Abnormal data generation device and abnormal data generation method

Abstract

An abnormal data generation device according to one aspect of the present invention comprises a generation unit that generates second abnormal data by restoring noise through a reverse diffusion process of a trained diffusion model on the basis of the noise and the trained diffusion model, the noise having been sampled from a prescribed distribution, and the trained diffusion model having been trained with first abnormal data or normal data.

Description

Abnormal data generating device and abnormal data generating method

[0001] The present disclosure relates to an abnormal data generating device and an abnormal data generating method.

[0002] In recent years, the widespread use of ICT (Information and Communication Technology) devices in all aspects of society has led to large-scale communication outages having a major impact on social activities. As a result, technology that can detect anomalies in traffic data before a large-scale communication outage occurs is becoming increasingly important.

[0003] In recent years, rule-based anomaly detection has become difficult due to the increase in traffic data and the increasing complexity of networks, and many anomaly detection methods using deep learning have been proposed (for example, Non-Patent Document 1). Ideally, anomaly detection methods using deep learning should be able to acquire sufficient amounts of both normal and abnormal data. However, because anomalies generally occur infrequently, the current situation is that the amount of abnormal data is overwhelmingly smaller than the amount of normal data.

[0004] For this reason, it is common to train a deep learning model using only normal data through unsupervised learning. For example, in an anomaly detection method using an autoencoder (AE) as a deep learning model, the AE is trained to minimize its reconstruction error using only normal data (e.g., Non-Patent Document 2). This makes it possible to determine an anomaly when test data is given and the AE's reconstruction error for the test data is equal to or greater than a threshold, and to determine a normal state otherwise. In addition to the AE, other deep learning models used in anomaly detection methods using deep learning include generative models such as a variational autoencoder (VAE), a generative adversarial network (GAN), and a diffusion model.

[0005] Ryoichi Kawahara, Keishiro Watanabe, Shigeaki Harada, and Takehiro Kawada, "Utilizing AI in Network Operations," Communications Society Magazine No. 45, Summer 2018, pp. 29-38. Keishiro Watanabe, Kengo Tajiri, and Yusuke Nakano, "Deep Learning-Based Anomaly Detection Technology: DeAnoS: Deep Anomaly Surveillance," NTT Technical Journal, May 2019.

[0006] However, if a sufficient amount of abnormal data is available, it is expected that more accurate anomaly detection can be achieved by using this abnormal data to train a deep learning model using supervised learning techniques.

[0007] The present disclosure has been made in consideration of the above points, and aims to provide a technology that can generate abnormal data using a diffusion model.

[0008] An abnormal data generation device according to one aspect of the present disclosure includes a generation unit that generates second abnormal data based on noise sampled from a predetermined distribution and a trained diffusion model trained using first abnormal data or normal data, by restoring the noise through a de-diffusion process of the trained diffusion model.

[0009] A technique is provided that can generate anomalous data using a diffusion model.

[0010] FIG. 1 is a diagram for explaining an example of a diffusion model. FIG. 2 is a diagram for explaining an example of a proposed method. FIG. 3 is a diagram showing an example of a hardware configuration of an anomaly detection device according to an embodiment. FIG. 4 is a diagram showing an example of a functional configuration of an anomaly detection device according to an embodiment. FIG. 5 is a flowchart showing an example of an anomaly data generation process according to an embodiment. FIG. 6 is a flowchart showing an example of an anomaly detector construction process according to an embodiment. FIG. 7 is a flowchart showing an example of an anomaly detection process according to an embodiment. FIG. 8 is a diagram showing an example of an evaluation result of the proposed method.

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0012] <Diffusion Model> The following describes DDPM (Denoising Diffusion Probabilistic Models), which is one of the diffusion models. For details of DDPM, see, for example, Reference 1.

[0013] DDPM consists of a diffusion process and a de-diffusion process (generation process). An example of DDPM is shown in Figure 1. In the example shown in Figure 1, x ｔ－１ From x ｔ The dashed arrow in the direction indicates the diffusion process, and x ｔ From x ｔ－１ Each solid arrow in the direction represents a de-diffusion process.

