JP6065628B2 - Time series data abnormality monitoring device, abnormality monitoring method, and abnormality monitoring program - Google Patents

Description

  The present invention relates to a chaos analysis technique for detecting an abnormality of a monitoring target and its precursor in a monitoring control system that handles time-series data.

  Conventionally, in a monitoring control system that handles time-series data, in order to detect an abnormality of a monitoring target and its precursor, for example, a trajectory parallel measure method (Trajectory Parallel) based on chaos theory described in Patent Literatures 1 to 3 and Non-Patent Literature 1, for example. An apparatus and method using Measure Method (TPM method) have been proposed.

  FIG. 15 shows an analysis algorithm disclosed in Patent Document 1 and Non-Patent Document 1. In FIG. 15, reference numeral 230 denotes a means for obtaining time series data from a system to be monitored, for example, taking time series data detected by a measuring instrument from the target system and obtaining time series data stored in a data storage unit. .

  The obtained time series data is embedded in the n-dimensional state space in the time series data embedding processing unit 231. This embedding process is performed with a certain dimension and delay, but the dimension and the delay are set in advance by the target system.

  Reference numeral 232 denotes a data vector selection unit that randomly selects (by random number) a plurality of data vectors from the entire system of the data series subjected to the embedding process, and 233 denotes a neighborhood space of each of the selected plurality of data vectors. It is a neighborhood vector detection part which detects the neighborhood vector in the inside.

  The relationship between one data vector Xi out of the plurality of selected data vectors and the neighborhood vectors Xj and Xk in the neighborhood space is as shown in FIG. 16, for example. FIG. 16 shows local features of the attractor in the reconstructed state space based on the embedding, where Ti is a unit tangent vector (tangential direction) of the data vector Xi, and Tj and Tk are the neighborhood vectors Xj and Xk. A unit tangent vector (tangential direction) is shown.

  Reference numeral 234 denotes a tangential direction calculation unit that calculates tangential directions Ti and Tj with respect to the trajectories of the obtained data vector Xi and the neighborhood vector Xj.

  Reference numeral 235 denotes a parallelism evaluation unit that calculates the parallelism between the calculated tangential directions Ti and Tj as an evaluation value (the parallelism becomes 0 as the tangential directions are aligned).

  It is determined by the determination unit 236 whether the parallelism between the tangential directions Ti and Tj in the parallelism evaluation unit 235 has reached the set number of samples (N samples). If not, the data vector selection unit 232 performs processing. Is repeated, and when the set number of samples is reached, the average of the parallelism is obtained by the parallelism determination unit 237, and if it is equal to or greater than the average, it is determined that the time series data is based on determinism. If it is below the average, it is determined as time series data based on a stochastic process, that is, random noise.

  As described above, in the analysis algorithm using the trajectory parallel measure described in Patent Document 1 and Non-Patent Document 1, the selection of the data vector for obtaining the parallelism (parallel measure) is performed in the neighborhood space shown in FIG. A feature is that a plurality of data are selected by random numbers, and a data vector Xi is selected within each neighborhood.

  Also in Patent Documents 2 and 3, the technique described with reference to FIGS. 15 and 16 is used for selection of the data vector of the orbital parallel measure method.

Japanese Patent No. 3785703 Japanese Patent No. 4713272 JP 2007-48097 A

Yasunari Fujimoto, Tadashi Hatake Hata, Takayoshi Tanimura, “Orbital Parallel Measure Method for Measuring Deterministic Properties of Observed Time Series Data”, Journal of Fuzzy Society of Japan, Vol. 9, no. 4, pp580-588 (1997) Shin Kosugi, “Creation of Curve by Arc Using Local Tangent Calculation Algorithm”, IEICE Transactions D, IEICE Dec. 20, 1977, Vol. J60-D, no. 12, pp. 1023-1030

  Conventional techniques described in Patent Documents 1 to 3 and Non-Patent Document 1 calculate a feature amount required for abnormality detection by extracting a plurality of arbitrary points from the entire system of the target data series. Met. For this reason, it has been difficult to apply to, for example, an on-line supervisory control system that handles time-series data in that the calculation cost is high and the off-line calculation is mainly used.

  The present invention solves the above-mentioned problem, and its purpose is to realize calculation in real time with extremely low calculation cost in abnormality detection processing, and to enable application to abnormality detection in an online system. An object of the present invention is to provide an apparatus, method, and program for monitoring abnormalities in series data.

