JP7580257B2 - Anomaly detection system, anomaly detection method, and program - Google Patents

Description

This disclosure relates to an anomaly detection system, an anomaly detection method, and a program.

Systems have been proposed that detect abnormalities in machines and equipment in plants, factories, etc. For example, Patent Document 1 discloses an anomaly detection system that collects operation data of equipment to be monitored in a learning phase, builds an anomaly detection model from the operation data, and in a monitoring phase calculates an anomaly score for each piece of operation data from the operation data and the anomaly detection model, and determines that an anomaly has occurred if the anomaly score exceeds a threshold value.

JP 2020-8997 A

In an anomaly detection method that calculates an anomaly score for one monitored item, such as temperature or pressure, included in the operational data and judges that anomaly score using a threshold, it is possible to detect anomalies that can be determined from the instantaneous value of that monitored item. However, for example, depending on the operating state of the equipment, the value of the monitored item may exceed the threshold even when no anomaly has occurred, and judging an anomaly for one monitored item by focusing only on one anomaly score may result in a decrease in the accuracy of anomaly detection.

This disclosure provides an anomaly detection system, an anomaly detection method, and a program that can solve the above problems.

The anomaly detection system disclosed herein comprises a data acquisition unit that acquires operation data of a monitored device; a score calculation unit that calculates multiple types of probabilities that a value of a first parameter, which is a measurement value of the monitored device included in the operation data, will be observed using different methods, and calculates a score indicating the degree of anomaly for each of the multiple types of probabilities; and an anomaly detection unit that determines whether or not each of the multiple scores is abnormal based on the multiple scores and a judgment model, and detects an anomaly of the device based on the results of the multiple judgments, wherein the probability associated with one of the multiple scores is the probability that the value of the first parameter included in the operation data will be observed in an operating state indicated by a second parameter, which is a measurement value related to the operating state of the device included in the operation data .

In the anomaly detection method disclosed herein, an anomaly detection system acquires operation data of a monitored device, calculates multiple types of probabilities that a value of a first parameter, which is a measurement value of the monitored device included in the operation data, will be observed using different methods, calculates a score indicating the degree of anomaly for each of the multiple types of probabilities, judges whether or not each of the multiple scores is abnormal based on the multiple scores and a judgment model, and detects an anomaly of the device based on the results of the multiple judgments, and the probability associated with one of the multiple scores is the probability that a value of the first parameter included in the operation data will be observed in an operating state indicated by a second parameter, which is a measurement value related to the operating state of the device included in the operation data.

The program disclosed herein causes a computer to perform processing to acquire operation data of a monitored device, calculate multiple types of probabilities that a value of a first parameter, which is a measurement value of the monitored device included in the operation data, will be observed using different methods, calculate a score indicating the degree of abnormality for each of the multiple types of probabilities, judge whether or not each of the multiple scores is abnormal based on the multiple scores and a judgment model, detect an abnormality of the device based on the results of the multiple judgments, and the probability associated with one of the multiple scores is the probability that the value of the first parameter included in the operation data will be observed in an operating state indicated by a second parameter, which is a measurement value related to the operating state of the device included in the operation data .

The above-mentioned anomaly detection system, anomaly detection method, and program can maintain the accuracy of anomaly detection.

1 is a functional block diagram illustrating a configuration example of an anomaly detection system according to an embodiment. FIG. 1 is a first diagram illustrating an anomaly detection method according to an embodiment. FIG. 2 is a second diagram illustrating the anomaly detection method according to the embodiment. FIG. 11 is a third diagram illustrating the anomaly detection method according to the embodiment. FIG. 4 is a fourth diagram illustrating the anomaly detection method according to the embodiment. FIG. 11 is a diagram illustrating an example of a method for determining anomaly detection according to the embodiment. FIG. 13 is a diagram illustrating an example of a report according to the embodiment. 10 is a flowchart illustrating an example of an anomaly detection model creation process according to the embodiment. 10 is a flowchart illustrating an example of an abnormality detection process according to the embodiment. FIG. 1 is a diagram illustrating an example of a hardware configuration of an anomaly detection system according to an embodiment.

<Embodiment>
Hereinafter, an anomaly detection system according to an embodiment will be described in detail with reference to FIGS.
(composition)
FIG. 1 is a functional block diagram illustrating an example of the configuration of an anomaly detection system according to an embodiment.
The anomaly detection system 10 acquires operation data from a monitored device 20 and monitors the behavior of the operation data to detect an anomaly in the device 20. The device 20 is, for example, equipment such as a boiler, compressor, or turbine in a plant, or a machine tool in a production factory. The anomaly detection system 10 includes a data acquisition unit 11, a score calculation unit 12, a setting acceptance unit 13, a learning unit 14, an anomaly detection unit 15, a memory unit 16, a report creation unit 17, and an output unit 18.

The data acquisition unit 11 acquires operation data of the device 20. Operation data refers to measured values, such as temperature, pressure, flow rate, vibration, current, power consumption, and rotation speed, measured by sensors provided in the device 20, or values calculated based on the measured values. The data acquisition unit 11 acquires the operation data and the measurement time of the operation data from the device 20. Hereinafter, the measured values included in the operation data and values calculated based on the measured values are referred to as parameters.

The score calculation unit 12 calculates a score indicating the degree of abnormality for the operational data acquired by the data acquisition unit 11. The score calculation unit 12 includes a first score calculation unit 121, a second score calculation unit 122, a third score calculation unit 123, and a fourth score calculation unit 124. The score calculation unit 12 calculates a score that focuses only on the parameter to be monitored, but also takes into account the relationship with other parameters.

Specifically, the first score calculation unit 121 calculates the first score for one monitored parameter α, which is a score when only the parameter α is focused on. For example, the first score calculation unit 121 calculates the probability density P(α) of the parameter α, and calculates the first score based on the value. For example, the negative common logarithm (e.g., −log ₁₀ (P(α))) of the probability density P(α) of the parameter α is calculated as the first score. In other words, when a value with a small probability density is measured for the parameter α, the first score at that time becomes a large value. In a simple example, if 1000 values of the parameter α are obtained, and 999 of the values are “1” and one is “10”, the probability density of the measured value “10” is 1÷1000=0.001, and the first score is 3.0.

