Abnormal data generation device and abnormal data generation method

The proposed denoising diffusion GAN model with conditional generative models effectively generates diverse pseudo-abnormal data, addressing the limitations of conventional methods and improving anomaly detection accuracy.

WO2026074690A1PCT designated stage Publication Date: 2026-04-09NT T INC
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
WO · WO
Patent Type
Applications
Current Assignee / Owner
Filing Date
2024-10-03
Publication Date
2026-04-09

AI Technical Summary

Technical Problem

Existing anomaly detection methods face challenges in generating diverse pseudo-abnormal data due to the low frequency of anomalies, leading to an imbalance with normal data, and conventional GAN-based methods are prone to mode collapse and limited in data variety.

Method used

A method utilizing a generalized denoising diffusion GAN model with conditional generative models, employing data mask prediction and controlled noise removal through initial noise and random numbers to generate diverse pseudo-abnormal data.

Benefits of technology

Enables the generation of varied pseudo-abnormal data, reducing the risk of mode collapse and allowing controlled generation of anomalous data, enhancing the accuracy of anomaly detection.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure JP2024035518_09042026_PF_FP_ABST
    Figure JP2024035518_09042026_PF_FP_ABST
Patent Text Reader

Abstract

An abnormal data generation device according to one aspect of the present disclosure comprises: a storage unit that stores a trained model composed of a diffusion model and a conditional generation model; a sampling unit that samples initial noise used in a despreading process of the diffusion model and each random number input when the conditional generation model generates a noise removal amount in each step of the despreading process; and a generation unit that generates abnormal data by removing noise from the initial noise in accordance with the noise removal amount generated by the conditional generation model in each step of the despreading process. The sampling unit samples outliers with respect to at least one or more of the initial noise and the random numbers.
Need to check novelty before this filing date? Find Prior Art

Description

Abnormal Data Generation Device and Abnormal Data Generation Method

[0001] The present disclosure relates to an abnormal data generation device and an abnormal data generation method.

[0002] In recent years, with the widespread use of ICT (Information and Communication Technology) devices in all aspects of society, large-scale communication failures have come to have a significant impact on social activities. For this reason, the importance of technologies for detecting anomalies in traffic data before large-scale communication failures occur has been increasing.

[0003] In recent years, due to the increase in traffic data and the complexity of networks, rule-based anomaly detection has become difficult, and many anomaly detection methods using deep learning have been proposed. In anomaly detection methods using deep learning, ideally, it is preferable that both normal data and abnormal data can be sufficiently obtained. However, generally, since the frequency of anomalies occurring is low, the current situation is that abnormal data is overwhelmingly less than normal data.

[0004] For this reason, a method of generating pseudo-abnormal data (hereinafter also referred to as pseudo-abnormal data) using a generative adversarial network (GAN: Generative Adversarial Network), which is one of the generative models, has been proposed (for example, Non-Patent Document 1).

[0005] HIRONORI MURASE AND KENJI FUKUMIZU. ALGAN: Anomaly Detection by Generating Pseudo Anomalous Data via Latent Variables. IEEE Access, 2022.

[0006] However, in conventional technologies including the method proposed in Non-Patent Document 1, it has not been possible to generate various pseudo-abnormal data.

[0007] The present disclosure has been made in view of the above points, and an object thereof is to provide a technology capable of generating various pseudo-abnormal data.

[0008] An abnormal data generation device according to an aspect of the present disclosure includes a storage unit that stores a learned model composed of a diffusion model and a conditional generation model, an initial noise used in the reverse diffusion process of the diffusion model, and each random number that is respectively input when the conditional generation model generates a noise removal amount at each step of the reverse diffusion process. A sampling unit that samples, and a generation unit that generates abnormal data by removing noise from the initial noise according to the noise removal amount generated by the conditional generation model at each step of the reverse diffusion process. The sampling unit samples an outlier with respect to at least one or more of the initial noise and each random number.

[0009] A variety of pseudo-abnormal data can be generated.