  The time-series data abnormality monitoring apparatus according to claim 1 for solving the above-mentioned problem, a data collection means for detecting time-series data from a monitoring target and for taking in the detected time-series data, and the data collection Data storage means for storing time series data captured by the means, data acquisition means for acquiring time series data stored in the data storage means, and an n-dimensional state from the time series data acquired by the data acquisition means Time series data embedding processing means for embedding in space, and data for selecting a data vector determined based on a data vector closest to the current time from the time series data embedded by the embedding processing means every predetermined time A vector selection means, and a space near the data vector selected by the data vector selection means Neighboring vector detecting means for detecting a neighboring vector, tangential direction computing means for computing a tangential direction with respect to the trajectory of the selected data vector and neighboring vector, tangential direction with respect to the trajectory of the computed data vector, and a neighborhood vector Parallelism evaluation means for evaluating the parallelism with the tangential direction with respect to the trajectory, and from the evaluation result of the parallelism evaluation means, for each time, measure the parallelism in the data vector selected by the data vector selection means, A parallelism determining unit that determines abnormality of the time series data from the parallelism measurement data, and the embedding processing unit embeds each time the parallelism of the data vector at a certain time is measured by the parallelism determining unit. Current time point updating means for updating the current time point of the received time series data It is characterized by a door.

  Further, in the time series data abnormality monitoring method according to any one of claims 5 to 7, the data collecting means detects the time series data from the monitoring target and takes in the detected time series data, and the data storage means A data accumulating step for accumulating the time series data captured by the data collecting means, a data obtaining step for the data obtaining means to obtain the time series data accumulated in the data accumulating means, and a time series data embedding process Means for embedding time-series data from the time-series data acquired by the data acquisition means into the n-dimensional state space, and a data vector selection means for embedding by the embedding processing means at predetermined time intervals. Data vector determined from the time-series data based on the data vector closest to the current time A data vector selecting step for selecting a data, a neighborhood vector detecting means for detecting a neighborhood vector in a neighborhood space of the data vector selected by the data vector selecting means, and a tangential direction computing means, A tangential direction calculating step for calculating a tangential direction with respect to the trajectory of the selected data vector and the neighborhood vector, and a parallelism evaluation unit, wherein the tangential direction with respect to the trajectory of the calculated data vector and a tangential direction with respect to the trajectory of the neighborhood vector are The parallelism evaluation step for evaluating the parallelism of the parallelism, and the parallelism measuring means measures the parallelism in the data vector selected by the data vector selection means at each time from the evaluation result of the parallelism evaluation means. Parallelism for determining abnormality of the time series data from the parallelism measurement data And the current time point updating means determines the current time point of the time series data embedded by the embedding processing means each time the parallelism for the data vector at a certain time is measured by the parallelism determining means. And a current time point updating step for updating.

  In the above configuration, the data vector selection means selects only the data vector determined based on the most advanced data vector representing the current time point of the data series at each time, and the parallelism determination means selects the one selected data Since the parallelism of the vectors is measured and the abnormality is determined, the calculation cost in the abnormality detection process can be kept extremely low, and real-time calculation can be realized. Further, the current time point of the time series data is updated by the current time point updating means.

  By these things, it can be applied to the abnormality detection of an online system according to this invention to the fact that the abnormality detection of the offline was the main analysis object by the present method.

  According to a fourth aspect of the present invention, the abnormality monitoring device for time-series data includes an accumulated data update unit that deletes data that has passed a set period from the time-series data accumulated in the data accumulation unit. .

  The abnormality monitoring method for time-series data according to claim 8 further comprises an accumulated data update step in which the accumulated data update means deletes data that has passed a set period from the time-series data accumulated in the data accumulation means. It is characterized by that.

  According to the above configuration, data having a low contribution to abnormality detection is excluded from the analysis target by the accumulated data updating unit. For this reason, the data accumulated for data analysis can be maintained at an appropriate amount.

  A program according to a ninth aspect is a program that causes a computer to function as each unit of the abnormality monitoring device according to any one of the first to fourth aspects.

  According to the above configuration, it is possible to provide a time-series data abnormality monitoring program that can be applied to abnormality detection in an online system.

(1) According to the first to ninth aspects of the present invention, the calculation cost in the abnormality detection process can be kept extremely low, real-time calculation can be realized, and the current method mainly detects the abnormality offline. It becomes possible to apply to the anomaly detection by the online method for what was the object of analysis.
(2) According to the third and seventh aspects of the invention, the delay of the abnormality detection process can be suppressed.
(3) According to the inventions described in claims 4 and 8, it is possible to exclude data having a low contribution to abnormality detection from the analysis target, and maintain an appropriate amount of data accumulated for data analysis. can do.

