Abnormality detection learning method and abnormality detection method

Abstract

According to the present invention, a machine learning model includes: a first mapping unit that maps normal state data of a first system to first vectors of a predetermined dimension; a second mapping unit that maps data of a second system to second vectors of the predetermined dimension; a mask unit that masks each of the first vectors or the second vectors using a mask vector; a reconstruction unit that reconstructs the first vectors or the second vectors from the masked vectors; a mask generation unit that generates a vector corresponding to the mask vector on the basis of the masked vectors; and an identification unit that identifies whether the vector is based on the first vectors or the second vectors on the basis of the masked vectors, wherein the machine learning model is trained using a plurality of pieces of normal state data of the first system and a plurality of pieces of normal state data of the second system so that the first vectors and the second vectors approach each other, the identification result of the identification unit is reversed, the output of the reconstruction unit and the input to the first mapping unit or the second mapping unit approach each other, and the mask vector and the vector generated by the mask generation unit approach each other, thereby improving the accuracy of abnormality detection when the amount of normal state data is small.

Description

Anomaly detection learning method and anomaly detection method

[0001] The present invention relates to an anomaly detection learning method and an anomaly detection method.

[0002] For operators of ICT systems, identifying anomalies that occur within the ICT system and responding to them promptly is an important task. Research has been conducted into methods for early detection of anomalies within ICT systems. In particular, unsupervised anomaly detection methods using deep learning (DL) have been proposed, which use normal ICT system data to learn the normal state and then calculate the degree of deviation from the normal state during testing to detect anomalies (Non-Patent Documents 1 and 2).

[0003] ICT systems provide a variety of services, and the users who use them also have various tendencies, so in order to learn from data about their normal state, a large amount of data from normal times is required. Generally, the time when an ICT system is normal is longer than the time when it is abnormal, so in ICT systems that have been in operation for a long period of time, it is possible to collect a large amount of data from normal times, and the above method can be used to detect abnormalities.

[0004] Y.Ikeda, K. Ishibashi, Y. Nakano, K. Watanabe, K. Tajiri, and R. Kawahara、"Human-Assisted Online Anomaly Detection with Normal Outlier Retraining"、ACM SIGKDD 2018 Workshop ODD v5.0, Aug. 2018Y.Ikeda, K. Tajiri, Y. Nakano, K. Watanabe, K. Ishibashi、"Unsupervised Estimation of Dimensions Contributing to Detected Anomalies with Variational Autoencoders"、AAAI-19 Workshop on Network Interpretability for Deep Learning, 2019Jinsung Yoon, Yao Zhang, James Jordon, and Mihaela van der Schaar. 2020、"VIME: extending the success of self- and semi-supervised learning to tabular domain"、In Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS'20). Curran Associates Inc., Red Hook, NY, USA, Article 926, 11033-11043Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, Francois Laviolette, Mario Marchand, and Victor Lempitsky. 2016、"Domain-adversarial training of neural networks"、J. Mach. Learn. Res.17, 1 (January 2016), 2096-2030Kingma, DP, & Ba, J. (2014), "Adam: A method for stochastic optimization", arXiv preprint arXiv:1412.6980.

[0005] As described above, unsupervised anomaly detection methods using DL detect anomalies by learning normal conditions based on a large amount of normal data. However, when a new ICT system is built, it takes time to collect sufficient normal data, making it impossible to detect anomalies during that time. Alternatively, if multiple services (e.g., web conferencing services and voice call services) are provided on an already-built ICT system and an anomaly detection model is trained using normal data acquired from that ICT system, providing a new service (e.g., a video streaming service) on the ICT system will change the normal state of the ICT system. As a result, the already-trained anomaly detection model cannot be used, and anomaly detection is not possible until sufficient new normal data has been collected.

[0006] The present invention has been made in view of the above points, and has as its object to improve the accuracy of anomaly detection when the amount of normal data is small.

