JP2018169994A - Information processing apparatus, information processing method, and computer program - Google Patents

Abstract

To build a model capable of detecting an outlier with high accuracy even if the distribution of a learning data group is biased by limited data sampling. An information processing apparatus according to an embodiment of the present invention includes a data processing unit and a learning unit. The data processing unit discretizes an N-dimensional data group representing the states of a plurality of target devices with a plurality of patterns. The learning unit combines a plurality of discretized data groups obtained by discretizing the data group with the plurality of patterns, and a plurality of candidate values for a parameter K of LOF (Local outer factor), respectively, to generate a plurality of temporary data. By generating a model and evaluating the plurality of temporary models based on the data group, a model is selected from the plurality of temporary models. [Selection] Figure 3

Description

  Embodiments described herein relate generally to an information processing apparatus, an information processing method, and a computer program.

In recent years, technology for computing resources such as a CPU (Central Processing Unit) and a memory has been developed, and a big data-related infrastructure has been developed. In addition, technologies such as data collection infrastructure programs and real-time processing infrastructure programs have been established, and these can be used by anyone as open source software.
In response to these, anomaly detection technologies such as failure sign detection and security intrusion detection will be strongly required in the future.

  One of the abnormality detection techniques is outlier detection by machine learning. There are two methods for detecting outliers, one using statistics and the other not using it. In a method using statistics, a method is generally known in which a deviation from an average is recognized as an outlier when the standard deviation is a certain distance or more. However, to use this method, it is necessary to assume that the distribution of the target data is unimodal. In many scenes that use outlier detection, such as failure prediction and network intrusion detection, the data is often multivariate and the generation mechanism is complex, and it is difficult to always assume unimodality.

  On the other hand, in a method that does not use statistics, there is an outlier detection method based on the distance between data. This method is called distance-based outlier detection. Distance-based outlier detection can also be applied to data that cannot assume unimodality. The K-neighbor method is known as the most famous distance-based outlier detection algorithm. However, the K-neighbor method has a drawback that the detection standard cannot be set appropriately when there is a difference in data distribution (a difference in data density in the acquired data).

  LOF (Local Outer Factor) is an effective distance-based outlier detection algorithm even when there is a difference in data distribution in the space. LOF is one of unsupervised learning algorithms, and normally only normal data is used as learning data. However, since LOF is machine learning, there is an overlearning problem that is one of the problems of the machine learning method.

  As a countermeasure technique for over-learning, there is a method of regularization. However, regularization is applicable only to machine learning of the type that learns the relationship between input data sets and output values as “functions”, such as regression and classification. Since LOF is not a type of machine learning that generates a function by learning, regularization cannot be applied to LOF.

https://en.wikipedia.org/wiki/K-nearest_neighbors_algorithm (k-nearest neighbors algorithm) http://www.dbs.ifi.lmu.de/Publikationen/Papers/LOF.pdf (LOF: Identifying Density-Based Local Outliers) http://www.keihirose.com/material/392-399_hirose.pdf (sparse modeling and model selection)

  The present invention relates to an information processing apparatus, an information processing method, and an information processing apparatus capable of constructing a model capable of detecting an outlier with high accuracy even when the distribution of a learning data group is biased by limited data sampling Provide a computer program.

  An information processing apparatus according to an embodiment of the present invention includes a data processing unit and a learning unit. The data processing unit discretizes an N-dimensional data group representing the states of a plurality of target devices with a plurality of patterns. The learning unit combines a plurality of discretized data groups obtained by discretizing the data group with the plurality of patterns, and a plurality of candidate values for a parameter K of LOF (Local outer factor), respectively, to generate a plurality of temporary data. By generating a model and evaluating the plurality of temporary models based on the data group, a model is selected from the plurality of temporary models.

Explanatory drawing of LOF. Explanatory drawing of LOF. 1 is a block diagram of an information processing system according to an embodiment of the present invention. The operation | movement sequence diagram of the system of FIG. The figure which shows the example of data collected from each monitoring object apparatus. The figure which shows the example which normalized the data of FIG. The figure which shows the example which discretized the data of FIG. 6 by each of several discretization patterns. Explanatory drawing of a discretization process. The figure which shows the example of the standard deviation of the score calculated for every temporary model. The figure which shows the identification rate calculated for every temporary model. The block diagram of a monitoring apparatus. The block diagram of the hardware structural example of the information processing apparatus which concerns on this embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  In this embodiment, in machine learning using LOF (Local Outer Factor), a model (LOF model) that can detect an outlier with high accuracy based on the actual number of learning data (number of samples), that is, erroneous detection. One of the features is learning an extremely small number of models.

  Hereinafter, the outline of LOF (Local Outer Factor) and the background to which the present inventor has made the present invention will be described.

FIG. 1 shows a diagram in which a large number of data are plotted in a multidimensional space. Black dots (dots) represent the plotted data. Here, for explanation, two dimensions are assumed, but three or more dimensions may be used. A data group C ₁ and a data group C ₂ exist, and further, data O ₂ and data O ₁ exist at positions away from these data groups. The density of the data group C ₂ is higher than the density of the data group C ₁ , and it can be said that the density of data is biased when viewed from the overall data distribution. The data group C ₁ and the data group C ₂ are both normal data, and the data O ₁ and the data O ₂ are both outliers. From the human eye, it is easy to see that both the data O ₁ and the data O ₂ are outliers, but this cannot be simply realized when trying to recognize this automatically.

Consider performing distance-based outlier detection (for example, the K-neighbor method) for the data group in FIG. In this case, setting a reference (threshold value) as data O ₂ is outliers when viewed from the data population C _2, each data belonging to the data group C ₁ density is lower than the data group C _2, the All of them are considered outliers in light of the standards. On the contrary, if a reference is set such that the data O ₁ is an outlier as viewed from the data group C ₁ , the data O ₂ is determined to be close to the data group C ₂ and is regarded as normal data. End up.

  In this way, if the distribution (density) of normal data in the space is disparate because the mechanism by which data is generated is essentially different, the detection criteria cannot be properly set by the K-neighbor method, etc. The value may not be detected correctly. Even in such a case, LOF is an algorithm that allows outliers to be detected correctly.