The second score calculation unit 122 calculates a second score, which is a score considering the relationship of the monitored parameter α with other parameters reflecting the operating state of the device 20. For example, when the device 20 is a power generation facility such as a gas turbine, the operating state of the device 20 refers to an operating mode such as whether the device 20 is operating at rated output or partial load, and in this case, the other parameter reflecting the operating state of the device 20 is, for example, the load of the power generation facility. If the other parameter reflecting the operating state of the device 20 is parameter β, the value of parameter β included in the operation data acquired by the data acquisition unit 11 is β1, and the value of parameter α is α1, for example, the second score calculation unit 122 calculates the probability that the value of parameter α becomes α1 under the condition that the value of parameter β becomes β1, that is, the conditional probability P(α1|β1), and calculates the negative common logarithm of the conditional probability P(α1|β1) as the second score. In other words, when a small value of the conditional probability P(α1|β1) is observed, the second score at that time will be a large value. This also applies to the third score and the fourth score below. Note that the number of other parameters reflecting the operating state of the device 20 may be two or more.

The third score calculation unit 123 calculates a third score, which is a score considering the relationship between the parameter α to be monitored and other parameters that have a strong relationship with the parameter α. A parameter that has a strong relationship is, for example, temperature data of an operating system and temperature data of a redundant system of the same equipment. Alternatively, for example, in the case of a power generation facility, if the turbine rotation speed and the temperature of the fuel gas increase with an increase in load, these may be parameters that have a strong relationship with each other. The other parameters that have a strong relationship with the parameter α can be selected by machine learning such as a decision tree. Alternatively, a user with knowledge may set other parameters that have a strong relationship with the parameter α. If the other parameter that has a strong relationship with the parameter α is the parameter γ, the value of the parameter γ included in the operation data acquired by the data acquisition unit 11 is γ1, and the value of the parameter α is α1, for example, the third score calculation unit 123 calculates the probability that the value of the parameter α is α1 under the condition that the value of the parameter γ is γ1, that is, the conditional probability P(α1|γ1), and calculates the negative common logarithm of the conditional probability P(α1|γ1) as the third score. Note that there may be two or more other parameters that are closely related to parameter α.

The fourth score calculation unit 124 calculates a fourth score for the parameter α to be monitored, which is a score that takes into account the relationship with all other parameters other than the parameter α. For example, when the combination of values of all other parameters included in the operation data acquired by the data acquisition unit 11 is δ1 and the value of the parameter α is α1, the fourth score calculation unit 124 calculates the probability that the value of the parameter α is α1 under the condition that the combination of values of all other parameters is δ1, that is, the conditional probability P(α1|δ1). The fourth score calculation unit 124 calculates the negative common logarithm of the conditional probability P(α1|δ1) as the fourth score.

The setting reception unit 13 receives various settings. For example, the setting reception unit 13 receives the setting of a parameter β that reflects the operating state. The setting reception unit 13 may also receive the setting of a parameter γ that is closely related to the parameter α, the setting of a threshold value for determining an abnormality, and the like. For example, the setting reception unit 13 receives indices that define conditions such as load and temperature, and the setting of redundant equipment, as the knowledge of on-site workers.

The learning unit 14 creates a judgment model that judges whether an abnormality has occurred in the device 20 or whether there is a sign of an abnormality, based on each score calculated by the first score calculation unit 121 to the fourth score calculation unit 124. For example, the learning unit 14 collects operation data from when the device 20 was operating normally in the past, learns the first score of parameter α included in the collected operation data, and creates judgment model 1 that indicates what value of the first score is normal. The learning unit 14 also learns the second score calculated based on parameters α and β included in the normal operation data, and creates judgment model 2 that indicates what value of the second score is normal. The learning unit 14 similarly creates judgment model 3 and judgment model 4 for the third score and the fourth score.

For example, the learning unit 14 may extract the parameter α from operation data including both normal and abnormal conditions collected when an abnormality occurred in the device 20 in the past, learn the first score in normal conditions and the first score in abnormal conditions related to the parameter α, and calculate a threshold value (judgment model 1) for judging whether an abnormality occurs at what value of the first score. Similarly, the learning unit 14 may learn the second score in normal conditions and the second score in abnormal conditions calculated based on the operation data of the device 20 including both normal and abnormal conditions, and create a judgment model 2 for judging whether an abnormality occurs at what value of the second score. Similarly, the learning unit 14 may create a judgment model 3 for discriminating between normal and abnormal conditions based on the third score, and a judgment model 4 for discriminating between normal and abnormal conditions based on the fourth score.

The learning unit 14 may further create one or more anomaly determination models that are not dependent on the first to fourth scores. For example, normal operation data of the device 20 may be collected, and a cluster based on the k-nearest neighbor method or a unit space based on the MT (Mahalanobis-Taguchi) method may be created as a determination model for the parameter α included in the operation data.

The anomaly detection unit 15 detects an anomaly in the device 20 based on the scores (first to fourth scores) calculated by the score calculation unit 12 and the judgment models (judgment models 1 to 4) created by the learning unit 14. The anomaly detection unit 15 detects an anomaly using a plurality of scores from the first to fourth scores. For example, when the judgment models 1 to 4 are created based on the first to fourth scores calculated from normal operation data, the anomaly detection unit 15 judges that the first score of the parameter α is abnormal if the difference between the value of the first score calculated by the score calculation unit 12 and the normal first score indicated by the judgment model 1 is equal to or greater than a threshold value. Similarly, the anomaly detection unit 15 compares the value of the second score with the judgment model 2 to judge whether the second score is abnormal or not, and judges whether the third score and the fourth score are normal or not based on the judgment models 3 and 4, respectively.
Furthermore, for example, when the learning unit 14 calculates a threshold value for determining an anomaly for each of the first score to the fourth score, the anomaly detection unit 15 determines that the first score of the parameter α is abnormal if the value of the first score calculated by the score calculation unit 12 exceeds the threshold value calculated by the learning unit 14. The anomaly detection unit 15 similarly determines whether or not the second score to the fourth score are abnormal based on the respective threshold values.
Then, the anomaly detection unit 15 performs anomaly detection for the device 20 based on the result of the determination of whether or not each score is abnormal and on each score. For example, the anomaly detection unit 15 selects the largest score among the scores determined to be abnormal, and outputs the value indicated by the selected score as the anomaly detection result.

