Abnormality determination device, method, and program

Abstract

This abnormality determination device: acquires one or more types of explanatory series data that are time-series data representing a situation and one type of target series data that is time-series data representing a result; calculates a scale indicating the level of difference in scale between the acquired explanatory series data and explanatory series data used for training a prediction model that uses one or more types of explanatory series data as inputs to predict one type of target series data; predicts the target series data by adjusting the acquired explanatory series data on the basis of the scale and inputting the adjusted explanatory series data to the prediction model, or predicts the target series data by adjusting, on the basis of the scale, the target series data predicted by inputting the acquired explanatory series data to the prediction model; and compares the predicted target sequence data with the target series data obtained by adjusting the acquired target series data on the basis of the scale to determine the presence or absence of an abnormality.

Description

Abnormality determination device, method, and program

[0001] The disclosed technology relates to an abnormality determination device, an abnormality determination method, and an abnormality determination program.

[0002] With the spread of IoT (Internet of Things), it has become easy to acquire a variety of sensor data in recent years, and anomaly detection, change detection, etc. have attracted attention as a way to utilize data. There are two main approaches to anomaly detection technology: methods based on human-defined rules such as threshold judgment, and methods using machine learning.

[0003] Among these methods that use machine learning, there are methods that learn normal and abnormal states and distinguish between normal and abnormal, and methods that learn only normal states and detect behavior that deviates from the normal state as an anomaly. The method that learns only normal states is useful when it is difficult to comprehensively observe abnormal states or when there is extremely little data on abnormal states.

[0004] When the above-described anomaly detection technology is applied to equipment that processes multiple processes, such as a plant, various normal patterns will be mixed in. Therefore, in time series prediction, which determines that only one prediction result will be output based on the learning results, only one normal state can be output as a prediction result, and there are cases where an abnormality is detected even when the observed value is a normal state with a pattern different from the prediction.

[0005] To deal with the above-mentioned cases, the technology described in Non-Patent Document 1 prepares multiple LSTM (Long Short Term Memory) models that have learned normal patterns. Then, if the predicted results from the multiple LSTM models differ from the observed values, an abnormality is determined. Furthermore, the technology described in Non-Patent Document 2, which was developed for embedded control, clusters data with a proven track record as normal data, and if the sample to be detected does not belong to any cluster, an abnormality is determined.

[0006] Shigeru Maya and Ken Ueno, "Proposal of a Time Series Anomaly Detection Method Using Deep Learning," Industrial Materials, Vol. 30, No. 1, pp. 22-26 (2020). Shinji Nakagawa, "Anomaly Detection Method for Embedded Systems," 6th Forum on Information Science and Technology, FIT2017, F-013 (2017).

[0007] However, as pointed out in Non-Patent Document 2, there is a concern that conventional technology may be unable to perform anomaly detection with sufficient accuracy if sufficient data on normal conditions is not collected. When sufficient data on normal conditions cannot be collected and no data is available in the environment in which anomaly detection is desired, a model is constructed using data acquired in a similar environment. In this case, the scale of the environment in which anomaly detection is desired and the environment in which the data for model construction was acquired may differ. In this case, it is expected that the scale of the predicted value of the objective variable, which serves as an indicator for anomaly detection predicted by the constructed model, differs from the observed value of the objective variable observed in the environment in which anomaly detection is desired. Under such circumstances, the error between the predicted value and the observed value becomes large even in normal conditions, resulting in an abnormality being detected or an abnormal condition being detected as normal, resulting in a model that is insufficient for anomaly detection.

[0008] The disclosed technology has been made in consideration of the above points, and aims to perform accurate abnormality detection even when the data being subjected to abnormality detection has a different scale from the data used to build a machine learning model for outputting a predicted value of a dependent variable that serves as an indicator for abnormality detection.

[0009] A first aspect of the present disclosure is an abnormality determination device including: an acquisition unit that acquires one or more types of explanatory series data, which are time series data representing a situation, and one type of target series data, which are time series data representing a result; a calculation unit that uses one or more types of explanatory series data as input and calculates a scale indicating the degree of difference in scale between the explanatory series data used to train a prediction model that predicts one type of target series data and the explanatory series data acquired by the acquisition unit; a prediction unit that predicts the target series data by either adjusting the explanatory series data acquired by the acquisition unit based on the scale and inputting it into the prediction model to predict the target series data, or inputting the explanatory series data acquired by the acquisition unit into the prediction model and adjusting the predicted target series data based on the scale; and a determination unit that compares the target series data predicted by the prediction unit with the target series data acquired by the acquisition unit adjusted based on the scale to determine whether or not an abnormality exists.

