JP5964016B2 - Abnormal event detection rule automatic extraction method, abnormal event detection rule automatic extraction device - Google Patents

Description

  The present invention relates to an abnormal event detection rule automatic extraction method and an abnormal event detection rule automatic extraction device that automatically generate a rule for detecting an abnormal event that occurs in an observation target.

  There is a technique for detecting abnormal behavior by comparing the behavior of a person to be observed with a predetermined determination rule (see Patent Documents 1 and 2). For example, there is a monitoring system in which a place and an action are defined as an abnormal action pattern, and an action similar to the defined action at the defined place is detected as an abnormal action (see Patent Document 3). In this monitoring system, staggered walking or staggered walking in a dangerous area (such as a sidewalk or a platform edge of a station) is detected as abnormal behavior.

  In addition, the monitoring target is analyzed in units of elements (movement of each part of the human body, appearance identification, number of visual recognition actions), and the monitoring items of the monitoring target are determined based on predetermined determination rules for each monitoring element. However, there is a system that outputs an alarm based on the comprehensive judgment (see, for example, Patent Document 4). In addition, it analyzes the general behavior of people such as walking and bending, and based on the time-series pattern data related to this general behavior, identifies whether or not a specific dedicated behavior (for example, transition from walking to bending, After that, there is an image monitoring system that determines that the patient is sick if the bending action continues for N seconds or longer (see Patent Document 5).

JP 2004-328622 A JP 2006-285399 A JP 2007-89105 A JP 2006-28784 A JP 2007-272488 A

  In the method of detecting an abnormal event by matching with a pre-defined judgment rule in the prior art document, an abnormal event is detected based on obvious temporal / spatial knowledge / rules.・ It is difficult to detect abnormal types of events where rules are difficult to obtain. For example, when detecting a suspicious person in a large parking lot, the rules for identifying a suspicious person are high because there is a high degree of freedom for people to enter and exit, and there are a wide variety of possible behavior patterns and individual differences. It is difficult to determine exactly.

  In addition, since the determination rule is set by the system designer or the like, the determination rule itself tends to be subjective. Furthermore, since there are many parameters constituting the determination rule, it takes time to set the parameters, and there is a problem that the detection accuracy of the abnormal event depends on how the parameters are set.

  The present invention is intended to solve the above-described problem, and includes an abnormal event detection rule automatic extraction method and an abnormal event detection rule automatic extraction device capable of automatically generating an objective rule for abnormal event detection. It is intended to provide.

  The gist of the present invention for achieving the object lies in the inventions of the following items.

[1] and the abnormal event database time series data is registered regarding abnormal events, it is compared with the normal event database time series data is registered about the health event, one that is registered in the abnormal event database abnormal event Extract time-series data patterns of any length that appear in some sections of the time-series data related to and that do not appear in the time-series data of all normal events registered in the normal event database An abnormal event detection rule automatic extraction method, wherein the extracted pattern is registered in the rule registration unit as an abnormal event detection rule.

In the above invention and the following [ 5 ] and [ 6 ], a rule for detecting an abnormal event is automatically generated by excluding data included in the data regarding a normal event from the data regarding the abnormal event. In other words, normal event sample data and abnormal event sample data are prepared as abnormal event detection data, and abnormal event detection rules are included in the abnormal event sample data but not in the normal event sample data. Automatically extract as.

Further, the data related to the abnormal event and the normal event is time-series pattern data representing the transition of the state of the observation target when an abnormality occurs and the transition of the state of the observation target at the normal time. For example, time-series pattern data defines the state of the observation target with motion (motion) elements, time (time) elements, space (location) elements, etc., and represents the temporal transition of the states defined by these elements. Configure as data.

[ 2 ] An abnormal event database in which data related to abnormal events is registered and a normal event database in which data related to normal events are registered are included in the abnormal event database and not included in the normal event database. An abnormal event detection rule automatic extraction method for extracting a pattern of data and registering the extracted pattern as an abnormal event detection rule in a rule registration unit,
The data is time-series pattern data representing the transition of the state of the observation target,
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
The time series pattern set that is included in the time series pattern set generated from the abnormal event database and that is not included in the time series pattern set generated from the normal event database is the rule registration as the abnormal event detection rule. abnormal event detection rules automatically extracting how to and registers in the part.

In the above invention and the following [7] and [8] , each of the time series pattern data of normal events and the time series pattern data of abnormal events is decomposed into time series pattern sets for each number of state transitions (for each length), For each pattern length, compare the time series pattern set of the abnormal event with the time series pattern set of the normal event, and include the time series pattern set of the abnormal event and not the time series pattern set of the normal event The set is extracted and registered as an abnormal event detection rule. Since the abnormal event detection rule can be obtained as a rule for each number of state transitions, an abnormal event can be detected in a multifaceted and short time with reference to the number of state transitions (pattern length).