  FIG. 2 is a diagram for explaining the LOF algorithm. Data group C, which is normal data, and data P are plotted in a multidimensional space (in this example, a two-dimensional space). Based on this figure, the “K distance”, which is a basic concept in LOF, will be described.

  Let's say that we focus on a certain point and count surrounding points in order from the point of interest. At this time, the distance to the Kth closest point (neighboring point) is called the K distance. K is LOF parameter information and determines the number of neighboring points with respect to the point of interest. It can be said that the parameter K is a threshold value (MinPts: a minimum number of points) for entering the sphere (circle) around the target point.

Focusing on the point P in FIG. 2 and assuming K = 3, d _{max in} the figure is the K distance for the point P. D _min is the distance from the point P to the nearest point. Considering an area of a sphere having a radius K and centering on the point P, there are three points. As an example, the density related to the point P (local reachable density) can be calculated by the reciprocal of the average of the distances from the point P to the above three points. In the figure, a sphere (two-dimensional sphere, that is, a circle) having a radius K and a center at the point P is drawn. If the point P is an outlier, the K distance will be long, so the volume of the sphere will be large and the density will be low.

Here, the K distance is similarly obtained for three points existing within the K distance range of the point P. In the figure, a sphere (circle) having a radius of K around each of these three points is drawn.
The density for each of these three points is also calculated. Similarly to the above, the density is calculated by calculating the reciprocal of the average of the distances to the three points within the K distance range for each of the three points. Since these three points are not outliers, it is assumed that the density for these three points will all be high. When d _max and d _min are calculated for each of these three points, i _max is the largest of these, and i _min is the smallest.

もし、点Ｐが３つの点と同じ集団に属していれば、点ＰのＫ距離圏の密度は、３つの点それぞれのＫ距離圏の密度と同程度となり、上記スコアは１または１に近い値となる。一方、点Ｐが外れ値であれば、点ＰのＫ距離圏の密度は、３つの点それぞれのＫ距離圏の密度に比べて小さくなるため、スコアは１より十分大きくなる。１より大きい閾値を設定し、スコアが閾値より大きければ、点Ｐは外れ値、スコアが閾値以下であれば、点Ｐは外れ値でない（正常データ）であると判断できる。この際に用いる閾値は、操作者が評価時に適宜設定すればよい。あるいは、閾値を、事前に定めておき、評価時にこの値を用いてもよい。 Here, the degree of deviation of the point P is evaluated by a score calculated by the following equation.

If the point P belongs to the same group as the three points, the density of the K distance sphere of the point P is almost the same as the density of the K distance sphere of each of the three points, and the score is close to 1 or 1. Value. On the other hand, if the point P is an outlier, the density of the K distance zone of the point P is smaller than the density of the K distance zone of each of the three points, so the score is sufficiently larger than 1. If a threshold value greater than 1 is set and the score is greater than the threshold value, it can be determined that the point P is an outlier, and if the score is less than or equal to the threshold value, the point P is not an outlier (normal data). The threshold used at this time may be appropriately set by the operator at the time of evaluation. Alternatively, a threshold value may be determined in advance, and this value may be used at the time of evaluation.

  According to the LOF described above, outliers can be detected with high accuracy even when there is an essential disparity in the distribution (density) of data in space. However, since LOF is machine learning, there is an overlearning problem. Over-learning in LOF means that data that should be normal appears to be an outlier when viewed from the currently obtained data distribution. This is because, in limited data sampling, if the data happens to be concentrated in a certain area, the advantage of LOF is adversely affected. Even if it is a normal area, the score is slightly distant from that area. This is due to the high price. Such an accidental disparity in data distribution can be eliminated by collecting sufficient data samples. However, in a multidimensional space, the volume increases explosively as the number of dimensions increases. Therefore, it is not easy to collect data so as not to be affected by data fluctuations in the entire space.

  Therefore, the present embodiment is intended to realize learning of a model capable of detecting an outlier with high accuracy based on a realistic number of data samples in machine learning using LOF (Local Outer Factor).

  FIG. 3 is a diagram illustrating an overall configuration of the information processing system according to the present embodiment. The information processing system in FIG. 3 includes an information processing device 10, a plurality of monitoring target devices (hereinafter, target devices) 20, and a monitoring device 30. The information processing device 10 is connected to a plurality of target devices 20 and monitoring devices 30 via a network 40. The network 40 may be a wired network, a wireless network, or a hybrid network of these. The network connecting the information processing apparatus 10 and the target apparatus 20 and the network connecting the information processing apparatus 10 and the monitoring apparatus 30 may be physically the same or different.

  The information processing apparatus 10 performs two operations, that is, a learning stage and a determination stage. In the learning stage, the information processing device 10 collects data from each of the plurality of target devices 20, and uses the collected data as learning data to construct a model for detecting outliers. In the determination stage, the information processing device 10 receives data from each target device 20, and determines whether the received data is an outlier based on the model. In the case of an outlier, the information processing apparatus 10 transmits data regarding the data determined to be an outlier and information related to the target device from which the data is generated to the monitoring apparatus 30. Hereinafter, the present system will be described in more detail.

  Each of the plurality of target devices 20 is a device to be monitored by the information processing device 10. The target device 20 is, for example, a computer device having a calculation function, a network device, equipment equipment such as a building or factory, and household electrical appliances. Examples of the computer device include a desktop personal computer (PC), a notebook PC, a mobile terminal (smart phone, tablet terminal, mobile phone, etc.) and the like. Examples of equipment include air conditioning equipment and lighting equipment. Examples of home appliances include air conditioning equipment, lighting equipment, and TV. Examples of network devices include routers, LAN (Local Area Network) switches, and access points. In addition to those listed here, various other devices such as wearable devices are conceivable. Each of the plurality of target devices 20 may correspond to each of a plurality of ports included in one LAN switch. In the following description, it is assumed that the plurality of target devices 20 are all the same type of device.

  Each of the plurality of target devices 20 includes a data measurement unit 21 and a data transmission unit 22.