[0010] A second aspect of the present disclosure is an anomaly detection method executed by an anomaly detection device including an acquisition unit, a calculation unit, a prediction unit, and a determination unit, wherein the acquisition unit acquires one or more types of explanation series data, which are time series data representing a situation, and one type of target series data, which is time series data representing a result; the calculation unit uses the one or more types of explanation series data as input and calculates a scale indicating the degree of difference in scale between the explanation series data used to train a prediction model that predicts the one type of target series data and the explanation series data acquired by the acquisition unit; the prediction unit either adjusts the explanation series data acquired by the acquisition unit based on the scale and inputs it into the prediction model to predict the target series data, or inputs the explanation series data acquired by the acquisition unit into the prediction model and adjusts the predicted target series data based on the scale, thereby predicting the target series data; and the determination unit compares the target series data predicted by the prediction unit with the target series data acquired by the acquisition unit adjusted based on the scale to determine whether or not an anomaly exists.

[0011] A third aspect of the present disclosure is an abnormality determination program for causing a computer to function as each unit of the abnormality determination device.

[0012] According to the disclosed technology, it is possible to perform anomaly detection with high accuracy even when the data to be detected as anomaly detection is on a different scale from the data used to construct a machine learning model for outputting a predicted value of a dependent variable that serves as an indicator for anomaly detection.

[0013] 1 is a block diagram showing a hardware configuration of an abnormality determination device; 2 is a functional block diagram of an abnormality determination device; 3 is a flowchart showing an example of a learning process; 4 is a flowchart showing an example of a determination process; 5 is an example of a graph of raw material input amount and gas generation amount in a methane gas fermentation plant; 6 is an example of a graph of predicted values ​​and observed values ​​before and after scale adjustment;

[0014] An example of an embodiment of the disclosed technology will be described below with reference to the drawings. Note that the same or equivalent components and parts in each drawing are given the same reference numerals. Also, the dimensional proportions in the drawings are exaggerated for the convenience of explanation and may differ from the actual proportions.

[0015] Fig. 1 is a block diagram showing the hardware configuration of an abnormality determination device 10. As shown in Fig. 1, the abnormality determination device 10 includes a central processing unit (CPU) 11, a read-only memory (ROM) 12, a random access memory (RAM) 13, a storage 14, an input unit 15, a display unit 16, and a communication interface (I / F) 17. Each component is connected to each other via a bus 19 so as to be able to communicate with each other.

[0016] The CPU 11 is a central processing unit that executes various programs and controls each part. That is, the CPU 11 reads programs from the ROM 12 or the storage 14 and executes the programs using the RAM 13 as a work area. The CPU 11 controls the above components and performs various arithmetic processing in accordance with the programs stored in the ROM 12 or the storage 14. In this embodiment, the ROM 12 or the storage 14 stores an abnormality determination program, which will be described later.

[0017] The ROM 12 stores various programs and various data. The RAM 13 temporarily stores programs or data as a working area. The storage 14 is configured by a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive), and stores various programs including an operating system and various data.

[0018] The input unit 15 includes a pointing device such as a mouse and a keyboard, and is used to input various information. The display unit 16 is, for example, a liquid crystal display, and displays various information. The display unit 16 may be a touch panel type and function as the input unit 15.

[0019] The communication I / F 17 is an interface for communicating with other devices, and the communication may use a wired communication standard such as Ethernet (registered trademark) or FDDI, or a wireless communication standard such as 4G, 5G, or Wi-Fi (registered trademark).

[0020] Next, the functional configuration of the abnormality determination device 10 will be described. Fig. 2 is a block diagram showing an example of the functional configuration of the abnormality determination device 10. As shown in Fig. 2, the abnormality determination device 10 includes, as its functional configuration, a learning-time acquisition unit 21, a learning unit 22, a determination-time acquisition unit 23, a calculation unit 24, a prediction unit 25, a determination unit 26, an update unit 27, and a prediction model 30. Each functional configuration is realized when the CPU 11 reads out an abnormality determination program stored in the ROM 12 or the storage 14, expands it in the RAM 13, and executes it. Note that the learning-time acquisition unit 21 and the determination-time acquisition unit 23 are examples of an "acquisition unit" in the present disclosure.