[ 3 ] An abnormal event database in which data related to abnormal events is registered and a normal event database in which data related to normal events are compared are included in the abnormal event database and are not included in the normal event database. An abnormal event detection rule automatic extraction method for extracting a pattern of data and registering the extracted pattern as an abnormal event detection rule in a rule registration unit,
The data is time-series pattern data representing the transition of the state of the observation target,
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
From among the abnormal event detection rule candidate, the sequence pattern set when extracted in filtering condition set by the user as the abnormal event detection rules, you and registers the rule registration unit abnormal event detection rule Automatic extraction method.

In the above invention and the following [9] and [10], the time series pattern data of normal events and the time series pattern data of abnormal events are decomposed into time series pattern sets for each number of state transitions (for each length), respectively. For each length, compare the time series pattern set of the abnormal event with the time series pattern set of the normal event, and include the time series pattern set of the abnormal event and not the time series pattern set of the normal event. Are selected as abnormal event detection rule candidates, and further extracted based on specific conditions, for example, occurrence frequency, are registered as abnormal event detection rules. Since an abnormal event detection rule can be obtained as a rule for each number of state transitions, an abnormal event can be detected in a multifaceted and short time on the basis of the number of state transitions (pattern length). In addition, since abnormal event detection rule candidates narrowed down under specific conditions are used as abnormal event detection rules, false detections in which abnormal events are not abnormal events are reduced.

[ 4 ] Time-series pattern data representing the transition of the state of the observation object, when the data related to normal events is time-series pattern data having a length corresponding to the predetermined number of state transitions from the registered normal event database Generating a series pattern set is performed by generating all possible time series pattern sets for each length of the time series pattern set, and these time series pattern sets are registered. An abnormal event detection rule automatic extraction method comprising: registering as a rule in a normal event rule registration unit in which a rule for determining an abnormal event is registered when all the rules do not match.

  In the above invention and the following [11] and [12], the abnormal event detection rule is generated from the data related to the normal event, so that it is possible to cope with the case where it is difficult to obtain the data related to the abnormal event.

[5] acquires time-series data relating to the abnormal event from the abnormal event database, a data acquisition unit for acquiring time series data about the health event from normal event database,
The time series data related to the abnormal event acquired from the abnormal event database is compared with the time series data related to the normal event acquired from the normal event database, and the time related to any abnormal event registered in the abnormal event database. appeared in some sections in the series data, and extracts an arbitrary pattern of the time series data of a length not appearing in the time-series data of all normal events the registered normal event database extract And
An abnormal event detection rule automatic extraction device comprising: an output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule.

[ 6 ] An abnormal event database in which time series data regarding abnormal events are registered;
A normal event database in which time-series data related to normal events is registered;
A rule registration unit;
The abnormal event database and the normal event database are compared , appear in a part of time series data related to any abnormal event registered in the abnormal event database, and the normal event database An extraction unit that extracts a pattern of time series data of an arbitrary length that does not appear in time series data of all normal events registered in
An abnormal event detection rule automatic extraction apparatus comprising: a registration control unit that registers the pattern extracted by the extraction unit as an abnormal event detection rule in the rule registration unit.

[ 7 ] A data acquisition unit that acquires data on abnormal events from the abnormal event database and acquires data on normal events from the normal event database;
Extraction that extracts data patterns that are included in the abnormal event database and not included in the normal event database by comparing the data acquired from the abnormal event database with data acquired from the normal event database And
An output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data Ri Ah in series pattern data when representing the transition of the observation target state,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set included in the time series pattern set generated from the abnormal event database and not included in the time series pattern set generated from the normal event database is used as the abnormal event detection rule. It shall be the abnormal event detection rule automatic extraction apparatus.

[ 8 ] An abnormal event database in which data on abnormal events are registered;
A normal event database in which data related to normal events are registered;
A rule registration unit;
An extraction unit that compares the abnormal event database with the normal event database and extracts a pattern of data that is included in the abnormal event database and not included in the normal event database;
A registration control unit that registers the pattern extracted by the extraction unit in the rule registration unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data is time-series pattern data representing the transition of the state of the observation target,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is used as the abnormal event detection rule. It shall be the abnormal event detection rule automatic extraction apparatus.

[ 9 ] A data acquisition unit that acquires data on abnormal events from the abnormal event database and acquires data on normal events from the normal event database;
Extraction that extracts data patterns that are included in the abnormal event database and not included in the normal event database by comparing the data acquired from the abnormal event database with data acquired from the normal event database And
An output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data is time-series pattern data representing the transition of the state of the observation target,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
Said different from the normal event detection rule candidate, the sequence pattern set when extracted in filtering condition set by the user, the you, characterized in that the abnormal event detection rule abnormal event detection rule automatic extractor.
[10] An abnormal event database in which data on abnormal events are registered;
A normal event database in which data related to normal events are registered;
A rule registration unit;
An extraction unit that compares the abnormal event database with the normal event database and extracts a pattern of data that is included in the abnormal event database and not included in the normal event database;
A registration control unit that registers the pattern extracted by the extraction unit in the rule registration unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data is time-series pattern data representing the transition of the state of the observation target,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
A time series pattern set extracted from the abnormal event detection rule candidates under a narrowing condition set by the user is used as the abnormal event detection rule.
An abnormal event detection rule automatic extraction device characterized by that.