The memory unit 16 stores information such as the operational data acquired by the data acquisition unit 11, various settings accepted by the setting acceptance unit 13, the first score to the fourth score, judgment models 1 to 4, and detection results by the anomaly detection unit 15.
The report creation unit 17 creates a report that describes the transition of the operational data over a predetermined period of time, the transition of the first score to the fourth score, etc. The report will be described later with reference to FIG.

The output unit 18 outputs to a display device a graph showing the progress of the first score to the fourth score calculated by the score calculation unit 12, the abnormality detection results by the abnormality detection unit 15, and the like. The output unit 18 also displays the report created by the report creation unit 17 on a display device or outputs it to an electronic file.

(4 scores)
Next, a method of detecting an anomaly using the first to fourth scores will be described with reference to FIGS. 2A to 2D and 3. FIG.
An example of the transition of the parameter α is shown in FIG. 2A. The first score is a probability density calculated by focusing on a single parameter α. For example, if the parameter α fluctuates as shown in FIG. 2A, the first score also fluctuates similarly. By monitoring the fluctuation of the first score, it is possible to grasp the fluctuation of the parameter α. For example, if the first score when the value of the parameter α is Q1 exceeds a threshold value, the anomaly detection unit 15 determines that the first score is abnormal.

An example of the transition of the monitored parameter α and the parameter β indicating the driving state is shown in FIG. 2B. The second score indicates the variation of the parameter α in the driving state at that time. For example, assume that the behavior of the parameter α and the parameter β have a positive correlation during normal driving. As shown in Q2, even if the parameter β is constant (the driving state is constant), if only the value of the parameter α decreases, the second score also varies. By monitoring the variation of the second score, it is possible to determine whether the variation of the parameter α is abnormal in the current driving state. Furthermore, when the first score and the second score are monitored, it is possible to assume that the parameter α varies only in the first score, only in the second score, or both in the first score and the second score, but by detecting an abnormality based on multiple scores, it is possible to suppress erroneous detection. For example, when only the first score varies, the value of the parameter α varies due to a change in the driving state, and considering the change in the driving state, the variation of the parameter α is within the normal range. However, when only the first score is monitored, there is a possibility that an abnormality is erroneously detected as occurring due to the variation of the first score. By detecting anomalies based on the first score and the second score, it is possible to suppress such false positives. Furthermore, the first score is a value that indicates a simple variation in the parameter α, and the second score is a value that indicates a variation in the parameter α that takes into account the operating state. By understanding how each score is calculated, the user can understand the meaning of each score when it varies. This allows the location and cause of the anomaly to be identified and the anomaly to be dealt with quickly.

An example of the transition of the parameter α and the strongly related parameters γ1 and γ2 is shown in FIG. 2C. The third score indicates the variation of the parameter α with respect to the strongly related parameters γ1 and γ2. For example, assume that the behavior of the parameter α and the parameters γ1 and γ2 are positively correlated during normal operation. As shown in Q3, if the parameter α alone increases despite the parameters γ1 and γ2 decreasing, the third score also varies. By monitoring the variation of the third score, it is possible to determine whether the variation of the parameter α is abnormal compared to the other parameters γ1 and γ2 (or whether the variation of the parameters γ1 and γ2 is abnormal compared to the parameter α). Furthermore, by monitoring in combination with the first score and the second score, the accuracy of abnormality detection can be improved. For example, if the third score does not increase even when the first score increases, it may mean that a parameter with a strong relationship fluctuates simultaneously due to some factor, and that the variation is not an uncommon event. This makes it possible to suppress false detections that occur when only the first score is monitored. In addition, by understanding the calculation method of the third score, the user can understand the meaning of the behavior indicated by the third score. For example, if the second score increases without increasing the third score, it can be inferred that an event has occurred that does not occur in the current driving state, causing a fluctuation in a group of parameters that are closely related, and that the fact that the third score does not increase suggests that the event may be an event that occurs frequently (in other driving states).

An example of the progression of all parameters is shown in Figure 2D. The fourth score indicates the fluctuation of parameter α in the state indicated by all parameters δ1 to δ3. For example, if parameter α alone exhibits special behavior compared to the behavior of all other parameters, the fourth score will also fluctuate. By monitoring the fluctuation of the fourth score, it is possible to determine whether the fluctuation of parameter α is abnormal compared to all other parameters δ1 to δ3. Furthermore, by monitoring it in combination with the first to third scores, it is possible to improve the accuracy of anomaly detection.

In general, in an anomaly detection system, values obtained by performing statistical processing on sensor measurements, etc., may be presented to the user as scores, but for users who are unfamiliar with statistical processing, it is difficult to understand the meaning of the values, even if they can recognize that the values are abnormal. In contrast, with the first to fourth scores of this embodiment, by knowing in advance how each score is calculated, it is possible to understand the meaning of each score value and estimate what kind of event is occurring in the device 20. For example, the first score indicates how rare a value was observed among the values indicated by the parameter. The second score indicates how rare a value was observed in the operating state. The third score indicates how rare a value was observed in the state indicated by a group of parameters that are highly related to behave in synchronization. The fourth score indicates how rare a value was observed in the state indicated by all parameters. The user can understand the meaning of each score and use it to understand and deal with the event when an abnormality is detected. In addition, by monitoring each score, the user can determine whether the behavior of the monitored parameter α is experiencing a sudden change, deterioration, deviation, or vibration.