[0021] When the prediction model 30 is trained, a training data set including multiple pieces of training data is input to the anomaly detection device 10. The training data is a pair of data consisting of one or more types of explanation series data and one type of target series data in a normal state. When an anomaly is detected using the trained prediction model 30, one or more types of explanation series data to be detected and one type of target series data are input to the anomaly detection device 10 as data to be detected.

[0022] The explanatory series data is time series data that represents the situation that is the target of anomaly detection, and is data used to predict the objective series data. The objective series data is data that serves as an index when determining whether or not an abnormality exists in the target of anomaly detection. For example, if time series data of types A to E are observed in an environment that is the target of anomaly detection, each of the time series data of types A to D may be used as the explanatory series data, and the time series data of type E may be used as the objective series data. Furthermore, for example, past data of the time series data acquired as the objective series data may be included in the explanatory series data. Note that each time series data is data in which data values ​​observed over a predetermined period at predetermined time intervals (e.g., every minute) are arranged in chronological order.

[0023] The learning-time acquisition unit 21 acquires a training dataset input to the anomaly detection device 10. The learning-time acquisition unit 21 may also downsample the explanation series data and the objective series data included in the acquired training dataset to generate time-series data with an appropriate time interval depending on the time scale at which an anomaly occurs. Specifically, it is assumed that the time range in which fluctuations in the target for anomaly detection occur is several hours or several days, and the time interval for observing the data is one minute. In this case, the learning-time acquisition unit 21 may acquire, as training data, data obtained by sampling each of the input explanation series data and the objective series data every 30 minutes. Furthermore, for example, the learning-time acquisition unit 21 may acquire, as training data, data obtained by converting each of the input explanation series data and the objective series data into statistical values, such as integrated values ​​and average values ​​of data over 30 minutes. The learning-time acquisition unit 21 passes the acquired training dataset to the learning unit 22.

[0024] The learning unit 22 uses the training data set transferred from the learning acquisition unit 21 to train a prediction model 30 that predicts one type of target series data using one or more types of explanation series data as input. Specifically, the learning unit 22 calculates parameters of the prediction model 30 so as to minimize the error between the target series data predicted by inputting the explanation series data of each training data into the prediction model 30 and the target series data of each training data. The learning unit 22 stores the trained prediction model 30, in which the calculated parameters are set, in a predetermined storage area of ​​the anomaly detection device 10.

[0025] The determination time acquisition unit 23 acquires the determination target data input to the abnormality determination device 10. The determination time acquisition unit 23 may also downsample each of the explanation series data and the objective series data, similar to the learning time acquisition unit 21. The determination time acquisition unit 23 passes the acquired determination target data to the calculation unit 24.

[0026] Here, the scale of the environment in which the training data set is observed may differ from the scale of the environment in which the target data is observed. In this case, if an anomaly determination is performed on the target data using the prediction model 30 trained on the training data set, an accurate determination may not be possible due to the difference in the scale of the data.

[0027] Therefore, the calculation unit 24 calculates a scale indicating the degree of difference in scale between the explanation series data used in training the prediction model 30 and the explanation series data of the data to be judged passed from the judgment time acquisition unit 23. Specifically, the calculation unit 24 calculates statistical values ​​such as the minimum, maximum, average, and median of the data values ​​of the explanation series data over a predetermined period for each of the explanation series data used in training the prediction model 30 and the explanation series data of the data to be judged. Then, the calculation unit 24 calculates the scale as a ratio between the statistical values ​​of the explanation series data used in training the prediction model 30 and the statistical values ​​of the explanation series data of the data to be judged. In addition, at this time, the calculation unit 24 may calculate the scale using statistical values ​​of data included in a section (e.g., the most recent few days) of the explanation series data of the data to be judged that is designated as a section with a high reliability of being normal.

[0028] Furthermore, the calculation unit 24 may calculate a plurality of scale candidates and determine the scale to be used by the prediction unit 25 from among them. Specifically, the calculation unit 24 calculates a scale candidate for each type of explanation series data or each type of statistical value. Then, the calculation unit 24 determines, as the scale to be used by the prediction unit 25, the scale candidate that minimizes the error between the target series data of the data to be determined and the target series data predicted by the prediction model 30 when adjusted with each of the plurality of scale candidates. Adjustment based on the scale will be described later.