[11] A data acquisition unit that acquires time-series pattern data representing a transition of the state of an observation target from a normal event database in which data related to normal events is registered;
From the time series pattern data acquired by the data acquisition unit, when generating a sequence pattern set, when the sequence pattern set its length for each length of the time series pattern data in a predetermined state transition number of times the length A rule generator that generates all time series pattern sets that can be taken ,
An abnormal event detection rule automatic extraction device comprising: an output unit that outputs a time-series pattern set generated by the rule generation unit as a rule for determining an abnormal event when it does not match all rules .

[12] For normal events, a normal event database in which time-series pattern data representing the transition of the state of the observation target is registered;
A normal event rule registration unit in which a rule for determining an abnormal event is registered when it does not match all registered rules;
For each length of the time series pattern set, generating a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transitions from the time series pattern data registered in the normal event database. A rule generator that generates all time series pattern sets that can be taken with the length ; and
An abnormal event detection rule automatic extraction device comprising: a registration control unit that registers a time series pattern set generated by the rule generation unit as the rule in the normal event rule registration unit.

  In the abnormal event detection rule automatic extraction method and the abnormal event detection rule automatic extraction device according to the present invention, an objective rule for detecting an abnormal event can be automatically generated.

It is a block diagram which shows schematic structure of the abnormal event detection rule automatic extraction apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the abnormal event detection rule automatic extraction method of this invention. It is a flowchart which shows the process of the abnormal event detection rule automatic extraction apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the data regarding an abnormal event, and the time series pattern set produced | generated from this data. It is explanatory drawing which shows an example of the data regarding a normal event, and the time series pattern set produced | generated from this data. It is explanatory drawing which shows the rule candidate for abnormal event detection selected from the time series pattern set of FIG. 4, FIG. It is explanatory drawing which shows the example of a rule extraction based on a cumulative occurrence probability. It is explanatory drawing which shows the example of rule extraction based on occurrence frequency. It is explanatory drawing which shows the example of extraction based on rule length. It is explanatory drawing which shows the example of extraction on the condition that a specific pattern (AB) is included. It is explanatory drawing which shows the component of the basic action of the person in a parking lot. It is explanatory drawing which shows an example of the normal action sequence set produced | generated from the time series pattern data of normal action. It is explanatory drawing which shows an example of the suspicious action sequence set produced | generated from the time series pattern data of suspicious action (abnormal action). It is explanatory drawing which shows the suspicious action sequence rule derived | led-out from the action sequence set of FIG. 12, FIG. It is a block diagram which shows schematic structure of the abnormal event detection rule automatic extraction apparatus which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows the process of the abnormal event detection rule automatic extraction apparatus which concerns on the 2nd Embodiment of this invention. It is explanatory drawing which shows the list of the abnormal event, normal event, and feature-value which are related to the failure diagnosis of an apparatus, and abnormal weather prediction.

  Hereinafter, various embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 shows a schematic configuration of an abnormal event detection rule automatic extraction apparatus 10 according to the first embodiment of the present invention. The abnormal event detection rule automatic extraction device 10 detects the occurrence of an abnormal event such as the appearance of a suspicious person in the parking lot, the occurrence of an abnormality in various devices, the occurrence of abnormal weather such as a sudden thunderstorm, It is a device that performs the function of automatically generating rules for analyzing and detecting observation data of various items related to equipment and weather.

  The abnormal event detection rule automatic extraction device 10 includes an input unit 11 that receives data input from the outside and a setting operation from the user, an output unit 12 that outputs data to the outside, displays various data to the user, and the like. A processing unit 13 that performs various processes related to generation, a database unit 14 in which sample data related to abnormal events and normal events are registered in advance, and an abnormal event detection rule registration unit 15 that registers the generated rules are configured. . The output unit 12 also functions to output the generated rule to an external device, for example, an abnormal event detection device.

  The processing unit 13 includes a CPU (Central Processing Unit), a ROM (Read Only Memory) storing a program executed by the CPU and various fixed data, a RAM (Random Access Memory), and the like as main parts. The processing unit 13 functions as a data acquisition unit 20, an abnormal event detection rule candidate search unit 21, an abnormal event detection rule extraction unit 22, and a registration control unit 28.

  The database unit 14 includes a normal event time series pattern DB unit 24 in which data related to normal events is registered, and an abnormal event time series pattern DB unit 25 in which data related to abnormal events are registered. Here, the data registered in the normal event time-series pattern DB unit 24 and the abnormal event time-series pattern DB unit 25 are sample data relating to normal events and abnormal events, and are also subject to observation (persons in the parking lot and monitoring targets). Time-series pattern data representing the temporal transition of the state of equipment, weather, etc.).