[0007] In order to solve the above problem, a computer executes a learning procedure to train a machine learning model including: a first mapping unit that maps data of a first system in a normal state onto a first vector of a predetermined dimension; a second mapping unit that maps data of a second system into a second vector of the predetermined dimension; a mask unit that masks each of the first vector or the second vector using a mask vector; a reconstruction unit that reconstructs the first vector or the second vector from the masked vector; a mask generation unit that generates a vector corresponding to the masked vector from the masked vector; and an identification unit that identifies, from the masked vector, whether the vector is based on the first vector or the second vector.The computer executes a learning procedure to train a machine learning model using a plurality of data of the first system in a normal state and a plurality of data of the second system in a normal state so that the first vector and the second vector approach each other, the identification result of the identification unit is reversed, the output of the reconstruction unit and the input to the first mapping unit or the second mapping unit approach each other, and the mask vector and the vector generated by the mask generation unit approach each other.

[0008] This can improve the accuracy of anomaly detection when there is a small amount of normal data.

[0009] FIG. 1 is a diagram for explaining an anomaly detection model M1 in a first embodiment. FIG. 2 is a diagram for explaining masking of augmented data. FIG. 3 is a diagram for explaining an anomaly detection model M1 in a second embodiment. FIG. 4 is a diagram for explaining an anomaly detection model M1 in a third embodiment. FIG. 5 is a diagram for explaining an anomaly detection model M1 in a fourth embodiment. FIG. 6 is a diagram illustrating an example of a hardware configuration of an anomaly detection device 10 in an embodiment of the present invention. FIG. 7 is a diagram illustrating an example of a functional configuration of an anomaly detection device 10 in an embodiment of the present invention. FIG. 8 is a flowchart for explaining an example of a processing procedure of an anomaly detection device 10 when learning anomaly detection model M1.

[0010] In this embodiment, although the configuration and functions differ for each ICT system, the problem is solved by focusing on the rule (empirical rule) that if they have similar configurations and functions, their normal states will be similar, and transferring the information obtained when learning from an ICT system with a large amount of normal data to another ICT system with only a small amount of normal data.

[0011] In this embodiment, an ICT system with a large amount of normal data is defined as a source domain S, and an ICT system with only a small amount of normal data is defined as a target domain T. One piece of normal data obtained from the source domain S is represented by an n-dimensional vector x Ｓ = [x １ , ..., x ｎ ] and the dataset is D Ｓ = (x １ , …x ｜Ｄ＿Ｓ｜ ) where n represents the number of types of data obtained in the source domain S, and |D_S| represents the number of data. Similarly, normal data obtained from the target domain is expressed as x Ｔ = [x １ , ..., x ｎ' ] and the dataset is D Ｔ = (x １ , …x ｜Ｄ＿Ｔ｜ ) where n' represents the number of types of data available in the target domain T, and |D_T| represents the number of data.

[0012] The anomaly detection model M1 in this embodiment will be described. The anomaly detection model M1 in this embodiment is a machine learning model that extends VIME (Non-Patent Document 3) and Domain Adversarial Neural Network (Non-Patent Document 4), and four embodiments are disclosed below.

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0014] [First embodiment] Fig. 1 is a diagram for explaining an anomaly detection model M1 in the first embodiment. As shown in Fig. 1, the anomaly detection model M1 in the first embodiment includes seven DNNs (Deep Neural Networks) and a mask function g ｍIncludes:

[0015] Two DNNs (DNN ｓ , D.N.N. ｔ ) is the input data (x ｓ , x ｔ ) into a common vector (v ｓ , v ｔ ) is a DNN that maps ｓ Ha x ｓ Enter v ｓ Outputs DNN. ｔ Ha x ｔ Enter v ｔ Outputs DNN. ｓ and DNN ｔ , v ｓ , v ｔ The parameters are learned so that the values ​​are as close as possible. This is because even if the configurations of the ICT systems in the source and target domains are different, there is likely to be a relationship between them, such as the absolute values ​​of the traffic volume being different but the periodicity being similar, or the number of output logs being different but similar logs being output. Note that input data for a certain domain is, for example, log data, traffic data, CPU usage, memory usage, etc. output from devices constituting the ICT systems of the respective domains.