[0029] The calculation unit 24 may also calculate a rough value of the objective series data estimated from the explanation series data as the scale. The calculation unit 24 may also integrate the scales calculated for each of the multiple types of explanation series data to calculate the scale to be used by the prediction unit 25. For example, the calculation unit 24 may calculate the scale by multiplying the ratio of the statistical value of the explanation series data of type A and the ratio of the statistical value of the explanation series data of type B for the explanation series data used in training the prediction model 30 and the explanation series data of the data to be determined.

[0030] The calculation unit 24 passes the determination target data and the calculated scale to the prediction unit 25 .

[0031] The prediction unit 25 predicts the target series data by adjusting the explanatory series data of the target data passed from the calculation unit 24 based on the scale passed from the prediction unit 25 and inputting the adjusted data into the prediction model 30. Alternatively, the calculation unit 24 may predict the target series data by inputting the explanatory series data of the target data into the prediction model 30 and adjusting the predicted target series data based on the scale.

[0032] Hereinafter, the target series data predicted by the prediction unit 25 will be referred to as the "predicted value of the target series data" or simply as the "predicted value," and the target series data of the data to be judged will be referred to as the "observed value of the target series data" or simply as the "observed value." The prediction unit 25 passes the scale, the predicted value, and the observed value of the target series data to the judgment unit 26.

[0033] The determination unit 26 compares the predicted value of the target series data passed from the prediction unit 25 with the target series data obtained by adjusting the observed value of the target series data based on the scale to determine whether or not there is an abnormality. Specifically, the determination unit 26 determines that there is an abnormality if the difference or ratio between the predicted value of the target series data and the observed value of the target series data adjusted based on the scale is equal to or greater than a predetermined threshold, and determines that there is a normality if it is less than the threshold.

[0034] The threshold for determining whether or not an abnormality exists may be set differently depending on the urgency of the target for which an abnormality is to be determined. For example, if an abnormality needs to be detected quickly, the threshold may be set to a value that is twice the average value of the error between the predicted value and the observed value when a previous determination was made that the target was normal. Alternatively, the threshold may be set to a value that is half the error between the predicted value and the observed value when a previous determination was made that the target was abnormal. This makes it possible to determine an abnormality at the stage when signs of an abnormality begin to appear. Furthermore, for example, if it is possible to take action after it is confirmed that an abnormality has occurred, the threshold may be set to a value that is one order of magnitude larger than the average value of the error.

[0035] The determination unit 26 outputs a determination result of abnormality or normality. If the determination result is normal, the determination unit 26 transfers the predicted value of the target series data and the observed value of the target series data adjusted based on the scale to the update unit 27.

[0036] The update unit 27 calculates parameters of the prediction model 30 so as to minimize the error between the predicted value of the target series data passed from the determination unit 26 and the observed value of the target series data adjusted based on the scale. The update unit 27 updates the prediction model 30 by setting the calculated parameters in the prediction model 30.

[0037] Next, the operation of the anomaly determination device 10 will be described. A training data set including multiple training data pairs each consisting of one or more types of explanation series data, which are time-series data representing a situation under normal conditions, and one type of target series data, which is time-series data representing a result, is input to the anomaly determination device 10. When the training data set is input to the anomaly determination device 10, a learning process is executed in the anomaly determination device 10. Furthermore, when one or more types of explanation series data and one type of target series data to be determined are input to the anomaly determination device 10 as data to be determined, a determination process is executed in the anomaly determination device 10.

[0038] Fig. 3 is a flowchart showing the flow of the learning process by the abnormality determination device 10. Fig. 4 is a flowchart showing the flow of the determination process by the abnormality determination device 10. The learning process and the determination process are performed by the CPU 11 reading out an abnormality determination program from the ROM 12 or the storage 14, expanding it into the RAM 13, and executing it. Note that the determination process is an example of the "abnormality determination method" of the present disclosure.

[0039] First, the learning process shown in FIG. 3 will be described.

[0040] In step S10, the CPU 11, functioning as the learning acquisition unit 21, acquires the training data set input to the anomaly determination device 10. Next, in step S12, the CPU 11, functioning as the learning unit 22, learns the prediction model 30 using the training data set acquired in step S10. Next, in step S14, the CPU 11, functioning as the learning unit 22, stores the learned prediction model 30 in a predetermined storage area of ​​the anomaly determination device 10, and the learning process ends.

[0041] Next, the determination process shown in FIG. 4 will be described.

[0042] In step S20, the CPU 11, functioning as the determination time acquisition unit 23, acquires the determination target data input to the abnormality determination device 10. Next, in step S22, the CPU 11, functioning as the calculation unit 24, calculates a scale indicating the degree of difference in scale between the explanatory series data used in training the prediction model 30 and the explanatory series data of the determination target data.