  The data acquisition unit 20 functions to acquire data related to abnormal events from the abnormal event time series pattern DB unit 25 and to acquire data related to normal events from the normal event time series pattern DB unit 24. The abnormal event detection rule candidate search unit 21 stores the data stored in the normal event time series pattern DB unit 24 and the data stored in the abnormal event time series pattern DB unit 25 acquired by the data acquisition unit 20. Then, the abnormal event detection rule candidate is searched for, and the abnormal event detection rule extraction unit 22 further narrows down the rule candidates obtained by the abnormal event detection rule candidate search unit 21 under specific conditions. It fulfills the function of extracting event detection rules. The registration control unit 28 registers the rule extracted by the abnormal event detection rule extraction unit 22 in the abnormal event detection rule registration unit 15. Note that the processing unit 13 may perform a process of outputting the rule extracted by the abnormal event detection rule extracting unit 22 from the output unit 12 to an external device.

  FIG. 2 shows an outline of a process in which the abnormal event detection rule automatic extraction device 10 extracts an abnormal event detection rule. First, data related to normal events and data related to abnormal events are read from the database unit 14 (step S101). Then, a data pattern included in the database related to the abnormal event and not included in the database related to the normal event is set as the abnormal event detection rule candidate (step S102). Further, the abnormal event detection rule is extracted from the abnormal event detection rule candidates to extract the abnormal event detection rule (step S103), and the extracted abnormal event detection rule is registered in the abnormal event detection rule registration unit 15. (Step S104) and the process ends. Specific conditions may be determined according to application examples.

  Note that rule extraction under the specific condition in step S103 may be omitted, and the abnormal event detection rule candidate may be used as the abnormal event detection rule as it is. Instead of registering in the abnormal event detection rule registration unit 15, the abnormal event detection rule may be output from the output unit 12 to the external device.

  FIG. 3 shows an extraction process of an abnormal event detection rule when a time series pattern set is generated from time series pattern data of abnormal events and normal events. The time-series pattern set is obtained by dividing time-series pattern data representing the transition of the state of the observation target by dividing it into a length corresponding to the predetermined number of state transitions (however, a length of 2 or more).

  For example, in the case of time-series pattern data (A-B-C-D-E) in which the state of the observation target has changed from A to B, C, D, and E five times, as a time-series pattern set of length 2, A -B, BC, CD, and DE are generated. That is, all time series pattern sets that can be taken with a length of 2 are generated. Similarly, A-B-C, B-C-D, and C-D-E are generated as a time-series pattern set of length 3. Two A-B-C-D and B-C-D-E are generated as a time-series pattern set of length 4, and A-B-C-D-E is generated as a time-series pattern set of length 5. Is generated.

  In the abnormal event detection rule extraction process of FIG. 3, first, time series pattern data related to normal events and time series pattern data related to abnormal events are read from the database unit 14 (step S121). Next, from each time series pattern data, every time series pattern set that can generate the length is generated every two or more lengths (step S122).

  Next, it is included in the time series pattern set generated from the abnormal event DB (time series pattern data of the abnormal event), and is included in the time series pattern set generated from the normal event DB (time series pattern data of the normal event). The time series pattern set that has not been selected is selected as an abnormal event detection rule candidate (step S123).

  Further, the abnormal event detection rules are extracted from the abnormal event detection rule candidates to extract abnormal event detection rules (step S124), and the extracted abnormal event detection rules are registered in the abnormal event detection rule registration unit 15. Or it outputs to an external device (step S125), and a process is complete | finished.

  FIG. 4 shows an example of the abnormal event time-series pattern data 31 and a list 32 of time-series pattern sets generated therefrom. FIG. 5 shows an example of a normal event time-series pattern data 34 and a list 35 of time-series pattern sets generated from now. 6 includes time series pattern sets that are included in the time series pattern set list 32 related to the abnormal event in FIG. 4 and are not included in the time series pattern set list 35 related to the normal event in FIG. It is a rule candidate list 37 for abnormal event detection shown according to length as rule candidates.

  For example, although “D-C-B” is included in the time series pattern set of abnormal events, it is also included in the time series pattern set of normal events, so it is not selected as an abnormal event detection rule candidate and excluded. Is done. Since “E-D-C” is included in the time series pattern set of abnormal events and not included in the time series pattern set of normal events, it is selected as an abnormal event detection rule candidate.

  FIG. 7 shows an extraction example when an abnormal event detection rule is extracted from abnormal event detection rule candidates based on the cumulative occurrence probability. A threshold value is set in which the total occurrence probability (cumulative occurrence probability) of the selected time-series pattern set is selected in descending order of occurrence probability from the abnormal event detection rule candidates (rule candidate patterns) in descending order of occurrence probability. When the value exceeds (for example, 90%), the selected time-series pattern set excluding the last selected one is extracted as an abnormal event detection rule.

