the representative segment and those of each sensor included in the time-series segment to be detected (step S401).

[0083] The sensor abnormality degree calculation unit 259 also identifies the minimum value among the absolute differences calculated for each sensor (step S402), and sets the identified minimum value as the abnormality degree of the sensor.

[0084] Furthermore, the sensor anomaly degree calculation unit 259 generates information for identifying a sensor in which an abnormality has occurred, based on the calculated abnormality degree. For example, the sensor anomaly degree calculation unit 259 generates ranking information, which is information for identifying a sensor in which an abnormality has occurred, by listing the calculated abnormality degrees in descending order (step S403).

[0085] The above is an example of the operation of the detection device 200 when generating information for identifying a sensor in which an abnormality has occurred. Note that the representative segment changes in response to the detection of a change in the system state by the change detection unit 255, etc.

[0086] As described above, the detection device 200 includes the change detection unit 255, the storage unit 256, and the system anomaly detection unit 258. With this configuration, the storage unit 256 can additionally store binary code in response to a change in the system state detected by the change detection unit 255. As a result, the system anomaly detection unit 258 can perform a search that includes the additionally stored results and detect an anomaly. In other words, with the above configuration, it is possible to search for binary code based on the time-series data after the change and detect an anomaly based on the search results. This makes it possible to suppress an increase in the anomaly score even when the system state changes.

[0087] For example, FIG. 15 shows an example of anomaly score calculation when additional binary code is stored. In the example shown in FIG. 15, the anomaly score is calculated using the results of additional storage from around 900 on the x-axis. As shown in FIG. 15, it can be seen that additional storage of binary code reduces the anomaly score value compared to the example shown in FIG. 2. Note that in the example shown in FIG. 15, for the sake of explanation, there is a period between 800 and 900 on the x-axis during which the anomaly score is not calculated. However, the detection device 200 may continue to calculate the anomaly score while starting additional storage of binary code. As shown in the example shown in FIG. 15, the detection device 200 may be configured to resume calculation of the anomaly score after a predetermined number of additional storages have been performed.

[0088] The detection device 200 also includes an adaptation unit 260 and an update unit 261. With this configuration, the update unit 261 replaces the temporarily added binary code after the adaptation unit 260 has performed model adaptation. As a result, the system anomaly detection unit 258 can perform more appropriate anomaly detection using the results of the model adaptation. In other words, with the above configuration, the temporary additional storage by the storage unit 256 temporarily suppresses an increase in the anomaly score, while allowing for appropriate anomaly detection.

[0089] The detection device 200 also includes a change detection unit 255, a representative segment update unit 257, and a sensor anomaly degree calculation unit 259. With this configuration, the representative segment update unit 257 can update the representative segment in response to a change in the system state detected by the change detection unit 255. As a result, the sensor anomaly degree calculation unit 259 can calculate the anomaly degree and generate ranking information using the updated representative segment. This makes it possible to appropriately calculate the anomaly degree even when the system state changes.

[0090] Furthermore, when the representative segment update unit 257 determines that sufficient time-series data has been acquired, it can select a representative segment from the acquired time-series data and thereby replace the provisionally replaced representative segment again. With this configuration, it is possible to more appropriately calculate the degree of anomaly, etc.

[0091] The detection device 200 described in the present disclosure can be utilized, for example, in healthcare settings. As described above, in healthcare settings, a user's behavioral pattern may change, such as by incorporating regular exercise, after undergoing medical examinations, receiving various advice, or undergoing hospitalization. Furthermore, the pattern of vital sign data, which is acquired time-series data, may change depending on the change in behavioral pattern. As described above, the detection device 200 described in the present disclosure can appropriately calculate anomaly levels and appropriately generate ranking information, which is information for identifying sensors experiencing anomalies, even when the system state changes as described above. As a result, it is possible to appropriately support the decision-making of users, such as patients. When the detection device 200 is used in healthcare settings, the acquired time-series data may be, for example, biometric data such as heart rate and blood pressure. The time-series data may also include time-series data input using the operation input unit 210, such as meal content and meal times.

[0092] Second Embodiment Next, a second embodiment of the present disclosure will be described with reference to Fig. 16 to Fig. 18. Fig. 16 is a diagram illustrating an example of the hardware configuration of an anomaly detection device 300. Fig. 17 is a block diagram illustrating an example of the configuration of the anomaly detection device 300. Fig. 18 is a flowchart illustrating an example of the operation of the anomaly detection device 300.