[0043] Next, in step S24, the CPU 11, as the prediction unit 25, adjusts the explanatory series data of the data to be determined based on the scale calculated in step S22 and inputs the adjusted data into the prediction model 30 to predict the target series data. Alternatively, the CPU 11, as the prediction unit 25, inputs the explanatory series data of the data to be determined into the prediction model 30 and adjusts the predicted target series data based on the scale to predict the target series data.

[0044] Next, in step S26, the CPU 11 functions as the determination unit 26 to compare the predicted value of the target series data with the observed value of the target series data adjusted based on the scale, and determine whether or not an abnormality exists.

[0045] If the result of the determination in step S26 is normal, the process proceeds to step S28. In step S28, the CPU 11, functioning as the update unit 27, updates the parameters of the prediction model 30 so as to minimize the error between the predicted value of the target series data and the observed value of the target series data adjusted based on the scale.

[0046] Next, in step S30, the CPU 11 functions as the determination unit 26 and outputs the determination result of step S26, ie, abnormal or normal, and the determination process ends.

[0047] The above-mentioned determination process will be explained in more detail using a specific example. Here, as a specific example, abnormality determination in a methane gas fermentation plant will be explained. A methane gas fermentation plant is a facility that obtains energy by generating methane gas by feeding livestock manure, food waste, etc. as raw materials into a fermentation tank.

[0048] In a methane gas fermentation plant, if an abnormality occurs in the fermenter, the amount of gas generated may be greater or less than the expected amount relative to the amount of raw material input. Therefore, the objective series data acquired in step S20 is the amount of gas generated. The explanatory series data includes data representing the environment of the fermenter, data that changes the environment of the fermenter, etc. Examples of data representing the environment of the fermenter include fermenter pH, ORP (Oxidation-Reduction Potential), ammonia nitrogen, and MLSS (Mixed Liquor Suspended Solids). Examples of data that change the environment of the fermenter include adjustment tank pH, the amount of raw material input to the adjustment tank, and the amount of raw material input to the fermenter. Furthermore, because the amount of gas generated changes gradually over time, the explanatory series data may include the most recent amount of gas generated.

[0049] In methane fermentation, the amount of gas generated is roughly determined by the amount of raw material input into the fermenter. Therefore, if there is a difference between the amount of raw material input as explanatory series data used to construct the prediction model 30 and the amount of raw material input as explanatory series data of the data to be determined, a difference will also occur in the amount of gas generated, which is the target series data. Therefore, the calculation unit 24 may calculate a rough value based on the amount of gas generated, which is the target series data estimated from the amount of raw material input as explanatory series data, as a scale. Note that the amount of raw material input as explanatory series data of the data to be determined is the amount of raw material input into the methane fermentation plant that is the target of abnormality determination.

[0050] The calculation of the scale in this case will be specifically described. The upper part of Figure 5 shows a graph of the raw material input amount as explanatory series data of the training data and the gas generation amount as target series data. The lower part of the figure shows a graph of the data in the plant that is the target of anomaly judgment, i.e., the raw material input amount as explanatory series data of the judgment target data, and the gas generation amount as target series data. For example, in step S22, the ratio between the raw material input amount as explanatory series data of the training data used to learn the prediction model 30 and the raw material input amount as the judgment target data is calculated as the scale. More specifically, assume that the maximum raw material input amount in the training data is 200 L / day and the raw material input amount in the judgment target data is 400 L / day. In this case, a value of 1 / 2 is calculated as the scale.

[0051] Furthermore, since the amount of gas generated varies depending on the composition of the raw material, the ratio of the raw material input amount may be multiplied by, for example, 1 / 2 to 2 times to take into account the influence of the composition. More specifically, if the composition of the raw material input varies daily, a plausible value may be selected as the scale from a range of (ratio calculated from the input amount) × (minimum magnification of the influence of the composition) to (ratio calculated from the input amount) × (maximum magnification of the influence of the composition), from 1 / 4 to 1. When selecting the scale, the target series data may be predicted by the prediction model 30 using a portion of the explanatory series data acquired from the plant to be detected for anomaly detection, and a scale with a small error may be selected. If the ratio of the raw material input amount is 1 / 2 and the difference in gas generation amount due to the composition of the raw material can be 1 / 2, the gas generation amount of the target series data is 1 / 4 of the gas generation amount of the training data used to train the prediction model 30, and this may be used as the scale.

