JP7710633B1 - Abnormality management device and abnormality management method - Google Patents

Abstract

An object of the present invention is to manage signal abnormalities even when there is a small amount of measurement data for the abnormal signal.
[Solution]
The abnormality management device 1 includes a first learning unit 11 configured to learn parameters of a probability model that outputs the posterior probability that the intensity of each frequency component is normal by maximum likelihood estimation using normal data indicating a frequency spectrum in which the intensity of each frequency component is normal among the frequency spectra of a plurality of signals as teacher data, and a derivation unit 12 configured to derive a probability distribution of abnormal data indicating a frequency spectrum including frequency components of abnormal intensity based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality.
[Selected Figure] Figure 1

Description

The present invention relates to an abnormality management device and an abnormality management method.

Techniques have been known for some time that analyze the characteristics of a time series signal in the frequency domain and detect anomalies contained in the signal. For example, Patent Document 1 discloses a technique for estimating anomalies in a signal measured by a sensor using a machine learning model constructed using the frequency spectra of both normal and abnormal signals as learning data.

However, with the technology disclosed in Patent Document 1, in order to construct a model with sufficient accuracy to detect anomalies, it is necessary to obtain a sufficient number of abnormal signals, and the abnormal signals must be accumulated over a long period of time. Furthermore, even when detecting signal abnormalities in the frequency spectrum using statistical methods, a large amount of measurement data on abnormal signals may be required.

JP 2020-027386 A

As such, with conventional technology, it can be difficult to manage signal abnormalities when there is little measurement data for abnormal signals.

The present invention has been made to solve the above-mentioned problems, and aims to manage signal abnormalities even when there is little measurement data of the abnormal signal.

In order to solve the above-mentioned problems, the abnormality management device according to the present invention includes a first learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the intensity of each frequency component is normal, using normal data indicating a frequency spectrum in which the intensity of each frequency component is normal among the frequency spectra of a plurality of signals as teacher data; a derivation unit configured to derive a probability distribution of abnormal data indicating a frequency spectrum containing a frequency component of abnormal intensity based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing unit configured to obtain a frequency spectrum of the abnormal data based on the derived probability distribution of the abnormal data; a second learning unit configured to learn a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the frequency spectrum of the abnormal data obtained by the data processing unit as true abnormal data; and a storage unit configured to store the pseudo-abnormal data generated using the learned generator constructed by the second learning unit.

The abnormality management device according to the present invention may further include a collection unit configured to collect a frequency spectrum of a signal to be managed, and a determination unit configured to determine that the signal to be managed is an abnormal signal when the collected frequency spectrum of the signal to be managed matches the pseudo-abnormal data stored in the storage unit.

The abnormality management device according to the present invention may further include a notification unit configured to notify an external party that an abnormality has occurred in the communication terminal that measured the abnormal signal when the determination unit determines that the signal is abnormal.

In addition, in the anomaly management device according to the present invention, the second learning unit may perform adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data.

In order to solve the above-mentioned problems, the anomaly management method according to the present invention includes a first learning step of learning parameters of a probability model that outputs a posterior probability that the intensity of each frequency component is normal by maximum likelihood estimation, using normal data, which indicates a frequency spectrum in which the intensity of each frequency component is normal, among the frequency spectra of a plurality of signals, as teacher data; a derivation step of deriving a probability distribution of abnormal data indicating a frequency spectrum containing a frequency component of abnormal intensity based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing step of determining a frequency spectrum of the abnormal data based on the derived probability distribution of the abnormal data; a second learning step of learning a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the frequency spectrum of the abnormal data determined in the data processing step as true abnormal data; and a storage step of storing the pseudo-abnormal data generated using the learned generator constructed in the second learning step in a storage unit.

The anomaly management method according to the present invention may further include a collection step of collecting a frequency spectrum of the signal to be managed, and a determination step of determining that the signal to be managed is an abnormal signal when the collected frequency spectrum of the signal to be managed matches the pseudo-abnormal data stored in the storage unit.

The abnormality management method according to the present invention may further include a notification step of notifying an external party that an abnormality has occurred in the communication terminal that measured the abnormal signal if the determination step determines that the signal is abnormal.

In addition, in the anomaly management method according to the present invention, the second learning step may involve adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data.

