JP7540932B2 - Anomaly detection device and method - Google Patents

Description

The present invention relates to anomaly detection technology, and to a technology for early detection of anomalies based on multiple time-series sensor signals output by equipment such as a plant.

For example, electric power companies supply hot water for district heating using waste heat from gas turbines, and supply high-pressure steam and low-pressure steam to factories. In facilities such as various plants using gas turbines, anomaly detection and preventive maintenance technologies that detect malfunctions or symptoms of malfunctions as abnormalities are extremely important in order to minimize damage to society. Target facilities include not only gas turbines and steam turbines, but also water turbines at hydroelectric power plants, wind turbines at wind power plants, nuclear reactors at nuclear power plants, engines of aircraft and heavy machinery, railroad cars and tracks, escalators, elevators, and various levels of equipment and parts. Malfunctions may occur in these facilities due to, for example, deterioration or lifespan of on-board batteries. For this reason, there are countless facilities that require the above-mentioned anomaly detection and preventive maintenance. The target facilities are provided with multiple sensors for acquiring various physical information. Each sensor outputs a time-series sensor signal. The above-mentioned system for anomaly detection, etc., judges and detects whether the target facilities are in a normal or abnormal state according to the monitoring criteria for each sensor.

An example of prior art related to the above-mentioned anomaly detection is JP 2014-142697 A (Patent Document 1). Patent Document 1 discloses a method for detecting the presence or absence of an anomaly by comparing an anomaly measure calculated based on learning of past normal data with a threshold value. Furthermore, Patent Document 1 discloses a method for identifying sensors related to an anomaly based on the two-dimensional distribution of sensor signals, with the aim of presenting information that supports the decision of the next action, such as countermeasures or investigation, for the detected anomaly.

JP 2014-142697 A

In conventional technologies for performing the above-mentioned anomaly detection, when there are seasonal variations in temperature and other factors in the environment including the equipment, such as the four seasons in Japan, there is a possibility that the equipment condition may be erroneously detected due to the influence of seasonal variations. In the anomaly detection method of Patent Document 1, data that deviates from learned normal data is detected as an anomaly. Therefore, with this method, if the learning period is less than one year, deviations in sensor signal values caused by seasonal variations are detected as an anomaly. In other words, erroneous detection occurs in which an equipment anomaly is detected as an anomaly when in fact there is no such anomaly. Furthermore, with this method, the true cause of the equipment anomaly cannot be extracted.

In conventional learning for anomaly judgment and detection, a learning process is required with a learning period of, for example, at least one week. If there are seasonal fluctuations in temperature, etc., over a relatively long period that exceeds the learning period, errors may occur in anomaly judgment and detection.

One idea for addressing the above issues is to extend the learning period. That is, the learning period could be set to a length that reflects seasonal fluctuations (for example, one year or more) so that the effects of seasonal fluctuations can be learned. However, such a long learning period increases the load on the computer and the amount of data, making it unrealistic and lengthening the preparation period until highly accurate anomaly determination and detection that can remove the effects of seasonal fluctuations can be achieved.

The object of the present invention is to provide a technology that can reduce errors in anomaly determination and detection by taking seasonal variations into account with respect to the above-mentioned anomaly detection technology.

A representative embodiment of the present invention has the following configuration. The anomaly detection device of the embodiment inputs a plurality of sensor signals from a plurality of sensors installed in equipment in an environment, inputs a signal of a seasonal variation value due to the temperature in the environment or another parameter, classifies the plurality of sensor signals into a first type sensor signal having a high correlation with the seasonal variation value and a second type sensor signal having a low correlation, extracts a feature vector for each time from the plurality of sensor signals, calculates an anomaly measure for each time using the feature vector for a specified learning period as learning data, and compares the anomaly measure with a threshold value to determine whether the state of the equipment represented by the plurality of sensor signals for each time is normal or abnormal, determines whether the determined anomaly is due to seasonal variation using the first type sensor signal, and if it is determined that the anomaly is due to seasonal variation, creates and outputs a detection result in which the influence of the seasonal variation is removed from the state of the equipment.

A representative embodiment of the present invention makes it possible to reduce errors in anomaly determination and detection by taking seasonal variations into account in the technology for anomaly detection and the like.

1 shows a configuration of a system including an anomaly detection device according to a first embodiment of the present invention. In the first embodiment, an example of the configuration of the server will be described. In the first embodiment, an example of a functional block configuration of a server is shown. In the first embodiment, a sensor list table of a plurality of sensors is shown. In the first embodiment, a process flow during learning performed by the anomaly detection device will be described. In the first embodiment, a process flow when the anomaly detection device detects an anomaly will be described. In the first embodiment, a flow of an anomaly measure calculation process during learning will be described. FIG. 4 is an explanatory diagram of an anomaly measure calculation process using a local subspace method in the first embodiment. In the first embodiment, a flow of a process for creating a first distribution density image will be described. FIG. 4 is an explanatory diagram of a method for creating a first distribution density image in the first embodiment. In the first embodiment, an example of the first distribution density image will be shown. In the first embodiment, an example of the first distribution density image will be shown. In the first embodiment, a flow of a process for creating a second distribution density image will be described. In the first embodiment, an example of the second distribution density image will be shown. In the first embodiment, a flow of an anomaly detection process will be described. In the first embodiment, a flow of isolation degree calculation processing will be described. FIG. 4 is an explanatory diagram of an isolation degree calculation method in the first embodiment. In the first embodiment, a flow of the associated sensor identification process will be described. In the first embodiment, a flow of the seasonal variation determination process will be described. In the first embodiment, a first flow of the seasonal variation removal process will be shown. In the first embodiment, the second flow of the seasonal variation removal process will be described. In the first embodiment, an offline analysis condition setting screen is shown. 13 shows a screen for designating an online analysis result display target in the first embodiment. 1 shows a sensor classification result display screen in the first embodiment. 13 shows an overall display screen of an anomaly detection result in the first embodiment. 13 shows an overall display screen of an anomaly detection result in the first embodiment. 13 shows a related sensor identification result display screen in the first embodiment. In the first embodiment, an example of an abnormality plot image will be shown.

<First embodiment>
An anomaly detection device and the like according to a first embodiment of the present invention will be described with reference to Figures 1 to 28. The anomaly detection method according to the first embodiment is a method having steps executed by the anomaly detection device according to the first embodiment.

When the anomaly detection device of the first embodiment judges and detects the state of the equipment (particularly anomalies) based on multiple sensor signals from the equipment, the device performs judgment and detection taking into account the influence of seasonal fluctuations, targeting sensor signals from a period of at least one week but less than one year in which seasonal fluctuations may be reflected. The anomaly detection device of the first embodiment judges whether the state of the equipment represented by the multiple sensor signal values is due to the influence of seasonal fluctuations, based on the correlation between the sensor signal values and seasonal fluctuation values such as temperature, and if it is due to the influence of seasonal fluctuations, creates and outputs a result from which the influence of seasonal fluctuations has been removed.

The anomaly detection device of the first embodiment inputs and accumulates multiple time-series sensor signals output from multiple sensors installed in equipment within the environment, and also inputs temperature signals within the environment, and classifies the multiple input sensor signals into those with a high correlation with temperature and those with a low correlation. The anomaly detection device extracts feature vectors for each time from the multiple sensor signals, and calculates an anomaly measure for each time using the feature vectors for a specified learning period as learning data. The anomaly detection device compares the calculated anomaly measure with a threshold value to determine whether the state of the equipment represented by the multiple sensor signals for each time is abnormal or normal. The anomaly detection device uses sensor signals that are highly correlated with temperature to determine whether the detected anomaly is due to seasonal variation. If the detected anomaly is due to seasonal variation, the anomaly detection device creates and outputs a detection result in which the effects of seasonal variation have been removed from the state of the equipment.

According to the anomaly detection device of the first embodiment, a sensor signal that is highly correlated with temperature is examined, and the sensor signal is used to automatically determine whether or not a detected anomaly is due to seasonal variation. Therefore, with this anomaly detection device, even with a relatively short learning period of less than one year (e.g., a few weeks to a few months), it is possible to distinguish between anomalies in equipment that are due to seasonal variation and those that are not due to seasonal variation. Furthermore, if an anomaly is due to seasonal variation, the anomaly detection device outputs a detection result in which the influence of seasonal variation has been removed. Therefore, with this anomaly detection device, if there is no anomaly in the equipment, it is possible to determine that the equipment is normal, preventing erroneous detection, and if there is an anomaly, it is possible to find the true cause other than seasonal variation.

[system]
FIG. 1 shows a system configuration including an anomaly detection device according to the first embodiment. The system (in other words, an anomaly detection system) in FIG. 1 includes an anomaly detection device 1 and a plurality of facilities 101 that are targets of state determination including anomaly detection. The anomaly detection device 1 is connected to each facility 101 or a communication device 150 via a communication network 9. Each environment such as a factory includes facilities 101 such as a plant. In the example of FIG. 1, the environment includes environments #1, #2, . . . as a plurality of environments, but is not limited thereto, and the target may be one facility 101 in one environment. The target facility 101 is, for example, a plant including a gas turbine, a steam turbine, etc. The facility is a concept that includes a plant.

A plurality of sensors 5 are installed in the equipment 101 in the environment. The plurality of sensors 5 are a plurality of types of sensors for detecting a plurality of types of physical information. Each sensor 5 may be built into the equipment 101 or may be attached externally. Each sensor 5 outputs a time-series sensor signal 102. The sensor 5 outputs a sensor value representing the state of the equipment 101, including a measurement value of a predetermined physical information, as the time-series sensor signal 102. In addition, a temperature sensor 6 is provided in the environment. The temperature sensor 6 detects the temperature of the environment of the equipment 101. The temperature sensor 6 outputs a time-series temperature signal 104.

As shown in the speech bubble, the equipment 101 in environment #1 has multiple sensors 5, for example, sensors S1, S2, ..., Sm, where the number of multiple types of sensors 5 is m. Note that a distinction is made between the multiple (m) sensors 5 {S1 to Sm} and the air temperature sensor 6. The multiple (m) sensors 5 {S1 to Sm} may include a temperature sensor that measures the temperature of a target location.

The anomaly detection device 1 (in other words, the anomaly detection system) in FIG. 1 is mainly implemented in a computer such as a server 10. Hereinafter, the server 10 may be referred to as the anomaly detection device 10. The server 10 is connected via communication to a client terminal 20 such as a PC used by a user U1. The server 10 is also connected via communication to a communication device 50 of the equipment 101 in each environment. The user U1 is a person such as a manager involved in anomaly detection and preventive maintenance of the equipment 101.

The communication device 50 is provided for communication with the server 10. If a computer such as the server 10 is provided in the environment, the communication device 50 can be omitted. The communication device 50 acquires a sensor signal 102 from each sensor 5 of the facility 101, and also acquires a temperature signal 104 from the temperature sensor 6. The communication device 50 then transmits data including the multiple sensor signals 102 and the temperature signal 104 to the server 10 as a communication signal 150. The server 10 stores the data received and acquired from each communication device 50 in a database (DB). The communication device 50 may automatically transmit the communication signal 150 to the server 10 at a set timing. Alternatively, the server 10 may request data from the communication device 50, and the communication device 50 may transmit the communication signal 150 to the server 10 in response to the request.