Next, referring to FIG. 3, a method for determining four indicators, namely, sudden change, deterioration, deviation, and vibration, using the first to fourth scores will be described. A sudden change is when the value of the parameter α of the monitored object changes abruptly over time. Deterioration is when the value of the parameter α changes, such as gradually decreasing or increasing over time. Deviation is when the value of the parameter α deviates from the values of other similar parameters. Vibration is when the frequency component of the fluctuation of the parameter α changes, such as suddenly becoming faster. Experienced monitors often monitor the behavior of the parameter α based on these four indicators to detect anomalies. In the table shown in FIG. 3, a double circle indicates the most suitable score for determining the indicator, a single circle indicates that the indicator can be detected by that score, a triangle indicates that the indicator may not be detected by that score, and an x indicates that the indicator cannot be detected by that score.

A sudden change can be detected by monitoring the first score, but it can also be detected by the second to fourth scores. For example, when the anomaly detection unit 15 determines that the first score is abnormal, the user determines that a sudden change has occurred in the parameter determined to be abnormal.

Although the second score is most appropriate for detecting deterioration, deterioration can also be detected by monitoring the first score. For example, when the anomaly detection unit 15 determines that the second score is abnormal, the user determines that deterioration has occurred in the parameter determined to be abnormal.

The deviation can be detected by monitoring the third score. For example, when the anomaly detection unit 15 determines that the third score is abnormal, the user determines that a deviation has occurred for the parameter determined to be abnormal.

Vibrations can be detected by the fourth score. For example, if all parameters are vibrating at a constant period and the period of parameter α fluctuates, fluctuations will occur in the fourth score. By utilizing this property, vibrations can be detected by the fourth score. Vibrations can also be detected by the second score. For example, when the anomaly detection unit 15 determines that the fourth score is abnormal, the user determines that vibrations are occurring in the parameters determined to be abnormal.

For example, the output unit 18 may output a graph showing the progress of the first to fourth scores for parameter α from several minutes ago to the present to a display device, and the user may check the fluctuations in each score and determine whether there is a sudden change, deterioration, deviation, or vibration. Alternatively, the anomaly detection unit 15 may be given a criterion for determining whether there is a sudden change, deterioration, deviation, or vibration, and the anomaly detection unit 15 may make a judgment. For example, in the case of a sudden change, a threshold for the amount of fluctuation in the first score is defined for each parameter to be monitored, and if there is a fluctuation that exceeds this threshold within a specified time, the anomaly detection unit 15 determines that a sudden change has occurred. By using the first to fourth scores according to this embodiment, it becomes easier to determine the four indicators that were previously determined by a skilled monitor by monitoring the behavior of each parameter.

(Report)
FIG. 4 shows an example of a report created by the report creating unit 17. As shown in FIG.
The report 100 is, for example, a monthly regular report, and describes the measured values of each parameter measured in the previous month, and the first to fourth scores for each month. The report 100 includes an area 101 that displays the data relationships, an area 102 that displays the top score rankings, an area 103 that displays the trend for the past month, and an area 104 that displays the long-term trend.

The area 101 displays the relationship between parameters. For example, the measurement point column shows the type of parameter. All or some of the parameters in the measurement point column may be monitored parameters. In the equipment status column, a circle is written on the parameter that indicates the operating state. In the correlation column, the same alphabet is written on the parameter that has a strong relationship. In the case of the report 100 of FIG. 4, Para1 to Para3 are written as the measurement points, and the relationship between Para1 and Para2 is strong ("A" in the correlation column), and Para3 is a parameter that indicates the operating state (circle in the equipment status column). Therefore, for example, if Para1 is a parameter to be monitored, the probability density of Para1 is the first score, the conditional probability P(Para1|Para3) is the second score, the conditional probability P(Para1|Para2) is the third score, and so on. By referring to the area 101, the user can check the parameter that indicates the operating state with respect to the second score, and the parameter that has a strong relationship with respect to the third score.

In the area 102, about 20 of the first to fourth scores observed for each parameter in one month are displayed in descending order of value. The No. column displays the ranking, the Time column displays the time when the score was observed, the Score column displays the score value, the Monitored Item column displays the type of the monitored parameter, and the Score Type column displays which of the first to fourth scores the score is. In the case of the report 100 in FIG. 4, the highest value is the first score value "X1" of Para1 observed on "Y/M/D hh:m1", the second highest value is the second score value "X2" of Para2 observed on "Y/M/D hh:m2", and the third highest value is the first score value "X3" of Para2 observed on "Y/M/D hh:m3". By referring to the area 102, the user can check the information of parameters that showed high values in the past month.

Area 103 shows the trends of the measured values of each parameter and the first to fourth scores over a one-month period. Area 104 shows the trends of the measured values of each parameter and the first to fourth scores over a long period (for example, the past five years). By referring to areas 103 and 104, the user can check the trends of the first to fourth scores calculated for each parameter. There are two needs for anomaly detection: short-term evaluation and medium- to long-term evaluation. Short-term evaluation is necessary to grasp, for example, a failure or anomaly currently occurring in device 20 based on the occurrence of anomalies in a short period based on the present. On the other hand, medium- to long-term evaluation is necessary to predict deterioration or failure of device 20 based on the trends (occurrence status such as frequency and magnitude of score) of anomalies and signs of anomaly detected from the past to the present. By referring to areas 103 and 104, the user can perform a medium- to long-term evaluation of device 20. In many cases, abnormalities in the device 20 will show some symptoms before they lead to a sudden breakdown. By using the report 100, it is possible to check for signs of abnormality. It can also be used to predict future abnormalities that may occur over time.

For example, a user can use report 100 to check the first to fourth scores and the measurement values by following the procedure below, thereby establishing a system that supports preventive maintenance-based equipment management rather than the conventional reactive maintenance-based equipment operation.
(1) Understand the relationships between data.
The user refers to area 101 to check the relationships and combinations of the parameters before referring to the specific score values, thereby making it possible to understand the meanings of the first to fourth scores.
(2) Check where your score has increased.
The user refers to areas 102 to 104 and checks the locations and times where the first to fourth scores were high.

