JP7348588B2 - Anomaly detection system and anomaly detection program - Google Patents

Description

The present invention relates to an anomaly detection technique for detecting an anomaly in a monitored object, and particularly to an anomaly detection system that can improve the accuracy of anomaly detection.

Anomaly detection techniques for detecting abnormalities in a monitored object have a problem in that it is difficult to accurately identify a state in which the monitored object is abnormal.
For example, when considering the construction of an abnormality detection system that can be used universally for various monitoring targets, it is not easy to define what state of the monitoring target is abnormal.

Therefore, by modeling the feature quantities extracted from various measurement data obtained from the normal state of the monitored target, without defining the abnormal state of the monitored target in advance, abnormalities can be detected from comparison with the normal state. It is conceivable to use a method to do so.
Since abnormality detection using this method does not define what constitutes an abnormality, it is possible to respond to unexpected abnormal conditions.

On the other hand, in such abnormality detection, the quality of input data has a very large influence on detection accuracy.
That is, there are various types of input data obtained by measuring a monitoring target, such as images and waveform data, and it is possible to extract many feature quantities from the images and waveform data. Furthermore, as the inspection target becomes more complex, it becomes more difficult to select the feature amounts necessary for determining an abnormal state. Furthermore, simply increasing the number of feature quantities used for determination results in the inclusion of feature quantities that degrade the quality of the determination result. Furthermore, the input data may contain noise, both in data indicating normal or abnormal conditions.
Therefore, in such an anomaly detection system, it is desirable to enable highly accurate anomaly detection by improving the quality of input data.

Japanese Patent Application Publication No. 2016-206784

In such an anomaly detection system, it is conceivable to process the feature amounts of input data by using a mapping method or the like, and perform anomaly detection using only useful features among the feature amounts. However, even when such a mapping method is used, if noise remains in the input data, the detection accuracy will decrease, but with the mapping method, it is difficult to properly remove noise from the input data. there were.

Therefore, the present inventors conducted extensive research, applied mapping methods and clustering methods to the features of input data, and removed certain clusters to remove outliers in the features and improve the accuracy of anomaly detection. The present invention was completed by successfully improving the
Here, as a technique using a mapping method and a clustering method, a data analysis device described in Patent Document 1 can be mentioned. However, with this device, it was not possible to remove outliers in the feature amounts of input data as in the present invention.

The present invention has been made in view of the above circumstances, and provides an anomaly detection system that can improve the accuracy of anomaly detection by improving the quality of input data for creating a learning model in the anomaly detection system. and to provide anomaly detection programs.

In order to achieve the above object, the anomaly detection system of the present invention is an anomaly detection system that detects an anomaly in a monitored target, and uses feature data obtained by calculating feature values using data related to the monitored target. A basis for defining a feature space corresponding to the feature data is generated using a mapping method to a state space model, and a new number of dimensions of the feature space is determined by mapping the feature data based on the base. a mapping unit that reduces the number of dimensions of the determined and mapped feature data to obtain the new number of dimensions and generates transformed feature data; a learning model creation unit that classifies the learning model candidates into clusters and creates learning model candidates; and a cluster that has a mixture ratio lower than a set threshold or a cluster that has the smallest mixture ratio for the learning model candidates. The configuration includes a model modification unit that creates a learning model by modifying the learning model candidate by deleting the learning model candidate.

Further, the anomaly detection program of the present invention is an anomaly detection program that detects an anomaly in a monitoring target, and the computer is configured to perform a state detection process on feature data obtained by calculating feature quantities using data related to the monitoring target. A basis defining a feature space corresponding to the feature data is generated using a mapping method to a spatial model, and a new number of dimensions of the feature space is determined by mapping the feature data based on the base. , a mapping unit that reduces the number of dimensions of the mapped feature data to obtain the new number of dimensions and generates transformed feature data, and classifies the transformed feature data into a plurality of clusters based on a mixture distribution method. and a learning model creation unit that creates a learning model candidate, and for the learning model candidates, deletes a cluster that has a mixture ratio lower than a set threshold value or a cluster that has a mixture ratio that has the smallest value. By doing so, it is configured to function as a model modification unit that modifies the learning model candidate to create a learning model.

According to the present invention, it is possible to provide an anomaly detection system and an anomaly detection program that can improve the accuracy of anomaly detection by improving the quality of input data for creating a learning model in the anomaly detection system. Become.

FIG. 1 is a block diagram showing the configuration of an abnormality detection system (anomaly detection device) according to a first embodiment of the present invention. FIG. 2 is an explanatory diagram showing a mapping method using principal component analysis used in the first embodiment, second embodiment, and third embodiment of the present invention. FIG. 2 is an explanatory diagram showing a flow of compressing feature data into a low-dimensional space based on principal component analysis used in the first embodiment, second embodiment, and third embodiment of the present invention. FIG. 3 is an explanatory diagram of model modification processing using a Gaussian mixture distribution model used in the first embodiment and the third embodiment of the present invention. It is a flowchart which shows the processing procedure by the abnormality detection system of the first embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of an abnormality detection system according to a second embodiment of the present invention. It is a flowchart which shows the processing procedure by the abnormality detection system of the second embodiment of this invention. FIG. 2 is a block diagram showing the configuration of an abnormality detection system according to a third embodiment of the present invention. It is a flowchart which shows the processing procedure by the abnormality detection system of 3rd embodiment of this invention. FIG. 3 is a diagram showing image data used in tests shown in Examples. FIG. 3 is a diagram showing types of feature amounts extracted from image data used in tests shown in Examples. It is a figure which shows the graph showing the result of the principal component analysis in the test shown in an Example. It is a figure which shows the evaluation result of the learning model obtained by the Example and the reference example.