The server 10 is equipped with an anomaly detection processing function. The server 10 realizes the anomaly detection processing function according to a program stored in the server 10 itself or a program distributed from an external program distribution server. The server 10 stores and manages data acquired from the equipment 101 and various processing information in a DB. The server 10 provides information such as detection results (output information) 160 relating to the status of the equipment 101, such as an abnormality, to the client terminal 20 of the user U1. For example, the server 10 provides a web page including the detection results 160 to the client terminal 20. The client terminal 20 displays the web page on a display screen.

The server 10 may, for example, be constantly connected to the communication device 10 and perform processing in real time. As a result, when the server 10 detects an abnormality in the equipment 101, the server 10 may immediately send a notification or an alert to a specified destination such as the client terminal 20 of the user U1. The server 10 may be connected to the communication device 50 only for a specified time, such as when an instruction is input by the user U1 or when it is set in advance.

The configuration example of FIG. 1 is not limiting. The anomaly detection device 1 is implemented by one or more computers, etc. One anomaly detection device 1 may be provided in one facility 101 in one environment. The communication device 50 may be the anomaly detection device. The anomaly detection devices provided in each environment may cooperate with each other via the communication network 9 to realize the function. The anomaly detection device 1 may be implemented by a cloud computing system on the communication network 9 using multiple computers. A storage device, a DB server, etc. may be connected to the server 10.

[Anomaly detection device (1)]
2 shows an example of the configuration of the server 10 in FIG. 1, which mainly constitutes the anomaly detection device 1, as a computer system. This computer system includes the server 10 and an input device 205 and a display device 206 connected thereto. The server 10 is configured with a processor 201, a memory 202, a communication interface device 203, an input/output interface device 204, and a bus that connects them to each other. The input device 205 and the display device 206 are connected to the input/output interface device 204. The input device 205 is, for example, a keyboard or a mouse. The display device 206 is, for example, a liquid crystal display. Not limited to this, the input device 205 and the display device 206 may be integrated into the server 10, or may be omitted when the client terminal 20 is used. The communication interface device 203 communicates with the communication device 50 in FIG. 1, the client terminal 20, and the like through a predetermined communication interface.

The processor 201 is composed of, for example, a CPU, a ROM, a RAM, etc., and constitutes the controller of the server 10. The processor 201 realizes an abnormality detection processing function and the like as a predetermined function based on software program processing. The processor 201 receives and acquires data of the communication signal 150 from the communication device 50, and stores the sensor signal 102 and the temperature signal 104 contained in the data in the memory 202 as sensor signal data D1 and temperature signal data D2. The processor 201 judges and detects the abnormality or other state of each facility 101 based on the data. In other words, the processor 201 performs learning and analysis based on the data. The processor 201 stores the learning data D3 and the analysis data D4 in the memory 202. The processor 201 creates the detection result of the abnormality or other state as detection result data (in other words, output information) D5 and stores it in the memory 202. The processor 201 also creates various screen data. The processor 201 transmits information such as the detection result based on the detection result data D5, etc. (e.g., a web page or email) to the client terminal 20.

The memory 202 is composed of a non-volatile storage device or the like, and stores and holds various data and information used by the processor 201 and the like. The memory 202 stores a control program 202A, setting information 202B, the sensor signal data D1, the temperature signal data D2, the learning data D3, the analysis data D4, and the detection result data D5. The control program 201A is a program for realizing the functions of the server 10. The setting information 202B is setting information for the control program 201A and the user U1. The user U1 can operate the input device 205 of the client terminal 20 or the server 10, and set or check the necessary information while looking at the screen of the client terminal 20 or the display device 206.

The configuration of the computer system is not limited to the example shown in FIG. 2. A computer program such as the control program 201A may be distributed from an external source and installed on the server 10. The computer program may be stored on a non-transient computer-readable recording medium.

The client terminal 20 is similarly composed of a processor such as a CPU, memory, a communication interface, an input/output interface, an input device, a display device, a bus, and the like. Based on program processing, the client terminal 20 realizes the function of a client application as part of the anomaly detection processing function of the server 10. The client terminal 20 communicates with the server 10 using a protocol such as HTTP, obtains web pages such as the detection result 160 from the server 10, and displays them on the screen of the display device. The client terminal 20 accepts input from the user U1 to the GUI on the screen, and transmits the input information to the server 10.

[Anomaly detection device (2)]
Fig. 3 shows an example of a functional block configuration of server 10, which is an anomaly detection device. The functional blocks in Fig. 3 are realized by program processing by processor 201 in Fig. 2, etc. Server 10, which is an anomaly detection device, includes a data accumulation unit 103, a sensor classification unit 105, a signal input unit 106, a feature vector extraction unit 107, anomaly measure calculation unit 108, a threshold calculation unit 109, a distribution density image creation unit 110, a learning result accumulation unit 111, anomaly detection unit 112, an associated sensor identification unit 113, a seasonal variation determination unit 114, a seasonal variation removal unit 115, and a detection result output unit 116.

The server 10 inputs and acquires sensor signals 102 from multiple sensors 5 of the target facility 101 as communication signals 150 through the communication device 50, for example, at predetermined time intervals, in other words, periodically. The server 10 also inputs and acquires temperature signals 103 from the temperature sensors 6 in the environment of the target facility 101 as communication signals 150 through the communication device 50, for example, at predetermined time intervals, in other words, periodically.

The server 10 inputs and acquires the communication signal 150 from the communication device 50 of the facility 101 in approximately real time. The server 10 temporarily accumulates the sensor signal 102 and the temperature signal 104, which are time-series signals acquired based on the communication signal 150, in the data accumulation unit 103. The data accumulation unit 103 also functions as a buffer. The signal input unit 106 inputs the sensor signal 102 from the data accumulation unit 103. The sensor classification unit 105 inputs the sensor signal 102 and the temperature signal 104 from the data accumulation unit 103. The signal input unit 106 and the sensor classification unit 105 may directly input each signal from the communication signal 150.

The sensor classification unit 105 refers to the temperature in the temperature signal 104, and also refers to multiple sensor values in the multiple sensor signals 102 of the equipment 101. Based on a determination of the correlation between the temperature and the sensor signals, the sensor classification unit 105 classifies the multiple sensor signals 102 into sensor signals that are highly correlated with the temperature (first type sensor signals) and sensor signals that are low in correlation with the temperature (second type sensor signals). This classification is relative.

The signal input unit 106 inputs a plurality of sensor signals 102 from the equipment 101, performs preprocessing, etc., and sends the signals to the feature vector extraction unit 107. The feature vector extraction unit 107 extracts feature vectors based on the input plurality of sensor signals 102, and sends the extracted feature vectors to the anomaly measure calculation unit 108. The anomaly measure calculation unit 108 calculates an anomaly measure for each feature vector at a predetermined time (hereinafter, sometimes referred to as each time) using the feature vectors of a pre-specified learning period. The learning period can be set by the user U1. The learning period may be at least one week or more and less than one year, as a period in which seasonal fluctuations are reflected. The threshold calculation unit 109 calculates a threshold value (H) based on the anomaly measure of the learning data by the anomaly measure calculation unit 108. The threshold value H is one or more threshold values for anomaly judgment, and constitutes a condition such as a range.

The distribution density image creation unit 110 creates and stores a distribution density image (called a first distribution density image) of all possible combinations of two sensors 5 paired together based on the sensor signals 102 during the learning period. The distribution density image creation unit 110 also acquires a first type sensor signal that has a high correlation with temperature from the sensor classification unit 105, and creates a distribution density image (called a second distribution density image) with the temperature on the horizontal axis and the sensor signal on the vertical axis.

The learning result storage unit 111 stores the feature vector of the learning period extracted by the feature vector extraction unit 107, the threshold value H calculated by the threshold calculation unit 109, the distribution density image created by the distribution density image creation unit 110, and other data required for anomaly detection as learning results (learning data D3 in FIG. 2).

The anomaly detection unit 112 compares the anomaly measure of each feature vector during the anomaly detection period from the anomaly measure calculation unit 108 with the threshold value calculated by the threshold calculation unit 109 to determine and detect an abnormality or other condition of the equipment 101. In other words, the anomaly detection unit 112 outputs information indicating the presence or absence of an abnormality in the equipment 101, or the degree of possibility of an abnormality.

When the anomaly detection unit 112 detects an anomaly, the associated sensor identification unit 113 uses the first distribution density image created by the distribution density image creation unit 110 to identify an anomaly-related sensor for each anomaly section. The anomaly-related sensor is a sensor 5 that is presumed to be related to the anomaly. The associated sensor identification unit 113 creates an image in which an anomaly is plotted in the distribution density image for the anomaly-related sensor.

The seasonal variation discrimination unit 114 uses the second distribution density image created by the distribution density image creation unit 110, in which the horizontal axis represents temperature, to determine whether the detected abnormality is caused by seasonal variation for each abnormal section. In other words, the seasonal variation discrimination unit 114 distinguishes abnormalities into abnormalities caused by seasonal variation and abnormalities not caused by seasonal variation, and outputs the results as the seasonal variation discrimination result.

The seasonal variation removal unit 115 performs processing to remove the influence of seasonal variation for each abnormal section based on the anomaly measure, the presence or absence of anomaly, the anomaly-related sensor identification result, and the seasonal variation determination result. The seasonal variation removal unit 115 outputs the processing result after removing the influence of seasonal variation as a detection result including anomaly-related sensor information. Specifically, among the anomaly-related sensors before removal, sensors that are determined to be caused by seasonal variation are removed together with an output indicating that they are caused by seasonal variation, and information on the presence or absence of anomalies other than those caused by seasonal variation is output.

Based on the detection results, the detection result output unit 116 creates detection result data D5 (FIG. 2) to be output to user U1, and provides a web page displaying the detection results after removing seasonal variations, for example, to the client terminal 20 of user U1. The detection result output unit 116 transmits a web page based on the detection result data D7 to the client terminal 20, for example. If the condition of the equipment 101 is abnormal, the detection result output unit 116 may immediately output an alert, etc. to a specified destination. The output is not limited to a screen display, and may be audio output, lamp illumination, etc., using a specified output device.

[Terminology]
A brief explanation of terminology will be given below. A feature vector is a representation of the measured values of each piece of physical information (values s1, s2, ..., sm in FIG. 1), which are multiple sensor values from multiple sensors 5, as one vector value, in other words, a one-dimensional array. Expressed symbolically, the feature vector is V, where V = {s1, s2, ..., sm}.

An abnormal measure is the deviation or distance of a feature vector of interest (i.e., the vector to be judged) from a feature vector (i.e., the vector that serves as the judgment standard) during a specified period. An abnormal section is a section in which abnormalities are considered to be detected continuously.

In the case of the first distribution density image, the distribution density image is an image that represents a two-dimensional histogram of two sensor signal values for a combination of two sensors 5 that form a pair. Each pixel value in this image is a pixel value that corresponds to a frequency value. Similarly, in the case of the second distribution density image, the distribution density image is an image that represents a two-dimensional histogram for a combination of air temperature and sensor signal value.