[0010] It is a diagram for explaining an example of DDPM. It is a diagram for explaining an example of denoising diffusion GANs. It is a diagram for explaining an example of model learning according to the proposed method. It is a diagram for explaining an example of abnormal data generation according to the proposed method. It is a diagram showing an example of the hardware configuration of the abnormal detection device according to the present embodiment. It is a diagram showing an example of the functional configuration of the abnormal detection device according to the present embodiment. It is a flowchart showing an example of the pseudo-abnormal data generation process according to the present embodiment. It is a flowchart showing an example of the abnormal detector construction process according to the present embodiment. It is a flowchart showing an example of the abnormal detection process according to the present embodiment.

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0012] <DDPM> DDPM (Denoising Diffusion Probabilistic Models) is one of the diffusion models and is composed of a diffusion process and a reverse diffusion process (Reference 1). An example of DDPM is shown in FIG. 1. In the example shown in FIG. 1, the dashed arrow in the direction from x t-1 to x t represents the diffusion process, and each solid arrow in the direction from x t to x t-1 represents the reverse diffusion process.

[0013] In the diffusion process, the given data is denoted as x 0 and for each data x t , Gaussian noise (hereinafter also referred to as diffusion noise) is sequentially added, and random noise x T is obtained. At this time, the transition probability at step t (that is, the amount of noise added at step t) is expressed by q(x t |x t-1 ). Since the diffusion noise added at each step of the diffusion process is preset, there is no learning target parameter in the diffusion process. In the example shown in FIG. 1, the total number of steps of the diffusion process is denoted as T.

[0014] On the other hand, in the reverse diffusion process, the data sampled from the normal distribution is denoted as x T and for each data x t , noise removal (denoising) is sequentially performed, and the original data x 0 (this is also called the restored data) is restored. At this time, the transition probability at step t (that is, the amount of noise removed at step t) is p θ (x t-1 |x t ). Here, p θ (x t-1 |x t ) is the output of a neural network with the learning target parameter θ. That is, in the reverse diffusion process, the transition probability at step t is approximated by the output p θ (x t-1 |x t ) of a neural network with the learning target parameter θ. In the example shown in FIG. 1, the total number of steps of the reverse diffusion process is also denoted as T as in the diffusion process.

[0015] At this time, in DDPM, for the given learning data, the diffusion process is performed to add noise to the data x t ~q(x t |x t-1 ), and then the reverse diffusion process is performed to remove noise from the data x t ~p<​​​​​

[0016] <Denoising Diffusion GANs> Denoising Diffusion GANs are a model that develops from conditional GANs (Reference 2) and DDPM. Like DDPM, denoising Diffusion GANs consist of a diffusion process and a backdiffusion process. An example of a denoising Diffusion GAN is shown in Figure 2. In the example shown in Figure 2, x t-1 from x t The dashed arrow pointing in the direction represents the diffusion process, x t from x t-1 Each solid arrow pointing in a direction represents a back-diffusion process.

[0017] In the diffusion process, the given data is x 0 Each data x t Spreading noise is successively added to it, and random noise x T This is obtained. At this time, the transition probability at step t (i.e., the amount of noise added at step t) is q(x t | x t-1 This is expressed as follows. Since the diffusion noise added at each step of the diffusion process is set in advance, there are no parameters to be learned in the diffusion process. In the example shown in Figure 2, the total number of steps in the diffusion process is T.

[0018] On the other hand, in the backdiffusion process, noise sampled from a normal distribution (hereinafter also called initial noise) is successively denoised (denoiced), and the original data x 0 This is restored. Below, we will represent the initial noise as ε.

[0019] At this time, the transition probability at step t (i.e., the probability of generating the denoised data at step t) is p θ (x t-1 | x t It is expressed by (z). Here, p θ (x t-1 | x t ,z) is the output of a conditional GAN ​​with the parameter θ to be learned. In a conditional GAN, x tBy inputting the random numbers z sampled from the standard normal distribution N(0,1) (hereinafter also called generator random numbers) into the generator, the noise-removed data x is obtained. t-1 It is generating.

[0020] If the total number of steps in the dediffusion process is T, then T generator random numbers are sampled. Therefore, one of the characteristics of denoising diffusion GANs is that each step in the dediffusion process uses random numbers following a standard normal distribution N(0,1). Below, in order to distinguish the generator random numbers of each step, the generator random number of step t is represented as z t We will represent it as follows.