[0014] In the diffusion process, the given data is divided into x ０ As a result, each data x ｔ Gaussian noise is sequentially added to the random noise x Ｔ At this time, the transition probability at step t (i.e., the amount of noise added at step t) is q(x ｔ |x ｔ－１ ) The Gaussian noise added at each step of the diffusion process is set in advance, so there are no parameters to be learned in the diffusion process. In the example shown in Figure 1, the total number of steps in the diffusion process is T.

[0015] On the other hand, in the de-diffusion process, data sampled from a Gaussian distribution is Ｔ As a result, each data x ｔ The noise is removed (denoised) sequentially from the original data x ０ (This is also called "recovered data") is recovered. At this time, the transition probability at step t (i.e., the amount of noise removed at step t) is p θ (x ｔ－１ |x ｔ ) where p θ (x ｔ－１ |x ｔ ) is the output of the neural network with the training parameter θ. That is, in the de-diffusion process, the transition probability at step t is the output p θ (x ｔ－１|x ｔ ) In the example shown in FIG. 1, the total number of steps in the despreading process is T, the same as in the spreading process.

[0016] At this time, in the DDPM, the learning parameter θ is learned so as to minimize the error between given learning data and restored data obtained by performing a diffusion process and a de-diffusion process on the learning data.

[0017] <Proposed Method> A method for generating abnormal data using DDPM, which is one of the diffusion models, will be described below (hereinafter also referred to as the "proposed method"). A set of normal data acquired from an anomaly detection target is called D １ = {x ｎ １ |n=1,...,N}, and the set of abnormal data is D ２ = {x ｍ ２ |m=1, ..., M}. Here, M<<N is assumed. That is, a situation is assumed in which only a small amount of abnormal data is obtained compared to normal data. However, M is assumed to be a number large enough to allow a DDPM with a certain degree of accuracy to be learned (it is not necessarily necessary to allow a highly accurate DDPM to be learned). Also, T' (≦T) is assumed to be a hyperparameter. Note that the required number of M depends on the size of the data acquired from the anomaly detection target (for example, if the data acquired from the anomaly detection target is image data, the number of channels, number of pixels, tasks, etc.), etc.

[0018] An example of the proposed method is shown in Figure 2. As shown in Figure 2, the proposed method executes the following steps 1 to 4.

[0019] Step 1: Abnormal data set D ２ The DDPM is trained using the abnormal data included in the normal data set D １ DDPM may be trained using N' (<N) pieces of normal data randomly sampled from the DDPM, where N' is not a large enough number to train a highly accurate DDPM.

[0020] Step 2: Sample noise from a normal distribution. Hereinafter, the noise sampled from a normal distribution is referred to as y ０ Let's say.

[0021] Step 3: Using the trained DDPM, the noise y ０ Hereinafter, the data denoised at step t of the despreading process is denoted as y ｔ This gives a set of denoised data {y ｔ |t=1, . . . , T} is obtained.

[0022] Step 4: Restore data Ｔ Depending on the result, one of the following actions (1) to (3) is performed. In the following, however, a label value of "1" indicates an abnormality, and a value of "0" indicates a normality.

[0023] (1) Restored data y Ｔ If y is treated as an abnormality ｔ Let (T'≦t≦T) be the label of ｔ = 1. In this case, the restored data y Ｔ is treated as abnormal data, so y ｔ This is because (T'≦t≦T-1) is also highly likely to be abnormal data.

[0024] (2) Restored data y Ｔ If not treated as abnormal, ｔ |t=1,...,T} is discarded. In this case, the restored data y Ｔ is not treated as abnormal data, so y ｔ This is because there is a high possibility that all of the data (1≦t≦T) are not abnormal data.

[0025] (3) Restored data y Ｔ When it is difficult to determine whether y is abnormal, for example, ｔ Let (T'≦t≦T) be the label of ｔ = 0.5. In this case, the restored data y Ｔ Since it is difficult to determine whether y is abnormal data or not, ｔ This is because (T'≦t≦T-1) is also likely to be difficult to distinguish.

[0026] It should be noted that which of the above (1) to (3) is performed depends on, for example, the restored data y Ｔ The user or the like may make a judgment by referring to the above. Also, only the above (1) or (2) may be performed without performing the above (3).