[0016] where θ ｓ , θ ｔ are the weight parameters of each DNN, which are learned based on the above learning. ・ are all weight parameters of the respective DNNs.

[0017] Function g ｍ , v ｓ and v ｔ Each of the above is masked (see FIG. 2).

[0018] where v is v ｓ or v ｔ In the following, since the same processing is performed on data from the source domain and data from the target domain, we will omit the description unless it is necessary to describe them separately.

[0019] m is a d-dimensional mask vector where each element takes the value 0 or 1. The symbol of a dot in a circle is the dot product, which is an operator that calculates the product of the i-th element of each vector. The - symbol above v (hereafter referred to as "v" in the text) － " is written as ". ) is a d-dimensional vector whose value of the i-th element is the statistical value (e.g., the mean value) of that element of the training data in the source domain or the target domain. Here, the value (0, 1) of each element of the mask vector m is derived for each input data from some distribution (e.g., Bernoulli distribution), and v － is determined using the statistics of the source domain if v is data from the source domain, and the statistics of the target if v is data from the target domain.

[0020] DNN ｅ is a masked v ～ (The symbol ~ above v in the formula) is embedded into the latent space.

[0021] This operation allows us to obtain representations in the same latent space for both the source and target domains.

[0022] Reconfigured DNN ｒ，ｓ , reconfigured DNN ｒ，ｔ , mask generation DNN ｍ , domain identification DNN ｃ Each of these inputs a vector embedded in the latent space to perform anomaly detection, mask vector generation, and domain identification.

[0023] Here, the reconstructed DNN ｒ is a method for reconstructing input data such as AutoEncoder, and the following equation is used to reconstruct the DNN ｒ，ｓ Output from r ｓ is the input data x ｓ The reconstruction DNN is trained to approach ｒ，ｔ Output from r ｔ Ga x ｔ It is learned to approach

[0024] Here, x ・，ｉ， r ・，ｉis the i-th data of the domain (source domain or target domain) and the vector reconstructed by inputting it. When performing anomaly detection, the degree of anomaly is calculated from the difference with the input using the reconstruction DNN, and a threshold is set for the degree of anomaly in some way (for example, the average value of the anomaly degree of the training data + 2 sigma) to perform anomaly detection. Each DNN is a fully connected DNN.

[0025] Mask Generation DNN ｍ is the combination of the generated mask vector and the original (function g ｍ The closeness of the generated mask vector to the original mask vector is evaluated using cross-entropy, and the parameters are trained to minimize the following equation (i.e., so that the generated mask vector approaches the original mask vector):

[0026] m － ｓ，ｉ，ｊ Ha x ｓ，ｉ Mask m for ｓ，ｉ represents the j-th element of m － ｔ，ｉ，ｊ The same is true for . Note that this process is a self-supervised learning framework, and a mask generation DNN is used to recognize the collapse of correlations that existed between the dimensions of the vectors by masking. ｍ is trained, and DNNe is trained to extract correlations between the dimensions of vectors.

[0027] Domain Identifier DNN ｃ determines whether the input data is from the source domain or the target domain (in other words, the DNN ｓ and DNN ｔ It is a neural network that determines whether the input data was input to one of the two inputs, and it learns parameters to minimize the cross-entropy error.

[0028] c ｉ is a value that can be 0 or 1 output from the classifier when the source domain or target domain is input, and y is the label (0 or 1) of the source domain or target domain. For example, c ｉand y, 1 indicates the source domain and 0 indicates the target domain.

[0029] This process is a framework for domain application, DNN ｅ is DNN ｃ By learning to output vectors that misjudge domain classification (always judge the opposite), ｃ The DNN is configured to output a vector that will cause a misjudgment of domain identification. ｅ The training is done to obtain domain-invariant vector representations.