[0093] In a second embodiment of the present disclosure, an anomaly detection device 300 that calculates the degree of anomaly of a sensor based on time-series data acquired from one or more sensors will be described. Fig. 16 shows an example hardware configuration of the anomaly detection device 300. Referring to Fig. 16, the anomaly detection device 300 has, as an example, the following hardware configuration: - CPU (Central Processing Unit) 301 (arithmetic unit) - ROM (Read Only Memory) 302 (storage device) - RAM (Random Access Memory) 303 (storage device) - Programs 304 loaded into RAM 303 - Storage device 305 that stores the programs 304 - Drive device 306 that reads and writes from / to a storage medium 310 external to the information processing device - Communication interface 307 that connects to a communication network 311 external to the information processing device - Input / output interface 308 that inputs and outputs data - Bus 309 that connects the various components

[0094] 17 . The program group 304 is stored in advance in the storage device 305 or the ROM 302, for example, and is loaded into the RAM 303 or the like and executed by the CPU 301 as needed. The program group 304 may be supplied to the CPU 301 via the communication network 311, or may be stored in advance in the recording medium 310, and the drive device 306 may read out the program and supply it to the CPU 301.

[0095] 16 shows an example of the hardware configuration of the anomaly detection device 300. The hardware configuration of the anomaly detection device 300 is not limited to the above-described case. For example, the anomaly detection device 300 may be configured with only a part of the above-described configuration, such as excluding the drive device 306. Furthermore, the CPU 301 may be a GPU or the like exemplified in the first embodiment.

[0096] The time-series data acquisition unit 321 acquires time-series data from a plurality of sensors included in the system.

[0097] The change detection unit 323 detects changes in the state of the system.

[0098] The representative segment update unit 324 updates the representative segment according to the detection result by the change detection unit 323 using the time-series data acquired after the change detection.

[0099] The calculation unit 322 calculates the degree of abnormality of a sensor by comparing time series segments obtained by dividing the time series data acquired by the time series data acquisition unit 321 with a representative segment, which is a representative point selected in advance from the time series data for learning. For example, the calculation unit 322 can calculate the degree of abnormality of each sensor included in the system. Furthermore, when the change detection unit 324 detects a change in the system state, the calculation unit 322 can compare the time series segment with the representative segment updated by the representative segment update unit 324 to calculate the degree of abnormality.

[0100] The above is an example of the configuration of the anomaly detection device 300. Next, an example of the operation of the anomaly detection device 300 will be described with reference to FIG.

[0101] Fig. 18 is a flowchart showing an example of the operation of the anomaly detection device 300. Referring to Fig. 18, the change detection unit 323 detects a change in the state of the system (step S501).

[0102] In response to the detection result by the change detection unit 323, the representative segment update unit 324 updates the representative segment using the time-series data acquired after the change detection (step S502).

[0103] The calculation unit 322 compares the time-series segment with the representative segment updated by the representative segment update unit 324 to calculate the degree of abnormality (step S503).

[0104] The above is an example of the operation of the anomaly detection device 300.

[0105] As described above, the anomaly detection device 300 includes the calculation unit 322, the change detection unit 323, and the representative segment update unit 324. With this configuration, when the change detection unit 324 detects a change in the system state, the calculation unit 322 can calculate the degree of anomaly using the representative segment updated by the representative segment update unit 324. As a result, the anomaly detection device 300 can appropriately calculate the degree of anomaly even when the system state changes.

[0106] The above-described anomaly detection device 300 can be realized by incorporating a predetermined program into an information processing device such as the anomaly detection device 300. Specifically, a program according to another aspect of the present invention is a program for causing an information processing device such as the anomaly detection device 300 to acquire time-series data from a plurality of sensors included in a system, calculate an anomaly level of the sensors by comparing time-series segments obtained by dividing the acquired time-series data with representative segments that are representative points pre-selected from time-series data for learning, detect a change in the state of the system, update the representative segments using the time-series data acquired after the change detection according to the detection result, and, when calculating the anomaly level, if a change in the system state is detected, compare the time-series segments with the updated representative segments to calculate the anomaly level.

[0107] Furthermore, an anomaly detection method executed by an information processing device such as the above-described anomaly detection device 300 is a method in which the information processing device detects a change in the state of an anomaly detection target, acquires feature amount information based on time-series data of the anomaly detection target, acquires feature amount information based on the time-series data after change detection based on the acquired feature amount information, and outputs anomaly information regarding an anomaly based on the feature amount information based on the time-series data after change detection and the feature amount information based on the time-series data of the anomaly detection target.

[0108] Even if the invention is a program having the above-described configuration, or a computer-readable recording medium having the program recorded thereon, or an anomaly detection method, it can achieve the same functions and effects as the above-described anomaly detection device 300, and therefore can achieve the above-described objective of the present disclosure.