  The data measurement unit 21 acquires a plurality of feature amounts (first feature amount to Nth feature amount) representing the state of the target device 20 by measuring the state of the target device 20. The data measurement unit 21 stores data including a plurality of acquired feature amounts (first feature amount to Nth feature amount) in a storage unit (not shown) such as a memory. The feature amount may be anything as long as it is a value based on the measurement value of the target device 20. As an example, the feature value may be a measurement value itself, or may be a statistical value of the measurement value (average, maximum value, minimum value, standard deviation, etc.), or a category when the target device 20 is classified based on the measurement value ( For example, it may be a value representing a category of high temperature, medium temperature, low temperature, etc. when temperature is measured. Alternatively, the feature amount may be a calculated value between different types of measurement values (for example, power obtained by multiplying current and voltage), or may be another value. In the following, the case where the feature value is a measurement value will be described as an example. However, the present invention can be implemented even when the feature value is a value other than the measurement value by replacing the measurement value with the feature value. is there.

  Here, as an example of values measured by the data measuring unit 21, in the case of a computer device, the CPU operating rate, communication characteristic values (communication amount (transmission amount, reception amount), communication error rate (transmission error rate, reception error) Rate), average throughput, etc.), and the amount of data read or written to the storage device. In the case of an air conditioner, there are operating conditions (on, off, etc.), temperature, humidity, and the like. In the case of lighting equipment, there are operating states (on, off, etc.), illuminance, and the like. The measurement may be performed using a sensor, or may be performed by acquiring a value calculated by a CPU (specifically, an application or OS (operating system) operating on the CPU). The acquisition of the value from the CPU may be performed by the data measuring unit 21 requesting the CPU to acquire the value and acquiring the value from the CPU, or the CPU may store the value in a predetermined storage area (register or memory). The calculated value may be periodically written and this value may be read. Measurements may be performed by methods other than those described here.

  The data transmission unit 22 transmits the data measured by the data measurement unit 21 to the information processing apparatus 10 via the network 40. The data is actually shaped into a packet or frame according to the communication protocol used and transmitted. As an example, the data is transmitted according to TCP / IP. When data measurement is performed at regular time intervals (for example, 1 minute interval, 10 minute interval, 30 minute interval, 1 hour interval, 1 day interval, etc.), the data transmission timing is adjusted to the data measurement timing. The information processing apparatus 10 may transmit a data transmission request to the target apparatus 20 and transmit data in response to the transmission request. The data to be transmitted may be data specified by a transmission request (for example, data at a predetermined time) or the latest data measured by the target device 20. Data may be transmitted by methods other than those described here. The data transmission unit 22 may receive the data to be transmitted directly from the data measurement unit 21 or may acquire the data to be transmitted by reading it from a storage unit (not shown).

  The information processing apparatus 10 includes a data reception unit 11, a control unit 12, a data processing unit 13, an outlier detection unit 14, an alert transmission unit 15, a learning unit 16, and a storage device 17. The storage device 17 includes a reception data storage unit D1, a setting data storage unit D2, and a result data storage unit D3.

  As described above, the information processing apparatus 10 largely performs the learning stage operation and the determination stage operation. In the learning stage, data is collected and accumulated from each target device 20, and a model (LOF model) is generated based on the accumulated data. In the determination stage, it is determined whether or not the data received from each target device 20 is an outlier based on the LOF model.

  Data collection from each target device 20 in the learning stage may be performed when each target device 20 is in a normal state, and the collected data may be assumed to be normal data. Alternatively, data may be collected from each target device without imposing such a premise. If it is common for the target device 20 to become abnormal only a few times a year, when data for one month is collected, it is normal that abnormal data is not included in the collected data. It is possible that abnormal data is included. This embodiment can deal with both cases where the collected data are all normal data and cases where the collected data includes some abnormal data.

  FIG. 4 shows an operation sequence of each of the learning stage and the determination stage.

[Learning stage]
The data receiving unit 11 receives data transmitted from each target device 20 (S11).

  The control unit 12 governs the overall operation of the information processing apparatus. The control unit 12 is connected to the data receiving unit 11 and collects data from each target device 20 using the data receiving unit 11 (S12). The control unit 12 is connected to the storage device 17 and stores the collected data in the received data storage unit D1 in the storage device 17 (S13). The reception data storage unit D1 is configured by a database as an example. Here, at the time of data collection, when it is possible to assume that each target device 20 is in a normal state (not in an abnormal state), the administrator of this system sends the administrator of each target device 20 to each target device 20. It may be confirmed in advance that is in a normal state.

  It is assumed that data transmitted from each target device 20 follows a predetermined format. N measurement values included in the data are arranged in an order according to the format.

  Further, the identifier of the target device 20 (target device ID) and the data identifier (data ID) may be associated with the data. In this case, the target device ID may be any value as long as each target device 20 can be distinguished. The target device ID may be an ID previously assigned to each target device by the information processing device, or may be a user ID of a user of the target device. The control unit 12 may specify the destination address of the received data packet, and may specify the target device ID from the correspondence table between the address and the target device ID held in advance. The data ID may be anything as long as it is a value that can distinguish between data collected from the same target device. It may be a value incremented by 1 each time data is transmitted, or may be a data generation time or a measurement time in the target device. The data ID may be assigned to the data when the control unit 12 acquires the data. For example, every time data is acquired, a value incremented by 1 may be assigned as a data ID. In addition, an element identifier that can identify each of the N measurement values may be included in the data.

  Here, it is assumed that a plurality of measurement values are transmitted at once, but a plurality of measurement values may be transmitted at different timings. In this case, the control part 12 should just arrange | position the measured value received separately, respectively, and should preserve | save the data containing the measured value after arranging in the received data storage part D1. Alternatively, every time an individual measurement value is received, the received measurement value may be stored in a corresponding item in the database. However, in that case, it is necessary to include an element identifier in the data or to include a division sequence ID in the data.

  FIG. 5 shows an example of data stored in the received data storage unit D1. Data collected from each target device 20 is stored in a database. In this example, s pieces of data are received from each target device (target devices 1 to h). Each entry (one horizontal row) in the database includes a target device ID, a data ID, and N measurement values.

Here, the r-th measurement value of the j-th data in the i-th target device is represented as “x _{i, j, r} ”. For example, the measurement value of the second of the first data in the first target device (type 2) _is a _{"x 1,1,2".} In the example of FIG. 5, this value is 0.7.