1 is an overall configuration diagram showing an embodiment of the present invention. The block diagram which shows the detailed structure of the data determination process part in one example of embodiment of this invention. Explanatory drawing of the Lorenz attractor input in the embodiment of this invention. Explanatory drawing of the Lorenz attractor with which 10% white noise was superimposed on the specific area utilized by the abnormality determination of the embodiment of this invention. (A) Explanatory drawing explaining the process which embeds time series data in n-dimensional state space, (b) The figure which illustrates the attractor embedded in n-dimensional state space. Explanatory drawing which shows the mode of the data vector selection by the method of this invention. Explanatory drawing which shows the mode of the data vector selection for every time by the method of this invention. The time series data for demonstrating the white noise detection by the method of this invention, and the graph of an orbit parallel measure calculated from there. The block diagram which shows the detailed structure of the data determination process part in one example of embodiment of this invention. Explanatory drawing explaining the calculation method of the tangent direction in the abnormality monitoring apparatus of Embodiment 2. FIG. The figure which shows the example of the time series data input into the abnormality monitoring apparatus of one embodiment of this invention. The graph of the orbit parallel measure calculated by the time series data identification method of Embodiment 2 of the present invention. The graph of the orbit parallel measure calculated by the time series data identification method of Embodiment 1 of the present invention. Explanatory drawing explaining the calculation method of the tangent direction in the identification method of the time series data of Embodiment 1 and Embodiment 2. FIG. The block diagram of the determination process part of patent document 1. FIG. Explanatory drawing of the local characteristic of the attractor of patent document 1. FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the following embodiments, and the deterministic behavior is dominant by the operation as designed in the normal state. However, it can be applied to system abnormality monitoring in which random noise based on a stochastic process is superimposed when an abnormality occurs.

(Embodiment 1)
FIG. 1 shows the overall configuration of an embodiment of the time series data abnormality monitoring apparatus of the present invention, and FIG. 2 shows the details of the data determination processing section of this embodiment.

  In FIG. 1, reference numeral 10 denotes a monitoring / control target, which is composed of, for example, a rotary machine system shaft vibration abnormality detection device. Note that, as data transmitted from the monitoring / control target 10, a measurement value of a pressure sensor or a temperature sensor may be input.

  Reference numeral 20 denotes an abnormality monitoring device, which detects time-series data from the monitoring / control target 10 and a data collection unit 21 serving as a data collection unit that captures the detected time-series data, and when the data collection unit 21 captures the time-series data. The data accumulating unit 22 as data accumulating means for accumulating the series data, and various processes described in FIG. 2 are performed on the accumulated data of the data accumulating unit 22, and the parallel trajectory measure for the time series data changing every moment And a data determination processing unit 23 that calculates a point immediately before the tip of the data series embedded as an attractor and determines abnormality of the time series data from the calculated data.

  Reference numeral 30 denotes an analysis result output unit that outputs a result determined by the abnormality monitoring device 20, and is configured by a display, a printer, or the like, for example.

  In FIG. 2 showing the details of the data determination processing unit 23, reference numeral 230 ′ denotes a data acquisition unit as a data acquisition unit that acquires time-series data stored in the data storage unit 22 as target time-series data. .

  Examples of time-series data to be processed in the data acquisition unit 230 ′ are shown in FIGS. FIG. 3 shows a data set forming a Lorenz attractor, and FIG. 4 shows a data set forming a Lorenz attractor in which 10% white noise is superimposed on a specific section in time-series data.

  Reference numeral 231 denotes a time-series data embedding processing unit as time-series data embedding processing means for embedding the n-dimensional state space from the time-series data acquired by the data acquisition unit 230 ′. The embedding process of the time-series data embedding processing unit 231 is the same as that of the time-series data embedding unit 231 shown in FIG.

More specifically, in the time series data embedding processing unit 231, as shown in FIG. 5A, from the observed time series data y (t), a vector X _t = (y (t), y ( t-τ),..., y (t− (n−1) τ)) (τ is a delay time). This vector represents one point in the n-dimensional reconstruction state space R ⁿ . Therefore, when t is changed, a trajectory as shown in FIG. 5B can be drawn in this n-dimensional reconstruction state space. The dimension n and the delay time τ are values set in advance according to the target system.

  Reference numeral 232 ′ denotes a data vector selection unit serving as a data vector selection unit that selects only the data vector immediately before the leading edge representing the current time point of the data series at each time of the embedded time series data.

  For example, as shown in FIG. 6 showing the local features of the attractor, the data vector Xi is obtained from the tip portion of the data vector. At this time, a plurality of data vectors Xi are not selected by random numbers, but only one before the most recent data point (current time point indicated by a black circle) is selected. This part is different from the data vector selection unit 232 of FIG.

  FIG. 6 shows local features of the attractor in the reconstructed state space based on the embedding, where Ti is a unit tangent vector (tangential direction) of the data vector Xi, and Tj and Tk are neighborhood vectors Xj and Xk. The unit tangent vector (tangent direction) is shown.

  In addition, the data vector selection unit 232 ′ is not limited to selecting the data vector one immediately before from the leading edge representing the current time point of the data series at each time described above, but two before, three before, ... (Only n (n is a positive number greater than or equal to 2)) data vectors may be selected.

  Reference numeral 233 denotes a neighborhood vector detection unit as neighborhood vector detection means for detecting a neighborhood vector in the neighborhood space of the selected data vector. As shown in FIG. 6, the neighborhood vector detection unit 233 detects a neighborhood vector in the neighborhood space in the same manner as the neighborhood vector detection unit 233 of FIG. 15 for one selected data vector Xi.