[0052] In step S22, the scale is calculated as 1 / 4 as in the above example. In this case, in step S24, the prediction unit 25 multiplies the most recent gas generation amount included in the explanatory series data of the data to be determined by 1 / 4 and inputs the multiplied data into the prediction model 30 to predict the current and future gas generation amounts. Alternatively, the prediction unit 25 may input the explanatory series data of the data to be determined into the prediction model 30 and multiply the predicted gas generation amount by 1 / 4 to obtain a predicted value of the target series data.

[0053] Since the gas generation rate is predicted based on the scale in this way, the predicted value of the gas generation rate is a value that is about 1 / 4 of the actual gas generation rate. Therefore, the gas generation rate, which is the target series data of the data to be determined and serves as an index for determination, is also adjusted using the calculated scale and then compared with the predicted value. Specifically, in step S26, the determination unit 26 compares the predicted value of the gas generation rate predicted in step S24 with the observed value of the gas generation rate, which is the target series data of the data to be determined, to determine whether or not an abnormality exists.

[0054] As described above, the anomaly detection device according to this embodiment acquires, as target data, one or more types of explanatory series data, which are time-series data representing a situation, and one type of target series data, which are time-series data representing a result. The anomaly detection device also receives the one or more types of explanatory series data as input and calculates a scale indicating the degree of difference in scale between the explanatory series data of the training data used to learn a prediction model that predicts one type of target series data and the explanatory series data of the target data. The anomaly detection device also adjusts the explanatory series data of the target data based on the scale and inputs it into the prediction model to predict the target series data. Alternatively, the anomaly detection device predicts the target series data by inputting the explanatory series data of the target data into the prediction model and adjusting the predicted target series data based on the scale. The anomaly detection device then compares the predicted value of the target series data with the observed value of the target series data adjusted based on the scale to determine whether or not an anomaly exists. This allows for accurate anomaly detection even when the target data has a different scale from the data used to build a machine learning model that outputs a predicted value of a target variable, which serves as an indicator for anomaly detection.

[0055] When there is insufficient data acquired from the target for which anomaly detection is desired, data acquired in an environment similar to the target may be used when training a predictive model. In such cases, the scale of the similar environment from which the training data used to train the predictive model was acquired may differ from that of the target for which anomaly detection is desired. In this case, it is expected that the scale of the target series data, which is an indicator of anomaly detection predicted by the predictive model, will be different from that of the target series data acquired in the environment for anomaly detection.

[0056] In this embodiment, a scale is calculated based on the data used to train the prediction model as described above to adjust for the difference in the scale of the environment between the time of training and the time of judgment. Then, the predicted values ​​and observed values ​​of the target series data are adjusted using this scale. Figure 6 shows a graph plotting the predicted values ​​and observed values ​​before and after scale adjustment. As shown in Figure 6, it can be seen that adjusting using the scale increases the degree of agreement between the observed values ​​and the predicted values. The predicted values ​​and observed values ​​of the target series data adjusted using the scale in this way are compared to determine whether they are normal or abnormal.

[0057] In this way, by incorporating the known scale relationship between explanatory series data and objective series data into the trained prediction model, it is possible to accurately determine anomalies even when sufficient data on normal conditions is not collected. In other words, it is possible to accurately determine anomalies even in the range of explanatory series data and objective variable series data that were not included in the training data during learning.

[0058] In the above embodiment, the functional unit that executes the learning process and the functional unit that executes the judgment process are implemented in a single device. However, they may be implemented in separate devices. For example, an anomaly judgment device that includes a judgment-time acquisition unit, a calculation unit, a prediction unit, and a judgment unit may perform an anomaly judgment using a prediction model learned by an anomaly judgment learning device that includes a learning-time acquisition unit and a learning unit. Also, for example, an update unit may be further added to the anomaly judgment learning device, and the predicted values ​​and observed values ​​of the target sequence data when the anomaly judgment device determines that the target sequence is normal may be acquired to update the prediction model. Also, the update unit may be provided on the anomaly judgment device side.

[0059] In the above embodiment, the abnormality determination process executed by the CPU after reading the software (program) may be executed by various processors other than the CPU. Examples of such processors include a programmable logic device (PLD) (such as a field-programmable gate array (FPGA)) whose circuit configuration can be changed after manufacture, and a dedicated electrical circuit, such as an application-specific integrated circuit (ASIC), which is a processor having a circuit configuration designed specifically to execute specific processing. The abnormality determination process may be executed by one of these various processors, or by a combination of two or more processors of the same or different types (e.g., multiple FPGAs, or a combination of a CPU and an FPGA). The hardware structure of these various processors is, more specifically, an electrical circuit that combines circuit elements such as semiconductor elements.