According to the present invention, normal data showing a frequency spectrum in which the intensity of each frequency component is normal is used as training data, and parameters of a probability model that outputs the posterior probability that the intensity of each frequency component is normal are learned by maximum likelihood estimation, and a probability distribution of abnormal data showing a frequency spectrum containing frequency components of abnormal intensity is derived based on the posterior probability estimated by the learned probability model, the probability distribution of normal data, and the probability of normality. Therefore, signal abnormalities can be managed even when there is little measurement data of the abnormal signal.

FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. FIG. 2 is a diagram for explaining abnormality data of signals managed by the abnormality management device according to the present embodiment. FIG. 3 is a diagram for explaining the second learning unit included in the abnormality management device according to the present embodiment. FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to the present embodiment. FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to the present embodiment. FIG. 6 is a block diagram showing a hardware configuration of the abnormality management device according to the present embodiment. FIG. 7 is a flowchart showing the operation of the abnormality management device according to the present embodiment. FIG. 8 is a flowchart showing the operation of the abnormality management device according to the present embodiment. FIG. 9 is a flowchart showing the operation of the abnormality management device according to the present embodiment.

A preferred embodiment of the present invention will be described in detail below with reference to Figures 1 to 9.

[Configuration of communication control system]
First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described.

The abnormality management system includes an abnormality management device 1 and a communication terminal 2. The abnormality management device 1 and the communication terminal 2 are connected via a network NW. The abnormality management system according to this embodiment builds a database of abnormality data for detecting signal abnormalities based on the frequency spectrum of the signal measured by the communication terminal 2.

The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, mobile communication networks using LTE/4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark), but the scope of the present invention is not limited to these.

The communication terminal 2 can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, or the like. In this embodiment, there are n communication terminals 2 (n is a positive integer of 2 or more). The communication terminals 2 include terminals compatible with a mobile communication network that have a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as a subscriber identification number (IMSI: International Mobile Subscriber Identity).

The communication terminal 2 also includes a terminal having an IP address and configured as an IoT terminal. The communication terminal 2 is equipped with a mobile communication module and various sensors, and can detect various physical quantities and measure them as electrical signals. The communication terminal 2 transmits the measured signals to a gateway or the like (not shown) or to the abnormality management device 1 via the network NW. In this embodiment, as an example, the reception level and signal strength of signals received from base stations, which are periodically measured and recorded by the communication terminal 2 using the mobile communication module, are treated as signals subject to abnormality management.

As shown in area 2a of FIG. 1, the communication terminal 2 measures and records time series data of signal strength ("power [dB]"). It is difficult to directly detect the occurrence of an abnormality in signal strength from the signal strength waveform data shown in area 2a. Therefore, the abnormality management device 1 described below converts the time series data of signal strength into a spectrum in the frequency domain and detects signal abnormalities by analyzing the frequency components.

Figure 2 is a diagram for explaining abnormal data showing a frequency spectrum containing a frequency component of abnormal intensity. In (a) of Figure 2, the horizontal axis is frequency and the vertical axis is intensity. Curve a1 shows a frequency spectrum in which the intensity of each frequency component of a signal measured by a certain communication terminal 2 is normal, and curve b1 shows a frequency spectrum containing a frequency component of abnormal intensity in a signal measured by another communication terminal 2. In the frequency range c, there is a peak of an abnormal frequency component that does not exist in the normal frequency spectrum, and an abnormality in the intensity of the frequency component occurs. A communication terminal 2 that has measured a signal related to a frequency spectrum containing such a frequency component of abnormal intensity has a problem with hardware or settings, or a problem on the receiving environment side. For example, there may be a failure of the communication module of the communication terminal 2, a bug or incorrect setting of the measurement software, or an influence due to an internal noise source. Therefore, it is considered that a failure has occurred in the communication terminal 2 that has measured a signal related to a frequency spectrum containing a frequency component of abnormal intensity.

[Function block of the abnormality management device]
Next, functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10, a first learning unit 11, a derivation unit 12, a data processing unit 13, a second learning unit 14, a generation unit 15, a storage unit 16, a determination unit 17, and a notification unit 18.

The collection unit 10 collects frequency spectra of signals measured by each of the multiple communication terminals 2 via the network NW. Alternatively, the collection unit 10 can collect time series data of signals measured by each of the multiple communication terminals 2 and perform a Fourier transform on the collected signals to obtain frequency spectra. The time series data of the signal and its frequency spectrum are associated with identification information of the communication terminal 2 that measured the signal. The collection unit 10 collects frequency spectra of signals that include a certain number or more of frequency spectra with normal intensities for each frequency component used for learning by the first learning unit 11. The collection unit 10 also collects frequency spectra of signals under management that are subject to abnormality judgment by the judgment unit 17.