In FIG. 7, the time-series pattern sets that have become abnormal event detection rule candidates are arranged in order of P ₁ , P ₂ , P ₃ ,..., P _N in descending order of occurrence probability, corresponding to P _x . The length of the bar graph represents the total value (cumulative occurrence probability) of the occurrence probabilities from P _{1 to} P _X. Since the cumulative occurrence probability up to P _J is less than the threshold Thr and the cumulative occurrence probability up to P _{J + 1} exceeds the threshold Thr, P ₁ to P _J are extracted as abnormal event detection rules.

FIG. 8 shows an extraction example when an abnormal event detection rule is extracted from abnormal event detection rule candidates based on the occurrence frequency. In Figure 8, the length of the bar graph of P _x indicates the frequency of occurrence of P _x. In addition, P ₁ , P ₂ , P ₃ ,..., P _N are arranged in the order of occurrence frequency. In this example, among the abnormal event detection rule candidates (rule candidate patterns), a time series pattern set whose occurrence frequency exceeds the threshold value Thr is extracted as an abnormal event detection rule.

  FIG. 9 shows an example in which a time series pattern set having a length of 4 or more is extracted as an abnormal event detection rule from the abnormal event detection rule candidates. FIG. 9A is a list of abnormal event detection rule candidates, and FIG. 9B is a list of abnormal event detection rules after extraction.

  FIG. 10 shows an example in which an abnormal event detection rule is extracted from abnormal event detection rule candidates on the condition that a specific pattern is included. 10A shows a list of abnormal event detection rule candidates, and FIG. 10B shows a list of abnormal event detection rules after extraction. In the example of FIG. 10, extraction is performed on the condition that the pattern (A-B) is included.

  In this way, because data related to abnormal events (time-series pattern set), excluding data included in data related to normal events (time-series pattern set) is automatically extracted as abnormal event detection rules, Compared to the case where a large number of control parameters are set by a person, the objective rule can be obtained with less setting effort. In particular, if rules for detecting abnormal events are generated from sample data obtained by observing abnormal events or sample data obtained by observing normal events, the rules are obtained from the actual observed data, so there is no subjectivity. Can generate objective rules.

  In addition, by generating a time-series pattern set for each pattern length from time-series pattern data related to normal events and abnormal events and obtaining rules for detecting abnormal events for each pattern length, abnormal event detection of various pattern lengths Rules can be generated, and the occurrence of abnormal events can be detected in many ways. Also, if a rule with a short length is hit, an abnormal event can be detected in a short time.

  Next, the case where the abnormal event detection rule automatic extraction device 10 automatically generates a rule for detecting a suspicious person in a parking lot will be described as a specific example.

  Here, the movement of a person in the parking lot is defined by three attributes: the type of movement (basic movement element), the duration of movement (time element), and the distance from the vehicle (relative position element). One operation is defined by these three attributes. The basic movement elements are “Move” such as walking and running, “Stop” that stops and stops on the spot, “Bend” that lowers the posture on the spot, and the door of the car. Define four doors to open and close (Door). The time element is defined by “short” and “long”. Relative position elements are defined as “Near” and “Far”.

  After that, “Move” is MV, “Mrudge” is ST, “Bend” is BN, “Door Open / Close” is DR, “Short” is S, “Long” is L, “Close” is N, “Far” is F Both are abbreviated in the figure. In addition, one operation is represented by a symbol in the form of “basic operation element (time element, relative position element)”. For example, when the basic motion element of the motion is “movement”, the time element is “short”, and the relative position element is “close”, this motion is represented by MV (S, N).

FIG. 12 shows time-series pattern data (also referred to as an action sequence) 40 relating to normal behavior (normal event) of a person in a parking lot, and a time-series pattern set (action sequence) for each length generated from this time-series pattern data. A list 41 is also shown. A time-series pattern set of length len is composed of a sequence of len motions. In the figure, MV (S, N)-ST (S, N)
Each operation is connected by “-” as in the case of-. The normal behavior in this example is a behavior in which a person approaches the car and gets on.

  FIG. 13 shows time-series pattern data (behavior sequence) 44 relating to suspicious behavior (abnormal event) of a person in a parking lot, and a time-series pattern set (behavior sequence set) for each length generated from this time-series pattern data. A list 45 is shown. The suspicious behavior in this example is a behavior in which a person approaches the car and opens the door key to invade (ride) the vehicle. The behavior sequence 44 of the suspicious behavior in FIG. 13 includes “bend” as the third operation with respect to the behavior sequence 40 of the normal behavior in FIG. 12.