[0021] In this case, denoising diffusion GANs perform a diffusion process on the given training data to add noise to it, resulting in data x t ~q(x) t | x t-1 ) and the data x generated by further performing a backdiffusion process t ~p θ (x t | x t+1 , z t+1 The target parameter θ is learned in such a way that it minimizes the error with ).

[0022] Furthermore, it has been experimentally verified that denoising distortion GANs are less prone to mode collapse than GANs (Reference 3).

[0023] <Data Mask Prediction> Data mask prediction is a technique that allows us to obtain data features even when labeled data is unavailable (References 4, 5). Data mask prediction is a model learning method that divides unlabeled data into masked and unmasked parts, and then predicts the masked part from the unmasked part. It is often called "inpainting" when the data is an image, and "imputation" when the data is time series data.

[0024] A concrete example of data mask prediction is to take time series data and mask normal data from a specific time period (e.g., from 12:00 to 13:00), then train a model to predict the data in the masked area from normal time series data for the remaining time periods.

[0025] <Proposed Method> Below, we propose a method that can generate diverse pseudo-anomalous data by using a generalized model of denoising distortion GANs (hereinafter also referred to as the proposed model) and data mask prediction.

[0026] ≪Proposed Model≫ Denoising Diffusion GANs use conditional GANs for denoising the despreading process, but the proposed method does not need to be limited to conditional GANs. Instead, it can use a general conditional generative model implemented by a neural network that takes the unmasked portion of the input data of the despreading process, a generator random number, and the data as input. That is, the transition probability at step t of the despreading process (data x t-1 The probability of generation is p θ (x t-1 | x t Any conditional generative model expressed by (, z, unmask) can be used. Here, unmask is the unmasked portion of the input data for the dediffusion process. For example, as a proposed model, instead of the conditional GAN ​​of denoising diffusion GANs, a model using conditional VAEs (Variational Autoencoders) or the like can be adopted. Note that a conditional generative model is a generative model that can be given conditions for the output (more precisely, data representing the conditions).

[0027] <Generation of Pseudo-Abnormal Data> The proposed method generates pseudo-abnormal data by following steps 1 to 3, under the assumption that sufficient normal data exists.

[0028] Procedure 1: Each normal data point is divided into a masked portion and an unmasked portion. The proposed model is then trained to predict the masked portion from the unmasked portion. At this time, the unmasked portion is used as a condition for the conditional generative model included in the proposed model. Furthermore, when performing the backdiffusion process, a random generator number z is generated from a predetermined probability distribution (e.g., standard normal distribution N(0,1), etc.). t Sample (t=1, ..., T), where T is the total number of steps in the diffusion and backdiffusion processes. This is shown in Figure 3. In the example shown in Figure 3, the total number of steps in the diffusion and backdiffusion processes is set to T=5. As shown in Figure 3, for example, the mask portion of the normal data is x 0 The diffusion process is carried out as x 5 After generating this x 5 Using the initial noise and the unmasked portion of the normal data as the condition 'unmask' of the conditional generative model, a despreading process is performed to restore the original data (i.e., the masked portion), and then, similar to normal DDPM, the original data x 0 A diffusion process was performed on x to add noise. t And then, data x generated by performing a further backdiffusion process t The target parameter θ of the proposed model is trained to minimize the error.

[0029] Step 2: Initial noise ε and random numbers z for each generator t Samples are taken at (t=1, ..., T). At this time, initial noise ε and generator random number z are used. t At least one of these is considered an outlier. For example, initial noise ε and generator random number z. t At least one of these is sampled from a normal distribution with a variance greater than 1.

[0030] Step 3: After dividing the arbitrary normal data into a masked portion and an unmasked portion, the unmasked portion is used as a condition for the conditional generative model, with the initial noise ε and each generator random number z. t Using this, the dediffusion process of the trained proposed model is performed. Then, the data x obtained at a certain step t of this dediffusion process is used. tThis is used as the data for the mask portion of the normal data. As a result, data in which only the mask portion of the original normal data is abnormal is obtained as pseudo-abnormal data. This is shown in Figure 4. In the example shown in Figure 4, the total number of steps in the backdiffusion process is set to T = 5. Also, in the example shown in Figure 4, the generator random number z is sampled from the normal distribution N(0,10). 4 This is used. In this case, the data x obtained in step t satisfying t < 4 t This will be used as the data for the mask portion of the normal data.