Hereinafter, embodiments of the abnormality detection system and abnormality detection program of the present invention will be described in detail. However, the present invention is not limited to the specific contents of the embodiments and examples described below.

[First embodiment]
First, an abnormality detection system and an abnormality detection program according to a first embodiment of the present invention will be described with reference to the drawings.
The abnormality detection system of this embodiment detects an abnormality in a monitored object. The objects to be monitored include the objects to be inspected, and the objects to be monitored include, for example, the environment of products, equipment, buildings, and the like.

Specifically, as shown in FIG. 1, an abnormality detection device 1 corresponding to the abnormality detection system of this embodiment includes a measurement data input section 10, a measurement data storage section 11, a feature extraction section 12, and a feature data storage. 13, a mapping section 14, a mapping data storage section 15, a learning model creation section 16, a learning model storage section 17, and a model modification section 18.

All of these components in the abnormality detection device 1 of this embodiment can be included in one information processing device as shown in FIG. Further, each of these configurations may be distributed and provided in each device of an abnormality detection system including a plurality of information processing devices. This also applies to each embodiment described below.

The measured data input unit 10 inputs data measured on the monitoring target (hereinafter sometimes referred to as measured data), and stores the data in the measured data storage unit 11.
The measurement data storage unit 11 stores measurement data input by the measurement data input unit 10.
Examples of measurement data include inspection data obtained from products and the like, and process data obtained from devices and the like.

Inspection data can include images, dimensions (size, circularity, etc.), color, defects (number, size, etc.), number of discharges, transparency, weight, strength, surface roughness, and the like. Note that since the inspection data includes only the items to be inspected, many other items may be assumed.
Examples of process data include sound, temperature, humidity, vibration, displacement, speed, acceleration, rotation angle, angular velocity, angular acceleration, voltage, current, light amount, pressure, and the like.
By using a combination of such inspection data and process data as a measurement index, it is possible to improve the performance of abnormality detection.

The feature amount extraction section 12 reads the measurement data from the measurement data storage section 11, calculates the feature amount based on this measurement data, generates feature amount data, and stores it in the feature amount data storage section 13.
At this time, the measured data is divided into two sets, and the feature extraction unit 12 uses the training data set as feature data to create a learning model candidate, and the training data set used to create a learning model candidate. It is preferable to generate two types of verification data sets used for completion and store them in the feature amount data storage unit 13.

Note that the measurement data input section 10, the measurement data storage section 11, and the feature amount extraction section 12 can be configured outside the abnormality detection system and abnormality detection program of this embodiment, and can be configured outside the abnormality detection system and abnormality detection program of this embodiment. These configurations may be omitted from the abnormality detection program.

The feature data storage unit 13 stores the feature data generated by the feature extraction unit 12.
The structure of the feature amount data can be made up of, for example, a measurement data (eg, image) ID, a plurality of feature amount IDs, and the like.

For example, when the measurement data is an image, the feature amounts may include size, aspect ratio, circularity, perimeter, circumscribed quadrangle area ratio, convex number, etc. related to the shape of the monitored object. In addition, regarding the brightness of the monitoring target, color space (R space, G space, B space, GRAY space), average value, standard deviation, maximum value, minimum value, maximum value - minimum value, median value, Quantile, second quartile, 1σ probability, 3σ probability, interquartile range, mean-median value, histogram probability density distribution (skewness, kurtosis, contrast, second moment, entropy), difference probability Examples include density distribution (contrast, second moment, entropy), etc.

In addition, as feature values, measured values in waveform data such as time series data, average value of a temporal width of waveform data, maximum value, minimum value, median value, standard deviation, maximum value - minimum value, 1σ probability, 3σ Probability, 1st quartile, 3rd quartile, mode of histogram of waveform data, kurtosis, skewness, peak position in frequency characteristics of waveform data, peak value, center of gravity position, change by Taguchi method Quantity, abundance, etc. can also be mentioned.

The mapping unit 14 reads the feature data from the feature data storage unit 13 and uses a mapping method for the feature data to a state space model to create a basis for defining a feature space corresponding to the feature data. The feature amount data is mapped based on this basis. At this time, a learning data set is preferably used as the feature data.
Furthermore, the mapping unit 14 determines a new number of dimensions (number of dimensions after compression) of the feature space based on the set threshold value.

Further, the mapping unit 14 performs dimension reduction processing to reduce the number of dimensions of the mapped feature amount data to obtain a new number of dimensions.
At this time, the mapping unit 14 adds up the eigenvalues of the principal components of the mapped feature data from the top and determines a new number of dimensions so that the total value is less than the threshold and becomes the maximum value. , dimensionality reduction processing can be performed.
Then, the mapping unit 14 stores the obtained post-conversion feature amount data in the mapping data storage unit 15 as mapping data.

The mapping data storage unit 15 stores the converted feature amount data generated by the mapping unit 14 as mapping data.
The structure of the post-conversion feature amount data may include, for example, a measurement data (eg, image) ID, a plurality of feature amount IDs, and the like.

Specifically, the mapping unit 14 uses principal component analysis (PCA), independent component analysis, kernel principal component analysis, LDA (Latent Dirichlet Allocation), and neighborhood search methods as mapping methods to the state space model. At least one of these can be used, and principal component analysis can be preferably used.

Principal component analysis is an orthogonal projection of data points onto a lower dimensional linear space called the principal subspace. Further, principal component analysis is a linear projection that minimizes the expected value of a projection cost function defined by the average value of the squared distance between the original data point and the projected point.
According to principal component analysis, information can be reduced to a low-dimensional space without losing as much information as possible in the original data. In other words, it is possible to express the original data with only the minimum amount of information without using unnecessary feature amounts that are not necessary for abnormality detection.

