Anomaly detection apparatus, anomaly detection method, and anomaly detection program

Patent metadata

Field	Value
Publication number	US-11829226-B2
Application number	US-202217681968-A
Country	US
Kind code	B2
Filing date	Feb 28, 2022
Priority date	Apr 20, 2021
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

To improve promptness of anomaly detection after occurrence of an event, provided is an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program. The processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, and a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event.

First claim

What is claimed is:

1. An anomaly detection apparatus comprising: a processor that executes a program; and a storage device that stores the program, wherein the processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event, and a linear transformation based on at least one of a change rate of the second measured data to apply the scale transformation, the scale transformation, and a shift transformation to correct the second predicted data in the correction process.

2. The anomaly detection apparatus according to claim 1 , wherein the processor uses,
in a case where the scale transformation is selected, a change rate of the second measured data to apply the scale transformation to correct the second predicted data; and
in a case where the shift transformation is selected, a difference of a change in the second measured data to apply the shift transformation to correct the second predicted data in the correction process.

3. The anomaly detection apparatus according to claim 2 , wherein the processor calculates
a scale error between the second measured data and the second predicted data that is enlarged and reduced by the change rate, and
a shift error between the second measured data and the second predicted data that is shifted by the difference of the change, to select the linear transformation of either the scale transformation or the shift transformation based on the scale error and the shift error in the correction process.

4. The anomaly detection apparatus according to claim 3 , wherein the processor selects the linear transformation with a smaller error between the scale error and the shift error in the correction process.

5. The anomaly detection apparatus according to claim 1 , wherein the processor
executes, for each change rate of measured values at observation time of the first measured data, a decision process of deciding that specific observation time larger than a change rate threshold is an occurrence time candidate of the specific event, and
applies, in the correction process, the scale transformation to correct the second predicted data including data after any one occurrence time candidate among occurrence time candidates of the specific event decided in the decision process.

6. The anomaly detection apparatus according to claim 5 , wherein the processor decides in the decision process that the specific observation time is the occurrence time candidate of the specific event, in a case where an error between the first predicted data and the first measured data is larger than an error threshold.

7. The anomaly detection apparatus according to claim 5 , wherein the processor
counts, in the decision process, the number of appearances of the change rate of the measured values at the specific observation time, the number of appearances corresponding to a predetermined period, and
decides that the specific observation time corresponding to the change rate of the measured values with the number of appearances smaller than a number-of-appearances threshold is the occurrence time candidate of the specific event.

8. An anomaly detection method executed by an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program, the method comprising: executing, by the processor, a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, a detection process of detecting an anomaly of the monitoring target based on the predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event and a linear transformation based on at least one of a change rate of the second measured data to apply the scale transformation, the scale transformation, and a shift transformation to correct the second predicted data in the correction process.

9. A method for detecting anomalies comprising: executing, with a processor a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, a detection process of detecting an anomaly of the monitoring target based on the predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event, and a linear transformation based on at least one of a change rate of the second measured data to apply the scale transformation, the scale transformation, and a shift transformation to correct the second predicted data in the correction process.

Assignees

• Hitachi Ltd

Inventors

• Jaiswal Satish Kumar
• Masuda Mineyoshi

Classifications

• G06F11/0751 Primary

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0721

  within a central processing unit [CPU] · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title