[0109] <Supplementary Notes> Part or all of the above-described embodiments can be described as follows: An overview of the anomaly detection device and the like according to the present invention will be described below. However, the present invention is not limited to the following configuration.

[0110] (Supplementary Note 1) An anomaly detection device comprising: a time-series data acquisition unit that acquires time-series data from a plurality of sensors included in a system; a calculation unit that calculates an anomaly degree of a sensor by comparing time-series segments obtained by dividing the time-series data acquired by the time-series data acquisition unit with a representative segment that is a representative point selected in advance from time-series data for learning; a change detection unit that detects a change in the state of the system; and a representative segment update unit that updates the representative segment using time-series data acquired after the change detection according to the detection result by the change detection unit, wherein when the change detection unit detects a change in the system state, the calculation unit calculates the anomaly degree by comparing the time-series segment with the representative segment updated by the representative segment update unit. (Supplementary Note 2) An anomaly detection device according to Supplementary Note 1, wherein, after updating the representative segment according to the detection result by the change detection unit, if it determines that sufficient time-series data has been acquired after the change in the system state, the representative segment update unit replaces the updated representative segment again by selecting a representative segment from the time-series data acquired after the change in the system state. (Supplementary Note 3) The anomaly detection device according to Supplementary Note 2, wherein the representative segment update unit updates the representative segment by selecting, as representative segments, all of the time-series segments obtained by dividing the time-series data acquired after the change has been detected, or by selecting, as representative segments, some of the time-series segments extracted from the divided time-series segments, in accordance with a detection result by the change detection unit. (Supplementary Note 4) The anomaly detection device according to Supplementary Note 2 or Supplementary Note 3, further comprising an adaptation unit that adapts a machine-learned model used for extracting features from the time-series data to a post-change state, based on the time-series data after the change has been detected by the change detection unit, and the representative segment update unit determines that sufficient time-series data has been acquired after the change in the system state, in accordance with a determination by the adaptation unit.(Supplementary Note 5) The anomaly detection device according to any one of Supplementary Note 1 to Supplementary Note 4, wherein the calculation unit calculates the degree of anomaly for each sensor included in the system and generates information for identifying a sensor in which an abnormality has occurred based on the calculated degree of anomaly. (Supplementary Note 6) The anomaly detection device according to any one of Supplementary Note 1 to Supplementary Note 5, further comprising an anomaly detection unit that detects an anomaly in the system based on information based on time series segments obtained by dividing the time series data acquired by the time series data acquisition unit and information stored in advance in a storage device, wherein the calculation unit calculates the degree of anomaly when the anomaly detection unit detects an anomaly in the system. (Supplementary Note 7) The anomaly detection device according to Supplementary Note 6, further comprising a storage unit that additionally stores in the storage device information based on time series segments obtained by dividing the time series data acquired after change detection based on a detection result by the change detection unit. (Supplementary Note 8) The anomaly detection device according to Supplementary Note 7, wherein the storage unit does not additionally store information corresponding to a time series segment until the change detection unit detects a change in the system state. (Supplementary Note 9) An anomaly detection method, wherein an information processing device acquires time series data from a plurality of sensors included in a system, calculates an anomaly degree of the sensor by comparing time series segments obtained by dividing the acquired time series data with a representative segment which is a representative point selected in advance from time series data for learning, and detects a change in the system state, updates the representative segment using the time series data acquired after the change detection according to the detection result, and calculates the anomaly degree by comparing the time series segment with the updated representative segment if a change in the system state is detected when calculating the anomaly degree.(Supplementary Note 10) A computer-readable recording medium having recorded thereon a program for implementing the following processes in an information processing device: acquiring time series data from a plurality of sensors included in a system; calculating the degree of abnormality of the sensors by comparing time series segments obtained by dividing the acquired time series data with representative segments that are representative points pre-selected from time series data for learning; detecting changes in the state of the system; updating the representative segments using the time series data acquired after the change detection according to the detection results; and, if a change in the system state is detected when calculating the degree of abnormality, comparing the time series segments with the updated representative segments to calculate the degree of abnormality.

[0111] Note that some or all of the configurations described in Supplementary Notes 2 to 8 that are dependent on the anomaly detection device described in Supplementary Note 1 may also be dependent in a similar dependent relationship on the anomaly detection method described in Supplementary Note 9 and the recording medium described in Supplementary Note 10. Furthermore, not limited to Supplementary Notes 9 and 10, some or all of the configurations described as Supplements may also be dependent on various hardware, software, various recording means for recording software, or systems within the scope of the above-described embodiments.