[0027] As a result, if the number of data labeled in step 4 is K, a set of labeled pseudo or artificial abnormal data E ３ = {(y ｋ , l ｋ ) |k=1,...,K} is obtained. ３ Let us call this the labeled pseudo anomalous data set, where K is a multiple of T-T'+1.

[0028] In addition, in step 4 above, the restored data y Ｔ The reason why the branching of (1) to (3) (or (1) to (2)) occurs depending on the normal distribution is that the number of abnormal data M is not sufficient to enable DDPM to be learned with high accuracy (or, when normal data is used in the above procedure 1, the number of samplings N' is insufficient, making DDPM learning unstable). Ｔ This is because there is a big change.

[0029] The above proposed method uses an extended model, and there are two major differences between data generation using an extended model and data generation using a VAE, GAN, or the like.

[0030] First, when the data to be generated is image data, it is experimentally known that image generation using DDPM is of higher quality than image generation using VAE or GAN (Reference 1). Therefore, in the proposed method, the abnormal data x ｍ ２ Since it is possible to generate data similar to the above, it is possible to generate data that appears more abnormal as pseudo-abnormal data.

[0031] The second point is that while VAE and GAN can obtain one output per sampling from a normal distribution, the extended model can obtain T outputs per sampling from a normal distribution, and these T outputs are output consecutively so as to restore the training data. For this reason, in the above proposed method, the restored data y Ｔ When treating y as abnormal data, ｔ (T' ≤ t ≤ T-1) can also be treated as anomalous data. This makes it possible to generate a large amount of pseudo-anomalous data with a single sampling, thereby reducing the number of labeling steps required in step 4 above.

[0032] Below, we use the above proposed method to generate a labeled pseudo-anomalous data set E ３ Generate a normal data set D １ and the abnormal data set D ２ and the labeled pseudo-anomalous data set E ３ An anomaly detection device 10 will be described that uses the above to construct an anomaly detector by a supervised learning method and then performs anomaly detection using the anomaly detector.

[0033] <Example of Hardware Configuration of Anomaly Detection Device 10> An example of the hardware configuration of the anomaly detection device 10 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the anomaly detection device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other so as to be able to communicate with each other via a bus 109.

[0034] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the anomaly detection device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0035] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0036] The communication I / F 104 is an interface for connecting to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is a variety of arithmetic devices such as a central processing unit (CPU) or a graphic processing unit (GPU).

[0037] 3 is an example, and the hardware configuration of the anomaly detection device 10 is not limited to this. For example, the anomaly detection device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0038] <Example of Functional Configuration of Anomaly Detection Device 10> Fig. 4 shows an example of the functional configuration of the anomaly detection device 10 according to this embodiment. As shown in Fig. 4, the anomaly detection device 10 according to this embodiment includes an anomaly data generation unit 201, an anomaly detector construction unit 202, and an anomaly detection unit 203. These units are realized, for example, by a process in which one or more programs installed in the anomaly detection device 10 are executed by the processor 108 or the like. The anomaly detection device 10 according to this embodiment also includes a storage unit 204. The storage unit 204 is realized, for example, by a storage area of ​​the auxiliary storage device 107. Note that the storage unit 204 may also be realized, for example, by a storage area of ​​a storage device (e.g., a storage device included in a database server) or the like that is communicatively connected to the anomaly detection device 10.

[0039] The abnormal data generation unit 201 generates a labeled pseudo abnormal data set E ３ Here, the abnormal data generation unit 201 includes a diffusion model training unit 211, a sampling unit 212, a restoration unit 213, and a label assignment unit 214. The diffusion model training unit 211 trains the DDPM by procedure 1 of the proposed method described above. The sampling unit 212 generates noise y ０ The restoration unit 213 samples the noise y ０ Restore data from Ｔ The labeling unit 214 creates pseudo-anomalous data that is labeled according to step 4 of the proposed method.

[0040] The anomaly detector construction unit 202 uses the normal data set D １ and the abnormal data set D ２ and the labeled pseudo-anomalous data set E ３ Using these, a machine learning model such as a neural network is trained using a supervised learning method. As a result, the trained machine learning model is obtained as an anomaly detector. Note that a neural network or the like appropriate for the task is used as the machine learning model to be trained. For example, when anomaly detection is performed using image recognition, a convolutional neural network or the like is used.