Also, at this time, the mapping unit 14 creates the following conversion formula for converting the feature amount data into converted feature amount data.

For example, as shown in FIG. 2, when 80% of the first principal component and 20% of the second principal component are obtained through principal component analysis, and the set threshold is 80%, the mapping unit 14 , one dimension is determined as the new number of dimensions of the feature space (the number of dimensions after compression), converted feature data is generated, and a conversion formula for converting the feature data into one-dimensional converted feature data is determined. Created.
Furthermore, as shown in FIG. 3, when the feature space corresponding to the feature data X is M-dimensional, the mapping process generates M-dimensional feature data X', and the dimension reduction process generates M'-dimensional ( Feature amount data X' with M>M') is generated.

Furthermore, the mapping unit 14 reads the feature data of the verification data set from the feature data storage unit 13, uses a mapping method to the state space model for this feature data, and converts the feature data into the previously generated base. Based on the feature data is mapped.
At this time, the mapping unit 14 maps the feature data using the above conversion formula to reduce the number of dimensions, and stores the obtained converted feature data as mapping data in the mapping data storage unit 15. Can be done.

The learning model creation unit 16 reads the converted feature data (mapping data) from the mapping data storage unit 15, classifies the converted feature data into a plurality of clusters (clumps) based on the mixture distribution method, and creates learning model candidates. is created and stored in the learning model storage section 17.
A learning model candidate is made up of one or more clusters, and the cluster structure can be made up of, for example, a cluster ID, an average value of each class, a covariance matrix, a mixing ratio, and the like.

In the abnormality detection system of this embodiment, measurement data is finally classified into two types: "normal" and "abnormal". Furthermore, the anomaly detection system of this embodiment employs unsupervised learning, in which a learning model is constructed using only "normal" data, and outliers are determined to be "abnormal". Therefore, it is possible to detect various types of abnormalities without defining abnormalities.
By the way, there is a possibility that there are various types of "normal" (polymorphism), and data that does not become an outlier in one homogeneous population will be different if one homogeneous population is divided into three groups. As a result, it is possible to express the distribution of data in detail, which may result in outliers.
Therefore, in the anomaly detection system of this embodiment, the accuracy of anomaly detection can be improved by classifying the converted feature data into a plurality of clusters using the mixture distribution method.

As the mixture distribution method, a distribution model based on at least one of the normal distribution, t distribution, Poisson distribution, Bernoulli distribution, and Dirichlet distribution can be used, and a Gaussian mixture model (GMM) is preferably used. be able to.
The Gaussian mixture distribution model is a model expressed by a weighted linear sum that combines multiple normal distributions.

Here, clustering refers to the process of grouping data into several clusters based on the degree of similarity or dissimilarity between data without any training data. The normal distribution can only express a unimodal probability distribution, but when actually observed measurement data is placed in the feature space, multiple clusters are formed because there are various types of measurement data. Conceivable. In this case, if the entire probability distribution is modeled by a weighted linear sum of a plurality of unimodal probability distributions, a highly consistent model will be constructed. Such a probability model is called a mixture distribution model, and in particular, a mixture distribution model constructed by mixing multiple normal distributions is called a Gaussian mixture distribution model.

In the Gaussian mixture distribution model, where x is a feature vector, j is the normal distribution number, and d is the number of dimensions, the probability distribution of x in the jth normal distribution is the normal distribution parameter (mean j, covariance matrix j) is expressed by the following formula.

In addition, when classifying the transformed feature data into multiple clusters based on the mixture distribution method, the learning model creation unit 16 divides the measured data into pieces with similar features by adjusting each parameter of the normal distribution little by little. Approximately represent the state. This is realized by a technique called EM algorithm. The EM algorithm is used when incomplete data, that is, measurement data to be detected has not been learned and the probability of its occurrence is unknown. This is one of the calculation algorithms of maximum likelihood estimation, which estimates the value by applying repeated operations when there is such a value that cannot be directly determined.

The model modification unit 18 deletes, from among the learning model candidates in the learning model storage unit 17, clusters that have a mixture ratio lower than a set threshold value or clusters that have a mixture ratio that has the smallest value (hereinafter referred to as The learning model candidate is modified by deleting a cluster (sometimes referred to as "cluster cut") to create a learning model, and the learning model candidate in the learning model storage unit 17 is updated to the learning model.
That is, according to the anomaly detection system of this embodiment, for example, as shown in FIG. By deleting clusters of abnormal values, it is possible to suppress false detections and improve the accuracy of abnormality detection.

A plurality of learning models may be created by the model modification unit 18 for each mixed number of clusters, as described later. Thereafter, the best learning model can be determined based on the optimal number of cluster mixtures, and the learning model can be completed.
Further, in the anomaly detection system of this embodiment, a storage unit separate from the learning model storage unit 17 may be provided in order to store the learning model completed in this manner.

It is also preferable that the model modification unit 18 performs abnormality determination processing using the transformed feature data of the verification data set, and performs cluster cutting based on the result.
That is, the model modification unit 18 calculates the probability (occurrence probability) that the converted feature data of the verification dataset will occur as an outlier for each cluster in the learning model candidates in the learning model storage unit 17, and sets the probability of occurrence. If the cluster is determined to be normal if it is lower than the threshold value, and the verification data corresponding to this converted feature data is originally abnormal (in the case of false determination), it is preferable to delete the cluster from the learning model candidates. .

Note that the model modification unit 18 inputs the feature data of the verification dataset, maps the feature data using the basis generated by the mapping unit 14, and reduces the number of dimensions of the mapped feature data. to create a new number of dimensions, generate converted feature data, calculate the probability of occurrence of the converted feature data for each cluster in the learning model candidates in the learning model storage unit 17, and set the occurrence probability to the set threshold. It is also possible to adopt a configuration in which the cluster is determined to be normal if it is lower than , and if the verification data corresponding to the converted feature data is originally abnormal, the cluster is deleted from the learning model candidates.

