Abnormality detection device, abnormality detection method and abnormality detection program

Patent metadata

Field	Value
Publication number	US-11496507-B2
Application number	US-201716491892-A
Country	US
Kind code	B2
Filing date	Mar 9, 2017
Priority date	Mar 9, 2017
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

An abnormality detection device 10 , which detects an abnormality of a data series to be detected that has regularity in a sequence of data forming the data series, is provided with: a determination unit 11 which refers to a data series of a normal model composed of a prescribed permutation as a data series that indicates a state in which a system to be detected is normal, and which, every time one piece of data is input, in light of a permutation indicated by a pair of the one piece of input data and another piece of data input immediately before the one piece of data is input, determines that the data series to be detected is locally abnormal when the permutation is not included in the normal model, and determines that the data series to be detected is locally normal when the permutation is included in the normal model.

First claim

The invention claimed is:

1. An abnormality detection device, which detects an abnormality of a data series to be detected that has regularity in a sequence of data forming the data series, the abnormality detection device comprising:
a processor; and
a memory storing executable instructions that, when executed by the processor, causes the processor to perform as:
a determination unit which refers to a data series of a normal model composed of a prescribed permutation as a data series that indicates a state in which a system to be detected is normal, and which, every time one piece of data is input, in light of a permutation indicated by a pair of one piece of input data and another piece of data input immediately before the one piece of data is input, determines that the data series to be detected is locally abnormal when the permutation is not included in the normal model, and determines that the data series to be detected is locally normal when the permutation is included in the normal model; and
a data candidate holding unit which holds at least one or more data candidates of the normal model, which are predicted to be subsequently input to the determination unit, when the determination unit determines that the data series to be detected is locally normal.

2. The abnormality detection device according to claim 1 , wherein the processor further performs as a determination counter holding unit that holds the number of normalities, which is the number of times that the determination unit sequentially determined that the input data is locally normal, wherein the determination unit determines that the system to be detected is in a normal state when the number of normalities held by the determination counter holding unit is equal to or greater than a first prescribed value.

3. The abnormality detection device according to claim 2 , wherein:
the determination counter holding unit holds the number of abnormalities, which is the number of times that the determination unit sequentially determined that the input data is locally abnormal; and
the determination unit determines that the system to be detected is in an abnormal state when the number of abnormalities held by the determination counter holding unit is equal to or greater than a second prescribed value.

4. The abnormality detection device according to claim 3 , wherein the first and second prescribed values are operating parameters of the abnormality detection device and are input parameters to the abnormality detection device.

5. The abnormality detection device according to claim 1 , wherein the processor further performs as:
a determination history holding unit that holds data of the normal model, which the determination unit referred to in order to determine that the input data is locally abnormal or locally normal, and the input data by a prescribed number of pieces of data as historical data;
an abnormal pattern recognition unit that extracts the data series to be detected including data determined to be locally abnormal by the determination unit and the data series of the normal model used for comparison with the data series to be detected from the determination history holding unit and that recognizes an abnormal pattern related to the sequence of the data series to be detected, when the system to be detected is determined to be in an abnormal state.

6. The abnormality detection device according to claim 5 , wherein the abnormal pattern recognition unit performs Levenshtein distance computation processing for the data series to be detected including the data determined to be locally abnormal and extracted from the determination history holding unit and the data series of the normal model used for the comparison with the data series to be detected and then recognizes the abnormal pattern related to the sequence of the data series to be detected according to a cost array and an operation history array that have been generated.

7. The abnormality detection device according to claim 1 , wherein:
a label or number for identifying the order of appearance in the normal model is given to individual pieces of data forming the data series of the normal model; and
individual pieces of data are formed as a multi-dimensional vector including data items represented by a plurality of actual values or discrete values.

8. The abnormality detection device according to claim 7 , wherein the data items include a timestamp for deciding the order of appearance in the normal model or time data corresponding to a difference between two timestamps.

9. The abnormality detection device according to claim 1 , wherein the prescribed sequence is a circular permutation.

10. An abnormality detection method, which is used to detect an abnormality of a data series to be detected that has regularity in a sequence of data forming the data series, the abnormality detection method comprising:
referring to a data series of a normal model composed of a prescribed permutation as a data series that indicates a state in which a system to be detected is normal, and every time one piece of data is input, in light of a permutation indicated by a pair of the one piece of input data and another piece of data input immediately before the one piece of data is input, determining that the data series to be detected is locally abnormal when the permutation is not included in the normal model, and determining that the data series to be detected is locally normal when the permutation is included in the normal model; and
holding at least one or more data candidates of the normal model, which are predicted to be subsequently input, when the data series to be detected is determined to be locally normal.

11. A non-transitory computer-readable recording medium having recorded therein an abnormality detection program, which is used to detect an abnormality of a data series to be detected that has regularity in a sequence of data forming the data series, the abnormality detection program being used for causing a computer to perform:
a determination process of referring to a data series of a normal model composed of a prescribed permutation as a data series that indicates a state in which a system to be detected is normal, and every time one piece of data is input, in light of a permutation indicated by a pair of the one piece of input data and another piece of data input immediately before the one piece of data is input, determining that the data series to be detected is locally abnormal when the permutation is not included in the normal model, and determining that the data series to be detected is locally normal when the permutation is included in the normal model; and
a holding process of holding at least one or more data candidates of the normal model, which are predicted to be subsequently input, when the data series to be detected is determined to be locally normal.

12. The abnormality detection device according to claim 2 , wherein the processor further performs as:
a determination history holding unit that holds data of the normal model, which the determination unit referred to in order to determine that the input data is locally abnormal or locally normal, and the input data by a prescribed number of pieces of data as historical data;
an abnormal pattern recognition unit that extracts the data series to be detected including data determined to be locally abnormal by the determination unit and the data series of the normal model used for comparison with the data series to be detected from the determination history holding unit and that recognizes an abnormal pattern related to the sequence of the data series to be detected, when the system to be detected is determined

Assignees

• Nec Corp

Inventors

• Yamada Yoshiyuki

Classifications

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F11/07

  Responding to the occurrence of a fault, e.g. fault tolerance · CPC title

• G06N5/04

  Inference or reasoning models · CPC title