[0041] The anomaly detection unit 203 uses an anomaly detector to detect anomalies from the given test data. That is, the anomaly detection unit 203 calculates the degree of anomaly by inputting the test data to the anomaly detector, and determines that the data is abnormal if the degree of anomaly is equal to or greater than a predetermined threshold, and determines that the data is normal if not.

[0042] The storage unit 204 stores various data (e.g., learned DDPM, normal data set D １ , abnormal data set D ２ , labeled pseudo-anomalous data set E ３ , anomaly detectors, various hyperparameters, etc.)

[0043] 2, the abnormal data generation unit 201, the anomaly detector construction unit 202, and the anomaly detection unit 203 are included in one device, but these units may be distributed among multiple devices. In this case, the device including the abnormal data generation unit 201 may be called, for example, an "abnormal data generation device."

[0044] <Abnormal Data Generation Processing> The abnormal data generation processing according to this embodiment will be described with reference to FIG. 5. Hereinafter, the storage unit 204 stores a normal data set D １ and abnormal data set D ２ At least one of the above is stored.

[0045] The diffusion model learning unit 211 of the abnormal data generation unit 201 generates the abnormal data set D ２ (or normal data set D １ ) is used to learn the DDPM by procedure 1 of the proposed method described above (step S101). As a result, a learned DDPM is obtained. The learned DDPM is stored in the storage unit 204.

[0046] The following steps S102 to S104 are repeatedly executed as many times as necessary. For example, they may be repeatedly executed a predetermined number of times, or may be repeatedly executed until a predetermined number or more of pseudo-abnormal data are obtained.

[0047] The sampling unit 212 of the abnormal data generating unit 201 obtains the noise y ０(Step S102). That is, the sampling unit 212 samples the noise y ０ Sample the following.

[0048] The restoration unit 213 of the abnormal data generation unit 201 uses the trained DDPM to restore the noise y ０ Restore data from Ｔ (Step S103). That is, the restoration unit 213 restores the noise y ０ Restore data from Ｔ This restores the set of denoised data {y ｔ |t=1, . . . , T} is obtained.

[0049] The labeling unit 214 of the abnormal data generation unit 201 creates pseudo-abnormal data labeled according to step 4 of the proposed method (step S104). That is, for example, after the user of the anomaly detection device 10 determines which of steps (1) to (3) (or (1) to (2)) of step 4 should be used, the labeling unit 214 assigns y if it is determined to be step (1) or (3). ｔ (T'≦t≦T) is used as pseudo-anomalous data and labeled l ｔ If it is determined to be (2), {y ｔ |t=1, . . . , T}.

[0050] By repeatedly executing the above steps S102 to S104 as many times as necessary, a labeled pseudo abnormal data set E ３ = {(y ｋ , l ｋ ) |k = 1, ..., K} is obtained. Note that the labeled pseudo-anomalous data set E ３ is stored in the storage unit 204.

[0051] <Anomaly Detector Construction Process> The anomaly detector construction process according to this embodiment will be described with reference to FIG. 6. Hereinafter, the storage unit 204 stores a normal data set D １ and the abnormal data set D ２ and the labeled pseudo-anomalous data set E ３ It is assumed that the following are stored.

[0052] The anomaly detector construction unit 202 uses the normal data set D １ The normal data included in the abnormal data set D ２ (Step S201). That is, the anomaly detector construction unit 202 assigns a label to each normal data x ｎ １ For label l ｎ = 0, each abnormal data x ｍ ２ For label l ｍ = 1. This gives the labeled normal data set E １ = {(x ｎ １ , 0) | n = 1, ..., N} and a labeled abnormal data set E ２ = {(x ｍ ２ , 1) |m=1, . . . , M} is obtained.

[0053] The anomaly detector construction unit 202 uses a labeled normal data set E １ and the labeled abnormal data set E ２ and the labeled pseudo-anomalous data set E ３ and l are used as a training data set, and a machine learning model such as a neural network is trained by a supervised learning method to construct an anomaly detector (step S202). １ ∪E ２ ∪E ３ The learnable parameters of the machine learning model are learned so as to minimize the error between the predicted label when data x is input to the machine learning model and label l. This results in an anomaly detector being obtained as a trained machine learning model. The anomaly detector is stored in the storage unit 204.