[0031] Note that in step 3 above, the unmasked portion may be omitted, meaning all of the normal data may be masked. In this case, pseudo-abnormal data can be obtained in which all parts of the original normal data are abnormal.

[0032] ≪Advantages≫ The proposed method has the following advantages over the prior art, including the method proposed in Non-Patent Document 1.

[0033] - The method proposed in Non-Patent Document 1 uses a GAN, which may lead to mode collapse. In contrast, the proposed method, even when using a conditional GAN ​​as the conditional generative model included in the proposed model, is less prone to mode collapse, similar to denoising diffusion GANs.

[0034] - In the method proposed in Non-Patent Document 1, a GAN is used, so the only place where the random numbers can be changed is the input part of the generator. Therefore, it is unclear what kind of pseudo-anomalous data can be generated by changing the random numbers. In contrast, in the proposed method, there is a high possibility that anomalous data completely different from normal data can be obtained by using outliers in the initial step or nearby of the despreading process, while there is a high possibility that anomalous data similar to normal data can be obtained by using outliers in the final step or nearby. That is, for example, initial noise ε or generator random number z in the initial step or a step nearby t By making it an outlier, there is a high possibility of obtaining abnormal data that is completely different from normal data, and the generator random number z in the final step or a step close to itt By treating certain values ​​as outliers, the likelihood of obtaining abnormal data that closely resembles normal data increases. Therefore, compared to the method proposed in Non-Patent Document 1, it is possible to easily control the generation of desired pseudo-abnormal data, and a wide variety of pseudo-abnormal data can be generated.

[0035] The following describes an anomaly detection device 10 that generates pseudo-anomaly data using the proposed method described above, constructs an anomaly detector using a supervised learning method, and then performs anomaly detection using that anomaly detector.

[0036] <Example Hardware Configuration of Anomaly Detection Device 10> An example hardware configuration of the anomaly detection device 10 according to this embodiment is shown in Figure 5. As shown in Figure 5, the anomaly detection device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these hardware components is connected to communicate via a bus 109.

[0037] The input device 101 is, for example, a keyboard, mouse, touch panel, physical buttons, etc. The display device 102 is, for example, a display, display panel, etc. Note that the abnormality detection device 10 does not necessarily have to have at least one of the input device 101 and the display device 102.

[0038] The external I / F 103 is an interface with external devices such as the recording medium 103a. Examples of recording media 103a include CDs (Compact Discs), DVDs (Digital Versatile Disks), SD memory cards (Secure Digital memory cards), and USB (Universal Serial Bus) memory cards.

[0039] The communication interface 104 is an interface for connecting to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 108 is a computing device such as a CPU (Central Processing Unit) or GPU (Graphic Processing Unit).

[0040] Note that the hardware configuration shown in Figure 5 is just one example, and the hardware configuration of the anomaly detection device 10 is not limited to this. For example, the anomaly detection device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, it may not have some of the hardware shown, or it may have various other hardware components besides the hardware shown.

[0041] <Example of Functional Configuration of Anomaly Detection Device 10> An example of the functional configuration of the anomaly detection device 10 according to this embodiment is shown in Figure 6. As shown in Figure 6, the anomaly detection device 10 according to this embodiment has an anomaly data generation unit 201, an anomaly detector construction unit 202, and an anomaly detection unit 203. Each of these units is realized, for example, by a process in which one or more programs installed in the anomaly detection device 10 are executed by a processor 108 or the like. The anomaly detection device 10 according to this embodiment also has a storage unit 204. The storage unit 204 is realized, for example, by the storage area of ​​an auxiliary storage device 107. The storage unit 204 may also be realized by the storage area of ​​a storage device (e.g., a storage device of a database server) that is communicably connected to the anomaly detection device 10.

[0042] The abnormal data generation unit 201 generates pseudo-abnormal data using the proposed method described above. Here, the abnormal data generation unit 201 includes a model learning unit 211, a sampling unit 212, and a generation unit 213. The model learning unit 211 learns the proposed model according to step 1 of the proposed method described above. The sampling unit 212 collects initial noise ε and random numbers z for each generator according to step 2 of the proposed method described above. t The data (t=1, ..., T) is sampled. The generation unit 213 generates pseudo-anomalous data according to step 3 of the proposed method described above.