(3) Check the relevant parameters.
The user checks the parameters for which high scores were observed as confirmed in (2). The user checks the target parameters from the following perspectives:
(3-1) The first score is increasing.
Focusing only on the target parameter, it is checked whether the measured value of that parameter has suddenly changed or whether it is within an unusual range of values.
(3-2) The second score is increasing.
Focus on the target parameter or the operating status parameter. Check whether one or both of them have abnormal values. The operating status parameters are the parameters marked with a circle in the equipment status area 101.
(3-3) The third score is increasing.
Pay attention to the target parameter or a parameter that has a strong relationship with the target parameter. Check the trend of each parameter (area 103) to see if any of the parameters have abnormal values. Parameters that have a strong relationship are shown in the correlation column in area 101. For example, in the example of FIG. 4, if the third score of Para1 increases, attention should also be paid to Para2.

The report creation unit 17 creates the report 100, for example, once a month, and the output unit 18 outputs the report 100 as an electronic file or the like. Based on the output report 100, the user can perform a medium- to long-term evaluation of abnormalities in the equipment 20 using the above procedure. Also, based on the report 100, the user can evaluate the condition of the equipment 20 from the perspective of the four indexes described using FIG. 3.

(Operation)
Next, the operation of the anomaly detection system 10 will be described with reference to FIGS.
First, an example of the operation in the learning phase will be described with reference to FIG.
FIG. 5 is a flowchart illustrating an example of an anomaly detection model creation process according to the embodiment.
First, the setting reception unit 13 receives various settings (step S11). For example, a user inputs settings of parameters to be monitored, parameters indicating an operating state, and parameters with strong correlations to the anomaly detection system 10. The setting reception unit 13 receives these settings and writes and stores them in the storage unit 16. Parameters with strong correlations are parameters that have been analyzed in advance by machine learning or the like to be strongly correlated.

Next, the data acquisition unit 11 collects operation data measured when the device 20 is operating in a normal operating state (step S12). The collected operation data becomes learning data for the anomaly determination model, so it is preferable to collect as much operation data measured when the device 20 is operating under various conditions as possible. In addition, for evaluation of the second score, it is preferable to collect operation data in all operating states of the device 20. The data acquisition unit 11 writes and stores the collected operation data in the memory unit 16.

Next, the score calculation unit 12 calculates the first score to the fourth score (step S13). For example, the first score calculation unit 121 reads out the data of the parameters set as the monitoring target from the operation data collected as the learning data stored in the storage unit 16, and calculates the probability density for the parameters at each time. For example, if 10,000 measured values are collected for the parameter α, the first score calculation unit 121 calculates the probability density (first score) among the 10,000 measured values for each of the 10,000 measured values. The first score calculation unit 121 writes and stores the calculated first score in the storage unit 16. Similarly, the second score calculation unit 122 reads out a combination of the data of the parameters set as the monitoring target and the data of the parameters set as indicating the operating state from the collected operation data, classifies the data of the parameters to be monitored for each operating state indicated by the value of the parameter indicating the operating state, and calculates the probability (second score) that the value is observed in the same classification for each classified data. The second score calculation unit 122 writes and stores the calculated second score in the storage unit 16. The third score calculation unit 123 reads a combination of data on the monitored parameter and data on parameters with strong correlations from the collected operation data, calculates the probability (third score) that the value of the monitored parameter is observed on the condition that the value of the strongly correlated parameter is observed, and writes and stores the third score in the storage unit 16. The fourth score calculation unit 124 calculates, for each value of the monitored parameter, the probability (fourth score) that the value of the monitored parameter is observed on the condition that a combination of the values of all other parameters measured at the same time is observed, and writes and stores the fourth score in the storage unit 16.

Next, the learning unit 14 creates judgment models 1 to 4 (step S14). For example, the learning unit 14 creates judgment model 1 based on the first score calculated in step S13. For example, the learning unit 14 may use the average value of the first score as judgment model 1, or may create judgment model 1 in which the range between the minimum and maximum values of the first score is considered normal, or may use a cluster created by clustering the first score using the k-nearest neighbor method as judgment model 1. The learning unit 14 also creates judgment models 2, 3, and 4 for the second score, third score, and fourth score, respectively, which indicate normal ranges for each score. The learning unit 14 writes and saves the created judgment models 1 to 4 in the memory unit 16.

Alternatively, the learning unit 14 may calculate a threshold value for discriminating between normality and abnormality. For example, the data acquisition unit 11 acquires operation data measured when the device 20 is operating in a normal state and operation data measured when an abnormality occurs, and stores the data in the storage unit 16. Next, the score calculation unit 12 calculates the first to fourth scores for the measured values of the parameters to be monitored included in the collected operation data, and stores the data in the storage unit 16. Next, the learning unit 14 assigns label information to each of the calculated first to fourth scores, indicating whether the score is the first to fourth score calculated based on the parameters measured when the device 20 is normal, or the first to fourth score calculated based on the parameters measured when the device 20 is abnormal. Next, the learning unit 14 uses the first score to which the label information is added as learning data, and creates a judgment model 1 for determining the presence or absence of an abnormality based on the value of the first score by a predetermined method. For example, the learning unit 14 creates the judgment model 1 by using an SVM (Support Vector Machine), a decision tree, or the like. The learning unit 14 creates judgment models 2 to 4 using a similar method.

In this manner, in this embodiment, the operational data is converted into a probability density or a conditional probability to create judgment models 1 to 4. This allows anomaly detection to be performed based on the first to fourth scores. Furthermore, as described below, anomaly detection can be performed using ensemble learning. For ensemble learning, the learning unit 14 may create a judgment model different from judgment models 1 to 4, for example, by using parameter values as learning data instead of the first to fourth scores.

Next, an example of the operation of the monitoring phase will be described with reference to FIG.
FIG. 6 is a flowchart illustrating an example of an abnormality detection process according to the embodiment.
It is assumed that the created judgment models 1 to 4 and the thresholds for anomaly judgment are registered in advance in the storage unit 16. For example, it is assumed that the threshold 1 for judging the first score of the parameter α of the monitoring target, the threshold 2 for judging the second score, the threshold 3 for judging the third score, and the threshold 4 for judging the fourth score are registered in the storage unit 16.