  The learning unit 16 performs a learning process for generating a model according to the present embodiment. The learning unit 16 determines whether a predetermined condition is satisfied, and starts the learning process when the predetermined condition is satisfied. The predetermined condition may be that a certain amount of data has been stored in the received data storage unit D1, or that a predetermined time may have been reached, or that the administrator of the information processing apparatus has received a user interface (keyboard). A learning instruction may be input using a mouse, a touch panel, or a voice input, and the learning instruction may be received. Conditions other than those described here may be used.

  In the learning process, the learning unit 16 reads a plurality of data (data sets) used for model learning from the received data storage unit D1 (S14). The read data is called learning data. The learning unit 16 specifies learning data in the reception data storage unit D1 by an arbitrary method. As an example, past data from the present to X days ago (30 days ago, etc.) is specified as learning data. As another method, the start time and end time of a period may be specified, and data included in these periods may be specified as learning data. In the following description, it is assumed that data 1 to s of target devices 1 to h are specified as learning data in the database shown in FIG.

  The learning unit 16 generates parameter information for data processing performed by the data processing unit 13 (S15). Data processing includes normalization and “discretization” newly defined and introduced in the present embodiment. This discretization is performed as an overlearning measure. For this reason, the parameter information for data processing includes parameter information for normalization and parameter information for discretization.

  Normalization performs scale adjustment and center-of-gravity movement for each type of measurement value for a learning data set. In the scale adjustment, each measurement value is adjusted to be a value from 0 to 1 by dividing each measurement value by the maximum value among the plurality of measurement values. The center of gravity shift is performed by subtracting these average values from a plurality of measured values after scale adjustment so that the average value becomes the origin (zero). The learning unit 16 acquires the maximum value and the average value calculated for each type of measurement value as parameter information for normalization. The learning unit 16 stores the parameter information for normalization in the setting data storage unit D2.

  Discretization is the processing of learning data in order to avoid excessive reaction to the distribution (density) of points representing learning data when the learning data set after normalization is plotted in an N-dimensional space. It is.

  The learning unit 16 generates a plurality of discretized patterns with different processing roughness (also referred to as scale roughness or precision roughness). A plurality of discretization patterns may be stored in advance in the storage device 17 or another storage device, and these may be read out as candidates by the learning unit 16. In the following description, the discrete pattern may be simply referred to as a pattern.

Three examples of discretization patterns are shown below. The parameter m is an arbitrary real number of 1 or more. [...] is a Gaussian symbol, which is rounded down. For example, [1.45] is 1.

x ′ _{i, j, r} is a value after normalization of the r-th measurement value in the j-th data of the i-th target device. σ _{x′i, r} is the standard deviation of the measurement value after normalization of the type r (the r-th measurement value after normalization). The standard deviation is an example of a value representing variation, and another value representing variation such as variance can be used. The learning unit 16 calculates the standard deviation σ _{x′i, r} of the normalized measurement value for each type of measurement value. The learning unit 16 determines a value of m (an arbitrary real number equal to or greater than 1). The value of m may be stored in advance in a memory or an application program and read out, or the administrator of the information processing apparatus may specify the value of m using a user interface. Alternatively, the learning unit 16 can randomly select from a predetermined range. The method for determining m may be arbitrary. As an example, the value of m is 10. m, m ² , and m ³ correspond to, for example, machining roughness (scale roughness or accuracy roughness).

In pattern 1, the measured value x ′ _{i, j, r} after normalization is divided by σ x ′ _{i, r} / m (a value obtained by dividing σ x ′ _{i , r} by m), and the decimal part is rounded down. Later, σ _{x′i, r} / m is added again. When r = 1 to N, σ _{x′i, 1} / m to σ _{x′i, N} / m correspond to the first value to the Nth value according to the present embodiment.
Pattern 2 _divides the normalized measurement value x ′ _{i, j, r} by σ x ′ _{i, r} / m ² (a value obtained by dividing σ _x′r by the square of m) and _rounds off the decimal part. After that, σ _{x′i, r} / m ² is integrated again. When r = 1 to N, σ _{x′i, 1} / m ^{2 to} σ _{x′i, N} / m ² correspond to the first value to the Nth value according to the present embodiment.
Pattern 3 _divides the normalized measurement value x ′ _{i, j, r} by σ x ′ _{i, r} / m ³ (value obtained by dividing σ _x′r by the cube of m), After rounding down, σ _{x′i, r} / m ³ is added again. When r = 1 to N, σ _{x′i, 1} / m ^{3 to} σ _{x′i, N} / m ³ correspond to the first value to the Nth value according to the present embodiment.

For example, if m is 10, pattern 1 is discretized with a scale width of 1/10 of the standard deviation, pattern 2 is discretized with a scale width of 1/100 of the standard deviation, and pattern 3 is standard deviation. It can be said that the pattern is discretized at a scale width of 1/1000 of the scale. Although three discretization patterns are shown here, the number may be four or more, or two or less.
The value of m is not limited to 10.

  In the example described above, rounding is performed to the first decimal place as the fraction processing, but rounding off or rounding up may be performed. In addition, fraction processing may be performed not on the first decimal place but on the second or lower order. In the present embodiment, normalization is performed before discretization, but a configuration in which normalization is omitted is also possible.

  The learning unit 16 may store a plurality of discretization patterns (discretization parameter information) in the setting data storage unit D2 or another storage unit.

  The learning unit 16 includes instruction information for requesting processing (normalization and discretization) of the learning data set together with parameter information for normalization and a plurality of discretization patterns (parameter information for discretization). 13 (S16).

  The data processing unit 13 performs normalization and discretization on the learning data set based on the parameter information for normalization provided from the learning unit 16 and the parameter information for discretization.

  That is, the data processing unit 13 normalizes the learning data set based on the parameter information for normalization (maximum value and average value for each type of measurement value). Specifically, as described above, by dividing the measured value by the maximum value for each type of measured value for each learning data, the measured value is set to a value within the range of 0 to 1. Adjust (scale adjustment). Then, the average value is subtracted from the measured value after the scale adjustment (center of gravity movement). An image of the learning data set after normalization is shown in FIG. In the present embodiment, the learning data is directly normalized, but a plurality of second feature amounts are calculated from a plurality of measurement values included in the learning data, and the second learning data includes a plurality of second feature amounts. And normalization may be performed on the second learning data. In this case, the subsequent processing is also performed on the second learning data. The second feature amount may be a measurement value itself, a statistical value, a category value, a calculated value between two or more measurement values, or other values, similar to the above-described feature amount. . Note that the value from which the second feature value is calculated may be a first feature value other than the measured value.