  Reference numeral 234 denotes a tangential direction calculation unit as tangential direction calculation means for calculating the tangent direction with respect to the trajectory of the selected data vector and neighboring vector. The tangential direction calculation unit 234 calculates tangential directions Ti and Tj with respect to the trajectory of the obtained data vector Xi and the neighborhood vector Xj, similarly to the tangential direction calculation unit 234 of FIG. For example, when the selected data vector is the target point C, the point immediately before the target point C is the point B, and the point immediately after the target point C is the point A, the tangent direction T at the target point C is 3 It is calculated as a tangent at the target point C of a circle passing through points B, C, A.

This tangential direction T can be calculated based on the following conditions (1) to (6).
(1) C + T is included in at most a two-dimensional subspace including three points B, C, and A.
(2) The tangential direction T is orthogonal to the vector PC from the center P of the circle to the target point C.
(3) The tangential direction T is a unit vector.
(4) The center P of the circle is included in a high two-dimensional subspace including the three points B, C, A.
(5) The vector from the center P of the circle to the midpoint of points B and C is orthogonal to the vector from point B to point C.
(6) The vector from the center P of the circle to the midpoint of the point C and the point A is orthogonal to the vector from the point C to the point A.

  By equating the point and the position vector, an equation is established based on the above conditions, and by solving this equation, the relational expression between the points B, C, A and the tangential direction T shown in Equation (1) can be obtained. it can. Note that two results in opposite directions are obtained for the tangential direction T. Therefore, in the equation (1), the direction from the point B to the point A through the point C is selected in accordance with the arrangement order of the points. Yes.

  15 calculates the parallelism of the calculated tangential directions Ti and Tj as an evaluation value, similar to the parallelism evaluation unit 235 of FIG. 15 (the parallelism is 0 as the tangential directions are aligned). It is a parallelism evaluation part as a parallelism evaluation means.

  237 ′ is a time series based on the parallelism (parallelism of tangential directions Ti and Tj; orbital parallelism) calculated in the selected data vector Xi at each time from the evaluation result of the parallelism evaluation unit 235. It is a parallelism determination part as a parallelism determination means which determines abnormality of data.

  Since the parallelism measurement performed by the parallelism determination unit 237 'is to determine the parallelism in the selected single data vector Xi, the set sample as in the conventional determination unit 236 in FIG. A process for obtaining parallelism is not required until several minutes are reached.

  For this reason, as shown in the following formula (2), the parallelism determination formula is more simplified than formula (3) (formula (2) of Non-Patent Document 1).

  Note that γi is the parallelism in the local space.

FIG. 7 shows how the data vector Xi is selected. In the method of the present invention, the parallel trajectory measure for time series data that changes from moment to moment is calculated for the point just before the tip of the data series embedded as an attractor. 7, for example, at time t-2, the data vector Xi is X _i ^t-2, and the at time ^{_{t-1 X i t-1}} , the current time and so X _i ^t at time t is selected The data vector Xi is selected sequentially with the change of, and the trajectory parallel measure is obtained each time. The orbit parallel measure at each time is stored in, for example, the data storage unit 22.

  FIG. 8 is a graph of the time series data of FIG. 4 and the orbit parallel measure calculated therefrom. From this graph, it can be seen that the trajectory parallel measure greatly increases immediately after entering the section (abnormal section) in which 10% white noise is superimposed. The abnormality determination performed by the parallelism determination unit 237 ′ is performed by using a statistical method to change the orbital parallel measure.

  That is, for example, by measuring the parallel measure of time-series data in advance, taking the average value of the trajectory parallel measure in the normal section and normal the section where noise is not superimposed, set the average value as a threshold, If the average value of the parallelism measurement data in the selected data vector at each time exceeds the set average value, it is abnormal, otherwise it is normal.

  According to the present embodiment, as described in FIG. 8, the average parallelism value of the time-series data in the section in which 10% white noise is superimposed is the parallelism of the time-series data in the section in which noise is not superimposed. Since it is larger than the average value of the measurement data, it is a robust technique for noise detection (abnormality detection).

  238 is a current time point that serves as a reference for selecting the data vector Xi every time the parallelism determination unit 237 ′ measures the orbital parallel measure for the data vector Xi selected at a certain time (FIG. 6). This is a current time point updating unit as current time point updating means for updating the cutting edge shown by the black circle in FIG. When updating the current time point, the current time update unit 238 additionally acquires the latest data from the data storage unit 22 and embeds it in the n-dimensional state space as necessary.

  239 deletes data having a low contribution to abnormality detection from the data storage unit 22 in order to maintain the stored data in the data storage unit 22 at an appropriate amount (the n-dimensional state space corresponding to the deleted data at this time). This is a stored data update unit as stored data update means (which also removes vectors from the analysis target by deleting the vectors at the same time).

  The accumulated data update unit 239, for example, has the data accumulation unit that stores data that has passed a set period or more and a vector in the n-dimensional state space corresponding to the data because old data in time series data has a low contribution to abnormality detection. 22 is deleted.