The isolation index is a parameter that indicates how far the sensor signal value deviates from the learning data, and indicates the strength of the association with an anomaly. The higher the isolation index, the stronger the association with an anomaly. There are several types of isolation index, which will be described later. The isolation index of a sensor signal value (e.g., sx) of a single sensor 5 (e.g., Sx) is defined as IA (e.g., Ix), and the isolation index of a pair of two sensors 5 (e.g., Sx, Sy) is defined as IB (e.g., Ixy). Furthermore, the concept of these isolation indexes I (IA, IB) is distinguished before and after the removal of the effects of seasonal fluctuations.

An anomaly-related sensor (also called a related sensor) is a sensor that is estimated to be highly related to the anomaly, specifically, sensor 5 that caused the anomaly measure of the feature vector to exceed threshold H and thus be detected as an anomaly.

An abnormality plot image is an image that is overlaid on a distribution density image and plots a color (e.g., red) that indicates an abnormality different from a color that indicates normality (e.g., gray) at pixels in positions that correspond to sensor signal values in the abnormal section.

The anomaly detection device of embodiment 1 determines whether the state of the equipment 101 is at least normal (no anomaly) or abnormal (anomaly present), but is not limited to this, and the state of the equipment 101 may be determined as three or more states or degrees.

[Sensor list table]
Fig. 4 shows an example of data (sometimes referred to as a sensor list table) in which a plurality of sensor signals 102 from a plurality of sensors 5 are listed in a table format. The server 10 holds such a sensor list table 400. The sensor list table 400 in Fig. 4 has items such as date and time 401 and sensor 402, with data for each date and time being stored in each row. The sensor 402 item has an item for each sensor 5, with a sensor value being stored for each item. The plurality of sensor signals 102 in Fig. 1 and the like are multidimensional time-series signals in which a plurality of pieces of physical information having different physical properties are acquired at predetermined time intervals.

The number (m) of sensors 5 may be as large as several hundred to several thousand. There may be multiple sensors of each type. Depending on the type of sensor 5, for example, the temperature of the cylinder, oil, cooling water, etc., the pressure of the oil or cooling water, the rotation speed of the shaft, the operating time, etc., are obtained as sensor values. The sensor values not only represent the output or state of each part of the equipment 101, but may also serve as control signals for controlling some state to a certain value (e.g., a target value). For example, a plant controller may control the plant using a certain sensor value as a control signal. The server 10 or the communication device 50 may acquire such sensor values from the controller of the equipment 101, etc.

The operation of the anomaly detection device 1 has the following phases: a "sensor classification" process for classifying the sensor 5 using the sensor signal 102 and the temperature signal 104 stored in the data storage unit 103; a "learning" process for generating and saving learning data using data stored in the data storage unit 103, etc.; and an "anomaly detection" process for detecting an anomaly in the equipment 101 by comparing the input signal with the learning data. In the first embodiment, the "sensor classification" and "learning" are basically performed as "offline" processes, and the "anomaly detection" is performed as "online" processes. The "offline" process corresponds to performing anomaly determination and detection all at once after learning and analyzing data is acquired and stored for the state of the equipment 101. The "online" process corresponds to performing anomaly determination and detection in approximately real time for the state of the equipment 101 based on learning data previously learned. However, it is also possible to treat the "anomaly detection" as an "offline" process. In the following description, these are sometimes broadly categorized as "during learning" and "during anomaly detection".

[Processing flow (1)]
FIG. 5 shows a flow of an overview of the learning process performed by the anomaly detection device 1, particularly the server 10. The flow in FIG. 5 can be broadly divided into (a) sensor classification process 500 during learning and (b) anomaly measure calculation process 510 during learning. In (a) sensor classification process 500 during learning, first, in step S501, the server 10 inputs the sensor signal 102 during a designated learning period. In step S502, the server 10 inputs data of the temperature signal 104 during the learning period. In step S503, the server 10 calculates the correlation between the temperature and the sensor signal as a correlation value. In step S504, the server 10 classifies the multiple sensors 5 (e.g., S1 to Sm in FIG. 1) and the sensor signals 102 (s1 to sm) into a first type sensor signal value and a second type sensor signal value according to the correlation. Specifically, the server 10 classifies the sensor 5 whose correlation value exceeds a pre-specified reference value as a first type sensor having a high correlation with the temperature.

In the anomaly measure calculation process 510 during learning (b), first, in step S511, the server 10 inputs the sensor signal 102 during the learning period. In step S512, the server 10 uses the sensor signal 102 to extract a feature vector. In step S513, the server 10 calculates an anomaly measure for the feature vector. In step S514, the server 10 calculates a threshold value H. In step S515, the server 10 creates a brute force distribution density image (first distribution density image) for each pair of two sensors. Then, in step S516, the server 10 creates a distribution density image (first distribution density image) in which the horizontal axis is temperature.

[Processing flow (2)]
FIG. 6 shows a flow of an outline of a process performed by the anomaly detection device 1, particularly the server 10, when detecting an anomaly. The flow of FIG. 6 includes an anomaly determination process 600 when detecting an anomaly (c). In the anomaly determination process 600, first, in step S601, the server 10 inputs the sensor signal 102 of the detection target in the target period. In step S602, the server 10 uses the sensor signal 102 to extract a feature vector. In step S603, the server 10 calculates an anomaly measure for the feature vector. In step S604, the server 10 compares the calculated anomaly measure with the threshold value H calculated in step S514 of FIG. 5 to determine the normal/abnormal state of the target equipment 101. In step S605, the server 10 extracts an anomaly section. In step S606, the server 10 calculates an isolation degree vector for each anomaly section as an isolation degree. In step S607, the server 10 identifies an anomaly-related sensor based on this isolation degree. In step S608, the server 10 creates an anomaly plot image with the horizontal axis representing temperature and the vertical axis representing the sensor signal value. In step S609, the server 10 performs seasonal variation determination to determine whether the anomaly is due to the influence of seasonal variation. In step S610, the server 10 performs seasonal variation removal to remove the influence of seasonal variation from the detection result.

[Processing details]
The anomaly measure calculation process 510 during learning shown in Fig. 5B and the anomaly determination process 600 during anomaly detection shown in Fig. 6C will be described below in order. Detailed flows of each process are shown in Fig. 7 and subsequent figures.

[Details of anomaly measure calculation process during learning]
FIG. 7 shows a detailed example of the anomaly measure calculation process 510 during learning in FIG. 5(b). First, in step S701, the server 10 inputs, in the signal input unit 106 in FIG. 3, a sensor signal of a designated learning period among the sensor values stored in the data storage unit 103. Here, the learning period is a period during which the equipment 101 was in a normal state, which is designated in advance by the user U1. Next, in step S702, the server 10 normalizes the input sensor signal in the feature vector extraction unit 107 in FIG. 3. This canonicalization is a process performed to treat multiple sensor signals with different units and scales in the same way. Specifically, in this canonicalization, each sensor signal is converted so that the average and standard deviation of the learning period of each sensor signal are used to convert the sensor signal so that the average is 0 and the variance is 1. The server 10 stores the average and standard deviation of each sensor signal so that the same conversion can be performed when an anomaly is detected. Alternatively, in this canonicalization, the maximum and minimum values of each sensor signal during the learning period are used to convert each sensor signal so that the maximum is 1 and the minimum is 0. Alternatively, in this canonicalization, preset upper and lower limit values may be used instead of the maximum and minimum values. In this case, the server 10 stores the maximum and minimum values or the upper and lower limit values of each sensor signal in the learning result accumulation unit 111 so that a similar conversion can be performed when an abnormality is detected.

Next, in step S703, the server 10 extracts feature vectors for each time in the feature vector extraction unit 107 of FIG. 3. These feature vectors are arrays in which the canonicalized sensor signal values are arranged as they are as elements. Alternatively, in this process, a feature representing the temporal change in the sensor signal may be extracted by setting windows such as ±1, ±2, ... for a certain time (say 0) and creating a feature vector of window width (3, 5, ...) x number of sensors (m). For example, a window width of 3 refers to a time width of three times (-1, 0, +1). The feature vector may also be extracted by decomposing it into frequency components using a discrete wavelet transform (DWT).

Next, the server 10 calculates the anomaly measure for the learning period in the anomaly measure calculation unit 108 of FIG. 3. For this purpose, in step S704, the server 10 first divides the learning period into a plurality of intervals. This interval division is, for example, a daily interval. Alternatively, this interval division may be for each batch in the case of batch processing such as a chemical plant, for each individual object to be processed in the case of a processing device, or for each person to be examined in the case of a medical device such as an MRI. The server 10 repeats the following process for all the extracted feature vectors in the loop from step S705. In step S706, the server 10 sets the feature vectors selected sequentially corresponding to the plurality of intervals as the attention vector, and sets the data of the learning period excluding the feature vectors of the same interval as the attention vector as the learning data. In step S707, the server 10 calculates the anomaly measure using the attention vector and the learning data. The local subspace classifier (LSC) or the projection distance method (PDM) can be used to calculate this anomaly measure.

[Anomaly measure calculation process (1)]
FIG. 8 is an explanatory diagram of the anomaly measure calculation process when the local subspace method is used in step S707. The local subspace method is a method of selecting k neighboring vectors for the target vector q, and measuring the projection distance when the target vector q is projected onto a k-1-dimensional affine subspace spanned by the selected k neighboring vectors. FIG. 8 shows a case where an affine subspace 801 is formed by k=3 neighboring vectors x1, x2, and x3. The neighboring vectors x1 to x3 shown by gray square points are on the plane of the affine subspace 801. The other vectors shown by white square points are spaced above and below the plane of the affine subspace 801. The target vector q shown by a circle is spaced above the plane of the affine subspace 801 by a distance 802. The black point Xb on the affine subspace 801 that is closest to the target vector q is the projection point (also called the reference vector). The distance 802, which is the projected distance from the vector of interest q to the reference vector Xb, is the anomaly measure.

A specific calculation method for the anomaly measure will be described. The vector of interest q is assumed to be evaluation data q. The server 10 creates a matrix Q in which k pieces of evaluation data q are arranged, and a matrix X in which the neighborhood vectors xi are arranged, from the evaluation data q and k pieces of neighborhood vectors xi (i = 1, ..., k). The server 10 obtains a correlation matrix C between the two from the following formula 1. Note that the symbol ^T indicates a transposed matrix.
Formula 1: C=(Q-X) ^T (Q-X)

Next, the server 10 calculates a coefficient vector b representing the weighting of the neighborhood vector x i from the following equation 2.
Equation 2: b=(C ⁻¹ 1 _n )/(1 _n ^T C ⁻¹ 1 _n )

If the anomaly measure is d, the anomaly measure d is calculated by the norm of the vector (q−Xb) or the square of the norm. The norm is an operation such as √(X1 ² + ...... +Xm ² ).

Note that in Figure 8, the number of neighbor vectors is k = 3, but this number can be any number as long as it is sufficiently smaller than the number of dimensions of the feature vector. When k = 1, the process is equivalent to the nearest neighbor method.