  The data processing unit 13 discretizes the normalized learning data set using each of a plurality of discretization patterns. Thereby, a discretized learning data set is obtained for each of the plurality of discretized patterns. The discretized learning data is called processed data. FIG. 7 shows an image of the machining data set obtained for each discretization pattern. 7A is a machining data set corresponding to the discretization pattern 1, FIG. 7B is a machining data set corresponding to the discretization pattern 2, and FIG. 7C is a machining data set corresponding to the discretization pattern 3. Represents.

  Further, when a plurality of the same processing data exists in the processing data set, only one processing data is left, and the rest is deleted, so that the plurality of processing data included in the processing data set is made unique. As a result, it can be prevented that the K distance of the attention point becomes 0 and the reciprocal diverges and the score cannot be calculated because there are K or more data in the same coordinates.

  A specific example of discretization will be shown with respect to certain three learning data (assuming learning data A, B, and C). In each learning data, it is assumed that the measurement values after normalization of the type r are 0.777, 0.776, and 0.778. The standard deviation of the type r is 0.598. In addition, m = 10.

学習データＡとＣに着目すると、離散化前の値の差分は、０．７７８−０．７７７＝０．００１である。一方、離散化後の値の差分は、０．７７７４−０．７１７６＝０．０５９８である。離散化前の間隔０．００１に比べて、離散化後では間隔が０．０５９８となり、大きく離散化されたことが分かる。つまり、種類ｒの測定値の間隔が、離散化により、大きく広げられている。このことから、離散化を行うことで、データ密度を低くできることが理解される。 At this time, when pattern 1 is used, the value after the discretization of 0.777 is [0.777 / (0.598 / 10)] × (0.598 / 10) = [12.9933] × ( 0.598 / 10) = 12 × (0.598 / 10) = 0.7176.
The value after discretization of 0.776 is [0.776 / (0.598 / 10)] × (0.598 / 10) = [12.9765] × (0.598 / 10) = 12 × ( 0.598 / 10) = 0.7176.
The value after discretization of 0.778 is [0.778 / (0.598 / 10)] × (0.598 / 10) = [13.0100] × (0.598 / 10) = 13 × ( 0.598 / 10) = 0.7774.
The measured values before discretization (measured values after normalization) and the measured values after discretization are summarized as follows.

Focusing on learning data A and C, the difference between the values before discretization is 0.778−0.777 = 0.001. On the other hand, the difference between the values after discretization is 0.7774-0.7176 = 0.0598. Compared to the interval 0.001 before discretization, the interval is 0.0598 after discretization, and it can be seen that the discretization is greatly increased. That is, the interval between the measurement values of type r is greatly expanded by discretization. From this, it is understood that data density can be lowered by discretization.

Using the same example, the value before discretization and the value after discretization when pattern 2 is applied are as follows. In this example, the change in value width due to discretization is smaller than that of pattern 1 between any learning data.

Using the same example, the value before discretization and the value after discretization when pattern 3 is applied are as follows. In this example, the change in the value width due to the discretization is smaller than that in the pattern 1 between any learning data.

  FIG. 8 conceptually shows the discretization according to the present embodiment. FIG. 8A is a plot of the normalized learning data set in a two-dimensional space. The horizontal direction corresponds to the measured value after discretization of type 1, and the vertical direction corresponds to the measured value after discretization of type 2. FIG. 8B is a plot of a processed data set obtained by discretizing the learning data set of FIG. 8A in a two-dimensional space. Before discretization, there is a bias in the learning data distribution (data density), but after discretization, the bias in the data distribution is alleviated. More specifically, the entire data distribution is approaching to be uniform as the density of the high density region is reduced. By performing the discretization according to the scale width described above, it is possible to suppress the density from being lowered in the originally low density region.

  In the subsequent processing, the learning unit 16 uses the plurality of discretization patterns described above to construct a model (LOF model) that can detect an outlier with high accuracy.

  For this purpose, the learning unit 16 acquires from the data processing unit 13 a processed data set discretized with each discretization pattern (S17). The learning unit 16 generates a plurality of temporary models using the LOF learning algorithm based on the processed data set corresponding to each discretization pattern and the range of candidate values of the LOF parameter K (S18). . An evaluation value of each temporary model is calculated by evaluating a plurality of temporary models using the normalized data set (S18). Based on the evaluation value, one of the plurality of temporary models is selected as an outlier detection model (LOF model) (S19).

  Hereinafter, a method for generating the LOF model will be described in detail.

  The learning unit uses a temporary model for all combinations of one of a plurality of discretization patterns and one of a plurality of candidate values (hereinafter referred to as K values) included in the range of candidate values for parameter K. Is generated. As many temporary models as the number of combinations are generated. For example, if the number of discretized patterns is 3 and the number of K values is 10, a temporary model of 3 × 10 = 30 is generated.

  The provisional model includes at least a machining data set discretized with a discretization pattern included in the combination and a K value included in the combination. The temporary model may be configured as a function that calculates a score (Equation 1) of the data based on the processed data set and the K value included in the temporary model when data to be determined is given. In this case, the provisional model includes a function (z = f (x)) that uses the data to be determined as an input variable x, calculates a score, and sets the output variable z, and a processed data set used for calculating the score. It is a model file that contains. The function includes program code for calculating a score (Equation 1) of the data by the LOF algorithm based on the machining data set and the K value. The function may include a program code for comparing the score with a threshold value and a program code for outputting a value indicating whether the result is a outlier as a comparison result.

  Here, the range of K candidate values may be set in advance in a storage unit such as a memory, and the learning unit 16 may read the range. Alternatively, a plurality of candidate value ranges may be set, the administrator may select one range via the user interface, and the learning unit 16 may read the selected range. Alternatively, the administrator may input a range of candidate values via the user interface. The range of candidate values may be expressed by a start position and an end position, or may be expressed by a start position and a width. For example, when the range of candidate values is 10 or more and 50 or less, “start position 10, end position 50” is specified in the former example, and “start position 10, width 40” is specified in the latter example.