Here, the calculation method of the occurrence probability by the model modification unit 18 is not particularly limited as long as it can perform processing for the same purpose, but it is preferably performed using the Mahalanobis distance of the Maharanobis Taguchi (MT) method, for example. I can do it.
Specifically, the Mahalanobis distance can be calculated using the following formula.

Then, by applying the obtained Mahalanobis distance to the following cumulative distribution function (CDF), the occurrence probability can be calculated. In addition, in the test described below, the threshold is set to 0.99 (one-sided significance level of 1% of chi-square distribution).

Furthermore, instead of the Mahalanobis Taguchi method, any one of the MTA (Maharanobis Taguchi Afjoint) method, the RT (Recognition Taguchi) method, the Taguchi method, and the Taguchi Schmidt method may be used.

Furthermore, the model modification unit 18 can use the center of gravity of each cluster when calculating the Mahalanobis distance between the feature amount data and each cluster.
Furthermore, "when it is originally abnormal" means that the verification data corresponding to the converted feature amount data is abnormal data in the verification data set.

Further, the learning model creation unit 16 creates a plurality of learning model candidates with different numbers of cluster mixtures, and the model modification unit 18 selects the learning model candidate with the highest true positive incidence among the plurality of learning model candidates. It is also preferable to let the learning model decide.
That is, the learning model creation unit 16 classifies the converted feature data (mapping data) into clusters corresponding to the number of mixtures based on the set number of mixtures, and creates a learning model candidate for each number of mixtures. It is preferable.

In addition, the mapping unit 14 inputs the feature data (verification data set), maps the feature data using the basis previously generated by the mapping unit 14, and calculates the number of dimensions of the mapped feature data. It is preferable to reduce the number of dimensions to a new number of dimensions and generate the transformed feature amount data.
Then, the model modification unit 18 calculates the probability of occurrence of the converted feature data for each cluster in the learning model candidate for each number of mixtures, and determines that the probability of occurrence of the transformed feature data is higher than the set threshold value is an outlier. It is also preferable to determine as the learning model a learning model candidate that is determined to be abnormal and has the highest incidence of true positives.

Note that the model modification unit 18 inputs the feature data (verification data set), maps the feature data using the basis generated by the mapping unit 14, and calculates the number of dimensions of the mapped feature data. Reduce the number of dimensions to a new number of dimensions, generate transformed feature data, calculate the probability of occurrence of the transformed feature data for each cluster in the learning model candidate for each mixture number, and calculate the probability of occurrence of the transformed feature data for each cluster in the learning model candidate. It is also possible to adopt a configuration in which the learning model candidate with the highest incidence of true positives is determined as an abnormality due to being an outlier when it is higher than .

The incidence rate of true positives can be calculated, for example, by preparing normal data and abnormal data in advance in a verification data set, and calculating the ratio of data determined to be abnormal among all abnormal data. Moreover, the incidence of false positives can be calculated as the ratio of data incorrectly determined to be abnormal data among all normal data.

Note that the anomaly detection system of this embodiment has a configuration up to the creation of a learning model, and does not detect anomalies in measured data, but it does create a learning model that can detect anomalies in measured data. Therefore, it is called an "abnormality detection system."

Next, the processing procedure by the abnormality detection system of this embodiment will be explained with reference to FIG.
First, the measurement data input section 10 inputs measurement data and stores it in the measurement data storage section 11 (step 10).
Next, the feature amount extraction section 12 reads the measurement data in the measurement data storage section 11, extracts the feature amount (step 11), generates feature amount data, and stores it in the feature amount data storage section 13. At this time, the feature amount extraction section 12 can divide the feature amount data into two types, a learning data set and a verification data set, and store them in the feature amount data storage section 13 (step 12).

Next, the mapping unit 14 reads the feature data in the feature data storage unit 13 and executes processing by the mapping unit (step 13).
At this time, the mapping unit 14 performs mapping processing and dimension reduction on the learning data set.
Specifically, the mapping unit 14 generates a base that defines a feature space corresponding to the feature data by principal component analysis or the like, and maps the feature data based on this base. Furthermore, a new number of dimensions (number of dimensions after compression) of the feature space is determined based on the set threshold value. Then, the number of dimensions of the mapped feature data is reduced to a new number of dimensions, and the obtained converted feature data is stored in the mapping data storage unit 15 as mapping data.

Next, the learning model creation unit 16 creates learning model candidates and stores them in the learning model storage unit 17 (step 14).
At this time, the learning model creation unit 16 reads the converted feature data (mapping data) from the mapping data storage unit 15, classifies the converted feature data into a plurality of clusters using a Gaussian mixture distribution model, etc., and performs learning. A model candidate is created and stored in the learning model storage section 17.

Next, the model modification unit 18 creates a learning model by performing a cluster cut on the learning model candidates, and determines a final learning model (step 15).
At this time, the model modification unit 18 changes the learning model candidate by deleting a cluster whose mixture ratio is lower than the set threshold or a cluster whose mixture ratio is the smallest. It is preferable to create a learning model by modifying it.

In addition, the model modification unit 18 calculates the probability of occurrence of the converted feature data for each cluster in the learning model candidate, and if the probability of occurrence is lower than a set threshold, it is determined to be normal and corresponds to the feature data. If the measurement data to be measured is originally abnormal, it is also preferable to create a learning model by modifying the learning model candidate by deleting the cluster from the learning model candidate.

Furthermore, the model modification unit 18 calculates the probability of occurrence of the converted feature data for each cluster in the learning model candidate for each number of mixtures, and determines that the probability of occurrence of the transformed feature data is higher than a set threshold value is an outlier. It is also preferable to determine the learning model candidate with the highest incidence of true positives as the final learning model.