The first learning unit 11 uses normal data, which indicates a frequency spectrum in which the intensity of each frequency component is normal, among the frequency spectra of multiple signals, as training data, and learns parameters of a probability model that outputs the posterior probability that the intensity of each frequency component is normal, by maximum likelihood estimation. In a situation in which there is little abnormal data, the first learning unit 11 uses normal data to learn a probability model by maximum likelihood estimation. The first learning unit 11 can use multiple frequency spectra that contain a certain amount or more of normal data as training data. "Intensity" is a concept that includes the amplitude, power, or physical quantities corresponding to these of each frequency component, and also includes a mode in which a voltage value is used as intensity.

Here, x is the intensity of a certain frequency component at a certain observation point. Furthermore, as shown in the following equation (1), the density function of normal data is defined as ρ _d (x), and the density function of abnormal data is defined as ρ _g (x).

In the above formula (1), y=1 indicates the normal class, and y=0 indicates the abnormal class. Therefore, _ρd (x) indicates the appearance tendency of intensity x when belonging to normal class y=1, and _ρg (x) indicates the appearance tendency of intensity x when belonging to abnormal class y=0. Here, FIG. 2B shows the horizontal axis of intensity and the vertical axis of probability distribution, and shows the density function (probability distribution) a2 of normal data and the density function (probability distribution) b2 of abnormal data at the data points of the black circles of normal data a1 and abnormal data b1 in FIG. 2A. In the example of FIG. 2B, both the probability distributions of normal data and abnormal data are normal distributions.

The density ratio γ(x) of the density function of the above equation (1) is expressed by the following equation (2).
The density ratio γ(x) indicates whether a certain intensity x is relatively more likely to appear in a normal state or in an abnormal state. By transforming the above equation (2) using Bayes' theorem, it can be expressed as the following equation (3).

In the above formula (3), x is the intensity (continuous variable), y is the class, ρ(x|y=1) is the density function of normal data and corresponds to _ρd (x), ρ(x|y=0) is the density function of abnormal data and corresponds to _ρg (x), ρ(y=1|x) is the posterior probability that intensity x is normal (y=1) given intensity x, and ρ(y=0|x) is the posterior probability that it is abnormal (y=0), ρ(y=1) is the prior probability of the normal class, ρ(y=0) is the prior probability of the abnormal class, and ρ(x) indicates the distribution of the entire intensity.

Here, if π=ρ(y=1), the above equation (3) can be further expressed as the following equation (4).
As shown in the above formula (4), the density ratio γ(x) is equivalent to finding the ratio of posterior probabilities based on the observed value x. However, while there are a large number of observed values x for the posterior probability ρ(y=1|x) of normality (y=1), there are almost no observed values x for the posterior probability ρ(y=0|x) of abnormality (y=0), making it difficult to calculate the posterior probability of abnormality (y=0).

First, we calculate the posterior probability ρ(y=1|x) that a large amount of observed value x is normal (y=1). If we assume that the posterior probability ρ(y=1|x) of normal data follows a normal distribution, it is defined as shown in the following equation (5).
In the above equation (5), f(x _n ) is an estimate that is the output by a probability model, σ ² is the variance of the error, and t is the observed correct signal, that is, normal data.

Furthermore, when the output f(x _n ) of the probability model is expressed as a linear combination, it can be expressed as in the following equation (6).
In the above formula (6), _wj is a parameter of the model, and _xj is each observed value, that is, each explanatory variable. The maximum likelihood estimation solution of the above formula (6) is expressed by the following formula (7).

In the above formula (7), Φ is a matrix of feature vectors x of all observed data. _tn represents a vector _tn = ( _t1 , ..., tN ₎ ^T of the strength of the correct answer (normal data) at each observation point x. Furthermore, in the above formula (7), Φ is expressed by the following formula (8).

That is, Φ is an N×M matrix in which feature vectors Φ(x _n ) obtained from N observation points x _n are arranged as rows.

Furthermore, the average error between the intensity f(x _n ) estimated based on the learned parameter w and the actual normal intensity t _n (teacher signal) is the value of the variance σ ² of the normal distribution shown in the following equation (9).