First, the data acquisition unit 11 acquires the latest operation data from the device 20 (step S21). The data acquisition unit 11 outputs the latest operation data to the score calculation unit 12. Next, the score calculation unit 12 (first score calculation unit 121 to fourth score calculation unit 124) calculates the first score to the fourth score for the latest operation data (step S22). Since the operation data collected in the learning phase is accumulated in the memory unit 16, for example, the score calculation unit 12 calculates the first score to the fourth score using the accumulated operation data and the latest operation data. The score calculation unit 12 outputs the first score to the fourth score to the anomaly detection unit 15. Next, the anomaly detection unit 15 judges an anomaly based on the judgment models 1 to 4 (step S23). First, the anomaly detection unit 15 judges whether the first score is abnormal or not based on the first score and the judgment model 1. For example, when the judgment model 1 is created as an average value of the first scores under normal conditions, the anomaly detection unit 15 may determine that the latest first score is abnormal if the difference between the first score based on the latest operation data and the average value of the first scores (judgment model 1) exceeds threshold 1. For example, when the judgment model 1 is created using the maximum and minimum values of the first scores under normal conditions, the anomaly detection unit 15 may determine that the latest first score is abnormal if the first score based on the latest operation data deviates from the range indicated by the maximum and minimum values by threshold 1 or more. For example, when the judgment model 1 is a cluster of first scores under normal conditions, the anomaly detection unit 15 may determine that the latest first score is abnormal if the distance between the first score based on the latest operation data and the center of gravity of the cluster is threshold 1 or more. The anomaly detection unit 15 may also determine whether the second score to the fourth score based on the latest operation data are abnormal in a similar manner.

Furthermore, in the learning phase, when judgment models 1 to 4 that distinguish between normality and abnormality have been created, the anomaly detection unit 15 inputs the value of the first score based on the latest operation data to judgment model 1. Judgment model 1 judges normality or abnormality and outputs the judgment result. If the judgment result output by judgment model 1 is abnormal, the anomaly detection unit 15 judges that the latest first score is abnormal. The anomaly detection unit 15 also judges whether the second score to the fourth score based on the latest operation data are abnormal or not in the same manner based on judgment models 2 to 4, respectively. In addition, when ensemble learning is performed, the anomaly detection unit 15 judges whether the latest operation data is abnormal or not using the judgment models created in the learning phase.

The anomaly detection unit 15 then analyzes the results of the judgment based on each score (step S24). Specifically, the anomaly detection unit 15 selects the maximum score value among the scores judged to be abnormal. For example, if the first score is "5", the second score is "10", the third score is "0.5", and the fourth score is "0.5", and the first score and the second score are judged to be abnormal, the anomaly detection unit 15 selects the second score as the score that most clearly indicates the abnormality occurring in the device 20.

Furthermore, when ensemble learning is performed and an abnormality is determined by the determination model created for ensemble learning, the anomaly detection unit 15 calculates the degree of anomaly indicated by the operation data using a predetermined method. The calculated degree of anomaly is a value comparable to the first score to the fourth score. The anomaly detection unit 15 selects the maximum value from among the first score to the fourth score and the degree of anomaly calculated for ensemble learning.
The anomaly detection unit 15 outputs information on the first score to the fourth score, the judgment results of each score, the judgment time, and the score showing the highest value to the output unit 18, and also writes and stores the information in the storage unit 16. This information is used by the report creation unit 17 when creating the report 100.

Next, the output unit 18 outputs the anomaly detection result to a display device or the like (step S25). For example, the output unit 18 acquires from the anomaly detection unit 15 the values of the first to fourth scores, the judgment results (whether or not there is an anomaly) and judgment times for each score, and information on the score indicating the maximum value selected by the anomaly detection unit 15, and displays these. The anomaly detection unit 15 may, for example, create and display a graph showing the transition of the values of the first to fourth scores from a predetermined period ago. For example, the user can check the occurrence of sudden changes, deterioration, deviations, and vibrations by focusing on the score indicating the maximum value selected by the anomaly detection unit 15, and detect an anomaly in the device 20. The output unit 18 displays the maximum value selected by the anomaly detection unit 15 from among the first to fourth scores. This makes it possible to convey to the user the best result from among the judgment results by multiple methods (the judgment results for each of the first to fourth scores), thereby improving the accuracy of anomaly detection. In addition, by displaying the first through fourth scores, the user can check multiple scores, which helps prevent false positives and allows the user to infer the cause and nature of the abnormality occurring in device 20 from the meaning of each score.

In the above embodiment, the process of detecting an anomaly by the anomaly detection unit 15 has been described as an example, but the state of the device 20 may be monitored based on the values of the first score to the fourth score, rather than simply detecting an anomaly. For example, the anomaly detection system 10 may further include a state determination unit that detects the operating state for each of the multiple scores based on the multiple scores (the first score to the fourth score, or the first score to the third score) and the determination model, and determines the state of the device 20 based on the results of the multiple operating states. Alternatively, the anomaly detection unit 15 may include the above-mentioned state determination unit. For example, an index indicating a state corresponding to one or more values or tendencies of the first score to the fourth score are defined in advance (for example, state A, state B, ..., or good, normal, not abnormal but has a tendency of XX, etc.), and the state determination unit performs a process of determining which of the indices indicating the predefined state is based on the first score to the fourth score. Furthermore, the state determination unit may determine the state of the device 20 based on the index indicating one or more determined states.
Furthermore, the output unit 18 may output an indicator indicating the state determined by the state determination unit or the state determined by the state determination unit in real time.