[0030] The loss function of the above anomaly detection model M1 (seven DNNs) is defined by the following equation:

[0031] where α １ , α ２ , α ３ , α ４ is a hyperparameter, and L ４ is the following equation:

[0032] v ｓ，ｉ is the data D of the source domain Ｓ DNN is the data sampled for |D_T| from ｓ In other words, for the source domain, D Ｓ Only |D_T| is used as input, not all of v. ｔ，ｉ is the data D of the target domain Ｔ The data is replicated floor(|D_S| / |D_T|) times (where floor(a) is a floor function that returns the largest integer not exceeding a) and then processed by DNN. ｔAlternatively, the vector obtained by inputting σ to the target domain can be used. In this way, the source domain and target domain data are embedded into similar vectors z in the latent space, enabling reconstruction, extracting correlations between dimensions, and obtaining domain-invariant features that make domain discrimination difficult. This makes it possible to obtain a vector representation that includes correlation information in the latent space of domain-invariant normal data that can be used to reconstruct the target domain, thereby improving the reconstruction performance for normal data in the target domain. As a result, when target domain data (hereinafter referred to as "test data") input as an anomaly detection target in actual operation after the completion of learning is found to be abnormal, reconstruction becomes more difficult, thereby improving detection accuracy.

[0033] Dataset D for each of the source and target domains Ｓ , D Ｔ Using this, the parameters are learned to minimize the above loss function.

[0034] There are various learning techniques, for example, optimization using Adam (Non-Patent Document 5).

[0035] During inference (detection of abnormalities during operation), the trained DNN ｒ，ｔ (DNNe (DNN ｔ (x ｔ ;θ ｔ ); θe); θr) and DNN ｍ (DNNe (DNN ｔ (x ｔ ;θ ｔ ), θe); θr), obtain test data from the target domain, and input the test data into DNNt(xt; θt) to perform anomaly detection.

[0036] [Second embodiment] Next, a second embodiment will be described. In the second embodiment, differences from the first embodiment will be described. Points not specifically mentioned in the second embodiment may be the same as those in the first embodiment.

[0037] 3 is a diagram for explaining the anomaly detection model M1 in the second embodiment. In FIG. 3, parts that are the same as or correspond to those in FIG. 1 are given the same names.

[0038] The anomaly detection model M1 of the second embodiment is the DNNe(v ～ :θ ｅ ) without using v ～ DNN ｒ，ｓ , D.N.N. ｒ，ｔ , D.N.N. ｍ , D.N.N. ｃ v ～ Since the loss function is defined so that the data in the source domain and the target domain are close to each other, even without DNNe, the data in the source domain and the target domain are similar vectors in the latent space v ～ By embedding the loss function in the vector, we can obtain domain-invariant features that are reconstructable and difficult to distinguish between domains. This reduces the amount of computation. The loss function is as follows:

[0039] The rest may be the same as in the first embodiment.

[0040] [Third Embodiment] Next, a third embodiment will be described. In the third embodiment, differences from the first embodiment will be described. Points not specifically mentioned in the third embodiment may be the same as those in the first embodiment.

[0041] 4 is a diagram for explaining the anomaly detection model M1 in the third embodiment. In FIG. 4, parts that are the same as or correspond to those in FIG. 1 are given the same names.

[0042] The anomaly detection model M1 of the third embodiment is the same as the reconstructed DNN (DNN ｒ，ｓ , D.N.N. ｒ，ｔ ) into source and target domains, but as one, not the source and target domain data, v ～ In other words, the DNN in FIG. ｒ，ｓ and DNN ｒ，ｔSpecifically, equation (1) is modified as follows:

[0043] v ～ ｉ DNN is a method to retrieve data from the source or target domain. ｓ or DNN ｔ The vector embedded using r ｉ is the data reconstructed using the reconstruction DNN.

[0044] The loss function is as follows:

[0045] The rest may be the same as in the first embodiment.

[0046] [Fourth embodiment] Next, a fourth embodiment will be described. In the fourth embodiment, differences from the second embodiment will be described. Points not specifically mentioned in the fourth embodiment may be the same as those in the first embodiment.