In the embodiment of the time series data abnormality monitoring method of the present invention, each process described in the description of each part is executed in, for example, an apparatus provided with each part of FIGS. That is,
<Step S1> The data collection unit 21 detects time-series data from the monitoring / control target 10, and captures the detected time-series data.
<Step S <b>2> The data storage unit 22 stores time-series data captured by the data collection unit 21.
<Step S3> The data acquisition unit 230 ′ acquires time-series data stored in the data storage unit 22.
<Step S4> The time series data embedding processing unit 231 performs embedding processing in the n-dimensional state space from the time series data acquired by the data acquisition unit 230 ′.
<Step S5> The data vector selection unit 232 ′ uses, for example, the data immediately before the most recent time representing the current time point of the data series at each time of the time series data embedded by the time series data embedding processing unit 231. Select a vector.
<Step S6> The neighborhood vector detection unit 233 detects a neighborhood vector in the neighborhood space of the data vector selected by the data vector selection unit 232 ′.
<Step S7> The tangential direction calculation unit 234 calculates the tangential direction with respect to the trajectory of the data vector selected by the data vector selection unit 232 ′ and the neighborhood vector detected by the neighborhood vector detection unit 233.
<Step S8> The parallelism evaluation unit 235 evaluates (calculates) the parallelism between the tangential direction with respect to the trajectory of the data vector calculated by the tangential direction calculation unit 234 and the tangential direction with respect to the trajectory of the neighboring vector.
<Step S9-1> The parallelism determination unit 237 ′ measures (acquires) the parallelism in the data vector selected by the data vector selection unit 232 ′ for each time from the evaluation result of the parallelism evaluation unit 235. )
<Step S9-2> The data storage unit 22 stores the parallelism measurement data.
<Step S9-3> The parallelism determination unit 237 ′ determines the abnormality of the time series data from the parallelism measurement data stored in the data storage unit 22.
<Step S10> The current time point update unit 238 is embedded by the time-series data embedding processing unit 231 every time the parallelism determination unit 237 ′ measures the parallelism of the data vector at a certain time. Update the current time point of time series data. At this time, if the time-series data at the current time point is not yet embedded, it is additionally acquired from the data storage unit 22 and embedded in the n-dimensional state space.
<Step S11> The accumulated data update unit 239 deletes data that has passed a set period from the time-series data and the n-dimensional state space accumulated in the data accumulation unit 22.

(Embodiment 2)
The time series data abnormality monitoring device according to the second embodiment of the present invention is implemented except that the processing of the data vector selection unit 232 ′ of the abnormality monitoring device 20 of the first embodiment is different from the processing of the tangential direction calculation unit 234. This is the same as the abnormality monitoring apparatus 20 of the first embodiment. Therefore, the configuration of the time series data abnormality monitoring apparatus according to the second embodiment of the present invention is the same as that of the abnormality monitoring apparatus 20 shown in FIG.

  In the method for deriving the tangent direction in the abnormality monitoring apparatus 20 according to the first embodiment, the tangent direction is derived based on the points before and after the selected point, so newer data is required than the selected point. As a result, when detecting abnormality of time-series data that changes every moment, the point closest to the current time cannot be selected, and there is a possibility that a delay occurs in the abnormality detection time of time-series data. Therefore, in the abnormality monitoring apparatus according to the second embodiment, the time series data closest to the current time is selected as the reference point by calculating the tangential direction based on the reference point and a point before the reference point. It is possible to suppress the delay of time-series data abnormality detection time.

  FIG. 9 illustrates details of the data determination processing unit of the time-series data abnormality monitoring apparatus according to the second embodiment.

  The data determination processing unit of the abnormality monitoring apparatus according to the second embodiment is the same as the data determination processing unit 23 illustrated in FIG. 2 except that the processing of the data vector selection unit 232 ′ and the processing of the tangential direction calculation unit 234 are different. Therefore, the same components as those of the data determination processing unit 23 according to the first embodiment are denoted by the same reference numerals, and detailed description thereof is omitted.

  232 ″ is a data vector selection unit that selects a state-of-the-art data vector representing the current time point of the data series at each time of the time series data embedded by the time series data embedding processing unit 231. Part. The data vector selection unit 232 ″ is not limited to selecting the most advanced data vector that represents the current time point of the data series at each time described above, but one (1) before, 2 (before),. The data vector immediately before (n is a positive number of 1 or more) may be selected.

  As shown in FIG. 10, the reference numeral 234 ′ denotes the tangent directions Ti, Tj, and the tangential directions of the data vector Xi selected by the data vector selection unit 232 ″ and the neighborhood vectors Xj and Xk detected by the neighborhood vector detection unit 233 with respect to the trajectory. It is a tangential direction calculation part as a tangential direction calculation means which calculates Tk.