According to the anomaly detection system and anomaly detection program of this embodiment, a learning model can be created by deleting clusters and the like in which the mixture ratio takes a low value below a certain level from the learning model candidates. Therefore, the quality of input data can be substantially improved, and the accuracy of abnormality detection can be improved.

[Second embodiment]
Next, an abnormality detection system and an abnormality detection program according to a second embodiment of the present invention will be described with reference to FIGS. 6 and 7.
The present embodiment relates to an apparatus that uses the learning model completed in the first embodiment to determine abnormality in measurement data.

As shown in FIG. 6, an abnormality detection device 1a corresponding to the abnormality detection system of this embodiment includes a measurement data input section 10a, a measurement data storage section 11a, a feature extraction section 12a, a feature data storage section 13a, and a mapping section. 14a, a mapping data storage section 15a, a learning model storage section 17a, an abnormality determination section 19a, and a determination result storage section 20a.

The measurement data input section 10a, the measurement data storage section 11a, the feature data storage section 13a, the mapping data storage section 15a, and the learning model storage section 17a in the abnormality detection device 1a of this embodiment have the same names in the first embodiment. It can be made similar to. Further, the other configurations of the abnormality detection device 1a of this embodiment can be the same as the configurations with the same names in the first embodiment, except for the points described below.

The feature extraction unit 12a reads the measurement data from the measurement data storage unit 11a, calculates the feature based on this measurement data, generates feature data (measurement data set), and stores it in the feature data storage 13a. let

The mapping unit 14a reads the feature data from the feature data storage unit 13a, maps the feature data based on the set basis using a mapping method to the state space model on the feature data, and The number of dimensions of the mapped feature data is reduced, and converted feature data is generated as a new number of dimensions.
At this time, the mapping unit 14a converts the feature data into post-conversion feature data using the conversion formula for converting the feature data created in the first embodiment into post-conversion feature data, and converts the post-conversion feature data into post-conversion feature data. The quantity data can be stored in the mapping data storage section 15a as mapping data. Note that the abnormality detection system 1a of this embodiment can be provided with a conversion formula storage section to store the above conversion formula in advance.

The anomaly determination unit 19a calculates the probability of occurrence of the converted feature data in the mapping data storage unit 15a for each cluster in the learning model candidates in the learning model storage unit 17a, and determines if the probability of occurrence is higher than a set threshold. When an outlier occurs, the corresponding measurement data is determined to be abnormal, and this determination result is stored in the determination result storage section 20a.
Calculation of the occurrence probability by the abnormality determination unit 19a can be performed using the same method as the model modification unit 18 of the first embodiment, and is preferably performed using the Mahalanobis distance of the Mahalanobis Taguchi (MT) method, for example. I can do it.

Next, the processing procedure of the abnormality detection system of this embodiment will be explained with reference to FIG.
First, the measurement data input section 10a inputs measurement data and stores it in the measurement data storage section 11a (step 30).
Next, the feature amount extraction section 12a reads the measurement data in the measurement data storage section 11a, extracts the feature amounts (step 31), generates feature amount data (measurement data set), and stores the measurement data in the feature amount data storage section 13a. (step 32).

Next, the mapping unit 14a reads the feature data in the feature data storage unit 13a, and executes processing by the mapping unit (step 33).
At this time, the mapping unit 14a performs mapping processing and dimension reduction of the measurement data set.
Specifically, the mapping section 14a converts the feature amount data into converted feature amount data using the above conversion formula, and stores the converted feature amount data as mapping data in the mapping data storage section 15a.

Next, the abnormality determination unit 19a performs abnormality determination processing on the measurement data (step 34).
At this time, the abnormality determination unit 19a calculates the probability of occurrence of the transformed feature data in the mapping data storage unit 15a for each cluster in the learning model in the learning model storage unit 17a, and calculates the probability of occurrence of the transformed feature data in the mapping data storage unit 15a, and If the value is high, it becomes an outlier, and the corresponding measurement data is determined to be abnormal, and this determination result is stored in the determination result storage section 20a.

According to the anomaly detection system and anomaly detection program of the present embodiment, for example, the anomaly detection system of the first embodiment creates a learning model and a conversion formula for converting feature data into converted feature data, By storing these in the abnormality detection system of this embodiment, it is possible to perform an abnormality determination of measurement data using the abnormality detection system of this embodiment.

[Third embodiment]
Next, an abnormality detection system and an abnormality detection program according to a third embodiment of the present invention will be described with reference to FIGS. 8 and 9.
This embodiment combines the first embodiment and the second embodiment, and adds a configuration for performing abnormality determination to the abnormality detection system of the first embodiment.

As shown in FIG. 8, an abnormality detection device 1b corresponding to the abnormality detection system of this embodiment includes a measurement data input section 10b, a measurement data storage section 11b, a feature extraction section 12b, a feature data storage section 13b, and a mapping section. 14b, a mapping data storage section 15b, a learning model creation section 16b, a learning model storage section 17b, a model modification section 18b, an abnormality determination section 19b, and a determination result storage section 20b.

In the abnormality detection device 1b of this embodiment, a measurement data input section 10b, a measurement data storage section 11b, a feature extraction section 12b, a feature data storage section 13b, a mapping section 14b, a mapping data storage section 15b, a learning model creation section 16b, The learning model storage unit 17b and the model modification unit 18b can have the same configuration as those having the same names in the first embodiment. Further, the abnormality determination section 19b and the determination result storage section 20b in the abnormality detection device 1b of this embodiment can be similar to the configurations with the same names in the second embodiment.