  The learning unit 16 calculates an evaluation value of the temporary model based on the normalized data set. More specifically, the learning unit 16 calculates scores (see Equation 1) of a plurality of data included in the normalized data set based on the temporary model. This calculation is performed when the machining data set in the temporary model is expanded in space and the data (normalized data) is mapped to the space as the point of interest P (see FIG. 2). This corresponds to calculating the score of the data according to Equation 1. Each point within the K distance range with respect to the point of interest P is processed data. If the temporary model is configured as a function with data as input variables and score as an output variable, the score is calculated by inputting data into this function. The learning unit 16 calculates a value representing the variation in the scores of the plurality of data as the evaluation value of the temporary model.

σ_ｅはスコアの標準偏差、ｎは正規化データセットに含まれるデータ数、ｙはデータｉのスコア、μはｎ個のデータのスコアの平均である。 Here, a specific example of a value representing variation includes standard deviation, unbiased standard deviation, or variance. Here, a standard deviation is assumed. The formula for calculating the standard deviation is shown below.

σ _e is a standard deviation of scores, n is the number of data included in the normalized data set, y is a score of data i, and μ is an average of scores of n data.

  The learning unit 16 repeats the above processing for the number of combinations described above. That is, the learning unit 16 calculates an evaluation value (score standard deviation) for each of the provisional models having the number of combinations. Thereby, the standard deviation of the score is obtained for each of the plurality of provisional models.

  The learning unit 16 selects a temporary model having the smallest standard deviation among the plurality of temporary models. Alternatively, as another example, a temporary model having a standard deviation equal to or less than a threshold value may be selected. For example, evaluation values (score standard deviation) are calculated in order for a plurality of temporary models, and the subsequent processing is stopped when a standard deviation equal to or less than a threshold is calculated. As a result, the processing speed can be increased.

  In FIG. 9, a plurality of temporary models are generated based on combinations of three discretization patterns 1, 2, and 3 and 96 K values (5 to 100). An example of calculating the standard deviation is shown in tabular form. In this example, temporary models 1 to 288 are generated. As an example, the temporary model 1 is a temporary model generated based on a machining data set obtained by discretizing a normalized data set using the discretization pattern 1 and a K value = 5. The temporary model 97 is a temporary model generated based on a machining data set obtained by discretizing the normalized data set with the discretization pattern 2 and a K value = 5. The temporary model 193 is a temporary model generated based on a machining data set obtained by discretizing a normalized data set with the discretization pattern 3 and a K value = 5.

  The learning unit 16 selects a temporary model having the smallest standard deviation among the temporary models 1 to 288 as the LOF model (S19). In the example of FIG. 9, the minimum standard deviation of the temporary models 1 to 288 is the standard deviation 0.134 of the temporary model 8. Therefore, the learning unit 16 selects the temporary model 8 as the LOF model. The K value included in the LOF model is 12. The machining data set included in the LOF model is a machining data set obtained by discretizing the normalized data set with the discretization pattern 1.

  Here, the reason why the temporary model having the minimum standard deviation is the LOF model will be described. Although the processed data set may contain noise or some abnormal data, most of the data is normal. For this reason, the scores of the majority of data are close to 1.0, and therefore the standard deviation of the score distribution is expected to be small. Therefore, it can be said that it is effective to use the standard model of the score as an index and the temporary model that minimizes the standard model as the LOF model.

  When two or more minimum standard deviations exist, as an example, a provisional model having the smallest K value is set as a LOF model. This is because the smaller the K value, the higher the sensitivity. As another method, a temporary model including a machining data set discretized with a discretization pattern having the largest discretization width can be used as the LOF model. This is because, as the discretization width is larger, the number of significant digits of the value of the processed data can be shortened, so that the data capacity of the LOF model file becomes smaller.

  The learning unit 16 provides the LOF model to the outlier detection unit 14 (S20). Further, the learning unit 16 stores this LOF model in the setting data storage unit D2 (S21). Note that the learning unit 16 may store information (including the value of the parameter m) indicating the discretization pattern used for generating the LOF model in the setting data storage unit D2.

(Modification) Another method for constructing the LOF model may be as follows. A plurality of temporary models are generated in the same manner as described above. Among the temporary models, the temporary model with the highest identification rate (identification accuracy), that is, the lowest false detection rate is defined as the LOF model. The false detection rate or the identification rate is an example of the evaluation value of the temporary model. The false detection rate can be calculated as follows, for example. For each data included in the normalized data set, a score (see formula (1)) is calculated with a temporary model, and if the score is equal to or greater than a predetermined threshold (threshold greater than 1), an outlier (incorrect answer), If it is less than the threshold value, it is determined that it is not an outlier (correct answer). Then, the false detection rate is calculated by dividing the number of incorrect answers by the total number of correct answers and incorrect answers. This method assumes that each data is normal data. In general, the identification rate includes two meanings of a false detection rate and a detection rate. The false detection rate means how many normal data are determined to be abnormal. The detection rate means how many abnormal data are determined to be abnormal. When it is assumed that each data is normal data, since the detection rate cannot be confirmed, the identification rate is evaluated only by the false detection rate. Although the temporary model with the lowest false detection rate is LOF here, one of the temporary models with the false detection rate equal to or less than the threshold may be the LOF model.

  You may apply a cross-validation method with respect to the modification mentioned above. For example, first, the value of K is provisionally determined. Then, the machining data set is divided into W partial data sets. The false detection rate is calculated by using the second to Wth partial data sets as training examples and the partial normalized data set corresponding to the first partial data set as test examples. The same process is repeated until each of the W partial data sets is used as a test case once. The representative value of the W false detection rates obtained as a result is determined by a statistical method. As an example, there is a method of taking an average. This representative value is defined as the false detection rate at the temporarily determined K. A temporary model based on the provisionally determined K and the used machining data set is generated. This process is repeated for each discretization pattern while changing K, and a table of temporary models and false detection rates is created. From this table, the optimum temporary model is set as the LOF model. For example, the temporary model with the lowest false detection rate is adopted.

  FIG. 10 shows a table summarizing the temporary model (in the figure, the temporary model is represented by a set of a discretization pattern and a K value) and a false detection rate. In this example, the cross-validation method is used to obtain the false detection rate for each temporary model. The learning unit 16 selects a temporary model (a set of a discretized pattern and a K value) having the lowest false detection rate from among them. In the example of FIG. 10, the provisional model corresponding to the set of the discretization pattern 1 and the value of K (= 11) has the lowest false detection rate. For this reason, the temporary model corresponding to the set of the discretization pattern 1 and the value of K (= 11) is selected as the LOF model.