In this way, when a probability model expressed by a linear combination estimates the posterior probability that the intensity is normal for an input x, it is assumed that each observed value t follows a normal distribution with the estimated value f( _xn ) of the probability model as the mean. The parameter w of the probability model and the error variance ^σ2 are estimated by performing maximum likelihood estimation for all data ( _xn , _tn ). In addition, the density function _ρd (x) of normal data is obtained from the definition of the normal distribution in the above formula (5).

Here, when the posterior probability ρ(y=1|x) of normal data is approximately estimated, the relationship becomes ρ(y=1|x) ≒ _qw (y=1|x). Based on the estimated value _qw (y=1|x) of the posterior probability that the input intensity x is normal, the cross entropy is defined as the loss function U as shown in the following equation (10).

The convergence value (minimum value) of the loss function U in the above equation (10) is expressed by the following equation (11).

The derivation unit 12 transforms the above equation (11) into the following equation (12), and derives the density function ρ _g (x) of the abnormal data.

In the above formula (12), the probability distribution of normal data, i.e., the density function ρ _d (x) of normal data, is calculated from the normal data collected by the collection unit 10. In addition, the prior probability π of normal data is much larger than the prior probability (1-π) of abnormal data, and can be set to, for example, 0.99. Furthermore, for an observed value x, the log likelihood lnq _w (y=1|x) when y=1 is obtained by maximum likelihood estimation based on a large amount of normal data (teacher signal), as shown in the above formulas (6) to (9). In this way, even if there is a small amount of abnormal data, the probability distribution of abnormal data can be obtained from normal data.

The derivation unit 12 derives a density function _ρg (x) of abnormal data indicating abnormal intensity based on an estimate _qw (y=1|x) of the posterior probability estimated by the probability model learned by the first learning unit 11, a density function _ρd (x) of normal data, and a priori probability π of normality.

The data processing unit 13 obtains a frequency spectrum of the abnormal data based on the derived probability distribution of the abnormal data. The data processing unit 13 generates intensity values in an abnormal state by, for example, random sampling using the density function ρ _g (x) of the abnormal data in the above formula (12), and arranges the values in order for each frequency component, thereby obtaining a frequency spectrum related to the abnormal data. The data processing unit 13 can also obtain a frequency spectrum of the abnormal data corresponding to any multiple data points in the frequency range c in which the abnormal state in FIG. 2(a) occurs.

The second learning unit 14 learns a generator 141 that generates pseudo-abnormal data that is statistically similar to true abnormal data, using the frequency spectrum of the abnormal data obtained by the data processing unit 13 as true abnormal data. The second learning unit 14 performs adversarial learning of a generative model that has, for example, the generator 141 and a classifier 142 that distinguishes between the pseudo-abnormal data generated by the generator 141 and true abnormal data.

As shown in FIG. 3, the second learning unit 14 performs adversarial learning on a GAN (Generative Adversarial Network) having a generator 141 and a discriminator 142.

4 and 5 are diagrams showing schematic configurations of the neural network of the generator 141 and the classifier 142 of the GAN used by the second learning unit 14. As shown in FIG. 4, the generator 141 is configured of a neural network having an input layer, a hidden layer, and an output layer. The generator 141 is a model that generates pseudo abnormal data from random noise. For example, m randomly sampled Gaussian noise vectors (z ₁ to z _m ) are input to the input node of the generator 141.

The generator 141 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 141 is data that is similar to true abnormal data. CNN or ResNet can be used as the neural network that constitutes the generator 141.

The classifier 142 shown in FIG. 5 is composed of a neural network having an input layer, a hidden layer, and an output layer. In the example of FIG. 5, the frequency spectrum of the abnormal data obtained by the data processing unit 14 as a result of learning by the first learning unit 11 is provided as the input of the training data.

The discriminator 142 outputs a binary output of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. When the discriminator 142 correctly identifies the training data related to the input truly abnormal data as truly abnormal data, it outputs an output y=1. On the other hand, when the discriminator 142 correctly identifies the training data related to the input pseudo-abnormal data as pseudo-abnormal data, it outputs an output y=0. In this way, the discriminator 142 is a model that distinguishes the model distribution generated by the generator 141 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the discriminator 142.

3 is a block diagram for explaining the adversarial learning of GAN by the second learning unit 14. The generator 141 of the GAN adopted by the second learning unit 14 is represented as a function G, and the discriminator 142 is represented as a function D. Furthermore, true abnormal data is represented as x, the predicted value output by the discriminator 142 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true abnormal data and 0 for pseudo abnormal data generated by the generator 141. At this time, the discriminator 142 can be represented as a binary classification problem by the cross entropy E _CE of the following equation (13).