[Anomaly measure calculation process (2)]
The anomaly measure calculation process when using the projected distance method is as follows. The projected distance method is a method for creating a subspace with a unique origin for the selected feature vector, i.e., an affine subspace (this is a space with maximum variance). The server 10 selects multiple feature vectors corresponding to the target vector by some method, and calculates the affine subspace by the following method.

First, the server 10 calculates the mean μ and covariance matrix Σ of the selected feature vector. Next, the server 10 solves the eigenvalue problem of the covariance matrix Σ, and arranges eigenvectors corresponding to r eigenvalues designated in advance from the largest value into a matrix U, which is the orthonormal basis of the affine subspace. The number r is smaller than the dimension of the feature vector and smaller than the number of selected data. Alternatively, the number r is not fixed, and the value when the cumulative contribution rate from the largest eigenvalue exceeds a pre-specified ratio may be used as the number r. As shown in FIG. 8, the point on the affine subspace closest to the vector of interest is the reference vector. Also, the vector of interest minus the reference vector (q-Xb) is the residual vector. The norm of the residual vector or the square of the norm is the anomaly measure.

Here, the method of selecting multiple feature vectors includes a method of selecting a predetermined number of tens to hundreds of feature vectors in order of proximity to the vector of interest. Another method is to cluster the feature vectors to be learned in advance and select the feature vector included in the cluster closest to the vector of interest. Other methods that may be used include the local average distance method, in which the distance to the average vector of k neighboring vectors of the vector of interest q is used as the anomaly measure, and the Gaussian process.

In FIG. 7, after the anomaly measure calculation process for all feature vectors in the loop, the server 10 calculates a threshold value H in the threshold calculation unit 109 in FIG. 3 in step S708. This threshold value H is used to determine whether the equipment 101 is normal or abnormal by comparing it with the anomaly measure input to the anomaly detection unit 112. The threshold calculation unit 109 calculates a threshold value H that does not determine normal learning data as abnormal. In other words, the threshold calculation unit 109 calculates the maximum value of the anomaly measure obtained from the normal learning data as the threshold value H. Alternatively, the threshold calculation unit 109 may calculate a threshold value H that determines more than a predetermined proportion of normal learning data as normal. In this case, the anomaly measures obtained from the normal learning data are sorted, and the anomaly measure that reaches the aforementioned predetermined proportion from the lowest anomaly measure is adopted as the threshold value H.

In the learning process of FIG. 7 (anomaly measure calculation process during learning), the server 10 stores the learning results in the learning result storage unit 111 of FIG. 3. The data stored as the learning results includes at least parameters for extracting feature vectors, parameters for calculating anomaly measures, parameters for sensor signal canonicalization, all extracted feature vector data, and a threshold value for anomaly determination. The parameters for extracting feature vectors and parameters for calculating anomaly measures are the same as those specified during learning. The parameters for sensor signal canonicalization are the average, standard deviation, maximum value, minimum value, etc. of each sensor signal calculated by the signal input unit 107 in the process of step S702.

[Creating process of first distribution density image]
Next, the details of the process of creating a brute force distribution density image in step S515 in Fig. 5 by the distribution density image creation unit 110 in Fig. 3 will be described. Fig. 9 shows a flow of the process of creating a brute force distribution density image during learning. First, in step S901, the server 10 inputs sensor signals for a specified learning period. In the first loop starting from step S902, the server 10 repeats the processes of steps S903 to S906 for each sensor signal.

First, in step S903, the server 10 calculates the maximum value MAX and minimum value MIN of the data. Next, in step S904, the server 10 calculates the interval S when dividing the range from the minimum value MIN to the maximum value MAX by the specified number N. This can be calculated by S = (MAX - MIN) / N. Next, in step S905, the server 10 expands the range from the minimum value MIN to the maximum value MAX outward, and calculates the processing range for calculating the two-dimensional histogram. Here, the range can be expanded, for example, by changing the minimum value MIN to (MIN - S x M) and the maximum value MAX to (MAX + S x M). M is a predetermined integer of 1 or more.

Next, in step S906, the server 10 calculates a bin number (referred to as BNO) from the sensor signal value (referred to as F) for all data in the learning period using the following formula 3, where the function INT(X) below represents the integer part of X. By using the bin number BNO, each sensor signal value F is converted into an integer value in (N+1) stages from a minimum value 0 to a maximum value N.
Equation 3: BNO=INT(N*(F-MIN)/(MAX-MIN))

Next, the server 10 extracts combinations of two sensors 5 as pairs from the multiple sensors 5, and creates a first distribution density image in a brute-force manner based on the combinations of the sensor signals of each. That is, in the second loop from step S907, the server 10 repeats the processes of steps S908 to S910 for all combinations of sensors 5 (all pairs). Here, it is assumed that the combinations of two sensors 5 include combinations of the same sensor 5. Therefore, the number of sensor combinations (corresponding number of repetitions) is m x (m + 1) / 2, where m is the number of sensors.

First, in step S908, the server 10 secures a two-dimensional array for calculating a two-dimensional histogram and sets all elements of the array to 0. The size of this array is assumed to be N. In step S909, the server 10 adds 1 to the elements of the array corresponding to the bin numbers BNO of the two sensor signals of the pair for all data in the learning period. That is, the server 10 assigns the bin number of one sensor signal to the column element, and the bin number of the other sensor signal to the row element. This process calculates a two-dimensional histogram of the signals from the two sensors 5. In step S910, the server 10 converts this histogram into an image and saves it. This conversion method will be described later. The bin number is a unit for creating a histogram and an image, and is a value divided and converted from the sensor signal value. In a broad sense, this unit uses the sensor signal value, and the bin number is used as an implementation example.

[Sensor signal and first distribution density image]
FIG. 10 is an explanatory diagram showing the relationship between the time series sensor signal and the first distribution density image. In FIG. 10, the signals of two sensors 5, sensor X and sensor Y on the left side, are shown in a distribution density image 1000 on the right side with the horizontal axis representing sensor X and the vertical axis representing sensor Y. The distribution density image 1000 is one of the brute force distribution density images, in other words, a two-dimensional histogram. Each pixel value of this distribution density image 1000 is a frequency value of a pair of the signal value of sensor X and the signal value of sensor Y, and corresponds to a density in a two-dimensional distribution. The frequency value is expressed as a pixel value, for example, in gray scale. Such a distribution density image is created for each combination (corresponding pair) of sensors 5.

[Image conversion method (S910)]
An example of an image conversion method in creating a distribution density image in step S910 of FIG. 9 will be described. First, the server 10 obtains the maximum value of the array elements, i.e., the maximum frequency. The image size is the same as the array size, and the pixel value of the coordinate corresponding to the value of each element is, for example, 255 x [array element value]/[maximum frequency]. The numerical value 255 is the maximum value when the pixel value is expressed in 8 bits, and if this value is used, it can be saved as it is in bitmap format. Alternatively, the pixel value may be 255 x LOG([array element value]+1)/LOG([maximum frequency]+1). However, the function LOG(X) represents the logarithm of X. If such a conversion formula is used, even if the maximum frequency is large, a non-zero pixel value can be associated with a non-zero frequency.

[Example of first distribution density image]
11 and 12 show examples of a brute force distribution density image (first distribution density image). In this distribution density image, the horizontal axis represents the signal value (corresponding bin number) of one sensor 5, sensor A, and the vertical axis represents the signal value (corresponding bin number) of the other sensor 5, sensor B. In the image obtained by the process of FIG. 9, high density areas in a two-dimensional feature space are represented by high pixel values. Here, this distribution density image is a grayscale image in which pixel values of 0 are white and 255 are black. In this distribution density image, the pattern of the distribution density shape of the image changes depending on the strength of correlation between the two sensors 5. FIG. 11 shows an example of an image when the correlation is strong, and FIG. 12 shows an example of an image when the correlation is weak. In the image of FIG. 11, the high density areas have a linear shape, whereas in the image of FIG. 12, the high density areas are widely distributed.

The method of creating a distribution density image is not limited to the above method. For example, instead of a simple frequency distribution, a method of assigning a Gaussian distribution or other weighted filter to one piece of data and superimposing them is also acceptable. Alternatively, a method of applying a maximum value filter of a predetermined size to the image obtained by the above method, or a method of applying an average filter or other weighted filter is also acceptable. Furthermore, the data is not limited to 8 bits, and a method of converting to 16 bits or the like is also acceptable. Furthermore, it is not necessarily necessary to save in image format, and a method of saving the two-dimensional array in binary or text format without converting it is also acceptable.

[Creating process of second distribution density image]
Next, FIG. 13 shows a flow of the process of creating a second distribution density image (step S516 in FIG. 5) in which the horizontal axis is temperature during learning by the distribution density image creation unit 110 in FIG. 3. The processes in steps S1302 to S1305 in FIG. 13 are performed in the same manner as the processes in steps S903 to S906 in FIG. 9. First, in step S1301, the server 10 inputs the temperature signal for the specified learning period. In step S1302, the server 10 calculates the maximum value MAX and the minimum value MIN of the temperature signal, and in step S1303, calculates the interval S for dividing the range from the minimum value MIN to the maximum value MAX by the specified number N. Next, in step S1304, the server 10 expands the range from the minimum value MIN to the maximum value MAX outward to calculate the processing range for calculating the two-dimensional histogram. Next, in step S1305, the server 10 calculates the bin number (BNO) from the sensor signal value (F) for all data in the learning period. Through these processes, the temperature data is converted into integer values in (N+1) stages ranging from a minimum value of 0 to a maximum value of N.

Next, in the loop starting from step S1306, the server 10 repeats the processing of steps S1307 to S1309 for the first type sensor signals that have a high correlation with the temperature classified in step S504, and creates a distribution density image based on each combination of the sensor signal and the temperature.

First, in step S1307, the server 10 secures a two-dimensional array for calculating the two-dimensional histogram and sets all elements to 0. The size of the array is N. In step S1308, the server 10 adds 1 to the elements of the array corresponding to the bin numbers of the temperature and the sensor signal for all data in the learning period. That is, the bin numbers of the temperature correspond to the elements of the columns, and the bin numbers of the sensor signal correspond to the elements of the rows. Here, the bin numbers of the sensor signal are those calculated in step S906 of FIG. 9. In step S1309, the server 10 converts the two-dimensional histogram obtained by the above process into an image (second distribution density image) and saves it. This conversion method is the same as in step S910. Finally, in step S1310, the server 10 determines and sets the range for maintaining correlation.

[Example of second distribution density image]
FIG. 14 shows an example of a second distribution density image with the horizontal axis being temperature. The vertical axis of this image 1400 is the signal value (corresponding bin number) of the sensor 5 that has a high correlation with temperature. Therefore, in this image 1400, normal data represented by high density gray is distributed on a sloping band. Correlation maintenance means that data is present within a range on the extension of the longitudinal direction of the normal data distribution (in this example, the diagonally upward right direction as shown by the arrow in the figure). The range 1401 represented by the dashed rectangle is the range in which the correlation is maintained. The server 10 automatically calculates such a correlation maintenance range 1401 based on the second distribution density image with the horizontal axis being temperature. The correlation maintenance range can be calculated, for example, by calculating a central axis from the original data by linear approximation using the least squares method or Hough transform, and expanding it left and right so that a predetermined ratio of data is included in all the data. Alternatively, a method can be applied in which the axis is rotated within a range of several degrees, and the same process is performed to select the one with the narrowest width.