  14 is included in the behavior sequence set list 45 for suspicious behavior in FIG. 13 and only the behavior sequence set not included in the behavior sequence set list 41 for normal behavior in FIG. The suspicious behavior detection action sequence rule list 47 obtained by selecting as is shown. In this example, the extraction by the abnormal event detection rule extraction unit 22 is not performed, and the rule candidates generated by the abnormal event detection rule candidate search unit 21 are directly used as suspicious behavior detection action sequence rules.

  In this way, the behavior sequence set for each behavior sequence length is generated from the behavior sequence of suspicious behavior and normal behavior, and the suspicious behavior detection rule is obtained for each length of the sequence set. Suspicious persons can be detected with higher accuracy and in a short time. In addition, since rules are automatically generated from sample data of abnormal events and normal events registered in the database, objective rules can be obtained with a small number of man-hours, unlike when people set rules. .

  Next, a second embodiment of the present invention will be described.

  It is difficult to collect data on suspicious behavior such as criminal activity. Therefore, in the second embodiment, a normal event rule is generated as a rule for detecting an abnormal event from data related to a normal event.

  FIG. 15 shows a configuration of an abnormal event detection rule automatic extraction device 10B according to the second embodiment. The same parts as those in the abnormal event detection rule automatic extraction apparatus 10 in FIG. The abnormal event detection rule automatic extraction device 10B registers an input unit 11, an output unit 12, a processing unit 13B that performs various processes related to rule generation, a database unit 14B in which data related to normal events is registered, and a generated rule And a normal event rule registration unit 16 configured.

  The processing unit 13B includes a CPU (Central Processing Unit), a ROM (Read Only Memory) in which programs executed by the CPU and various fixed data are stored, a RAM (Random Access Memory), and the like as main parts. . The processing unit 13B functions as a data acquisition unit 20, a normal event rule generation unit 23, and a registration control unit 28.

  The database unit 14B includes a normal event time series pattern DB unit 24 in which data related to normal events is registered. The data registered in the normal event time series pattern DB unit 24 is time series pattern data representing a temporal transition of the state of an observation target (a person in a parking lot, a device to be monitored, weather, etc.). The data acquisition unit 20 acquires data from the normal event time series pattern DB unit 24, and the normal event rule generation unit 23 calculates the length from the data acquired from the normal event time series pattern DB unit 24 by the data acquisition unit 20. Generate a time-series pattern set of The registration control unit 28 registers the time-series pattern set for each length generated by the normal event rule generation unit 23 in the normal event rule registration unit 16 as a normal event rule for each length. Note that the processing unit 13B may perform a process of outputting the time series pattern set for each length generated by the normal event rule generation unit 23 from the output unit 12 to the external device as a normal event rule for each length.

  The normal event rule is used as a rule for determining an abnormal event when it does not match all the rules registered in the normal event rule registration unit 16. For example, time series pattern data representing the temporal transition of the state of the observation target is obtained from the monitoring video data in the parking lot, etc., and is decomposed into time series pattern sets for each length. Then, the time series pattern set of each length obtained by the decomposition is compared with all the normal event rules of the corresponding length, and if no length matches any normal event rule, it is an abnormal event. Is detected.

  FIG. 16 shows normal event rule generation processing performed by the abnormal event detection rule automatic extraction device 10B. Time series pattern data relating to normal events is read from the database unit 14B (step S201). Next, for each length of 2 or more, all time series pattern sets that can be generated for each length are generated from each time series pattern data (step S202). All the generated time series pattern sets are registered as normal event rules in the normal event rule registration unit 16 or output to an external device (step S203), and the process is terminated.

  In this way, an objective rule for detecting an abnormal event can be generated from only the data related to a normal event for an observation target for which it is difficult to obtain data related to the abnormal event. In addition, time-series pattern sets for each length are generated and these are used as normal event rules, so that abnormal events can be detected at each length, and the occurrence of abnormal events can be identified from short-time observations. It becomes possible.

  The embodiment of the present invention has been described with reference to the drawings. However, the specific configuration is not limited to that shown in the embodiment, and there are changes and additions within the scope of the present invention. Are also included in the present invention.

  In the embodiment, the abnormal event detection rule automatic extraction devices 10 and 10B have been described. However, the present invention can also be applied to a program or a method for causing an information processing device or the like to execute an equivalent function.

  The abnormal event detection rule automatic extraction devices 10 and 10B may be configured not to include the database units 14 and 14B but to input data related to abnormal events and data related to normal events from an external database. Further, the abnormal event detection rule registration unit 15 and the normal event rule registration unit 16 may not be provided, and the generated abnormal event detection rule and normal event rule may be output to an external device.

  In the embodiment, the data related to the abnormal event and the normal event is the time series pattern data representing the transition of the state of the observation target, but the data indicating the instantaneous values related to a large number of measurement items is not necessarily the time series data. It doesn't matter. For example, when determining normality / abnormality of device operation, instantaneous values of measurement data related to many items when the device is operating normally are collected as normal event data, and those when an abnormality occurs in the device Instantaneous values of measurement data related to the items in the above are collected as abnormal event data, and the instantaneous values of abnormal event data and normal event data are compared for each item. By excluding items having, rules for detecting abnormal events (measurement items and their instantaneous values) can be automatically generated.