In t _n lny _n represented by the first term in the braces in the above equation (13), it is desirable that the predicted value _yn of the classifier 142 approaches the value of the correct label of truly anomalous data, t _n = 1. On the other hand, in (1-t _n ) ln (1-y _n ), represented by the second term in the braces, it is desirable that the predicted value _yn of the classifier 142 approaches the value of the correct label for classifying pseudo anomalous data, (1-t _n ) = 0. In this way, the cross entropy E _CE is maximum when the predicted value matches the value of the correct label.

Here, the generator 141 constituting the GAN has parameters _wG and _θG and is represented as a function G( _wG , _θG ). The discriminator 142 has parameters _wD and _θD and is represented as a function D( _wD , _θD ). The objective function E of the GAN including the generator 141 and the discriminator 142 based on the cross entropy _ECE of the above formula (13) can be represented by the following formula (14).

E _D(x)=1 lnD(w _D , θ _D ), which is the first term of the above formula (14), is the expected value at which the discriminator 142 discriminates true anomalous data as true anomalous data. E _D(x)=0 ln(1-D(G(w _G , θ _G ), w _D , θ _D )), which is the second term of the above formula (14), is the expected value at which the discriminator 142 discriminates the pseudo anomalous data generated by the generator 141 as pseudo anomalous data. In GAN learning, the generator 141 and the discriminator 142 are trained in an adversarial manner by min-max optimization of the objective function E. Therefore, the generator 141 is trained so as to generate pseudo anomalous data that deceives the discriminator 142, and the discriminator 142 is trained so as to discriminate the pseudo anomalous data generated by the generator 141 as pseudo anomalous data.

In the learning of the classifier 142, when true abnormal data is given, the classifier 142 maximizes the first term of the objective function E in the above equation (14) by outputting an output close to y = 1. On the other hand, when pseudo abnormal data is given, the classifier 142 learns to maximize the second term of the objective function E by outputting an output close to y = 0.

In the learning of the generator 141, the objective function E is minimized by outputting G( _wG , _θG ) (G(z) in FIG. 3) such that D(G( _wG , θG), _wD , _θD ) (D(G( _z )) in FIG. 3) in the above equation (14) becomes close to 1. The second learning unit 14 uses a learning procedure that alternately updates the parameters of the generator 141 and the parameters of the discriminator 142. Details of the learning procedure of the generator 141 and the discriminator 142 by the second learning unit 14 will be described later.

The generation unit 15 generates pseudo-abnormal data using a trained generator 141' in which the objective function E of the GAN has been optimized by the second learning unit 14.

The memory unit 16 stores the generated pseudo-abnormal data. The memory unit 16 also stores the true abnormal data determined by the data processing unit 13.

The determination unit 17 determines that the signal is abnormal when the frequency spectrum of the signal collected by the collection unit 10 matches the pseudo-abnormal data stored in the storage unit 16. More specifically, when the frequency spectrum of the signal matches the pseudo-abnormal data and the true abnormal data stored in the storage unit 16, the determination unit 17 identifies the communication terminal 2 associated with the signal of the frequency spectrum.

When the determination unit 17 determines that the signal is abnormal, the notification unit 18 notifies the outside that an abnormality has occurred in the communication terminal 2 that measured the signal of the frequency spectrum to be determined. The notification unit 18 can send an alarm to an external management server. The notification unit 18 may also send a notification via the network NW to the communication device 2 in which the occurrence of the abnormality has been detected.

[Hardware configuration of the abnormality management device]
Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-mentioned functions will be described with reference to FIG.

As shown in FIG. 6, the abnormality management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input/output I/O 106 connected via a bus 101, and a program that controls these hardware resources. Furthermore, the abnormality management device 1 includes a display device 107.

The processor 102 is realized by a CPU, GPU, FPGA, ASIC, etc.

The main memory device 103 prestores programs that allow the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 realize the various functions of the abnormality management device 1, such as the collection unit 10, the first learning unit 11, the derivation unit 12, the data processing unit 13, the second learning unit 14, the generation unit 15, the judgment unit 17, and the notification unit 18 shown in FIG. 1.

The communication interface 104 is an interface circuit for network connection between the abnormality management device 1 and various external electronic devices.