[0043] The anomaly detection unit 202 uses normal data and pseudo-anomaly data generated by the anomaly data generation unit 201 to train a machine learning model such as a neural network using supervised learning methods. If true anomaly data exists, the anomaly detection unit 202 may also use the true anomaly data to train the machine learning model. This results in a trained machine learning model being used as an anomaly detection device. The machine learning model used for training will depend on the task; for example, a convolutional neural network may be used for anomaly detection using image recognition.

[0044] The anomaly detection unit 203 uses an anomaly detector to detect anomalies from the given test data. Specifically, the anomaly detection unit 203 calculates the degree of anomaly by inputting the test data into the anomaly detector, and determines that it is an anomaly if the degree of anomaly is above a predetermined threshold, and normal otherwise.

[0045] The memory unit 204 stores various types of data (e.g., trained proposed model, normal data, pseudo-abnormal data, true abnormal data, anomaly detector, various hyperparameters, etc.).

[0046] In the example shown in Figure 6, the abnormal data generation unit 201, the abnormality detector construction unit 202, and the abnormality detection unit 203 are all contained within a single device. However, these units may be distributed among multiple devices. In this case, the device containing the abnormal data generation unit 201 may be called, for example, an "abnormal data generation device" or a "pseudo-abnormal data generation device."

[0047] <Example of pseudo-abnormal data generation process> An example of the pseudo-abnormal data generation process according to this embodiment will be described with reference to Figure 7. In the following, it will be assumed that a sufficient number of normal data are stored in the storage unit 204.

[0048] The model learning unit 211 of the abnormal data generation unit 201 learns the proposed model using normal data according to step 1 of the proposed method described above (step S101). That is, the model learning unit 211 divides each normal data into a masked portion and an unmasked portion, and then learns the proposed model to predict the masked portion from the unmasked portion. This gives rise to the trained proposed model. The trained proposed model is stored in the storage unit 204.

[0049] Steps S102 to S104 below are repeated as many times as necessary. For example, they may be repeated a predetermined number of times, or they may be repeated until a predetermined number or more of pseudo-abnormal data are obtained.

[0050] The sampling unit 212 of the abnormal data generation unit 201 uses the initial noise ε and each generator random number z according to procedure 2 of the proposed method described above. t (t=1, ..., T) are sampled (step S102). At this time, the sampling unit 212 samples the initial noise ε and the generator random number z. t At least one of these should be considered an outlier.

[0051] The generation unit 213 of the abnormal data generation unit 201 generates pseudo-abnormal data using normal data according to step 3 of the proposed method described above (step S103). That is, the generation unit 213 divides the normal data into a masked portion and an unmasked portion, and uses the unmasked portion as a condition for the conditional generative model included in the trained proposed model, with initial noise ε and each generator random number z. t The dediffusion process of the trained proposed model is performed using (t=1, ..., T). Then, the generation unit 213 processes the data x obtained at a certain step t of this dediffusion process. tBy using this as the data for the mask portion of the normal data, pseudo-abnormal data is generated. This yields pseudo-abnormal data. The pseudo-abnormal data is stored in the storage unit 204.

[0052] <Example of Anomaly Detector Construction Process> An example of the anomaly detector construction process according to this embodiment will be described with reference to Figure 8. Hereinafter, it will be assumed that normal data, true anomaly data, and pseudo-anomaly data are stored in the storage unit 204. However, true anomaly data does not have to be stored in the storage unit 204 (i.e., true anomaly data does not have to be present).

[0053] The anomaly detection unit 202 acquires normal data, true anomaly data, and pseudo-anomaly data from the storage unit 204 (step S201).

[0054] The anomaly detection unit 202 uses normal data, true anomaly data, and pseudo-anomaly data as training data and constructs an anomaly detection unit by training a machine learning model such as a neural network using supervised learning methods (step S202). As a result, a trained machine learning model is obtained as an anomaly detection unit. The anomaly detection unit is stored in the storage unit 204.

[0055] <Example of Anomaly Detection Processing> An example of the anomaly detection processing according to this embodiment will be described with reference to Figure 9. Hereinafter, it will be assumed that the anomaly detector is stored in the storage unit 204. Furthermore, it will be assumed that the anomaly detection device 10 is provided with test data to be detected as an anomaly. Steps S301 to S304 below will be executed each time test data is provided.