  For example, when the selected data vector is the target point X, the point immediately before the target point X is the point Y, and the point two points before the target point X is the point Z, The tangential direction T at the point X is calculated as the tangent at the target point X of the circle passing through the three points X, Y, and Z.

This tangential direction T can be calculated based on the following conditions (1) to (6).
(1) X + T is included in at most a two-dimensional subspace including three points X, Y, and Z.
(2) The tangential direction T is orthogonal to the vector PX from the center P of the circle to the target point X.
(3) The tangential direction T is a unit vector.
(4) The center P of the circle is included in a noble two-dimensional subspace including three points X, Y, and Z.
(5) The vector from the center P of the circle to the midpoint of the point X and the point Y is orthogonal to the vector from the point Y to the point X.
(6) The vector from the center P of the circle to the midpoint of the points X and Z is orthogonal to the vector from the point Z to the point X.

  By equating the point and the position vector, an equation is established based on the above conditions, and by solving this equation, a relational expression between the points X, Y, Z and the tangential direction T shown in Equation (4) can be obtained. it can. Note that two results in opposite directions can be obtained for the tangential direction T. Therefore, in the equation (4), points in the direction from the point Z and the point Y to the point X are selected in accordance with the arrangement order of the points.

[Example]
As an example of specific time-series data, the time-series data shown in FIG. 11 is input to the abnormality monitoring apparatus according to the second embodiment, and the orbit parallel measure of the input time-series data is sequentially measured.

  As shown in FIG. 11, the input time-series data is Lorentz chaos data (deterministic chaos time-series data) input before time t, and white noise is added to the Lorentz chaos data after time t. This is time series data to which 10% superimposed data (deterministic chaos time series data including 10% time series data based on a stochastic process) is input.

A processing procedure of time series data by the abnormality monitoring apparatus according to the second embodiment is shown below. In addition, the same code | symbol is attached | subjected about the process same as the process sequence of the time series data of the abnormality monitoring apparatus 20 which concerns on Embodiment 1, and detailed description is abbreviate | omitted.
<Step S1> to <Step S4> This is the same as the time-series data processing procedure of the abnormality monitoring apparatus 20 according to the first embodiment.
<Step S5 ′> The data vector selection unit 232 ″ selects, for example, a state-of-the-art data vector representing the current time point of the data series at each time from the time-series data embedded by the time-series data embedding processing unit 231. select.
<Step S6> The neighborhood vector detection unit 233 detects a neighborhood vector in the neighborhood space of the data vector selected by the data vector selection unit 232 ″.
<Step S <b> 7 ′> The tangential direction calculation unit 234 ′ calculates the tangential direction with respect to the trajectory of the data vector selected by the data vector selection unit 232 ″ and the neighborhood vector detected by the neighborhood vector detection unit 233.
<Step S8> to <Step S11> This is the same as the time-series data processing procedure of the abnormality monitoring apparatus 20 according to the first embodiment.

  FIG. 12 shows the measurement result of the orbit parallel measure of the input time series data. As shown in FIG. 12, when deterministic chaotic time series data not including random noise is input, the value of the orbital parallel measure is 0.1 or less. On the other hand, after the time t when Lorentz chaos data on which 10% of white noise is superimposed is input, the value of the orbital parallel measure greatly increases.

  The same time series data as the example (time series data shown in FIG. 11) was input to the abnormality monitoring apparatus 20 according to the first embodiment, and the orbit parallel measure was measured. The measurement results are shown in FIG. As shown in FIG. 13, when deterministic chaotic time series data not including random noise is input, the value of the orbital parallel measure is 0.1 or less. On the other hand, after the time t when Lorentz chaos data on which 10% of white noise is superimposed is input, the value of the orbital parallel measure greatly increases.

  When the measurement result of the abnormality monitoring device according to the second embodiment shown in FIG. 12 is compared with the result of the abnormality monitoring device 20 according to the first embodiment shown in FIG. Immediately after the Lorentz chaos data with 10% white noise superimposed on it, the orbital parallel measure greatly increases. On the other hand, in the abnormality monitoring device 20 according to the first embodiment, the increase in the trajectory parallel measure immediately after the elapse of t time is moderate as compared with the abnormality monitoring device according to the second embodiment. That is, the abnormality monitoring method according to the abnormality monitoring apparatus according to the second embodiment detects an abnormality (occurrence of random noise) that occurs in the time series data earlier than the abnormality monitoring method of the abnormality monitoring apparatus 20 according to the first embodiment. can do.