The auxiliary storage device 105 is composed of a readable/writable storage medium and a drive for reading and writing various information such as programs and data from the storage medium. The auxiliary storage device 105 can use semiconductor memory such as a hard disk or flash memory as the storage medium.

The auxiliary storage device 105 has a program storage area for storing the anomaly management program. The auxiliary storage device 105 also has a program storage area for storing a learning program for performing adversarial learning of the GAN executed by the anomaly management device 1. The auxiliary storage device 105 also has a program storage area for storing the first learning program executed by the anomaly management device 1. The auxiliary storage device 105 realizes the memory unit 16 described in FIG. 1. Furthermore, for example, it may have a backup area for backing up the above-mentioned data, programs, etc.

The input/output I/O 106 is an input/output device that inputs signals from external devices and outputs signals to external devices.

The display device 107 is configured with an organic EL display, a liquid crystal display, or the like. The display device 107 can display true abnormal data on the screen.

[Operation of the abnormality management device]
Next, the operation of the abnormality management device 1 having the above-mentioned configuration will be described with reference to the flowcharts of FIGS.

As shown in FIG. 7, first, the collection unit 10 collects frequency spectra that contain a certain number of normal data or more (step S1). The collection unit 10 collects frequency spectra of multiple signals, for example, frequency spectra in which 99% or more of the data is normal. The collection unit 10 can collect time series data of signals measured at each communication terminal 2 from the gateway or each communication terminal 2 via the network NW, and convert the data into a frequency spectrum.

Next, the first learning unit 11 performs a first learning process (step S2). After that, the derivation unit 12 derives a density function of the abnormal data (step S3). FIG. 8 is a flowchart for explaining steps S2 and S3 in more detail. As shown in step S30 of FIG. 8, the first learning unit 11 learns the parameters w and σ 2 of a probabilistic model that outputs an estimate q _w (y=1|x) of the posterior probability that the intensity x is normal, by maximum likelihood estimation, based on the frequency spectrum that includes normal data at a certain rate or higher, collected in step ^S1 , using the normal data as teacher data (step S30).

In step S30, the first learning unit 11 performs learning by maximum likelihood estimation according to the above formulas (6) to (9). Also, in step S30, the first learning unit 11 obtains an estimate q _w (y=1|x) of the posterior probability that the intensity x is normal from a probability model having parameters w and σ ² estimated by maximum likelihood estimation.

Furthermore, the first learning unit 11 estimates a density function ρ _d (x) (normal distribution) of normal data based on the normal intensity x of each frequency component (step S31).

Next, the derivation unit 12 substitutes the log-likelihood of the posterior probability _lnqw (y=1|x) calculated in step S30, the density function _ρd (x) of the normal data calculated in step S31, and the prior probability π (e.g., 0.99) of the normal data into the above equation (12) to derive the density function _ρg (x) of the abnormal data (step S33).

After that, the process proceeds to step S4 in Fig. 7. Next, the data processing unit 13 sequentially arranges the intensities of the frequency components of the abnormal data based on the density function _ρg (x) of the abnormal data derived in step S3 to obtain a frequency spectrum (step S4). For example, in step S4, 10,000 pieces of data are created centered on the median from the density function _ρg (x), which is a normal distribution for each frequency component. If the number of frequency components is 1,000, (10,000 to the power of 10,000) frequency spectra are created.

Next, the second learning unit 14 learns a generator 141 that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the frequency spectrum of the abnormal data obtained in step S4 as the true abnormal data (step S5) (second learning process).

Specifically, the second learning unit 14 performs adversarial learning of a GAN having a generator 141 that generates pseudo-abnormal data similar to the true abnormal data, using the frequency spectrum of the abnormal data obtained in step S4 as the true abnormal data, and a discriminator 142 that distinguishes between the pseudo-abnormal data generated by the generator 141 and the true abnormal data. Details of the learning process in step S5 will be described later.

Next, the generation unit 15 generates pseudo-abnormal data using the trained generator 141' (step S6). The generated pseudo-abnormal data is stored in the storage unit 16 (step S7). In step S7, the true abnormal data used as training data for the GAN is also stored in the storage unit 16.