That is, in the learning model creation stage, the feature extraction unit 12b reads measurement data from the measurement data storage unit 11b, calculates the feature based on this measurement data, generates feature data, and stores the feature data. The information is stored in the section 13b.
At this time, the measurement data is divided into two sets, and the feature extraction unit 12b uses the training data set as feature data to create a learning model candidate, and the training data set used to create a learning model candidate. Two types of verification data sets used for completion are generated and stored in the feature amount data storage section 13b.

The mapping unit 14b also reads feature data (learning data set) from the feature data storage unit 13b, and maps the feature data to a state space model using a mapping method to the state space model. A base that defines a feature space is generated, and feature data is mapped based on this base. Furthermore, the mapping unit 14b determines a new number of dimensions (number of dimensions after compression) of the feature space based on the set threshold value. Further, the mapping unit 14b performs a dimension reduction process to reduce the number of dimensions of the mapped feature amount data to obtain a new number of dimensions. Then, the mapping unit 14b stores the obtained post-conversion feature data as mapping data in the mapping data storage unit 15b. Also, at this time, the mapping unit 14b creates a conversion formula for converting the feature amount data into converted feature amount data.

In addition, after the learning model is completed, in the anomaly detection stage, the feature extraction unit 12b reads the measurement data from the measurement data storage unit 11b, calculates the feature based on this measurement data, and calculates the feature quantity data (measurement data set). ) is generated and stored in the feature amount data storage section 13b.

The mapping unit 14b reads the feature data from the feature data storage unit 13b, maps the feature data based on the set basis using a mapping method to a state space model on the feature data, and The number of dimensions of the mapped feature data is reduced, and converted feature data is generated as a new number of dimensions.
At this time, the mapping section 14b can convert the feature amount data into converted feature amount data using the above conversion formula, and store the converted feature amount data as mapping data in the mapping data storage section 15b. .

Next, the processing procedure by the abnormality detection system of this embodiment will be explained with reference to FIG.
First, the measurement data input section 10b inputs measurement data and stores it in the measurement data storage section 11b (step 50).
Next, the feature amount extraction section 12b reads the measurement data in the measurement data storage section 11b, extracts the feature amount (step 51), generates feature amount data, and stores it in the feature amount data storage section 13b. At this time, the feature extraction unit 12b divides the feature data into two types, a learning data set and a verification data set, and stores them in the feature data storage unit 13b (step 52).

Next, the mapping unit 14b reads the feature data in the feature data storage unit 13b and executes processing by the mapping unit (step 53). At this time, the mapping unit 14b performs mapping processing and dimension reduction on the learning data set.
Next, the learning model creation unit 16b creates a learning model candidate and stores it in the learning model storage unit 17b (step 54).

Next, the model modification unit 18b creates a learning model by performing a cluster cut on the learning model candidates, and determines a final learning model (step 55).
Then, in the abnormality detection stage, the measured data input section 10b inputs the measured data and stores it in the measured data storage section 11b (step 56).
Next, the feature amount extracting section 12b reads the measurement data in the measurement data storage section 11b, extracts the feature amount (step 57), generates feature amount data (measurement data set), and stores it in the feature amount data storage section 13b. (step 58).

Next, the mapping unit 14b reads the feature data in the feature data storage unit 13b and executes processing by the mapping unit (step 59). At this time, the mapping unit 14b performs mapping processing and dimension reduction of the measurement data set.
Finally, the abnormality determination section 19b performs abnormality determination processing on the measurement data (step 60).
At this time, the abnormality determination unit 19b calculates the probability of occurrence of the transformed feature data in the mapping data storage unit 15b for each cluster in the learning model in the learning model storage unit 17b, and calculates the probability of occurrence of the transformed feature data in the mapping data storage unit 15b, and If the value is high, it becomes an outlier, and the corresponding measurement data is determined to be abnormal, and this determination result is stored in the determination result storage section 20b.

According to the anomaly detection system and anomaly detection program of this embodiment, a learning model can be created by deleting clusters and the like in which the mixture ratio takes a low value below a certain level from the learning model candidates. Further, this abnormality detection system can be used as is for abnormality detection.
As a result, according to this embodiment, it is possible to substantially improve the quality of input data and improve the accuracy of abnormality detection.

The abnormality detection system of the above embodiment can be realized using a computer controlled by the abnormality detection program of the present invention. The CPU of the computer sends commands to each component of the computer based on the anomaly detection program, and performs predetermined processing necessary for the operation of the anomaly detection system, such as input processing of measurement data, extraction processing of feature quantities, and dataset processing. , processing by the mapping unit, learning model generation processing, model modification processing, abnormality determination processing, etc. In this way, each process and operation in the abnormality detection system of the present invention can be realized by specific means in which a program and a computer cooperate.

The program is stored in advance in a recording medium such as a ROM or RAM, and the program is read into the computer from the recording medium installed in the computer and executed, but it can also be read into the computer via a communication line, for example.
Further, the recording medium that stores the program can be constituted by, for example, a semiconductor memory, a magnetic disk, an optical disk, or any other computer-readable recording means.

Hereinafter, a test in which a learning model was created using an anomaly detection system and an anomaly detection program according to an embodiment of the present invention and its effectiveness was evaluated will be described using FIGS. 10 to 13.
As an example, an abnormality detection system according to the first embodiment of the present invention was used. Furthermore, as a reference example, a partially modified image processing apparatus according to the first embodiment of the present invention was used. Specifically, in the reference example, the model modification unit 18 was omitted and changed so that cluster cutting was not performed.

In this test, image data was prepared to be used as measurement data.
Specifically, as shown in FIG. 10, an image class containing nine types of images with different shapes and colors was prepared. The size of the image in each image class is 50 x 50 pixels, and the detection target is drawn within 20 x 20 to 34 x 34 pixels at the center of the image.

