Monitoring device, monitoring method and non-transitory storage medium

Patent metadata

Field	Value
Publication number	US-2019205234-A1
Application number	US-201816128795-A
Country	US
Kind code	A1
Filing date	Sep 12, 2018
Priority date	Jan 4, 2018
Publication date	Jul 4, 2019
Grant date	—

Abstract

According to one embodiment, a monitoring device includes a variable selector and an anomaly detector. The variable selector is configured to select context variables which indicate conditions when content variables were obtained based on values of the content variables and values of the context variables included in base data, and values of the content variables and values of the context variables included in target data. The anomaly detector is configured to detect anomalies in the target data using the context variables which were selected by the variable selector.

First claim

1 . A monitoring device comprising:
a variable selector configured to select context variables which indicate conditions when content variables were obtained based on values of the content variables and values of the context variables included in base data, and values of the content variables and values of the context variables included in target data; and an anomaly detector configured to detect anomalies in the target data using the context variables which were selected by the variable selector.

2 . The monitoring device according to claim 1 , wherein
the base data is data obtained when a system or a device being monitored is in normal state.

3 . The monitoring device according to claim 1 , wherein
the variable selector is configured to generate first data by concatenating the context variables in the base data and the context variables in the target data, configured to calculate importance of the context variables within the first data using classification and configured to select the context variables with values of the importance which are equal to or less than a first threshold value as the context variables which are used in the anomaly detection.

4 . The monitoring device according to claim 3 , wherein
the variable selector is configured to; generate second data by concatenating the content variables in the base data, the content variables in the target data, the context variables selected for use in anomaly detection in the base data and the context variables selected for use in anomaly detection in the target data; calculate importance of the content variables within the second data using classification; and select the content variables with values of importance which are equal to or greater than a second threshold value as the content variables which are used in the anomaly detection.

5 . The monitoring device according to claim 3 , wherein
the variable selector is configured to use an ensemble learning method to execute the classification.

6 . The monitoring device according to claim 5 , wherein
the variable selector is configured to use a random forest method in the ensemble learning method.

7 . The monitoring device according to claim 3 , wherein
the variable selector is configured to calculate the importance based on either permutation importance or Gini importance.

8 . The monitoring device according to claim 1 , wherein
the variable selector is configured to execute a statistical test for each context variable in the base data and the target data, and configured to select the context variables without a significant difference between the base data and the target data as the context variables used in the anomaly detection.

9 . The monitoring device according to claim 8 , wherein
the variable selector is configured to execute statistical tests including nonparametric statistical tests.

10 . The monitoring device according to claim 9 , wherein
the variable selector is configured to execute nonparametric statistical tests including Mann-Whitney U test.

11 . The monitoring device according to claim 1 , further comprising a collector configured to categorize variables included in the base data and the target data to the content variables and the context variables.

12 . The monitoring device according to claim 1 , wherein
the anomaly detector is configured to detect anomalies in the target data using the base data; wherein both the base data and the target data including the context variables and the content variables which were selected by the variable selector but not including the context variables and the content variables which were not selected by the variable selector.

13 . The monitoring device according to claim 1 , further comprising a display configured to display results of the anomaly detection by the anomaly detector.

14 . The monitoring device according to claim 13 , wherein
the display is configured to display at least the context variables which are not used in the anomaly detection or the content variables which are not used in the anomaly detection.

15 . A monitoring method comprising the steps of:
selecting context variables which indicate conditions when content variables were obtained based on values of the content variables and values of the context variables included in base data and target data; detecting anomalies in the target data using the base data, excluding the context variables which were not selected in anomaly detection; and displaying the context variables which were not selected.

16 . A non-transitory storage medium having a computer program stored therein which causes a computer to execute processes comprising:
selecting context variables which indicate conditions when content variables were obtained based on values of the content variables and values of the context variables included in base data and target data; detecting anomalies in the target data using the base data, excluding the context variables which were not selected in anomaly detection; and displaying the context variables which were not selected.

Assignees

• Toshiba Kk

Inventors

• Moriyama Takuro
• Ishii Gaku

Classifications

• G06F11/263 Primary

  Generation of test inputs, e.g. test vectors, patterns or sequences {; with adaptation of the tested hardware for testability with external testers} · CPC title

• G06N5/045 Primary

  Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence · CPC title

• G06F18/2148

  characterised by the process organisation or structure, e.g. boosting cascade · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06F18/2433

  Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection · CPC title