[0060] In the above embodiment, the abnormality determination program is pre-stored (installed) in the storage 14, but the present invention is not limited to this. The program may be provided in a form stored on a non-transitory storage medium such as a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), or a USB (Universal Serial Bus) memory. The program may also be downloaded from an external device via a network.

[0061] The following additional notes are provided regarding the above-described embodiments.

[0062] (Supplementary Item 1) An anomaly detection device including: an acquisition unit that acquires one or more types of explanation series data that are time series data representing a situation, and one type of purpose series data that are time series data representing a result; a calculation unit that uses one or more types of explanation series data as input and calculates a scale that indicates the degree of difference in scale between the explanation series data used to train a prediction model that predicts one type of purpose series data and the explanation series data acquired by the acquisition unit; a prediction unit that predicts the purpose series data by adjusting the explanation series data acquired by the acquisition unit based on the scale and inputting the adjusted explanation series data into the prediction model, or by inputting the explanation series data acquired by the acquisition unit into the prediction model and adjusting the predicted purpose series data based on the scale; and a determination unit that compares the purpose series data predicted by the prediction unit with the purpose series data acquired by the acquisition unit adjusted based on the scale to determine whether or not there is an abnormality.

[0063] (Supplementary Item 2) The abnormality determination device according to Supplementary Item 1, wherein the calculation unit calculates the scale using statistical values ​​of data included in an interval designated as an interval with a high degree of confidence that the explanatory series data acquired by the acquisition unit is normal.

[0064] (Supplementary Item 3) The abnormality determination device according to Supplementary Item 1 or Supplementary Item 2, wherein the calculation unit calculates a plurality of scale candidates, and determines a scale that minimizes an error between the target series data acquired by the acquisition unit and the target series data predicted by the prediction unit when each of the plurality of scale candidates is applied as the scale to be used by the prediction unit.

[0065] (Supplementary Item 4) The abnormality determination device according to any one of Supplementary Items 1 to 3, wherein the calculation unit integrates scales calculated for each of multiple types of explanatory series data to calculate a scale to be used by the prediction unit.

[0066] (Supplementary Item 5) The abnormality determination device according to any one of Supplementary Items 1 to 4, further comprising an update unit that updates parameters of the prediction model so as to minimize an error between target series data predicted by the prediction unit and determined to be in a normal state by the determination unit, and target series data obtained by adjusting the target series data acquired by the acquisition unit based on the scale.

[0067] (Supplementary clause 6) An acquisition unit that acquires, as training data, one or more types of explanatory series data that are time series data representing a situation in a normal state and one type of purpose series data that are time series data representing a result, and acquires one or more types of explanatory series data and one type of purpose series data of a target to be determined; a learning unit that uses the training data to learn a prediction model that predicts one type of purpose series data using one or more types of explanatory series data as input; a calculation unit that calculates a scale that indicates the degree of difference in scale between the explanatory series data included in the training data and the explanatory series data of the target to be determined; a prediction unit that predicts the purpose series data by adjusting the explanatory series data of the target to be determined based on the scale and inputting it into the prediction model to predict the purpose series data, or inputting the explanatory series data of the target to be determined into the prediction model and adjusting the predicted purpose series data based on the scale; a judgment unit that compares the purpose series data predicted by the prediction unit with the purpose series data acquired by the acquisition unit adjusted based on the scale to determine whether or not there is an abnormality. an update unit that updates parameters of the prediction model so as to minimize an error between the target series data of the target that is determined to be in a normal state by the determination unit and the target series data obtained by adjusting the target series data included in the training data based on the scale.

[0068] (Supplementary Item 7) An anomaly detection method executed by an anomaly detection device including an acquisition unit, a calculation unit, a prediction unit, and a determination unit, wherein the acquisition unit acquires one or more types of explanation series data which are time series data representing a situation, and one type of target series data which is time series data representing a result; the calculation unit uses the one or more types of explanation series data as input and calculates a scale indicating the degree of difference in magnitude between the explanation series data used to train a prediction model that predicts one type of target series data and the explanation series data acquired by the acquisition unit; the prediction unit predicts the target series data by adjusting the explanation series data acquired by the acquisition unit based on the scale and inputting it into the prediction model, or by inputting the explanation series data acquired by the acquisition unit into the prediction model and adjusting the predicted target series data based on the scale; and the determination unit compares the target series data predicted by the prediction unit with the target series data acquired by the acquisition unit adjusted based on the scale, to determine whether or not an anomaly exists.