(effect)
As described above, according to this embodiment, anomaly detection is performed using not only one score but scores calculated from multiple viewpoints. As a result, the degree of anomaly can be evaluated after adjusting the index that defines the state of each device so that the index is in a certain condition, and thus erroneous detection can be prevented and the accuracy of anomaly detection can be improved. More specifically, unlike methods that evaluate the degree of anomaly based on the distribution of data, such as the MT method, k-nearest neighbor method, and LOF, which are general unsupervised anomaly detection methods, and methods that simply present the index that contributed to them, the data probability density can be estimated and the degree of anomaly can be evaluated comprehensively from the conditional probability under multiple conditions, thereby preventing erroneous detection and improving the accuracy of anomaly detection. In addition, the first score to the fourth score are values based on various probabilities that the parameters of the monitoring target are observed. The contents of the probability behind each score can be understood. In other words, according to this embodiment, the meaning of each score can be improved in terms of explainability to the user. By understanding the meaning of the score, it is possible to identify the abnormal part, deal with the abnormality, and improve the quality and accuracy of the monitoring work by the user. In addition, according to the report 100, the long-term trends of the first score to the fourth score can be confirmed. This enables mid- to long-term evaluation of the device 20, and the evaluation results can be utilized for preventive maintenance.
Furthermore, according to this embodiment, condition monitoring can be performed using not only one score, but scores calculated from multiple perspectives.

FIG. 7 is a diagram illustrating an example of a hardware configuration of the prediction system according to the embodiment.
The computer 900 includes a CPU 901 , a main memory device 902 , an auxiliary memory device 903 , an input/output interface 904 , and a communication interface 905 .
The above-described anomaly detection system 10 is implemented in a computer 900. Each of the above-described functions is stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads the program from the auxiliary storage device 903, loads it in the main storage device 902, and executes the above-described processing in accordance with the program. The CPU 901 also reserves a storage area in the main storage device 902 in accordance with the program. The CPU 901 also reserves a storage area in the auxiliary storage device 903 for storing data being processed in accordance with the program.

In addition, a program for realizing all or part of the functions of the anomaly detection system 10 may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed to perform processing by each functional unit. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. In addition, if a WWW system is used, the term "computer system" also includes a homepage providing environment (or display environment). In addition, the term "computer-readable recording medium" refers to portable media such as CDs, DVDs, and USBs, and storage devices such as hard disks built into a computer system. In addition, if the program is distributed to a computer 900 via a communication line, the computer 900 that receives the program may load the program into the main storage device 902 and execute the above processing. In addition, the program may be for realizing part of the above-mentioned functions, and may further be capable of realizing the above-mentioned functions in combination with a program already recorded in the computer system.
The anomaly detection system 10 may be composed of multiple computers 900.

As described above, several embodiments of the present disclosure have been described, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. For example, it is possible to calculate three scores, the first score, the second score, the third score, and detect an abnormality based on the largest score among these scores without adopting the fourth score. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents as described in the claims, as well as in the scope and gist of the invention.

<Additional Notes>
The anomaly detection system 10, the anomaly detection method, and the program described in each embodiment can be understood, for example, as follows.

(1) An anomaly detection system 10 relating to a first aspect includes a data acquisition unit 11 that acquires operation data of a monitored device, a score calculation unit 12 that calculates, using different methods, multiple types of probabilities that a value of a first parameter, which is a measurement value of the monitored device included in the operation data, will be observed, and calculates a score indicating the degree of anomaly for each of the multiple types of probabilities, and an anomaly detection unit 15 that determines whether or not each of the multiple scores is abnormal based on the multiple scores and a judgment model, and detects an anomaly of the device based on the multiple judgment results.
By detecting anomalies based on multiple scores, it is possible to prevent false positives and improve detection accuracy. Since the multiple scores are values based on multiple types of probabilities that the parameters to be monitored will be observed, the user can understand the meaning of each score by grasping the calculation contents of the multiple types of probabilities. In other words, it is possible to improve the explainability of the scores.

(2) A second aspect of the anomaly detection system 10 is the anomaly detection system 10 of (1), wherein the probability associated with one of the multiple scores is the probability that the value of the first parameter included in the operation data is observed in an operating state indicated by a second parameter, which is a measurement value related to the operating state of the apparatus included in the operation data.
This allows the probability of observing the value of the first parameter in the current operating state to be calculated, and for example, when a value with a low probability is observed, it can be determined that an abnormal value has been observed in the current operating state. In addition, by monitoring the second score based on the probability, it is possible to determine whether the behavior indicated by the parameter is "deterioration."

(3) The anomaly detection system 10 according to a third aspect is the anomaly detection system 10 of (1) to (2), wherein the probability associated with one of the multiple scores is the probability that, for a third parameter, which is a predetermined measurement value having a strong relationship with the first parameter, the value of the first parameter included in the operating data is observed when the value of the third parameter included in the operating data is observed.
This allows the probability that the value of the first parameter is observed relative to the value of another parameter with a strong relationship to be calculated, and for example, when a value with a low probability is observed, it can be determined that an abnormal value has been observed in the first parameter or the parameter with a strong relationship. In addition, by monitoring the third score based on the probability, it is possible to determine "deviation" from the behavior exhibited by the parameter.

(4) The anomaly detection system 10 according to a fourth aspect is the anomaly detection system 10 of (1) to (3), wherein the probability associated with one of the multiple scores is the probability that, for a fourth parameter which is a multiple other measurement value excluding the first parameter, the value of the first parameter included in the operating data is observed when the value of the fourth parameter included in the operating data is observed.
This allows the probability of observing the value of the first parameter relative to the values of the other parameters to be calculated, and for example, when a value with a low probability is observed, it can be determined that an abnormal value has been observed in the first parameter or the other parameters. In addition, by monitoring the fourth score based on the probability, it is possible to determine "oscillation" among the behaviors exhibited by the parameters.

(5) The anomaly detection system 10 according to a fifth aspect is an anomaly detection system 10 according to any one of (1) to (4), wherein the probability associated with one of the multiple scores is a probability density that the value of the first parameter included in the operational data is observed.
This allows the probability that the current value of the first parameter will be observed among the possible values of the first parameter to be calculated, and for example, when a value with a low probability is observed, it can be determined that an abnormal value has been observed for the first parameter. Also, by monitoring the first score based on the probability, it is possible to determine a "sudden change" in the behavior indicated by the parameter.