  In the failure diagnosis of the device, as shown in the list 51 of FIG. 17A, the voltage value / current value of a predetermined location in the device, the temperature of each part in the device, the fan rotation speed, the clock frequency, the contents of communication data Measurement items such as are set as feature amounts indicating the state of the device (corresponding to A to E in FIG. 6). Each feature amount can be a change tendency (increase / decrease, increase / decrease, etc.), change width, greater than or less than a specified value, less than or equal to a specified value, within a specified range, outside a specified range, average value / variance value, and the like. For example, the rule of length 2 is a combination of two measurement items. That is, the combination of voltage value (outside the range of a volt to b volt) and temperature (d ° C. or more), voltage value (outside the range of a volt to b volt) and clock frequency (outside of 10% error) is long. 2 is generated as an abnormal event detection rule. FIG. 17B shows an example of the list 52 showing abnormal events related to weather, normal events, and feature quantities (observation items). In the case of abnormal weather, it may be performed in the same manner as device failure diagnosis.

DESCRIPTION OF SYMBOLS 10, 10B ... Abnormal event detection rule automatic extraction apparatus 11 ... Input part 12 ... Output part 13, 13B ... Processing part 14, 14B ... Database part 15 ... Rule registration part for abnormal event detection 16 ... Normal event rule registration part 20 ... Data Acquisition unit 21 ... Rule candidate search unit for abnormal event detection 22 ... Rule extraction unit for abnormal event detection 23 ... Normal event rule generation unit 24 ... Normal event time series pattern DB unit 25 ... Abnormal event time series pattern DB unit 28 ... Registration control Part 31: Abnormal Event Time Series Pattern Data 32 ... List of Abnormal Event Time Series Pattern Set 34 ... Normal Event Time Series Pattern Data 35 ... List of Normal Event Time Series Pattern Set 37 ... List of Candidate Rules for Abnormal Event Detection 40 ... Inside Parking Lot Behavioral sequence of normal behavior of a person 41 ... List of behavioral sequence sets of normal behavior 44 ... Inside the parking lot Behavior sequence of suspicious behavior of person 45 ... List of behavior sequence set of suspicious behavior 47 ... List of behavior sequence rules for detecting suspicious behavior 51 ... List of abnormal events, normal events, and feature quantities related to device failure diagnosis 52 ... For abnormal weather prediction List of abnormal events, normal events, and feature values

Claims (12)