[0047] Fig. 5 is a diagram for explaining an anomaly detection model M1 in the fourth embodiment. In Fig. 5, parts that are the same as or correspond to those in Fig. 3 or 4 are given the same names.

[0048] The anomaly detection model M1 of the fourth embodiment has a configuration that combines the second embodiment and the third embodiment.

[0049] The rest may be the same as in the first embodiment.

[0050] [Anomaly Detection Device 10] The anomaly detection device 10 that learns the anomaly detection model M1 of each of the above embodiments and performs anomaly detection using the anomaly detection model M1 will be described.

[0051] 6 is a diagram showing an example of the hardware configuration of an abnormality detection device 10 according to an embodiment of the present invention. The abnormality detection device 10 in Fig. 6 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, which are all interconnected via a bus B.

[0052] The program that realizes the processing in the anomaly detection device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, but may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc.

[0053] When an instruction to start a program is received, the memory device 103 reads and stores the program from the auxiliary storage device 102. The processor 104 is a CPU or a GPU (Graphics Processing Unit), or a CPU and a GPU, and executes functions related to the anomaly detection device 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0054] 7 is a diagram illustrating an example of the functional configuration of an anomaly detection device 10 according to an embodiment of the present invention. In FIG. 7 , the anomaly detection device 10 includes a learning unit 11 and an inference unit 12. These units are implemented by a processor 104 executing one or more programs installed in the anomaly detection device 10. The anomaly detection device 10 also utilizes databases (storage units), such as a source domain input data DB 13, a target domain input data DB 14, and a trained model DB 15. Each of these databases can be implemented using, for example, an auxiliary storage device 102 or a storage device connectable to the anomaly detection device 10 via a network.

[0055] [Processing Procedure During Learning] FIG. 8 is a flowchart for explaining an example of the processing procedure of the anomaly detection device 10 during learning of the anomaly detection model M1.

[0056] In step S101, the learning unit 11 calculates the D ＳData sampled from |D_T| (x ｓ ) and the D stored in the target domain input data DB 14 Ｔ The data that constitutes the ｔ ) into a predetermined number of batches. The method of dividing the data set into batches is not limited to a predetermined method. Each batch is divided into the same number of x ｓ and x ｔ may or may not be included.

[0057] Next, the learning unit 11 executes a loop process L1 for each batch. The batch being processed in the loop process L1 will be referred to as the "target batch" hereinafter.

[0058] In the loop process L1, the learning unit 11 executes a loop process L2 including steps S102 and S103 for each piece of data in the target batch. The data to be processed in the loop process L2 will be referred to as "target data" hereinafter.

[0059] In step S102, the learning unit 11 inputs the target data to the anomaly detection model M1 and obtains an output from each DNN. ｓ In this case, the target data is DNN ｓ The target data is input to x ｔ In this case, the target data is DNN ｔ At this time, the function g ｍ in v － is assigned the statistical value of v for each data in the target batch that is in the same domain as the target data. ｓ or DNN ｔ The calculation of may be performed for all data of the target batch outside the loop process L2, and the resulting statistical values ​​for each domain of v may be calculated. In step S102, v for the target data and the statistical values ​​are calculated using the function g ｍ and enter the function g ｍ Output from v ～ may be input to DNNe to obtain the output of each DNN after DNNe.

[0060] In step S103, the learning unit 11 calculates the loss by substituting the output from each DNN into a loss function.

[0061] When loop processing L2 is completed for all data of the target batch, the learning unit 11 updates the parameter values ​​of the anomaly detection model M1 (each DNN) based on the sum of losses calculated for the target batch in step S103 (S104).

[0062] When the above process is performed for all batches, the learning unit 11 stores the trained anomaly detection model M1 (the parameter values ​​of the model) in the trained model DB 15 (S105).