As a modified example, the anomaly detection device 1 may allow the user U1 to set a correlation maintenance range for the distribution density image. For example, the user U1 checks a distribution density image such as that shown in FIG. 14 displayed on the screen of the client terminal 20, and sets a correlation maintenance range on the image by operating the mouse or the like to shift, enlarge, or rotate basic shapes such as rectangles and ellipses, or by specifying any point or line.

In the processing of Figures 9 and 13, the server 10 records the size of the two-dimensional array and the processing range and step width of each sensor signal and air temperature calculated in steps S904, S905, S1303, and S1304 in the learning result storage unit 111. The server 10 also records the first distribution density image and the second distribution density image, and the correlation maintenance range set in step S1310 in the learning result storage unit 111.

[Abnormality determination process when abnormality is detected]
Next, the details of the anomaly determination process 600 when an anomaly is detected in (c) of Fig. 6 will be described with reference to Figs. 15 to 21. Fig. 15 shows a detailed flow of the anomaly detection process (steps S601 to S604) in Fig. 6 by the anomaly detection unit 112 in Fig. 3. Here, the server 10 extracts feature vectors by the feature vector extraction unit 107 (S602) and calculates an anomaly measure by the anomaly measure calculation unit 108 (S603) for data for a specified period of time or newly observed data stored in the data storage unit 103. Then, the server 10 compares the anomaly measure with the threshold value H calculated by the threshold calculation unit 109, and determines whether the data is normal or abnormal by the anomaly detection unit 112 (S604).

In step S1501, the feature vector extraction unit 107 reads out the learning results stored during learning from the DB of the learning result storage unit 111. At that time, the user U1 selects an appropriate processing number based on the anomaly measure and threshold value at the time of learning, and the server 10 uses the learning result associated with that processing number. In step S1501, the signal input unit 106 inputs the sensor signal 102 from the data storage unit 103 or the equipment 101, and in step S1503, canonicalizes each sensor signal. At this time, the parameters used in the canonicalization process in step S702 of FIG. 7 are used. Next, in step S1504, the feature vector extraction unit 107 extracts a feature vector from the selected sensor signal in the same manner as in the process in step S703 of FIG. 7.

Next, in the loop starting from step S1505, the server 10 performs the processes of steps S1506 to S1508 for all feature vectors. In step S1506, the anomaly measure calculation unit 108 calculates an anomaly measure using the vector of interest and the learning data. This process is performed in the same manner as step S707 in FIG. 7, but all learning data is used. In step S1507, the anomaly detection unit 112 compares the threshold value H read in step S1501 with the anomaly measure calculated in step S1506. If the anomaly measure is equal to or less than the threshold value H, the anomaly detection unit 112 judges the state of the equipment 101 to be "normal", and if the anomaly measure is greater than the threshold value H, it judges the state to be "abnormal". Next, in step S1508, the server 10 calculates a residual vector. The residual vector is the square of each element of the vector of the difference between the vector of interest and the reference vector used in calculating the anomaly measure. In the case of the local subspace method in Figure 8, the vector of interest is q, the reference vector is Xb, and the difference vector is (q-Xb). The anomaly measure is defined as the square of the norm of the difference vector (q-Xb). With this definition, the sum of the elements of the residual vector becomes the anomaly measure. The residual vector is used in the subsequent process of removing seasonal fluctuations.

[Isolation Degree Calculation Process]
Fig. 16 shows a detailed flow of the isolation degree calculation process (steps S605 to S607) in Fig. 6 performed by the associated sensor identification unit 113 in Fig. 3. Here, the server 10 extracts abnormal sections in which abnormalities are deemed to have been continuously detected, calculates an isolation degree vector representing deviation from the learning data for each abnormal section, and identifies an abnormality-associated sensor based on this isolation degree vector.

In step S1601, the anomaly detection unit 111 inputs the sensor signal to be processed, and in step S1602, calculates the bin number corresponding to each sensor signal for all data. In this calculation, the server 10 calculates the bin number in the same manner as in step S906 in FIG. 9 using the parameters for creating the distribution density image read out in step S1501 in FIG. 15, specifically, the size of the two-dimensional array, the processing range for each sensor, and the step size. Next, in step S1603, the anomaly detection unit 111 inputs the calculated anomaly measure data, and in step S1604, based on this anomaly measure data, extracts an anomaly section in which anomalies are continuously detected. When calculating this anomaly section, an interruption (no anomaly detected) of a pre-specified length or less than the allowable gap is considered to be a continuous anomaly section. Conversely, at a predetermined data break, such as a change of date, even if an anomaly is continuously detected, it is considered to be a different anomaly section.

Next, in the first loop from step S1605, the server 10 repeats the process of calculating the isolation degree and identifying the associated sensor in steps S1606 to S1613 for each abnormal section. First, in step S1601, the server 10 resets the isolation degree for all combinations of two sensors 5 to 0. Let one sensor of the pair be represented by i, and the other sensor of the pair be represented by j. In the second loop from step S1607, the server 10 calculates the isolation degree (Ii) for each sensor i. In the third loop from step S1608, the server 10 calculates the isolation degree (Ij) for each sensor j. Each isolation degree (Ii, Ij) is the isolation degree in units of a single sensor 5 described above.

In each of the second and third loops, the server 10 processes all data in the abnormal section of interest in the fourth loop from step S1609. In step S1610, the server 10 reads the pixel value (corresponding frequency value) of the coordinates corresponding to the bin number of each sensor i, j calculated in step S1602 from the distribution density image of the sensors i, j of the pair of interest. In step S1611, if the pixel value is 0, the server 10 adds 1 to the isolation degree (Iij) of the sensor i, j of interest. This isolation degree (Iij) of the sensors i, j is the isolation degree in units of the pair described above.

By the above process, the isolation degree of the abnormal section of interest is calculated for each combination of two sensors 5. The isolation degree is high when the combination of signal values of two sensors 5 corresponding to each other on the two-dimensional histogram is not present in the learning data. Here, the fourth loop and the second and third loops may be performed in the reverse order.

In step S1612, the server 10 calculates the isolation degree (Ii, Ij) for each sensor 5 based on the isolation degree (Iij) for each combination of two sensors 5. For example, the isolation degree Ii for sensor i is calculated by fixing sensor i and adding up the isolation degrees (Iij) of sensors i and j for all sensors j. The isolation degree Ij for sensor j is calculated by fixing sensor j and adding up the isolation degrees (Iij) of sensors i and j for all sensors i. The server 10 uses the isolation degree (Ii, Ij) of each sensor 5 combined for all sensors as an isolation degree vector. For example, for sensors S1 to Sm, the isolation degree vector = {I1, I2, ..., Im}.

Next, in step S1613, the server 10 identifies an anomaly-related sensor based on the isolation degree vector. An anomaly is detected because the evaluation target data deviates from the learning data. For this reason, the server 10 extracts the sensor 5 whose sensor signal has a high isolation degree at the time the anomaly is detected as an anomaly-related sensor.

Details of the calculation of the isolation degree during the above process (S1610, S1611) and the identification of the abnormality-related sensor (S1613) are described below.

[Isolation]
FIG. 17 is an explanatory diagram of a more specific method of calculating the degree of isolation. FIG. 17A shows sensor signals input from, for example, three sensors S1 to S3 when an anomaly is detected. Circles indicate sensor signal values at a certain time. The server 10 calculates an anomaly measure from the feature vector of each sensor signal, and judges and detects an "anomaly" at a time when the anomaly measure exceeds a threshold value H (for example, the time indicated by the dashed line). FIG. 17B shows a first distribution density image created in advance from learning data, which shows the sensor signal value distribution of the learning data with pixel values for all combinations of two sensors 5. If the horizontal axis is the signal value of sensor i and the vertical axis is the signal value of sensor j, in this example, as shown in the figure, there are 3×3=9 combinations of images {images g11, g12, . . . , g33} for i=1 to 3 and j=1 to 3.

The server 10 plots the signal values of each sensor S1 to S3 at the time of abnormality detection obtained in (A) at the corresponding coordinate position of the corresponding distribution density image in (B). The server 10 reads the pixel value at the plot position, and if the pixel value is 0, the isolation degree Iij of the combination of sensors (i, j) is set to 1. The cross marks indicate the location where the isolation degree Iij is 1. For example, the image G13 of the combination of sensors (i = 1, j = 3) has a pixel value of 0 at the plot position, so the isolation degree Iij is 1. If the pixel value is other than 0, the server 10 sets the isolation degree Iij to 0, as indicated by the circle mark. In this way, the server 10 calculates the isolation degree (e.g. I1, I2, I3) for each sensor 5 by adding up the isolation degrees Iij for different combinations for each sensor 5. For example, the isolation degree I1 of sensor S1 is I11 + I12 + I13 = 0 + 0 + 1 = 1. Similarly, the isolation degree I2 of sensor S2 is 0, and the isolation degree I3 of sensor S3 is 1. In this example, only the combination of sensors S1 and S3 (I13, I31) is isolated, that is, the isolation degree is 1 (marked with an x).

[Identifying abnormality-related sensors]
18 shows a process flow for identifying an anomaly-related sensor based on the isolation degree. This flow is a first loop starting from step S1801, which is repeated a predetermined number of times or until a condition is satisfied. First, in step S1802, the server 10 searches for the sensor 5 with the maximum isolation degree, that is, the sensor 5 corresponding to the maximum element (the sensor with the maximum isolation degree) of the isolation degree vector calculated in step S1612 of FIG. 16. The sensor 5 found as a result of the search, in other words, the sensor with the maximum isolation degree, is referred to as sensor A here.

Next, in step S1803, the server 10 searches for the other sensor 5 that has the maximum isolation degree (Iij) when combined with sensor A. The sensor 5 found as a result of the search is referred to as sensor B here. The search target here is the isolation degree (Iij) for the combination of two sensors 5 calculated at the end of the processing of the second loop in step S1607 of FIG. 16. The value of the isolation degree (Iij) for the found combination of sensors A and B is referred to as ISO here.

In step S1804, if ISO is greater than 0 (Y), the server 10 proceeds to step S1805. Otherwise (N), i.e., if ISO is 0, the server 10 exits the first loop and ends this flow process. In step S1805, the server 10 extracts sensors A and B as abnormality-related sensors. In addition, in step S1806, the server 10 creates an abnormality plot image in which abnormal data is plotted in the second distribution density images of sensors A and B. In this case, the server 10 represents normal data in grayscale in the image, while representing abnormal data in a highly saturated color (e.g., red) to make it easier to distinguish. In addition, the server 10 represents pixels that do not overlap with normal data and pixels that overlap with normal data in different colors.