  Further, both the abnormality monitoring method of the abnormality monitoring apparatus according to the second embodiment and the abnormality monitoring method of the abnormality monitoring apparatus 20 according to the first embodiment calculate the trajectory parallel measure based on points passing through three points. In the abnormality monitoring method of the abnormality monitoring apparatus according to aspect 2, the value of the orbit parallel measure changes more greatly. That is, when normal data (Lorentz chaos data) is input, almost the same result is output between the determination result of the abnormality monitoring device according to the second embodiment and the determination result of the abnormality monitoring device 20 according to the first embodiment. On the other hand, when abnormality data (Lorentz chaos data on which white noise is superimposed) is input, the determination result of the abnormality monitoring device according to the second embodiment is that of the abnormality monitoring device 20 according to the first embodiment. The value is a little less than three times the determination result. This indicates that the abnormality monitoring method of the abnormality monitoring apparatus according to the second embodiment has higher abnormality detection sensitivity than the abnormality monitoring method of the abnormality monitoring apparatus 20 according to the first embodiment.

As shown in FIG. 14, when calculating the tangential direction of the time series data, the point X _{i serving as} a reference and the point X _i of the circle passing through the points X _{i + 1} and X _i-1 before and after the point X _i An approximation method for obtaining a tangent at (a tangent calculation method in the first embodiment) is a general calculation method. In addition, an algorithm for calculating a tangent at a reference point using five points centered on a point for obtaining a tangent has been proposed (Non-Patent Document 2). However, although the accuracy of the tangent direction of the circle passing through the three points X _i-1 , X, X _{i + 1} may be inferior, the circle passing through the three points X _i-1 , X, X _{i + 1} is determined. For example, the tangent of the circle can be obtained at X _i-1 and X _{i + 1} .

  As shown in FIG. 14, the time-series data identification method according to the abnormality monitoring apparatus according to the second embodiment includes a reference point and a point before the reference point with respect to the tangential direction calculated when calculating the trajectory parallel measure. Calculate based on That is, the tangent direction at the end point (reference point) of a circle passing through three points is used. This means that the calculated tangential direction can be used as a comparison index for changes in time-series data by using the same calculation method for the data vector to be compared and the neighborhood vector without obtaining a strictly correct tangent direction. It can be done. Note that, as shown in FIG. 14, it is considered that the sensitivity to the change becomes higher by obtaining the tangent from the end point.

  As described above, according to the abnormality monitoring device and the abnormality monitoring method according to the second embodiment of the present invention, based on the reference point for calculating the tangential direction and the circle passing through the point before this reference point, the reference point Calculate the tangential direction. Therefore, the most advanced value (the point closest to the current time) can be used as a reference point for calculating the trajectory parallel measure. That is, when an abnormality is detected from time-series data that changes every moment, the most advanced point can be used as data used for the abnormality detection. As a result, the abnormality of the time series data can be detected earlier in the calculation of the sequential orbit parallel measure method that sequentially acquires the time series data and detects the noise included in the time series data. In addition, it is possible to detect abnormality of time series data with high sensitivity.

  As described above, according to the abnormality monitoring apparatus and abnormality monitoring method of the present invention, it is possible to detect an abnormality from time series data very early by setting a small number of parameters (embedding dimension, delay time).

  Further, the abnormality monitoring device 20 according to the first embodiment and the abnormality monitoring device according to the second embodiment configured as described above are configured by, for example, a computer, and hardware resources of a normal computer, for example, ROM, RAM, CPU, An input device, an output device, a communication interface, a hard disk, a recording medium, and a driving device thereof are provided.

  As a result of the cooperation between the hardware resource and the software resource (OS, application, etc.), the abnormality monitoring apparatus 20 according to the first embodiment and the abnormality monitoring apparatus according to the second embodiment are shown in FIGS. As described above, the data collection unit 21, the data storage unit 22, the data acquisition unit 230 ′, the time series data embedding processing unit 231, the data vector selection units 232 ′ and 232 ″, the neighborhood vector detection unit 233, and the tangential direction calculation unit 234. , 234 ′, parallelism evaluation unit 235, parallelism determination unit 237 ′, current time point update unit 238, and accumulated data update unit 239.

  It is assumed that the data storage unit 22 is constructed in storage means / storage means such as a hard disk or RAM.

  It should be noted that a part or all of the functions of each means in the time series data abnormality monitoring device of each embodiment can be configured by a computer program, and the present invention can be realized by executing the program using the computer. It goes without saying that the procedure in the time series data abnormality monitoring method of the present embodiment can be configured by a computer program and the program can be executed by the computer. Readable recording media such as FD (Floppy (registered trademark) Disk), MO (Magneto-Optical disk), ROM (Read Only Memory), memory card, CD (Compact Disk) -ROM, DVD (Digit) al Versatile Disk) -ROM, CD-R, CD-RW, HDD, removable disk, etc., and can be stored or distributed. It is also possible to provide the above program through a network such as the Internet or electronic mail.