[0056] The anomaly detection unit 203 calculates the degree of anomaly from the test data using an anomaly detector (step S301). That is, the anomaly detection unit 203 calculates the degree of anomaly as an output (or a value calculated from that output) by inputting the test data into the anomaly detector.

[0057] The anomaly detection unit 203 determines whether the degree of anomaly is above a predetermined threshold (step S302).

[0058] If the abnormality level is determined to be above a predetermined threshold in step S302, the abnormality detection unit 203 outputs information indicating that an abnormality has occurred to a predetermined output destination (step S303). The predetermined output destination is not limited to a specific destination, but examples include a display device 102 such as a display, other devices or equipment, terminals, etc. that are communicatively connected to the abnormality detection device 10.

[0059] On the other hand, if the abnormality level is not determined to be above a predetermined threshold in step S302, the abnormality detection unit 203 outputs information indicating that it is normal to a predetermined output destination (step S304). Note that this step is optional.

[0060] <Summary> As described above, the anomaly detection device 10 according to this embodiment generates pseudo-anomalous data (or may be called artificial anomaly data) using a model that generalizes denoising diffusion GANs into a general conditional generative model, and constructs an anomaly detector using this anomaly data and a supervised learning method. This makes it possible to construct an anomaly detector with high accuracy.

[0061] Furthermore, the fields to which the anomaly detection device 10 according to this embodiment can be applied are not limited to specific fields; it can be applied to any field where anomaly detection is necessary. Also, the data that is input to the anomaly detector is not limited to specific data such as image data or traffic data; various types of data can be input to the anomaly detector depending on the field to which the anomaly detection device 10 is applied.

[0062] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0063] 1. A. 1. A. 1:A. Jain J. Ho and P. Abel. Denoising diffusion probabilistic models. 34th Conference on Neural Information Processing Systems (NeurIPS), Conditional Generative Adversarial Nets . Character 3: Zhisheng Xiao , Karsten Kreis , and Arash Vahdat TACKLING THE GENERATIVE LEARNING TRILEMMA WITH DENOISING DIFFUSION CAREFULLY . The Tenth International Conference on Learning Representations (ICLR). 2022. Environmental Protection 4:Chenguang Fang, Chen Wang. Time Series Data Imputation: A Survey of Deep Learning Approaches , arXiv preprint arXiv:2011.11347. Figure 5: Gui Lin Liu Fitsum A. Reda Kevin J. Shih Ting Chun Wang Andrew Tao Bryan Catanzaro .Image Painting for Irregular Holes Using Partial Convolutions . European Conference on Computer Vision (ECCV), 2018.

[0064] 10 Anomaly detection device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Anomaly data generation unit 202 Anomaly detector construction unit 203 Anomaly detection unit 204 Storage unit 211 Model learning unit 212 Sampling unit 213 Generation unit

Claims

1. An abnormal data generation device comprising: a storage unit for storing a trained model composed of a diffusion model and a conditional generative model; a sampling unit for sampling initial noise used in the despreading process of the diffusion model and each random number input when the conditional generative model generates a noise reduction amount at each step of the despreading process; and a generation unit for generating abnormal data by removing noise from the initial noise according to the noise reduction amount generated by the conditional generative model at each step of the despreading process, wherein the sampling unit samples outliers with respect to at least one of the initial noise and each random number.

2. The abnormal data generation apparatus according to claim 1, wherein the generation unit generates the abnormal data using at least a portion of the given normal data as conditions for the conditional generation model.

3. The abnormal data generation apparatus according to claim 1 or 2, wherein the generation unit generates abnormal data from denoised data generated in an intermediate step of the back-diffusion process, or from denoised data generated in the final step of the back-diffusion process.

4. A method for generating abnormal data, wherein a computer performs the following steps: a storage step of storing a trained model consisting of a diffusion model and a conditional generative model in a memory unit; a sampling step of sampling initial noise used in the despreading process of the diffusion model and each random number input when the conditional generative model generates a noise reduction amount at each step of the despreading process; and a generation step of generating abnormal data by removing noise from the initial noise according to the noise reduction amount generated by the conditional generative model at each step of the despreading process, wherein the sampling step samples outliers with respect to at least one of the initial noise and each random number.