[0112] The programs described in the above embodiments and appendices may be stored in a storage device or a computer-readable recording medium, such as a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

[0113] Although the present invention has been described above with reference to the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0114] 100 Detection system 200 Detection device 210 Operation input unit 220 Screen display unit 230 Communication I / F unit 240 Memory unit 241 Model information 242 Feature information 243 Time series data information 244 Representative segment information 245 Program 250 Arithmetic processing unit 251 Time series data acquisition unit 252 Feature extraction unit 253 Binary code conversion unit 254 Representative segment selection unit 255 Change detection unit 256 Storage unit 257 Representative segment update unit 258 System abnormality detection unit 259 Sensor abnormality degree calculation unit 260 Adaptation unit 261 Update unit 262 Output unit 300 Anomaly detection device 301 CPU 302 ROM 303 RAM 304 Program group 305 Storage device 306 Drive device 307 Communication interface 308 Input / output interface 309 Bus 310 Recording medium 311 Communication network 321 Time series data acquisition unit 322 Calculation unit 323 Change detection unit 324 Representative segment update unit

Claims

1. An anomaly detection device comprising: a time series data acquisition unit that acquires time series data from a plurality of sensors included in a system; a calculation unit that calculates a degree of anomaly of a sensor by comparing time series segments obtained by dividing the time series data acquired by the time series data acquisition unit with a representative segment that is a representative point selected in advance from time series data for learning; a change detection unit that detects a change in a state of the system; and a representative segment update unit that updates the representative segment using the time series data acquired after change detection in accordance with a detection result by the change detection unit, wherein when the change detection unit detects a change in the system state, the calculation unit compares the time series segment with the representative segment updated by the representative segment update unit to calculate the degree of anomaly.

2. An anomaly detection device as described in claim 1, wherein the representative segment update unit updates the representative segment in accordance with the detection result by the change detection unit, and then, when it determines that sufficient time series data has been acquired after the change in the system state, replaces the updated representative segment again by selecting a representative segment from the time series data acquired after the change in the system state.

3. An anomaly detection device according to claim 2, wherein the representative segment update unit updates the representative segment by selecting, according to a detection result by the change detection unit, all of the time series segments obtained by dividing the time series data obtained after change detection as representative segments, or by selecting, as representative segments, a portion of the time series segments extracted from the divided time series segments.

4. An anomaly detection device as described in claim 2, further comprising an adaptation unit that adapts a machine-learned model used to extract features from time series data to a changed state based on the time series data after a change has been detected by the change detection unit, and the representative segment update unit determines that sufficient time series data has been acquired after the change in the system state, depending on the judgment of the adaptation unit.

5. An anomaly detection device as claimed in claim 1, wherein the calculation unit calculates the degree of anomaly for each sensor included in the system, and generates information for identifying a sensor in which an anomaly has occurred based on the calculated degree of anomaly.

6. An anomaly detection device as claimed in claim 1, further comprising an anomaly detection unit that detects an anomaly in the system in accordance with information corresponding to time series segments into which the time series data acquired by the time series data acquisition unit is divided and information pre-stored in a storage device, and wherein the calculation unit calculates the degree of anomaly when the anomaly detection unit detects an anomaly in the system.

7. An anomaly detection device according to claim 6, further comprising a storage unit which additionally stores in said storage device information corresponding to time series segments obtained by dividing time series data obtained after change detection, according to a detection result by said change detection unit.

8. An anomaly detection device according to claim 7, wherein the storage section does not additionally store information corresponding to a time series segment until the change detection section detects a change in the system state.

9. An anomaly detection method in which an information processing device acquires time series data from a plurality of sensors included in a system, calculates an anomaly degree of the sensors by comparing time series segments into which the acquired time series data is divided with a representative segment which is a representative point pre-selected from time series data for learning, and detects a change in the state of the system, and updates the representative segment using the time series data acquired after the detection of the change according to the detection result, and if a change in the system state is detected when calculating the anomaly degree, compares the time series segment with the updated representative segment to calculate the anomaly degree.

10. A computer-readable recording medium having recorded thereon a program for implementing the following processes in an information processing device: acquiring time series data from multiple sensors included in a system; calculating an abnormality degree of the sensors by comparing time series segments into which the acquired time series data is divided with a representative segment which is a representative point pre-selected from time series data for learning; detecting a change in the state of the system; updating the representative segment using the time series data acquired after the detection of the change according to the detection result; and, when calculating the abnormality degree, comparing the time series segment with the updated representative segment if a change in the system state is detected.

Images