DESCRIPTION OF SYMBOLS 10 ... Monitoring / control target 20 ... Abnormality monitoring apparatus 21 ... Data collection part 22 ... Data storage part 23 ... Data determination processing part 30 ... Analysis result output part 230 '... Data acquisition means 231 ... Time series data embedding processing part 232' , 232 ″, data vector selection unit 233 ′, neighborhood vector detection unit 234, 234 ′, tangential direction calculation unit 235, parallelism evaluation unit 237 ′, parallelism determination unit 238, current time point update unit 239, accumulated data update Part

Claims (9)

Data collecting means for detecting time-series data from the monitoring target and capturing the detected time-series data;
Data accumulation means for accumulating time series data captured by the data collection means;
Data acquisition means for acquiring time-series data stored in the data storage means;
Time-series data embedding processing means for embedding the n-dimensional state space from the time-series data acquired by the data acquisition means;
Data vector selection means for selecting a data vector determined based on the data vector closest to the current time from the time-series data embedded by the embedding processing means every predetermined time;
Neighborhood vector detection means for detecting a neighborhood vector in the neighborhood space of the data vector selected by the data vector selection means;
A tangential direction calculating means for calculating a tangential direction with respect to the trajectory of the selected data vector and the neighborhood vector;
Parallelism evaluation means for evaluating parallelism between a tangential direction with respect to a trajectory of the calculated data vector and a tangential direction with respect to a trajectory of a neighboring vector;
The parallelism for measuring the parallelism in the data vector selected by the data vector selection means for each time from the evaluation result of the parallelism evaluation means, and determining the abnormality of the time series data from the parallelism measurement data A determination means;
A current time point updating unit that updates the current time point of the time-series data embedded by the embedding processing unit each time the parallelism of the data vector at a certain time is measured by the parallelism determining unit. An abnormality monitoring device for time-series data characterized by the above. 2. The time-series data abnormality monitoring apparatus according to claim 1, wherein the data vector selection unit selects a data vector immediately preceding from the most advanced point representing the current time point of the data series at each time. The data vector selection means selects the most advanced data vector representing the current time point of the data series at each time,
The tangential direction calculation means selects the circle derived based on the selected data vector and a data vector before the data vector, with respect to the tangential direction with respect to the trajectory of the data vector selected by the data vector selection means. Calculated as a tangent line in the generated data vector, and the tangential direction with respect to the trajectory of the neighborhood vector detected by the neighborhood vector detecting means is the neighborhood of the circle derived based on the neighborhood vector and the data vector before the neighborhood vector. The time-series data abnormality monitoring apparatus according to claim 1, wherein the abnormality monitoring apparatus calculates the tangent in the vector. 4. The time according to claim 1, further comprising accumulated data updating means for deleting data that has passed a set period from the time series data accumulated in the data accumulation means. 5. Series data abnormality monitoring device. A data collection means for detecting time-series data from the monitoring target and capturing the detected time-series data; and
A data accumulating step in which the data accumulating unit accumulates the time series data captured by the data collecting unit;
A data acquisition step in which the data acquisition means acquires time-series data stored in the data storage means;
Time-series data embedding processing means for embedding time-series data from the time-series data acquired by the data acquisition means into an n-dimensional state space; and
A data vector selection step for selecting a data vector determined based on a data vector closest to the current time from the time-series data embedded by the embedding processing unit every predetermined time;
A neighborhood vector detecting step for detecting a neighborhood vector in a neighborhood space of the data vector selected by the data vector selecting unit;
A tangential direction calculating means for calculating a tangential direction with respect to the trajectory of the selected data vector and the neighborhood vector; and
A parallelism evaluation means for evaluating a parallelism between a tangential direction with respect to a trajectory of the calculated data vector and a tangential direction with respect to a trajectory of a neighboring vector;
The parallelism measuring means measures the parallelism in the data vector selected by the data vector selecting means for each time from the evaluation result of the parallelism evaluating means, and from the parallelism measurement data, the time series data A parallelism determination step for determining abnormality,
The current time when the current time point updating unit updates the current time point of the time series data embedded by the embedding processing unit every time the parallelism of the data vector at a certain time is measured by the parallelism determining unit. An abnormality monitoring method for time-series data, comprising: a point updating step. 6. The time series according to claim 5, wherein, in the data vector selection step, the data vector selection means selects a data vector immediately preceding from the forefront representing the current time point of the data series at each time. Data abnormality monitoring method. In the data vector selection step, the data vector selection means selects the most advanced data vector representing the current time point of the data series at each time,
In the tangential direction calculation step, the tangential direction calculation means determines a tangential direction with respect to the trajectory of the data vector selected by the data vector selection means based on the selected data vector and a data vector preceding this data vector. Calculated as a tangent to the selected data vector of the derived circle, and the tangent direction to the trajectory of the neighborhood vector detected by the neighborhood vector detection means is based on the neighborhood vector and the data vector before this neighborhood vector. 6. The time series data abnormality monitoring method according to claim 5, wherein the abnormality is calculated as a tangent to the derived vector of the circle. 8. The accumulated data updating means, comprising: an accumulated data updating step for deleting data that has passed a set period from time-series data accumulated in the data accumulating means. Anomaly monitoring method for time-series data described in 1. The program for functioning a computer as each means of the abnormality monitoring apparatus of any one of Claim 1 to 4.

Images