[Judgment stage]
The control unit 12 acquires data from each target device via the data reception unit 11 (S31, S32), and stores the acquired data in the reception data storage unit D1 (S33). Note that the database for storing data may be divided between the learning stage and the determination stage, or the same database may be used.

  Further, the control unit 12 reads parameter information (maximum value and average value for each type of measurement value) necessary for data normalization from the setting data storage unit D2 (S34). This parameter information is the same as that stored in the setting data storage unit D2 in the learning stage. Then, the control unit 12 outputs instruction information for requesting processing (here, only normalization) of data acquired from the target device to the data processing unit 13 together with the read parameter information (S35).

  The data processing unit 13 processes the data instructed by the control unit 12 according to the parameter information for normalization (here, only normalization), and returns the normalized data to the control unit 12 (S36).

  The control unit 12 outputs, to the outlier detection unit 14, instruction information for requesting to determine whether the data after the normalization received from the data processing unit 13 is an outlier (S37). .

  The outlier detection unit 14 determines whether the data instructed by the control unit 12 is an outlier (that is, whether the target device is abnormal) based on the LOF model. The outlier detection unit 14 returns the determination result to the control unit 12 (S38).

  As a specific operation example, the outlier detection unit 14 calculates a score from the data instructed by the control unit 12 and the LOF model. An operation example of the score calculation will be described. When further plotting the data to be judged on the N-dimensional space object on which the machining data set included in the LOF model is plotted, the point representing the data to be judged is the point of interest, and the Kth Up to a point close to (that is, K points within the K distance range). For the attention point, the distance to each of the K points is calculated, and the density for the attention point is calculated. For example, the density is calculated from the average reciprocal of the distance from the point of interest to K points. Similarly, for each of the specified K points, K points within the K distance range are specified, and the density is obtained.

  A score is calculated from the density obtained for the attention point and the density obtained for each of the specified K points. Then, the score is compared with a threshold, and if the score is equal to or greater than the threshold, it is determined that the data to be determined is an outlier (that is, the target device is in an abnormal state or may be in an abnormal state). To do. On the other hand, if the score is less than the threshold value, it is determined that the data to be determined is not an outlier (the target device is in a normal state). The threshold value used here (the threshold value for the determination stage) may be the same value as that used in the learning stage, or may be a value different from that used in the learning stage. In the latter case, an administrator may input a threshold value via a user interface, or a threshold value for a determination step may be stored in advance in a storage unit such as a memory and read out.

  In order to reduce the amount of calculation at the time of determination, for each data of the machining data set used for the LOF model, information specifying which K pieces of data within the K distance (referred to as neighborhood data information) It may be saved in a format such as. By using this neighborhood data information, when obtaining the K distance for each of the K points existing within the K distance range of the target point, the process of specifying the points (data) existing within the K distance range of each point can be performed at high speed. Can be done. In this case, the LOF model of this embodiment may include the neighborhood data information in addition to the value of K.

  The control unit 12 stores the determination result received from the outlier detection unit 14 and the data to be determined (data before normalization, but data after normalization may be used) in the result data storage unit D3. Store (S39). When the determination result received from the data processing unit 13 indicates that the data to be determined is an outlier, the control unit 12 outputs instruction information for requesting the alert transmission unit 15 to transmit an alert (S40). . The alert transmission unit 15 transmits an alert message to the monitoring device 30 according to the instruction information of the control unit 12 (S41). The configuration of the alert message may be arbitrary, but as an example, the data determined to be an outlier (the data before normalization may be data after normalization) and the target device that is the transmission source of the data Contains identification information.

  FIG. 11 shows a block diagram of the monitoring device 30. The communication unit 33 receives an alert message from the control unit 12 of the information processing apparatus 10. The control unit 31 displays the alert message on the display unit 35 and stores it in the storage unit 32. The operation unit 34 is an input interface operated by an administrator of the monitoring device 30. Upon confirming the alert message displayed on the display unit 35, the administrator transmits a message notifying that the outlier has been detected to the administrator terminal of the target device 20 or the target device 20 using the operation unit 34. You may perform operation to do.

  As described above, according to the present embodiment, in the machine learning by LOF, when the learning data set is processed so as to reduce the bias of the data distribution (so as to make the data distribution uniform), the number of learning data is small. However, it is possible to create a model with very few false detections. That is, even when an accidental data distribution bias exists in the learning data set, a highly accurate model can be created. In addition, the calculation speed can be improved by reducing the number of data.

  Also, in this embodiment, discretization is performed using standard deviation values and fraction processing. By using this method, data distribution bias is alleviated (the density of high-density regions is reduced). It has been confirmed by the present inventor that a highly accurate LOF model can be generated. However, the present embodiment is not limited to using the value of the standard deviation, and another value is used as long as processing that can widen the distance between points belonging to a high-density area according to the scale width is possible. It is also possible to do.

  A hardware configuration of the information processing apparatus according to the present embodiment will be described with reference to FIG. The information processing apparatus according to the present embodiment is configured by a computer 100. FIG. 12 is a diagram illustrating an example of the computer 100.

  A computer 100 in FIG. 12 includes a processor 101, an input device 102, a display device 103, a communication device 104, and a storage device 105. The processor 101, the input device 102, the display device 103, the communication device 104, and the storage device 105 are connected to each other via a bus 106.

  The processor 101 is an electronic circuit including a control device and a calculation device of the computer 100. Examples of the processor 101 include a general-purpose processor, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a state machine, an application-specific integrated circuit, a field programmable gate array (FPGA), and a program Possible logic circuits (PLDs) and combinations thereof can be used.

  The processor 101 performs arithmetic processing based on data or a program input from each device (for example, the input device 102, the communication device 104, and the storage device 105) connected via the bus 106, and outputs a calculation result and a control signal. And output to each device (for example, the display device 103, the communication device 104, and the storage device 105) connected via the bus 106. Specifically, the processor 101 executes an OS (operating system) of the computer 100, an information processing program for realizing the functions of the information processing apparatus in FIG.