(6) The anomaly detection system 10 according to a sixth aspect is the anomaly detection system 10 of (1) to (5), wherein the anomaly detection unit 15 detects an anomaly based on the largest score among the multiple scores.
This allows the user to be notified of a score that most clearly indicates an abnormality, which can be useful in determining whether or not an abnormality exists.

(7) The anomaly detection system 10 according to the seventh aspect is the anomaly detection system 10 according to any one of (1) to (6), further comprising an output unit 18 that outputs an anomaly detected by the anomaly detection unit 15.

(8) The anomaly detection system 10 according to the eighth aspect is the anomaly detection system 10 of (1) to (7), further including a judgment model creation unit (learning unit 14) that creates the judgment models 1 to 4 indicating the range in which the scores are normal for each of the multiple types of scores calculated by the score calculation unit 12 based on the operational data when the device 20 is in a normal operating state.
This allows an evaluation of whether the score calculated by the score calculation unit is abnormal or not.

(9) The anomaly detection system 10 according to an eighth aspect is the anomaly detection system 10 of (1) to (8), further comprising a report creation unit 17 that creates a report including a graph showing the progress of multiple types of the scores.
By checking the transition of the score, it is possible to evaluate the change over time in the abnormality of the device 20. By setting the range of the transition shown in the graph to, for example, one year or more, it is possible to perform a medium- to long-term evaluation of the device 20.

(10) In a prediction method according to the tenth aspect, an anomaly detection system acquires operation data of a device to be monitored, calculates multiple types of probabilities of observing a value of a first parameter, which is a measurement value of the monitored device included in the operation data, using different methods, calculates a score indicating the degree of anomaly for each of the multiple types of probabilities, determines whether each of the multiple scores is abnormal or not based on the multiple scores and a determination model, and detects an anomaly in the device based on the results of the multiple determinations.

(11) A program according to an eleventh aspect causes a computer to execute a process of acquiring operation data of a device to be monitored, calculating multiple types of probabilities of observing a value of a first parameter, which is a measurement value of the monitored device included in the operation data, using different methods, calculating a score indicating the degree of abnormality for each of the multiple types of probabilities, determining whether or not each of the multiple scores is abnormal based on the multiple scores and a determination model, and detecting an abnormality in the device based on the results of the multiple determinations.

10: Anomaly detection system 11: Data acquisition unit 12: Score calculation unit 13: Setting reception unit 14: Learning unit 15: Anomaly detection unit 16: Memory unit 17: Report creation unit 18: Output unit 20: Apparatus 900: Computer 901: CPU
902: Main memory device 903: Auxiliary memory device 904: Input/output interface 905: Communication interface

Claims (10)

a data acquisition unit that acquires operation data of a device to be monitored;
a score calculation unit that calculates a plurality of types of probabilities of observing a value of a first parameter, which is a measurement value of a monitoring target included in the operation data, using different methods, and calculates a score indicating a degree of anomaly for each of the plurality of types of probabilities;
an anomaly detection unit that determines whether or not each of the plurality of scores is abnormal based on the plurality of scores and a determination model, and detects an anomaly of the device based on the plurality of determination results;
Equipped with
the probability associated with one of the plurality of scores is a probability that a value of the first parameter included in the operational data is observed in an operational state indicated by a second parameter, the second parameter being a measurement value related to an operational state of the apparatus included in the operational data;
Anomaly detection system. the probability associated with one of the plurality of scores is a probability that a value of the first parameter included in the operational data is observed when a value of the third parameter included in the operational data is observed, the third parameter being a predetermined measurement value having a strong relationship with the first parameter;
The anomaly detection system according to claim 1 . the probability associated with one of the plurality of scores is a probability that a value of the first parameter included in the operational data is observed when a value of a fourth parameter included in the operational data is observed, the fourth parameter being a plurality of other measured values excluding the first parameter;
The anomaly detection system according to claim 1 or 2 . the probability associated with one of the plurality of scores is a probability density that a value of the first parameter included in the operational data is observed;
The anomaly detection system according to any one of claims 1 to 3 . The anomaly detection unit detects an anomaly based on a largest score among the plurality of scores.
The anomaly detection system according to any one of claims 1 to 4 . an output unit that outputs the abnormality detected by the abnormality detection unit;
The anomaly detection system according to claim 1 , further comprising: a judgment model creation unit that creates the judgment model indicating a normal range for each of the multiple types of scores calculated by the score calculation unit based on the operation data when the device is in a normal operating state;
The anomaly detection system according to claim 1 , further comprising: The anomaly detection system according to claim 1 , further comprising a report creation unit that creates a report including a graph showing changes in the scores over time. The anomaly detection system
Acquire operation data of the monitored equipment,
calculating a plurality of types of probabilities that a first parameter value, which is a measurement value of a monitoring target included in the operation data, will be observed using different methods, and calculating a score indicating a degree of anomaly for each of the plurality of types of probabilities;
determining whether or not each of the plurality of scores is abnormal based on the plurality of scores and a judgment model, and detecting an abnormality of the device based on the plurality of judgment results ;
the probability associated with one of the plurality of scores is a probability that a value of the first parameter included in the operational data is observed in an operational state indicated by a second parameter, the second parameter being a measurement value related to an operational state of the apparatus included in the operational data;
Anomaly detection methods. On the computer,
Acquire operation data of the monitored equipment,
calculating a plurality of types of probabilities that a first parameter value, which is a measurement value of a monitoring target included in the operation data, will be observed using different methods, and calculating a score indicating a degree of anomaly for each of the plurality of types of probabilities;
determining whether or not each of the plurality of scores is abnormal based on the plurality of scores and a judgment model, and detecting an abnormality of the device based on the plurality of judgment results ;
a process in which the probability associated with one of the plurality of scores is a probability that a value of the first parameter included in the operational data is observed in an operational state indicated by a second parameter, the second parameter being a measurement value related to an operational state of the apparatus included in the operational data ;
A program that executes the following.

Images