[0063] [Processing Procedure During Inference] The inference unit 12 performs inference on the DNN that has completed learning. ｒ，ｔ (DNNe (DNN ｔ (x ｔ ;θ ｔ ); θe); θr) and DNN ｍ (DNNe (DNN ｔ (x ｔ ;θ ｔ ) ; θe) ; θr) are extracted from the trained model DB 15 and anomaly detection is performed. ｒ，ｔ (DNNe (DNN ｔ (x ｔ ;θ ｔ ), θe), θr), test data is input, and the difference (error) between the reconstructed output and the test data is taken as the anomaly level, and anomaly detection is performed based on whether it exceeds the threshold. Here, the test data is not masked (i.e., the function g ｍ (Does not apply) Also, DNN ｍ (DNNe (DNN ｔ (x ｔ ;θ ｔ Similarly, test data is input without masking for θe); θr), and the output masked estimated position is confirmed. If a masked element (an element with a value of 1) is output, the element can be considered to be an abnormal value.

[0064] The inference unit 12 finally ｒ，ｔ (DNNe (DNN ｔ (xｔ ;θ ｔ ); θe); θr) and DNN ｍ (DNNe (DNN ｔ (x ｔ ;θ ｔ The anomaly detection result for the test data is determined based on whether an anomaly is detected in one of θe) or θr) or both. In this way, in addition to detecting an anomaly, it is possible to estimate which element is abnormal. Note that if an anomaly is detected in only one of these, it may be left to the user's discretion as to whether to determine that an anomaly exists or not.

[0065] Although the processing procedures during learning and inference in the first embodiment have been described above, the processing procedures are the same except for the configuration of the anomaly detection model M1.

[0066] As described above, according to this embodiment, information obtained during learning in an ICT system (source domain) with a large amount of normal data is transferred to another ICT system (target domain) with only a small amount of normal data, thereby enabling learning of an anomaly detection model M1 for the target domain. Therefore, the accuracy of anomaly detection when there is only a small amount of normal data can be improved.

[0067] In the above embodiments, DNN ｓ is an example of the first mapping unit. ｔ is an example of the second mapping unit. ｒ，ｓ , D.N.N. ｒ，ｔ is an example of a reconstruction unit. ｍ is an example of a mask generator. ｃ is an example of an identification unit. DNNe is an example of an embedding unit. ｒ，ｓ is an example of a first reconstruction unit. ｒ，ｔ is an example of a second reconstruction unit.

[0068] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0069] REFERENCE SIGNS LIST 10 Anomaly detection device 11 Learning unit 12 Inference unit 13 Source domain input data DB 14 Target domain input data DB 15 Trained model DB 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 Processor 105 Interface device B Bus

Claims

a mask unit that masks each of the first and second vectors using a mask vector; a reconstruction unit that reconstructs the first or second vector from the masked vector; a mask generation unit that generates a vector corresponding to the masked vector from the masked vector; and an identification unit that identifies, from the masked vector, whether the vector is based on the first vector or the second vector; and a learning procedure that uses a plurality of data sets of the first system when it is normal and a plurality of data sets of the second system when it is normal so that the first vector and the second vector approach each other, the identification result of the identification unit is reversed, the output of the reconstruction unit and the input to the first mapping unit or the second mapping unit approach each other, and the mask vector and the vector generated by the mask generation unit approach each other.

2. The anomaly detection learning method according to claim 1, characterized in that: the machine learning model includes an embedding unit that embeds the masked vector into a latent space; the reconstruction unit reconstructs the first vector or the second vector from the vector embedded in the latent space; the mask generation unit generates a vector corresponding to the mask vector from the vector embedded in the latent space; and the identification unit identifies, from the vector embedded in the latent space, whether the vector is based on the first vector or the second vector.

3. The anomaly detection learning method according to claim 2, characterized in that the reconstruction unit includes a first reconstruction unit that reconstructs the first vector from a vector obtained by masking the first vector, and a second reconstruction unit that reconstructs the second vector from a vector obtained by masking the second vector.

4. An anomaly detection method characterized by the computer executing an inference procedure in which, when data of the second system is input to the second mapping section of the machine learning model trained by the anomaly detection learning method described in any one of claims 1 to 3, the presence or absence of an anomaly in the second system is determined based on the difference between the value output by the reconstruction section and the data, and the vector generated by the mask generation section.

Images