Next, in the second loop starting from step S1807, the server 10 repeats the processing of steps S1808 to S1811 for all sensors i. In step S1808, the server 10 subtracts the isolation degree (IiA) of the combination of sensors i and A from the isolation degree (Ii) of sensor i. Also, in step S1809, if sensors A and B are different (Y), the server 10 proceeds to step S1810, and if they are the same (N), it omits step S1810.

In step S1810, the server 10 also subtracts the isolation degree (IiB) for the combination of sensors i and B from the isolation degree (Ii) of sensor i. Furthermore, in step S1811, the server 10 sets the isolation degrees of sensors A and B to 0.

The processing in steps S1807 to S1811 is performed to remove the influence of sensors A and B extracted as anomaly-related sensors in step S1805. Thereafter, the server 10 repeats the first loop in the same manner, and extracts sensors A and B with the maximum isolation degree among the remaining isolation degree vectors as new anomaly-related sensors. In this way, it is possible to extract multiple anomaly-related sensors without omission.

[Seasonal fluctuation determination process]
FIG. 19 shows a detailed flow of the seasonal variation determination process (steps S608 to S609 in FIG. 6) by the seasonal variation determination unit 114 in FIG. 3. This process is repeated for each abnormal section in the first loop from step S1901, and for sensors with a high correlation with temperature in the second loop from step S1902. First, in step S1903, the server 10 acquires the second distribution density image with temperature on the horizontal axis created in step S1309 in FIG. 13. In step S1904, the server 10 plots abnormal data on the second distribution density image to create an abnormal plot image with temperature on the horizontal axis. Next, in step S1905, the server 10 determines which of the following three statuses is based on the state of correlation. Specifically, when abnormal data is included in the normal data distribution, the server 10 determines the status as "no abnormality". If the abnormal data is outside the normal data distribution and is included in the correlation maintenance range set in step S1310, the server 10 determines the status as "seasonal variation". If the abnormal data is outside the correlation maintenance range, the server 10 determines the status as "abnormal". The "seasonal variation" status indicates that the abnormality is due to seasonal variation.

In the example of Figure 14, point A in image 1400 is included in the normal data distribution shown in gray, so it is given a "no abnormality" status. Point B is outside the correlation maintenance range 1401, so it is given a "abnormal" status. Point C is included in an area of correlation maintenance range 1401 other than the normal data distribution, so it is given a "seasonal variation" status. The server 10 further classifies the presence or absence of anomalies ("normal"/"abnormal") determined by the anomaly detection unit 112 in Figure 3 for the state of the equipment 101 based on a combination of multiple sensor signals into three statuses, including the "seasonal variation" status.

[Seasonal variation removal process]
20 and 21 show a detailed flow of the seasonal variation removal process (step S610 in FIG. 6) by the seasonal variation removal unit 115 in FIG. 3. This process is a first loop starting from step S2001, in which the calculation of the isolation degree with the effects of seasonal variation removed, the identification of anomaly-related sensors, the calculation of anomaly measures, and anomaly determination are repeated for each abnormal section. When creating detection results with the effects of seasonal variation removed, the server 10 creates detection results with data values corresponding to the "seasonal variation" status removed.

In step S2002, the server 10 obtains the isolation degree (Ii, Ij) of all combinations of two sensors 5 created by the end of the second loop in step S1607 of FIG. 16 in order to calculate the isolation degree with the effects of seasonal variation removed. In the second loop from step S2003, the server 10 repeats the processes of steps S2004 to S2008 for all sensors i. First, in step S2004, the server 10 sets the isolation degree of sensor i to 0. Next, in step S2005, if the sensor i is not determined to be in the "seasonal variation" status in step S1905 of FIG. 19 (Y), that is, if it is determined to be "no abnormality" or "abnormality present", the server 10 proceeds to step S2006, and if it is determined to be in the "seasonal variation" status (N), the server 10 proceeds to the end of the second loop. In the third loop from step S2006, the server 10 performs processing for all sensors j. In step S2007, if the server 10 determines that the sensor j is not in the "seasonal variation" status in step S1905 of FIG. 19 (Y), the server 10 proceeds to step S2008, and if it is determined that the sensor j is in the "seasonal variation" status (N), the server 10 skips step S2008. In step S2008, the server 10 adds the isolation degree (Iij) of the combination of sensors (i, j) to the isolation degree (Ii) of sensor i. Then, the second and third loops end. After calculating the isolation degrees of all sensors 5, in step S2009, the server 10 identifies the sensor associated with the anomaly according to the flow in FIG. 18.

In the process of step S2008 and the like, the server 10 performs an overwrite update process on the isolation degree. This results in an isolation degree from which the effects of seasonal variation have been removed. The isolation degree before the effects were removed is erased. This is not the only possible process example. That is, the server 10 may calculate and store or output both the isolation degree before the effects of seasonal variation have been removed and the isolation degree after the effects of seasonal variation have been removed. Similarly, for anomaly measures and the like, values before and after the effects of seasonal variation have been removed may be stored or output.

Figure 21 is a continuation of Figure 20. In the fourth loop from step S2010, the server 10 repeats the processes of steps S2011 to S2016 for all data within the interval in order to calculate the anomaly measure from which the effects of seasonal variation have been removed. In step S2011, the server 10 sets the anomaly measure to 0. In the fifth loop from step S2012, the server 10 performs processing for all sensors i. In step S2013, if the sensor i is not determined to be in "seasonal variation" status in step S1905 of Figure 19 (Y), the server 10 proceeds to step S2014, and if it is determined to be in "seasonal variation" status (N), the server 10 omits step S2014. In step S2014, the server 10 adds the residual calculated in step S1508 of Figure 15 to the anomaly measure. The fifth loop then ends.

In step S2015, if the isolation degrees calculated after the end of the second loop in step S2003 in FIG. 20 are all 0 or the anomaly measures are less than or equal to the threshold (Y), the server 10 proceeds to step S2016, otherwise (N), it omits step S2016. In step S2016, the server 10 changes the determination status to "no abnormality" status. After that, the fourth loop and the first loop end, and this flow ends. Through the above processing, the server 10 can output a result from which the effects of seasonal fluctuations have been removed.

[GUI (1)]
Next, we will explain an example of the configuration of a user interface, particularly a graphical user interface (GUI), provided in association with the above-mentioned processing and operations in the anomaly detection device 1. A user U1 (FIG. 1) of the anomaly detection device 1 browses and operates each screen displayed on the client terminal 20 based on data provided from the server 10. For example, a web page screen is configured using GUI elements such as windows, buttons, scroll bars, and list boxes.

Figure 22 shows screen 2201, which is an offline analysis condition setting screen, as a first screen example. This screen 2201 has a GUI for setting analysis conditions including a learning period for performing offline analysis and processing parameters. Offline analysis is analysis in response to a user's instruction at any timing (including a series of processes such as those in Figure 3). On this screen, the calculated learning results can also be registered as a recipe for offline analysis conditions. It is assumed that past sensor signals 102 are stored in the DB of the data accumulation unit 103 in association with the equipment ID and time.

In this screen 2201, the target equipment, learning period, evaluation period, anomaly measure calculation parameters, etc. can be input. In the equipment ID field 2202, the ID of the target equipment 101 is input. By pressing the equipment list display button 2203, an equipment ID list is displayed based on the data stored in the data storage unit 103 in FIG. 3. The user U1 can select and input an equipment ID from the list. If there is only one equipment 101 connected to the anomaly detection device 1, it is not necessary to display the equipment ID field 2202. In the learning period field 2204, the start date and end date of the learning period, which is the period for which learning data is to be extracted, can be input. In the evaluation period field 2205, the start date and end date of the evaluation period, which is the period for which anomaly detection is to be analyzed, can be input. In the sensor selection field 2206, the sensor (corresponding sensor ID) to be used for processing can be input. By pressing the list display button 2207, a sensor list 2208 is displayed. The sensor list 2208 displays information on multiple sensors 5 associated with the equipment 101 as candidates. The user U1 can select and input one or more sensors from the list. The sensor selection field 2206 may allow the user to specify sensors to be excluded. When inputting the sensor signal 102 in FIG. 3, only the information on the sensor selected here is input.

In the sensor classification parameter field 2209, a reference value to be used in step S504 in FIG. 5 can be input. In this example, this reference value is a threshold value for the correlation value. A sensor 5 whose correlation value exceeds this reference value is classified as a first type sensor having a high correlation with the temperature. In the anomaly measure calculation parameter field 2210, parameters to be used in the calculation of the anomaly measure can be input. This example is an example in which the local subspace method is adopted, and the number of neighboring vectors and a regularization parameter can be input. The regularization parameter is a small number to be added to the diagonal components to prevent the inverse matrix of the correlation matrix C in Equation 2 from being calculated.

In the distribution density image creation parameter field 2211 (in other words, the two-dimensional histogram calculation parameter field), parameters used in creating the distribution density image can be entered, such as image size and information on the size within the image that corresponds to the normal range. In the abnormal section extraction parameter field 2212, the maximum length of the interruption period (in other words, the allowable gap) during which abnormal detection is considered to be continuous when extracting an abnormal section can be entered.

After inputting and confirming the offline analysis condition information as described above, user U1 can use execute button 2214 to instruct anomaly detection device 1 to execute offline analysis under the offline analysis conditions described above. In accordance with the execution instruction, anomaly detection device 1 first performs sensor classification according to FIG. 5 using the temperature and sensor signal during the learning period. Next, anomaly detection device 1 executes learning according to FIG. 7, FIG. 9, and FIG. 13.

As a result of learning, the anomaly detection device 1 stores the following data and information in the learning result accumulation unit 111.
- The average and standard deviation for each sensor signal calculated in step S702 - Data of all feature vectors for the learning period extracted in step S703 - The threshold value calculated in step S708 - The processing range and step size for each sensor signal calculated in steps S904 and S905 - The brute force distribution density image created in step S910 - The processing range and step size for temperature data calculated in steps S1303 and S1304 - The distribution density image with temperature on the horizontal axis created in step S1309 - The correlation maintenance range set in step S1310.

Furthermore, the anomaly detection device 1 uses the sensor signals from the learning period and the evaluation period to calculate an anomaly measure according to FIG. 15, judges whether the data is normal or abnormal, and stores the judgment result together with the anomaly measure and a threshold value. However, for data from the learning period, the anomaly measure calculated in step S707 of FIG. 7 is used to judge whether the data is normal or abnormal.

Next, the anomaly detection device 1 extracts the anomaly sections according to FIG. 16, calculates the isolation degree for each anomaly section, and identifies the anomaly-related sensor. For display purposes, the anomaly detection device 1 saves the start time, end time, isolation degree, identified related sensor name, and anomaly plot image for each anomaly section.

Next, the anomaly detection device 1 determines whether the status of each sensor that has a high correlation with temperature for each abnormal section is abnormal, seasonal variation, or abnormal, according to FIG. 19. The anomaly detection device 1 saves, as the processing result, the abnormal plot image with the horizontal axis being temperature created in step S1904, and the determination result in step S1905.

Furthermore, the anomaly detection device 1 calculates the degree of isolation removing the effects of seasonal variation for each abnormal section, identifies anomaly-related sensors, calculates anomaly measures, and determines whether the section is abnormal or normal, according to Figures 20 and 21.