[0054] <Abnormality Detection Processing> The abnormality detection processing according to this embodiment will be described with reference to FIG. 7. In the following, it is assumed that an anomaly detector is stored in the storage unit 204. It is also assumed that test data x to be subjected to abnormality detection is provided to the abnormality detection device 10. Note that the following steps S301 to S304 are executed each time test data x is provided.

[0055] The anomaly detection unit 203 uses an anomaly detector to calculate the degree of anomaly from the test data x (step S301). That is, the anomaly detection unit 203 inputs the test data x to the anomaly detector and calculates the degree of anomaly as the output (or a value calculated from the output).

[0056] The abnormality detection unit 203 determines whether the degree of abnormality is equal to or greater than a predetermined threshold value α (step S302).

[0057] If it is determined in step S302 that the degree of anomaly is equal to or greater than the predetermined threshold value α, the anomaly detection unit 203 outputs information indicating that an anomaly has occurred to a predetermined output destination (step S303). Note that the predetermined output destination is not limited to a specific output destination, and examples thereof include the display device 102 such as a display, other devices, equipment, and terminals communicably connected to the anomaly detection device 10.

[0058] On the other hand, if it is not determined in step S302 that the degree of abnormality is equal to or greater than the predetermined threshold value α, the abnormality detection unit 203 outputs information indicating normality to a predetermined output destination (step S304). Note that this step does not have to be executed.

[0059] <Evaluation> The proposed method was evaluated by performing a simulation using the MNIST dataset, a dataset of handwritten digits. In this simulation, anomaly detection was performed by classifying data labeled 9 in the MNIST dataset as normal and data labeled 4 as abnormal.

[0060] In the proposed method, the normal data set D １DDPM was trained using N' normal data randomly sampled from the table as training data. In this simulation, we performed five runs of simulations, one for generating pseudo-abnormal data with T = 1000, T' = 990, N = 5949, N' = 1200, M = 10, and K = 13 × (T' - T + 1) = 143, and one for not generating pseudo-abnormal data (i.e., K = 0), and compared the accuracy rates.

[0061] The results of this simulation are shown in Figure 8. As shown in Figure 8, the accuracy rate is higher when the proposed method is used than when pseudo-anomalous data is not generated. In Figure 8, the solid line represents the average accuracy rate, and the width around it represents the standard deviation.

[0062] As described above, the anomaly detection device 10 according to this embodiment generates pseudo or artificial anomaly data using DDPM, which is a diffusion model, and uses this anomaly data to build an anomaly detector through supervised learning, thereby enabling the construction of a highly accurate anomaly detector.

[0063] The anomaly detection device 10 according to the present embodiment is not limited to a specific field, but can be applied to any field that requires anomaly detection. Furthermore, the data input to the anomaly detector is not limited to specific data such as image data or traffic data, but various data can be input to the anomaly detector depending on the field to which the anomaly detection device 10 is applied.

[0064] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0065] [References] Reference 1: A. Jain J. Ho and P. Abbeel. Denoising diffusion probabilistic models. 34th Conference on Neural Information Processing Systems (NeurIPS), 2020.

[0066] 10 Anomaly detection device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Anomaly data generation unit 202 Anomaly detector construction unit 203 Anomaly detection unit 204 Storage unit 211 Diffusion model learning unit 212 Sampling unit 213 Restoration unit 214 Label assignment unit

Claims

1. An abnormal data generation device having a generation unit that generates second abnormal data by restoring noise sampled from a predetermined distribution and a trained diffusion model trained using first abnormal data or normal data through a de-diffusion process of the trained diffusion model.

2. The abnormal data generating device of claim 1, wherein, when the restored data from which the noise has been restored is data representing an abnormality, the generating unit generates the restored data and data restored up to a predetermined number of steps before the restored data as the second abnormal data.

3. The abnormal data generating device according to claim 1 or 2, wherein the diffusion model is a DDPM (Denoising Diffusion Probabilistic Model).

4. A computer-implemented abnormal data generation method comprising: a generation unit that generates second abnormal data by restoring noise sampled from a predetermined distribution and a trained diffusion model trained using first abnormal data or normal data through a de-diffusion process of the trained diffusion model, based on the noise sampled from the predetermined distribution and the trained diffusion model trained using first abnormal data or normal data.

Images