And abnormal event database time series data is registered regarding abnormal events, is compared with the normal event database time series data is registered about the health event, time-series for any abnormal event that has been registered in the abnormal event database Extract a pattern of time-series data of any length that appears in some sections of the data and does not appear in the time-series data of all normal events registered in the normal event database. An abnormal event detection rule automatic extraction method, wherein the pattern is registered in the rule registration unit as an abnormal event detection rule. A pattern of data that is included in the abnormal event database and not included in the normal event database by comparing the abnormal event database in which the data related to the abnormal event is registered with the normal event database in which the data related to the normal event is registered Is an abnormal event detection rule automatic extraction method for registering the extracted pattern as an abnormal event detection rule in the rule registration unit,
The data is time-series pattern data representing the transition of the state of the observation target,
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
The time series pattern set that is included in the time series pattern set generated from the abnormal event database and that is not included in the time series pattern set generated from the normal event database is the rule registration as the abnormal event detection rule. abnormal event detection rules automatically extracting how to and registers in the part. A pattern of data that is included in the abnormal event database and not included in the normal event database by comparing the abnormal event database in which the data related to the abnormal event is registered with the normal event database in which the data related to the normal event is registered Is an abnormal event detection rule automatic extraction method for registering the extracted pattern as an abnormal event detection rule in the rule registration unit,
The data is time-series pattern data representing the transition of the state of the observation target,
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
From among the abnormal event detection rule candidate, the sequence pattern set when extracted in filtering condition set by the user as the abnormal event detection rules, you and registers the rule registration unit abnormal event detection rule Automatic extraction method. Time-series pattern data representing time-series pattern data that represents the transition of the state of the observation target, and that is time-series pattern data of a predetermined number of times of state transition from the normal-event database in which information about normal events is registered Is generated so that every time series pattern set that can be taken with that length is generated for each length of the time series pattern set, and these time series pattern sets are added to all registered rules. An abnormal event detection rule automatic extraction method comprising: registering the rule as a rule in a normal event rule registration unit in which a rule for determining an abnormal event is registered when the rule does not match. A data acquisition unit that acquires time series data related to abnormal events from the abnormal event database, and acquires time series data related to normal events from the normal event database;
The time series data related to the abnormal event acquired from the abnormal event database is compared with the time series data related to the normal event acquired from the normal event database, and the time related to any abnormal event registered in the abnormal event database. appeared in some sections in the series data, and extracts an arbitrary pattern of the time series data of a length not appearing in the time-series data of all normal events the registered normal event database extract And
An abnormal event detection rule automatic extraction device comprising: an output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule. An abnormal event database in which time series data related to abnormal events is registered,
A normal event database in which time-series data related to normal events is registered;
A rule registration unit;
The abnormal event database and the normal event database are compared , appear in a part of time series data related to any abnormal event registered in the abnormal event database, and the normal event database An extraction unit that extracts a pattern of time series data of an arbitrary length that does not appear in time series data of all normal events registered in
An abnormal event detection rule automatic extraction apparatus comprising: a registration control unit that registers the pattern extracted by the extraction unit as an abnormal event detection rule in the rule registration unit. A data acquisition unit for acquiring data on abnormal events from the abnormal event database, and acquiring data on normal events from the normal event database;
Extraction that extracts data patterns that are included in the abnormal event database and not included in the normal event database by comparing the data acquired from the abnormal event database with data acquired from the normal event database And
An output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data is time-series pattern data representing the transition of the state of the observation target,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is used as the abnormal event detection rule. It shall be the abnormal event detection rule automatic extraction apparatus.   An abnormal event database in which data on abnormal events are registered;
  A normal event database in which data related to normal events are registered;
  A rule registration unit;
  An extraction unit that compares the abnormal event database with the normal event database and extracts a pattern of data that is included in the abnormal event database and not included in the normal event database;
  A registration control unit that registers the pattern extracted by the extraction unit in the rule registration unit as an abnormal event detection rule;
  An abnormal event detection rule automatic extraction device having
  The data is time-series pattern data representing the transition of the state of the observation target,
  The extraction unit includes:
  For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
  A time series pattern set included in the time series pattern set generated from the abnormal event database and not included in the time series pattern set generated from the normal event database is set as the abnormal event detection rule.
  An abnormal event detection rule automatic extraction device characterized by that. A data acquisition unit for acquiring data on abnormal events from the abnormal event database, and acquiring data on normal events from the normal event database;
Extraction that extracts data patterns that are included in the abnormal event database and not included in the normal event database by comparing the data acquired from the abnormal event database with data acquired from the normal event database And
An output unit that outputs the pattern extracted by the extraction unit as an abnormal event detection rule;
An abnormal event detection rule automatic extraction device having
The data is time-series pattern data representing the transition of the state of the observation target,
The extraction unit includes:
For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
Said different from the normal event detection rule candidate, the sequence pattern set when extracted in filtering condition set by the user, the you, characterized in that the abnormal event detection rule abnormal event detection rule automatic extractor.   An abnormal event database in which data on abnormal events are registered;
  A normal event database in which data related to normal events are registered;
  A rule registration unit;
  An extraction unit that compares the abnormal event database with the normal event database and extracts a pattern of data that is included in the abnormal event database and not included in the normal event database;
  A registration control unit that registers the pattern extracted by the extraction unit in the rule registration unit as an abnormal event detection rule;
  An abnormal event detection rule automatic extraction device having
  The data is time-series pattern data representing the transition of the state of the observation target,
  The extraction unit includes:
  For each length of the time series pattern set, a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transition times is generated from each of the abnormal event database and the normal event database. All the time series pattern sets that can be taken are generated,
  A time series pattern set that is included in the time series pattern set generated from the abnormal event database and is not included in the time series pattern set generated from the normal event database is a rule candidate for abnormal event detection,
  A time series pattern set extracted from the abnormal event detection rule candidates under a narrowing condition set by the user is used as the abnormal event detection rule.
  An abnormal event detection rule automatic extraction device characterized by that. A data acquisition unit that acquires time-series pattern data representing the transition of the state of the observation target from the normal event database in which data related to normal events is registered;
From the time series pattern data acquired by the data acquisition unit, generating a time series pattern set that is a time series pattern data having a length corresponding to the predetermined number of state transition times, for each length of the time series pattern set A rule generator that generates all time series pattern sets that can be taken,
An abnormal event detection rule automatic extraction device comprising: an output unit that outputs a time-series pattern set generated by the rule generation unit as a rule for determining an abnormal event when it does not match all rules . For normal events, a normal event database in which time-series pattern data representing the transition of the state of the observation target is registered,
A normal event rule registration unit in which a rule for determining an abnormal event is registered when it does not match all registered rules;
For each length of the time series pattern set, generating a time series pattern set that is time series pattern data having a length corresponding to a predetermined number of state transitions from the time series pattern data registered in the normal event database. A rule generator that generates all time series pattern sets that can be taken with the length; and
An abnormal event detection rule automatic extraction device comprising: a registration control unit that registers a time series pattern set generated by the rule generation unit as the rule in the normal event rule registration unit.

Images