Then, the collection unit 10 collects the frequency spectrum of the signal to be managed (step S8). Next, the determination unit 17 determines that the signal is abnormal if the frequency spectrum of the signal collected in step S8 matches the pseudo-abnormal data or true abnormal data stored in the storage unit 16 (step S9). In step S9, the frequency spectrum of the signal to be managed can be determined to be abnormal if it matches the pseudo-abnormal data or true abnormal data completely or within a certain tolerance range. In addition, the frequency spectrum is collated in order for each frequency component, and it can be determined that the signal is abnormal if it matches, for example, in the frequency component range c of the curve b1 of the abnormal data in FIG. 2(a) or a frequency component before that. The determination unit 17 identifies the communication terminal 2 that measured the abnormal signal.

Next, the notification unit 18 notifies an external management server or the like that an abnormality has occurred in the communication terminal 2 that measured the signal determined to be an abnormal signal (step S10).

Next, the second learning process (step S5) of the abnormality management device 1 described in Fig. 7 will be described with reference to Fig. 9. First, the second learning unit 14 inputs true abnormal data to the classifier 142 as training data 144, and learns and updates parameters _wD and _θD of the classifier 142 so as to classify the true abnormal data from true abnormal data (y = 1) (step S20).

In step S20, the second learning unit 14 can cause the classifier 142 to learn true abnormal data using, for example, the backpropagation method. In step S20, the classifier 142 that can distinguish true abnormal data from true abnormal data is constructed in advance.

Next, the second learning unit 14 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 141 (step S21). Next, the generator 141 performs a product-sum operation of the input z and the weight parameters _wG and _θG and threshold processing using an activation function based on the provided Gaussian noise to generate pseudo abnormal data G(z) (step S22).

Next, the second learning unit 14 trains the discriminator 142. The learning of the discriminator 142 is performed by fixing the parameters _wD and _θD of the generator 141. First, the second learning unit 14 provides true abnormal data as training data 144 as an input to the discriminator 142. Then, the second learning unit 14 updates the parameters _wD and _θD by the backpropagation method or the like so that the objective function E of the above formula (14) is maximized (step S23). The label of the training data 144 is set to 1 (true abnormal data).

Next, the second learning unit 14 provides the pseudo abnormal data generated by the generator 141 in step S22 as an input to the discriminator 142, and updates the parameters _wD and _θD by backpropagation or the like so as to maximize the objective function E in the above formula (14) (step S24). That is, in steps S23 and S24, in order to maximize the objective function E in the above formula (14), the first term is optimized so that D( _wD , _θD )=1 is output and the second term is optimized so that D(G( _wG , _θG ), _wD , _θD )=0. Note that the label 0 (pseudo abnormal data) is set for the training data 144.

The learning of the classifier 142 in steps S23 and S24 corresponds to the dashed arrow in the block diagram of the second learning unit 14 shown in FIG. 3, which indicates that the classifier error is calculated in block 145 of the objective function E based on the output 143 from the classifier 142, and then the error is backpropagated to the classifier 142.

Next, the second learning unit 14 learns the generator 141. The learning of the generator 141 is performed with the parameters of the discriminator 142 fixed. The second learning unit 14 learns the generator 141 so that pseudo abnormal data is generated when random Gaussian noise is given to the generator 141. Specifically, the second learning unit 14 updates the parameters w _G and θ _G by the backpropagation method or the like in order to minimize the objective function E of the above equation (14) (step S25).

The learning in step S25 corresponds to the flow of the dashed arrow indicating backpropagation of error to the generator 141 in the block diagram of the second learning unit 14 in FIG. 3. That is, step S25 corresponds to the flow of the dashed arrow in which the pseudo-abnormal data generated by the generator 141 in FIG. 3 is input to the discriminator 142, the generator error is calculated from the output 143 in the block 145 of the objective function E, and the error is further backpropagated to the generator 141.

Then, the learning of the discriminator 142 and the generator 141 from step S22 to step S25 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S26: NO). On the other hand, if the value of the objective function E has converged (step S26: YES), the processing from step S20 to step S26 is repeated using the remaining true abnormal data in order until the generator 141 and the discriminator 142 are learned (step S27: NO).

After that, when the generator 141 and the discriminator 142 have been trained using all the true abnormal data (step S27: YES), the second learning unit 14 stores the trained generator 141' in the storage unit 16 (step S28). The trained generator 141' is constructed by the above processes from step S20 to step S28. After that, the process proceeds to step S6 in FIG. 7.