  The information processing program is a program that causes the computer 100 to realize the above-described functional configurations of the information processing apparatus. The information processing program is stored in a computer-readable storage medium. The storage medium is, for example, an optical disk, a magneto-optical disk, a magnetic disk, a magnetic tape, a flash memory, or a semiconductor memory, but is not limited thereto. When the processor 101 executes the information processing program, the computer 100 functions as an information processing apparatus.

  The input device 102 is a device for inputting information to the computer 100. The input device 102 is, for example, a keyboard, a mouse, and a touch panel, but is not limited thereto. The user can make various settings by using the input device 102.

  The display device 103 is a device for displaying images and videos. The display device 103 is, for example, an LCD (liquid crystal display), a CRT (CRT), and a PDP (plasma display), but is not limited thereto. The display device 103 displays a GUI or CUI. The display device 103 may display various data stored in the storage device 105.

  The communication device 104 is a device for the computer 100 to communicate with an external device wirelessly or by wire. The communication device 104 is, for example, a modem, a hub, and a router, but is not limited thereto. The sensor data may be input from an external device via the communication device 104 and stored in the storage device 105.

  The storage device 105 is a hardware storage medium that stores the OS of the computer 100, an information processing program, data necessary for execution of the information processing program, data generated by execution of the information processing, and the like. The storage device 105 includes a main storage device and an external storage device. The main storage device is, for example, a RAM, a DRAM, an SRAM, or a NAND flash memory, but is not limited thereto. The external storage device is, for example, a hard disk, an optical disk, an SSD, and a magnetic tape, but is not limited thereto. The storage device 105 corresponds to the storage device 17 of FIG.

  Note that the computer 100 may include one or more processors 101, input devices 102, display devices 103, communication devices 104, and storage devices 105, and is connected to peripheral devices such as printers and scanners. Also good. The computer 100 may be configured not to include the display device 103 or the input device 102.

  3 may be configured by a single computer 100, or may be configured as a system including a plurality of computers 100 connected to each other.

  Further, the information processing program may be stored in advance in the storage device 105 of the computer 100, may be stored in a storage medium outside the computer 100, or may be uploaded on the Internet. In any case, the functions of the information processing apparatus are realized by installing and executing the information processing program in the computer 100.

  The term “processor” in the present embodiment may be a general-purpose processor or a central processing unit (CPU), or may be a circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA), or a combination thereof. . In the case of a general purpose processor or CPU, the function of the information processing apparatus according to the present embodiment can be realized by causing the general purpose processor or CPU to execute a program describing an instruction code.

  The term “storage device” may be a storage device capable of permanently storing data, such as a hard disk device or an SSD (Solid State Drive), or a memory. The memory may be a volatile memory such as a DRAM (Dynamic RAM (Random Access Memory)) or SRAM (Static RAM), or a non-volatile memory such as an MRAM (Magnetic Resistive RAM) or NAND (inverted AND) flash memory. Both of these may be used. These memories can be read and / or written by the processor.

  The present invention is not limited to the above-described embodiment, and various constituent elements of the present invention can be embodied. In addition, the present invention can be formed by appropriately expanding, changing, deleting, or combining each component in the above embodiment. It is also possible to add another component to form the present invention.

10: Information processing device 20: Monitoring target device (target device)
30: Monitoring device 40: Network 11: Data reception unit 12: Control unit 13: Data processing unit 14: Outlier detection unit 15: Alert transmission unit 16: Learning unit 17: Storage device 21: Data measurement unit 22: Data transmission unit 31: Control unit 32: Storage unit 33: Communication unit 34: Operation unit 35: Display unit

Claims (11)

A data processing unit for discretizing an N-dimensional data group representing the states of a plurality of target devices with a plurality of patterns;
Combining a plurality of discretized data groups obtained by discretizing the data groups with the plurality of patterns and a plurality of candidate values of LOF (Local outer factor) parameters K one by one to generate a plurality of temporary models; An information processing apparatus comprising: a learning unit that selects a model from the plurality of temporary models by evaluating the plurality of temporary models based on the data group. The information processing apparatus according to claim 1, wherein the learning unit calculates an evaluation value of each of the plurality of temporary models based on the data group, and selects the model from the plurality of temporary models based on the evaluation value. . The information processing apparatus according to claim 2, wherein the learning unit calculates a score of each data of the data group based on the temporary model, and calculates an evaluation value of the temporary model based on the score. The information processing apparatus according to claim 3, wherein the evaluation value is a value representing variation in the score. The information processing apparatus according to claim 4, wherein the value representing the variation is a standard deviation, an unbiased standard deviation, or a variance. The information processing apparatus according to claim 5, wherein the learning unit selects the temporary model having the smallest standard deviation, unbiased standard deviation, or variance as the model. The information processing apparatus according to claim 2, wherein the evaluation value of the temporary model is an identification rate of the data group based on the temporary model. The data processing unit divides each of N values included in the data by a first value to an Nth value, rounds the value after the division, and sets the first value to the value after the rounding process. The data group is discretized by multiplying each of the value to the Nth value, and the first value to the Nth value are predetermined values representing the variations of the N values in the data group. The information processing apparatus according to claim 1, wherein the information processing apparatus is a value divided by a value. A data receiving unit that receives data including a first measurement value to an Nth measurement value, which is a determination target from the target device;
An outlier detector that calculates a score of the received data based on the selected model and compares the score with a threshold to determine whether the data is an outlier;
The information processing apparatus according to any one of claims 1 to 8, further comprising: Discretizing N-dimensional data groups representing the states of a plurality of target devices with a plurality of patterns;
Combining a plurality of discretized data groups obtained by discretizing the data groups with the plurality of patterns and a plurality of candidate values of LOF (Local outer factor) parameters K one by one to generate a plurality of temporary models; Selecting a model from the plurality of temporary models by evaluating the plurality of temporary models based on the data group. Discretizing N-dimensional data groups representing the states of a plurality of target devices with a plurality of patterns;
Combining a plurality of discretized data groups obtained by discretizing the data groups with the plurality of patterns and a plurality of candidate values of LOF (Local outer factor) parameters K one by one to generate a plurality of temporary models; A computer program for causing a computer to execute a step of selecting a model from the plurality of temporary models by evaluating the plurality of temporary models based on the data group.

Images