The shape of the detection target in image classes 1 to 3 is circular, the shape of the detection target in image classes 4 to 6 is triangular, and the shape of the detection target in image classes 7 to 9 is square.
Furthermore, the colors of the detection targets in image classes 1, 4, and 7 are red, indicating that the value of R is greater than G and B in the RGB space. Furthermore, the colors of the detection targets for image classes 2, 5, and 8 are greenish, indicating that the value of G is greater than R and B in the RGB space. The colors to be detected in image classes 3, 6, and 9 are blue, indicating that the value of B is greater than R and G in the RGB space. Note that the representative image indicates an example of a representative image in each image class.

Further, it is assumed that all images included in image classes 1, 3 to 9 are normal, and all images included in image class 2 are abnormal.
Specifically, 500 images each are included in image classes 1 and 3 to 9 for creating the learning data set, and the statuses of all of them are assumed to be normal. Furthermore, the number of images included in image class 2 for creating the learning dataset is 280 each, and the status of all of them is set as abnormal.

Furthermore, the number of images included in each of image classes 1, 3 to 9 for creating a verification data set is 100, and the status of all images is normal. Further, the number of images included in image class 2 for creating the verification data set is 800 each, and the status of all of them is set as abnormal.

In the above, the difference between normal and abnormal is that the status is arbitrarily determined for the image class.
In other words, the 280 images with abnormal status in the training dataset account for about 7% of the total 4280 images, and the abnormality detection system of this embodiment creates a learning model that determines these as abnormal. It is assumed that

The background of each image is drawn by setting a gray color (0 to 25 brightness (randomly) determined for each pixel) using shades of black, and adding a Gaussian filter to blur it.
Further, noise is randomly added to detection targets in images of all image classes. Specifically, a gray color (0 to 25 brightness (random)) is added to each pixel with a probability of 20%. In this way, by adding noise to both normal data and abnormal data, the difficulty level of abnormality detection using a learning model is improved. It is estimated that these noises can be removed or reduced by feature extraction processing by the feature extraction unit 12 and dimension reduction processing in principal component analysis by the mapping unit 14.

As shown in FIG. 11, the target feature quantities for feature quantity extraction by the feature quantity extracting unit 12 include six types of shape-related feature quantities, four types of color spaces for calculating brightness feature quantities, and brightness feature quantities. There were 20 types, making a total of 86 types (=6+4×20).

Then, the mapping unit 14 performed principal component analysis using the learning data set to generate a basis. In addition, the training dataset is mapped using the generated basis, and the eigenvalues of the principal components of the mapped training dataset are added up from the top, so that the total value is less than 95% and becomes the maximum value. , the number of dimensions after compression was determined and dimension reduction was performed.
Specifically, 86 dimensions corresponding to 86 types of feature amounts shown in FIG. 12 were compressed to 11 dimensions. In addition, the verification data set was similarly mapped and then compressed to the same number of dimensions.

Next, the learning model creation unit 16 generated a learning model candidate based on a Gaussian mixture distribution model using the compressed learning data set (post-converted feature data). At this time, the number of mixed clusters was 20 types ranging from 1 to 20.

In the embodiment, the model modification unit 18 performed abnormality determination processing using the learning model candidates for each number of mixtures using the compressed verification data set (post-conversion feature data). In addition, the model modification unit 18 performed cluster cutting by deleting the class with the smallest mixture ratio and the class in which a false negative (an abnormality was incorrectly determined as normal) occurred for each mixture number. Note that the cluster cut was performed by calculating the threshold value with a one-sided significance level of 0%, and thereby all data existing in that class were treated as outliers.
On the other hand, in the reference example, such a cluster cut was not performed.

For each learning model candidate of the example and reference example obtained above, we calculated the true positive rate (the rate at which abnormalities were determined to be abnormal) and the false positive rate (the rate at which normalities were erroneously determined to be abnormal) for each number of mixtures. Calculated. The results are shown in FIG.

In an anomaly detection system, it is important to accurately determine an anomaly as an anomaly, and as shown in these figures, in the example, the true positive rate is 1.00 for most of the number of mixtures, It can be seen that almost all abnormal data can be determined as abnormal. On the other hand, the reference example is significantly inferior to the example in terms of true positive rate for all mixture numbers.

On the other hand, in the example, the false positive rate is reduced by performing cluster cut, indicating a trade-off relationship between the true positive rate and the false positive rate. This tendency is noticeable when the number of mixtures is low, but the decline in the false positive rate is suppressed when the number of mixtures exceeds 9, and in this test, the best performance was obtained when the number of mixtures was 18. ing.
Therefore, in this case, the model modification unit 18 in the anomaly detection system of the present embodiment can suitably determine the learning model candidate with the number of mixtures of 18 as the final learning model.

It goes without saying that the present invention is not limited to the above-described embodiments, and that various modifications can be made within the scope of the present invention.
For example, each configuration in the anomaly detection system may be distributed among multiple information processing devices, or feature quantities other than those shown in the embodiments and examples may be included and modified as appropriate. It is possible.

INDUSTRIAL APPLICABILITY The present invention can be suitably used when inspecting a monitored target for abnormalities using process data acquired from a monitored device, inspection data acquired from a product, etc. be.