[0069] (Supplementary Item 8) An abnormality determination program for causing a computer to function as each part of the abnormality determination device according to any one of Supplementary Items 1 to 6.

[0070] (Supplementary Item 9) An anomaly detection device comprising: a memory; and at least one processor connected to the memory, wherein the processor is configured to: acquire one or more types of explanation series data which are time series data representing a situation, and one type of purpose series data which are time series data representing a result; calculate a scale indicating the degree of difference in scale between the explanation series data used to train a prediction model which predicts one type of purpose series data using the one or more types of explanation series data as input and the acquired explanation series data; predict the purpose series data by adjusting the acquired explanation series data based on the scale and inputting it into the prediction model; or predict the purpose series data by inputting the acquired explanation series data into the prediction model and adjusting the predicted purpose series data based on the scale; and determine whether or not an anomaly exists by comparing the predicted purpose series data with the purpose series data obtained by adjusting the acquired purpose series data based on the scale.

[0071] (Appendix 10) A non-transitory storage medium storing a program executable by a computer to execute an abnormality determination process, wherein the abnormality determination process: acquires one or more types of explanation series data which are time series data representing a situation, and one type of purpose series data which are time series data representing a result; calculates a scale indicating the degree of difference in magnitude between the explanation series data used to train a prediction model that predicts one type of purpose series data using the one or more types of explanation series data as input and the acquired explanation series data; adjusts the acquired explanation series data based on the scale and inputs it to the prediction model to predict the purpose series data, or inputs the acquired explanation series data to the prediction model and adjusts the predicted purpose series data based on the scale, thereby predicting the purpose series data; and compares the predicted purpose series data with the purpose series data obtained by adjusting the acquired purpose series data based on the scale to determine whether or not an abnormality exists.

[0072] REFERENCE SIGNS LIST 10 Abnormality determination device 11 CPU 12 ROM 13 RAM 14 Storage 15 Input unit 16 Display unit 17 Communication I / F 19 Bus 21 Acquisition unit during learning 22 Learning unit 23 Acquisition unit during determination 24 Calculation unit 25 Prediction unit 26 Determination unit 27 Update unit 30 Prediction model

Claims

1. An anomaly detection device comprising: an acquisition unit that acquires one or more types of explanation series data, which are time series data representing a situation, and one type of purpose series data, which is time series data representing a result; a calculation unit that uses one or more types of explanation series data as input and calculates a scale indicating the degree of difference in scale between the explanation series data used to train a prediction model that predicts one type of purpose series data and the explanation series data acquired by the acquisition unit; a prediction unit that predicts purpose series data by either adjusting the explanation series data acquired by the acquisition unit based on the scale and inputting it into the prediction model to predict purpose series data, or by inputting the explanation series data acquired by the acquisition unit into the prediction model and adjusting the predicted purpose series data based on the scale; and a determination unit that compares the purpose series data predicted by the prediction unit with the purpose series data acquired by the acquisition unit adjusted based on the scale to determine whether or not there is an abnormality.

2. The abnormality determination device according to claim 1, wherein the calculation unit calculates the scale using statistical values ​​of data included in an interval designated as an interval with a high degree of confidence of normality among the explanatory series data acquired by the acquisition unit.

3. An anomaly detection method executed by an anomaly detection device including an acquisition unit, a calculation unit, a prediction unit, and a judgment unit, wherein the acquisition unit acquires one or more types of explanation series data which are time series data representing a situation, and one type of target series data which is time series data representing a result; the calculation unit uses the one or more types of explanation series data as input and calculates a scale indicating the degree of difference in scale between the explanation series data used to train a prediction model that predicts one type of target series data and the explanation series data acquired by the acquisition unit; the prediction unit predicts the target series data by adjusting the explanation series data acquired by the acquisition unit based on the scale and inputting it into the prediction model, or by inputting the explanation series data acquired by the acquisition unit into the prediction model and adjusting the predicted target series data based on the scale; and the judgment unit compares the target series data predicted by the prediction unit with the target series data acquired by the acquisition unit adjusted based on the scale, and determines whether or not an anomaly exists.

4. An abnormality determination program for causing a computer to function as each part of the abnormality determination device according to claim 1 or claim 2.

Images