After the above offline analysis is completed, the anomaly detection device 1 displays a result display screen, which will be described later. After the user U1 has finished checking the result display screen, the screen returns to the offline analysis condition setting screen of FIG. 22. In the recipe name field 2213 of the screen 2201, the offline analysis conditions, which are composed of the above learning results and analysis results and input information, can be set as a recipe. The user U1 can input a recipe name in the recipe name field 2213 and register/update it as a recipe by using the registration button 2215. The anomaly detection device 1 associates the offline analysis conditions based on the learning results and analysis results with the equipment ID and recipe name, and stores them in the learning result accumulation unit 111. The learning results (corresponding offline analysis conditions) include the data created and stored by the learning execution, as well as the sensor classification parameters, anomaly measure calculation parameters, distribution density image creation parameters, and abnormal section extraction parameters input in each field.

The anomaly detection device 1 closes this screen in response to the exit button 2216. At the time of this exit, if there is learning result and analysis result data, that data is deleted, or the remaining data is overwritten by the next learning and analysis performed.

The learning results (recipes for the corresponding offline analysis conditions) registered on the above screen 2201 are managed with a label indicating whether they are active or inactive. User U1 can set a label for each of the multiple learning results (recipes for the corresponding offline analysis conditions). Offline analysis conditions with an active label are also applied as online analysis conditions in online analysis.

After the recipe is registered as described above, online analysis is automatically performed for the specified evaluation period. In the online analysis, the anomaly detection device 1 performs processing such as in FIG. 15, FIG. 16, FIG. 19, FIG. 20, FIG. 21, etc., using online analysis condition information such as the learning result of activity that matches the equipment ID for newly input data such as the sensor signal 102. The anomaly detection device 1 stores the processing results in the learning result storage unit 111 in association with the recipe name and processing date and time, etc. These online analysis processes are performed at a predetermined period or date and time according to the target equipment 101, etc., for example, once a day as a regular interval. For equipment 101 with a short sampling interval or equipment 101 that requires real-time performance, the interval for executing the online analysis can be set to an interval shorter than one day (for example, one hour, etc.).

[GUI (2)]
23 shows, as an example of a second screen, a screen 2301 for specifying the display target of the online analysis result. On this screen 2301, the user U1 can specify the equipment 101, recipe, and period to be displayed. First, the user U1 selects an equipment ID in an equipment ID selection field 2302. Next, the user U1 selects the recipe to be displayed in a recipe name selection field 2303 from a list of recipes targeted for the equipment ID in the equipment ID selection field 2302.

The data recording period field 2304 displays the start and end dates of the data recording period, which is the period during which processing was performed using the input recipe and records remain. The result display period field 2305 allows the user to specify and input the start and end dates of the result display period, which is the period during which the online analysis results are to be displayed. In response to the display button 2306, the detection results of the anomaly detection process in the online analysis are displayed in accordance with the display target specification on screen 2301. In response to the exit button 2307, screen 2301 is closed.

[GUI (3-1)]
24 to 27 show examples of screens that display the analysis results (offline or online detection results) by the anomaly detection device 1. The screens in Figs. 24 to 27 each have multiple tabs at the top. Depending on the tab selected by U1, one of the screens shown in Fig. 24 to Fig. 27 corresponding to each tab is displayed. Fig. 24 shows a sensor classification result display screen 2400, and Fig. 25 shows an abnormality FIG. 26 shows an enlarged abnormality detection result display screen 2600 , and FIG. 27 shows a related sensor identification result display screen 2700 .

The sensor classification result display screen 2400 in FIG. 24 displays temperature signal data, a time series graph of a first type sensor that has a high correlation with temperature, and a second distribution density image with temperature on the horizontal axis. When displaying offline analysis results, the learning period and evaluation period specified in FIG. 22 are displayed in the period display field 2401. When displaying online analysis results, the learning period and evaluation period corresponding to the recipe are displayed in the period display field 2401. In this example, the learning period is three months from January 1 to March 31, 2009. The evaluation period is eight months from April 1 to November 30, 2009.

In the temperature display field 2402, temperature data 2402a for the learning period and evaluation period are displayed as a time series graph. In the first sensor signal display field 2403, a time series graph of the sensor signal 2403a with the highest correlation with temperature and a distribution density image 2403b with the sensor signal on the vertical axis and the temperature on the horizontal axis are displayed. In the second sensor signal display field 2404, similar information (2404a, 2404b) is displayed for the sensor with the second highest correlation with temperature. In the third sensor signal display field 2405, similar information (2405a, 2405b) is displayed for the sensor with the third highest correlation with temperature. In this example, of the multiple (m=16) sensors 5 (sensors 00, 01, ..., 15) of a certain facility 101, the sensors with the highest correlation with temperature are "sensor 15", "sensor 11", and "sensor 02". In this example, the number of sensor signal display columns is three, but this is not limited to three, and the number will be the same as the number of sensors classified as having a high correlation with temperature, and the display of this column will automatically change depending on the data and reference value.

The date bar 2406 displays the date corresponding to the time on the horizontal axis of the time series graph. If the period is too long to be displayed on the screen, the user U1 can select the period to be displayed using a scroll bar or the like. This screen is closed by clicking the exit button 2407. As a variation, the sensor classification screen 2400 may also display the order of correlation with temperature and correlation values for information on multiple sensor signals (2403-2405).

[GUI (3-2)]
25, an anomaly detection result overall display screen 2500 displays anomaly measures, thresholds, and judgment results for a specified period, as well as a time series graph of the sensor signal. When the results are displayed, the learning period and evaluation period specified in FIG. 22 are displayed, and when the online analysis results are displayed, the result display period specified in FIG. 23 is displayed. In the column 2502a, it is displayed whether the analysis result being displayed is before or after removing the seasonal variation. Before removing corresponds to the steps up to step S607 in FIG. After removing corresponds to the steps up to step S610 This corresponds to after the processing up to

Column 2502a is initially set to "Before seasonal variation is removed." That is, at this time, the data before seasonal variation is removed is displayed on the anomaly detection result overall display screen 2500. The display content of column 2502a can be switched to "Before seasonal variation is removed" by using the switch button 2502b. With the switch, the data after seasonal variation is removed is displayed on the anomaly detection result overall display screen 2500. This switch is also reflected on the other tabs, the anomaly detection result enlarged display screen 2600 and the related sensor identification result display screen 2700. Although not shown, in the display of data on the screen after seasonal variation is removed, the data portion corresponding to the "seasonal variation" status is removed, and the anomaly measure 2504a, the judgment result 2504c, and the values and shapes of the graphs of each sensor signal are different from before the removal.

The anomaly measure column 2504 displays a time series graph of the anomaly measure 2504a for a specified period (learning period, evaluation period, or result display period), a threshold value 2504b, and a judgment result 2504c. The judgment result 2504c is displayed as a binary line for each point in time, with "no abnormality" being a value of 0 and "abnormality present" being a value of 1 (e.g., red).

In the first sensor signal field 2505, a graph of the time series sensor signal 2505b for the sensor 5 specified in the sensor field 2505a is displayed for the above-specified period. Similarly, in the second sensor signal field 2506 and the third sensor signal field 2507, information about the specified sensor is displayed. User U1 can specify any sensor 5 to display information. In this example, information about "sensor 11" is displayed in the first sensor signal field 2505, information about "sensor 00" is displayed in the second sensor signal field 2506, and information about "sensor 15" is displayed in the third sensor signal field 2507. In this example, the number of sensor signal fields is three, but it is not limited to this. The date bar 2508 displays the date corresponding to the time on the horizontal axis of the time series graph. The cursor 2509 is a time designation button, which represents the starting point for the enlarged display described later, and can be moved by the user U1 by operating the mouse or the like. The number of days to display specification field 2510 displays the number of days from the start point to the end point of the enlarged display on the analysis result enlarged display screen 2600 as the number of days to display, and can also be input and specified in this field. The date display field 2511 displays the date and time at the position of the cursor 2509. The screen closes in response to the exit button.

By looking at the above screen, user U1 can check the details by comparing the graph (2504) of the anomaly measure, threshold, and equipment status judgment or detection result with the graph of the first type sensor signal that has a high correlation with temperature. The following is also possible as a variation. In a screen like the above, information before and after the removal of seasonal variation may be displayed in parallel so that they can be compared. For example, similar information is displayed vertically or horizontally with the same units, etc. By switching or displaying in parallel as described above, user U1 can easily check the information before and after removal.

[GUI (3-3)]
In the anomaly detection result enlarged display screen 2600 in FIG. 26, the anomaly detection result enlarged display screen 2600 displays the anomaly measures and thresholds for the period of the display days specified in the display days specification field 2510 starting from the date specified by the cursor 2509 on the anomaly detection result full display screen 2500. 25. In other words, in the anomaly measure column 2604 and the sensor signal columns 2605 to 2607, the same information as in FIG. 25 is displayed in an enlarged manner for a specified period. The date bar 2608, for example, displays two days, and June 22 and 23 are displayed. A scroll bar 2611 and a scroll bar area 2612 are additionally displayed on the anomaly detection result enlarged display screen 2600. The total length of the scroll bar area 2612 corresponds to the display period on the anomaly detection result total display screen 2500. The length of the scroll bar 2611 corresponds to the number of days specified in the display number of days specification field 2510. It is considered to be of a corresponding length. The left end of the scroll bar 2611 corresponds to the start point of the enlarged display, and the right end corresponds to the end point of the enlarged display. The user U1 can change the start point of the enlarged display by operating the scroll bar 2611. This change can be made to the entire anomaly detection result. This is also reflected in the position of the cursor 2509 on the display screen 2500 and the display of the date display field 2511 .

[GUI (3-4)]
The related sensor identification result display screen 2700 in FIG. 27 displays the anomaly measure, threshold value, and judgment result for the specified period, the anomaly related sensor identification result for the selected abnormal section, and the seasonal variation judgment result. This associated sensor identification result display screen 2700 has an abnormal section number column 2701, an associated sensor identification column 2702, and a seasonal variation determination result column 2706.

The period display column 2501, the display content column 2502, and the anomaly measure column 2503 are the same as those displayed on the anomaly detection result overall display screen 2500. On this screen, too, you can use the switch button to switch between before and after seasonal variation removal, and this switching is reflected on the screens of the other tabs.

The abnormal section number column 2701 displays a number representing the selected abnormal section and the date and time of the abnormal section. Initially, the first abnormal section on the date indicated by the cursor 2509 on the date bar is selected and displayed. If there is no abnormal section on that date, it will be blank, and neither the related sensor identification result nor the seasonal variation discrimination result will be displayed. User U1 can select the previous or next abnormal section using the arrow buttons in the abnormal section number column 2701. If it is blank, the closest abnormal section before or after the date indicated by the cursor 2509 will be selected and displayed. User U1 can also specify the abnormal section number by directly inputting it. The position of the cursor 2509 will change to the date of the selected abnormal section. This change will also be reflected on the screens of the other tabs.