1, 1a, 1b abnormality detection device 10, 10a, 10b measurement data input section 11, 11a, 11b measurement data storage section 12, 12a, 12b feature amount extraction section 13, 13a, 13b feature amount data storage section 14, 14a, 14b Mapping section 15, 15a, 15b Mapping data storage section 16, 16b Learning model creation section 17, 17a, 17b Learning model storage section 18, 18b Model modification section 19a, 19b Abnormality determination section 20a, 20b Judgment result storage section

Claims (12)

An anomaly detection system that detects anomalies in a monitored object,
Generate a basis for defining a feature space corresponding to the feature data using a mapping method to a state space model for the feature data obtained by calculating the feature data using data related to the monitoring target, and The feature data is mapped based on the basis, a new number of dimensions of the feature space is determined, the number of dimensions of the mapped feature data is reduced to the new number of dimensions, and the transformed feature data is a mapping unit that generates
a learning model creation unit that creates learning model candidates by classifying the transformed feature data into a plurality of clusters based on a mixture distribution method;
A learning model is created by modifying the learning model candidate by deleting a cluster with a mixture ratio lower than a set threshold value or a cluster with the lowest mixture ratio for the learning model candidate. a model modification section for
The mapping section is
Mapping the other feature data obtained by calculating the feature using other data related to the monitoring target based on the basis using a mapping method to a state space model; reducing the number of dimensions of the other mapped feature data and generating other post-conversion feature data as the new number of dimensions;
The model modification section
Calculate the probability of occurrence of the other converted feature data for each cluster in the learning model candidate, and determine it as normal if the probability of occurrence is lower than a set threshold;
If the other data corresponding to the other feature data is originally abnormal, the cluster is deleted from the learning model candidates.
An anomaly detection system characterized by: The learning model creation unit,
Based on the plurality of set numbers of mixtures, classify the converted feature data into clusters corresponding to the number of mixtures, and create a learning model candidate for each number of mixtures;
The model modification section
For each number of mixtures, calculate the probability of occurrence of the other converted feature data for each cluster in the learning model candidate, and determine that it is abnormal if the probability of occurrence is higher than a set threshold;
The anomaly detection system according to claim 1, wherein the learning model candidate with the highest incidence of true positives is determined as the learning model. 3. The anomaly detection system according to claim 1 , wherein the mapping unit determines a new number of dimensions of the feature space based on a set threshold value. The mapping section is
Mapping the new feature data obtained by calculating a feature using new data regarding the monitoring target based on the basis using a mapping method to a state space model; reducing the number of dimensions of the new mapped feature data and generating new post-conversion feature data as the new number of dimensions;
In the anomaly detection system,
It is characterized by further comprising an anomaly determination unit that calculates the probability of occurrence of the new post-conversion feature data for each cluster in the learning model, and determines that the occurrence probability is abnormal when the probability of occurrence is higher than a set threshold. The abnormality detection system according to any one of claims 1 to 3 , wherein: The abnormality detection system according to any one of claims 1 to 4 , wherein the data regarding the monitored object is data measured about the monitored object. 6. The method of mapping to the state space model is at least one of principal component analysis, independent component analysis, kernel principal component analysis, LDA (Latent Dirichlet Allocation), and neighborhood search method. Anomaly detection system according to any of the above. The abnormality detection system according to any one of claims 1 to 6 , wherein the mixed distribution method is a distribution model based on at least one of a normal distribution, a t-distribution, a Poisson distribution, a Bernoulli distribution, and a Dirichlet distribution. . Any one of claims 5 to 7, wherein the data measured regarding the monitoring target is at least one of an image, size, color, defect, number of discharges, transmittance, weight, strength, and surface roughness. Anomaly detection system described in Crab. The data measured on the monitoring target is at least one of sound, temperature, humidity, vibration, displacement, speed, acceleration, rotation angle, angular velocity, angular acceleration, voltage, current, light amount, and pressure. The abnormality detection system according to any one of claims 5 to 8 . An anomaly detection program that detects anomalies in a monitored object,
computer,
Generate a basis for defining a feature space corresponding to the feature data using a mapping method to a state space model for the feature data obtained by calculating the feature data using data related to the monitoring target, and The feature data is mapped based on the basis, a new number of dimensions of the feature space is determined, the number of dimensions of the mapped feature data is reduced to the new number of dimensions, and the transformed feature data is A mapping unit that generates
a learning model creation unit that creates learning model candidates by classifying the transformed feature data into a plurality of clusters based on a mixture distribution method;
A learning model is created by modifying the learning model candidate by deleting a cluster that has a mixture ratio lower than a set threshold value or a cluster that has the lowest mixture ratio for the learning model candidate. function as a model modification section to
In the mapping section,
Mapping the other feature data obtained by calculating the feature using other data related to the monitoring target based on the basis using a mapping method to a state space model; reducing the number of dimensions of the other mapped feature data to the new number of dimensions and generating other post-conversion feature data;
In the model modification section,
Calculate the probability of occurrence of the other converted feature data for each cluster in the learning model candidate, and determine it as normal if the probability of occurrence is lower than a set threshold;
If the other data corresponding to the other feature data is originally abnormal, the cluster is deleted from the learning model candidates.
An anomaly detection program characterized by: In the learning model creation section,
Based on a plurality of set numbers of mixtures, the converted feature data is classified into clusters of the number of mixtures, and learning model candidates are created for each number of mixtures;
In the model modification section,
Calculates the probability of occurrence of the other converted feature data for each cluster in the learning model candidate for each number of mixtures, and determines that it is abnormal if the probability of occurrence is higher than a set threshold;
11. The anomaly detection program according to claim 10 , further comprising: causing the learning model to determine the learning model candidate with the highest incidence of true positives. In the mapping section,
Mapping the new feature data obtained by calculating a feature using new data regarding the monitoring target based on the basis using a mapping method to a state space model; reducing the number of dimensions of the new mapped feature data to the new number of dimensions to generate new post-conversion feature data;
The computer,
It further functions as an anomaly determination unit that calculates the probability of occurrence of the new post-conversion feature data for each cluster in the learning model, and determines that the occurrence probability is abnormal when the probability of occurrence is higher than a set threshold. The abnormality detection program according to claim 10 or 11 .

Images