The related sensor identification column 2702 has an isolation degree column 2703 and an abnormality plot image column 2704. The isolation degree column 2703 displays the isolation degree in the selected abnormal section. The horizontal axis of the graph in this column is the sensor name or sensor ID (e.g., sensors 00, 01, ..., 15) of each of the multiple sensors 5, and the vertical axis is the isolation degree for each sensor 5. If the display content column 2502 displays "before removing seasonal variations," the isolation degree calculated in FIG. 16 is displayed, and if the display content column 2502 displays "after removing seasonal variations," the isolation degree calculated in FIG. 20 is displayed.

In the abnormal plot image field 2704, for example, abnormal plot images 2704a, 2704b, and 2704c are displayed as abnormal plot images in the selected abnormal section. In the case of "before removing seasonal variations", the abnormal plot images created in step S1613 of FIG. 16 are displayed, and in the case of "after removing seasonal variations", the abnormal plot images created in step S2009 of FIG. 20 are displayed. In this example, these abnormal plot images are images in which abnormal data values are plotted on the first distribution density image for a combination of two sensors 5. In addition, multiple abnormal plot images are displayed, for example, from left to right in the order created in step S1806 in the first loop of step S1801 of FIG. 18. The number of abnormal plot images varies depending on the section. If multiple images cannot be displayed on the screen, the displayed abnormal plot images can be shifted to the left or right by operating the arrow buttons in the abnormal plot image field 2704, etc.

In the seasonal variation discrimination result column 2706, abnormal plot images with temperature on the horizontal axis, for example, abnormal plot images 2706a, 2706b, and 2706c, created in step S1904 of FIG. 19, for the selected abnormal section are displayed. In these abnormal plot images, an image representing the correlation maintenance range may be displayed overlapping as in FIG. 14 described above. In addition, each abnormal plot image is displayed with "seasonal variation", "abnormal", etc. as the status 2708 of the discrimination result in step S1905 of FIG. 19. The number and order of the multiple abnormal plot images displayed in the seasonal variation discrimination result column 2706 are unified, for example, in order of high correlation with temperature, as in the display of data of multiple sensor signals in FIG. 24. By looking at such abnormal plot images, user U1 can easily confirm sensor signals with high correlation with temperature, abnormal data values, discrimination result status, etc. Additionally, user U1 can check details about the detection results before and after removing seasonal variations by also looking at the display in the related sensor identification field 2702 (2703, 2704).

[Example of an abnormality plot image]
FIG. 28 shows an example of an abnormal plot image. User U1 can select an abnormal plot image on a screen such as that shown in FIG. 27 and display the details on the screen for confirmation. (A) shows a detailed display of an abnormal plot image 2701a, (B) shows an abnormal plot image 2701b, and (C) shows an abnormal plot image 2701c. In the abnormal plot image 2701a in (A), a portion 2801 shown in a dashed line frame corresponds to normal data with a high distribution density and is displayed in gray. A portion 2802 is displayed in red. This portion 2802 is within the correlation maintenance range 2803, similar to point C in the correlation maintenance range 1401 in FIG. 14, and is an example of data for which correlation is maintained. Therefore, this data is determined to be in the "seasonal variation" status.

In (B) of the abnormal plot image 2701b, part 2811 corresponds to normal data and is displayed in gray. Part 2812 is displayed in red. This part 2812 has a part that is away from part 2811 and outside the corresponding correlation maintenance range 2813, and is an example of data where correlation is not maintained. Therefore, this data is determined to be "abnormal" rather than "seasonal variation". In (C) of the abnormal plot image 2701c, part 2821 corresponds to normal data and is displayed in gray. Part 2822 is displayed in red. This part 2822 has a part that is away from part 2821 and outside the corresponding correlation maintenance range 2823, and is an example of data where correlation is not maintained. Therefore, this data is determined to be "abnormal" rather than "seasonal variation".

[Effects, etc.]
As described above, according to the anomaly detection device etc. of the first embodiment, it is possible to reduce errors in anomaly determination/detection by taking seasonal variations into consideration when detecting anomalies etc. based on a plurality of time-series sensor signals output by the facility 101. Moreover, according to the first embodiment, it is possible to automatically distinguish between anomalies in the facility 101 that are caused by seasonal variations and those that are not, without the need for a long learning period of one year or more, and to output a result in which the influence of seasonal variations is reduced or removed.

According to the first embodiment, the sensors 5 are classified based on the correlation with the temperature, so that even if the learning period is less than one year, it is possible to know the sensors 5 that are affected by seasonal variations. According to the first embodiment, it is checked whether the correlation between the sensors 5 and the temperature is maintained. As a result, in the first embodiment, it is possible to further distinguish between "seasonal variations" and the presence or absence of an abnormality not caused by seasonal variations ("no abnormality"/"abnormality present") from the judgment result of the presence or absence of an abnormality (normal/abnormal). According to the first embodiment, an abnormality plot image with the horizontal axis of temperature can be displayed on the screen as the seasonal variation judgment result, so that the user U1 can easily confirm and understand whether the correlation with the temperature is maintained and whether the abnormality is caused by seasonal variations. According to the first embodiment, each detection result before and after the removal of the seasonal variation can be displayed on the screen, so that the user U1 can confirm the presence or absence of the influence of the seasonal variation, and after the removal, the user U1 can grasp the abnormal phenomenon caused by factors other than the seasonal variation.

Above, an example was described in which temperature is used as a parameter that varies with the season (seasonal variation value). Other parameters such as precipitation, wind direction/speed, solar radiation, atmospheric pressure, and humidity also vary with the season. It is also possible to replace the temperature in embodiment 1 with any of these seasonal variation values. It is also possible to use multiple seasonal variation values as input and perform similar processing to determine seasonal variation and remove seasonal variation, etc.

Furthermore, data on temperature or other seasonal fluctuation values may be acquired by installing a dedicated sensor (e.g., temperature sensor 6) near the equipment 101 as shown in FIG. 1, but this is not limiting. The anomaly detection device 1 (e.g., server 10) may periodically download data on temperature and seasonal fluctuation values in various locations from outside the equipment 101, for example from the homepage (web service) of the Japan Meteorological Agency on the communication network 9, and store the data in a DB.

The present invention has been specifically described above based on the embodiments, but the present invention is not limited to the above embodiments and can be modified in various ways without departing from the spirit of the invention.

1...anomaly detection device, 5...sensor, 9...communication network, 10...server, 20...client terminal, 50...communication device, 101...equipment, 102...sensor signal, 103...data storage unit, 104...temperature signal, 105...sensor classification unit, 106...signal input unit, 107...feature vector extraction unit, 108...anomaly measure calculation unit, 109...threshold calculation unit, 110...distribution density image creation unit, 111...learning result storage unit, 112...anomaly detection unit, 113...associated sensor identification unit, 114...seasonal variation discrimination unit, 115...seasonal variation removal unit, 116...detection result output unit, 150...communication signal, 160...detection result, U1...user.

Claims (10)

A plurality of sensor signals are input from a plurality of sensors installed in equipment in the environment;
A signal of a seasonal variation value due to a parameter other than temperature or temperature in the environment is input;
classifying the plurality of sensor signals into a first type sensor signal having a high correlation with the seasonal variation value and a second type sensor signal having a low correlation with the seasonal variation value;
Extracting a feature vector for each time from the plurality of sensor signals;
Calculating an anomaly measure for each time based on the feature vector for each time period, using the feature vector for a specified learning period as learning data;
determining whether a state of the equipment represented by the plurality of sensor signals at each time point is normal or abnormal by comparing the abnormality measure with a threshold value;
Using the first type sensor signal, determine whether the determined abnormality is caused by a seasonal variation;
If it is determined that the problem is caused by the seasonal variation, a detection result is created in which the influence of the seasonal variation is removed from the state of the equipment, and the detection result is output.
Anomaly detection device. 2. The anomaly detection device according to claim 1,
For the determined abnormality, a two-dimensional frequency distribution in the relationship between the seasonal variation value and the first type sensor signal is examined, a correlation maintenance range in which the correlation between the seasonal variation value and the first type sensor signal is maintained is calculated based on the normal distribution region at the time of learning, and if a data value of the frequency distribution is included in the normal distribution region within the correlation maintenance range, a "no abnormality" status is determined, if it is outside the normal distribution region within the correlation maintenance range, a "seasonal variation" status is determined, and if it is outside the correlation maintenance range, an "abnormality" status is determined.
Anomaly detection device. 3. The abnormality detection device according to claim 2,
creating a distribution density image representing a two-dimensional frequency distribution of the determined abnormality in relation to the seasonal variation value and the first type sensor signal, and creating an abnormality plot image by plotting the data values determined to be abnormal on the distribution density image;
Displaying the abnormality plot image on a screen.
Anomaly detection device. 3. The abnormality detection device according to claim 2,
When creating the detection result from which the influence of seasonal variation has been removed, a detection result from which data values corresponding to the "seasonal variation" status have been removed is created.
Anomaly detection device. 2. The anomaly detection device according to claim 1,
The data before and after removing the effects of seasonal variations are displayed on the screen in response to a switching operation or displayed in parallel.
Anomaly detection device. 2. The anomaly detection device according to claim 1,
creating a first distribution density image representing a two-dimensional frequency distribution in relation to the two sensors for each combination of two sensors in the plurality of sensors;
Calculating an isolation degree for each of the first distribution density images for a combination of the two sensors;
Calculating an isolation degree for each of the sensors based on the isolation degree for the combination of the two sensors;
Identifying a sensor that is highly associated with the abnormality based on the isolation degree of each sensor;
Displaying information on a sensor highly related to the abnormality on a screen.
Anomaly detection device. 2. The anomaly detection device according to claim 1,
displaying on a screen a graph of the anomaly measure, the threshold value, and a result of judgment or detection of the state of the equipment, and a graph of the first type sensor signal;
Anomaly detection device. 2. The anomaly detection device according to claim 1,
The seasonal variation value is at least one of temperature, precipitation, wind direction/speed, solar radiation, atmospheric pressure, and humidity.
Anomaly detection device. 2. The anomaly detection device according to claim 1,
The study period is at least one week and not more than one year.
Anomaly detection device. An anomaly detection method for an anomaly detection device, comprising:
The steps executed by the anomaly detection device include:
receiving a plurality of sensor signals from a plurality of sensors installed in a facility in the environment;
inputting a signal of a seasonal variation value due to a temperature or a parameter other than temperature in the environment;
classifying the plurality of sensor signals into a first type sensor signal having a high correlation with the seasonal variation value and a second type sensor signal having a low correlation with the seasonal variation value;
extracting a feature vector for each time from the plurality of sensor signals;
calculating an anomaly measure for each time based on the feature vector for each time period, using the feature vector for a designated learning period as learning data;
A step of determining whether a state of the equipment represented by the plurality of sensor signals at each time point is normal or abnormal by comparing the abnormality measure with a threshold value;
determining whether the determined abnormality is due to a seasonal variation using the first type sensor signal;
creating and outputting a detection result in which the influence of the seasonal variation is removed from the state of the equipment when it is determined that the influence of the seasonal variation is caused;
The anomaly detection method includes the steps of:

Images