As described above, according to the abnormality management device 1 of this embodiment, the posterior probability that the intensity is normal is estimated by learning the parameters of a probabilistic model that outputs the posterior probability that the intensity is normal using normal data as teacher data by maximum likelihood estimation. Furthermore, a density function of the abnormal data is derived based on the estimated value of the posterior probability, the density function of the normal data, and the prior probability of the normal data. Furthermore, the frequency spectrum of the abnormal data obtained from the derived density function of the abnormal data is used as the true abnormal data in the generation model, and pseudo-abnormal data similar to the true abnormal data is generated. The generated pseudo-abnormal data is stored in the memory unit 16 as a database together with the true abnormal data. Therefore, even if there is a small amount of measurement data of the abnormal signal, it is possible to manage signal abnormalities.

In addition, the abnormality management device 1 according to this embodiment collects the frequency spectrum of the signal measured for each communication terminal 2 and judges the abnormal data, so that the communication terminal 2 in which an abnormality has occurred is identified and an alarm is issued. Therefore, a failure of the communication terminal 2 can be detected remotely without performing an abnormality analysis at the location where the communication terminal 2 is located.

In addition, according to the abnormality management device 1 of this embodiment, the intensity of each frequency component of the frequency spectrum indicated by the pseudo abnormality data generated by the trained generator 141' is compared with the intensity of each frequency component of the frequency spectrum of the actually measured signal, so that it is possible to predict an abnormality in the signal when parts of the spectrum match.

In the embodiment described above, the signal measured by the communication terminal 2 is time series data of signal strength. However, the time series signal that is the subject of anomaly detection is not limited to signal strength as long as it is a signal that can be subjected to frequency analysis. For example, the communication terminal 2 may be equipped with a biosensor and configured to measure time series data of biosignals such as the user's heart rate, blood pressure, and body temperature. Alternatively, the communication terminal 2 may be equipped with various sensors such as a vibration sensor, a sound sensor, and a pressure sensor, and can measure time series data of physical quantities such as vibration, sound, and pressure.

In the embodiment described above, the communication terminal 2 is exemplified as a terminal equipped with a SIM, such as a smartphone, and an IoT terminal having an IP address. However, the communication terminal 2 may be a conventional device without a communication function, as long as it is capable of inputting time series data of the measured signal to the anomaly detection device 1.

In the embodiment described above, the second learning unit 14 is described as learning a GAN. However, the learning of the generator 141 can be performed using a VAE (Variational Autoencoder), a diffusion model, Energy-Based Models (EBMs), and the like in addition to adversarial learning.

The above describes the embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can imagine can be made within the scope of the invention described in the claims.

1...abnormality management device, 2...communication terminal, 3...base station, 4...core network, 10...collection unit, 11...first learning unit, 12...derivation unit, 13...data processing unit, 14...second learning unit, 15...generation unit, 16...memory unit, 17...judgment unit, 18...notification unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input/output I/O, 107...display device, 141...generator, 142...identifier, NW...network.

Claims (8)

a first learning unit configured to learn, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the intensity of each frequency component is normal, using normal data that indicates a frequency spectrum in which the intensity of each frequency component is normal among frequency spectra of a plurality of signals as teacher data;
a derivation unit configured to derive a probability distribution of abnormal data indicating a frequency spectrum including a frequency component of abnormal intensity based on the posterior probability estimated by the trained probability model, the probability distribution of the normal data, and a prior probability of normality;
A data processing unit configured to obtain a frequency spectrum of the abnormal data based on the derived probability distribution of the abnormal data;
a second learning unit configured to learn a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data by using the frequency spectrum of the abnormal data obtained by the data processing unit as true abnormal data;
and a memory unit configured to store the pseudo-abnormal data generated using the learned generator constructed by the second learning unit. 2. The abnormality management device according to claim 1,
a collection unit configured to collect a frequency spectrum of the signal to be managed;
and a judgment unit configured to judge that the signal to be managed is an abnormal signal when a frequency spectrum of the collected signal to be managed matches the pseudo-abnormal data stored in the memory unit. 3. The abnormality management device according to claim 2,
The abnormality management device further comprises a notification unit configured to notify an external party that an abnormality has occurred in the communication terminal that measured the abnormal signal when the determination unit determines that the signal is abnormal. 2. The abnormality management device according to claim 1,
The second learning unit performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomaly data. 1. A computer-implemented anomaly management method, comprising:
a first learning step of learning parameters of a probabilistic model that outputs a posterior probability that the intensity of each frequency component is normal by maximum likelihood estimation using normal data that indicates a frequency spectrum in which the intensity of each frequency component is normal among the frequency spectra of a plurality of signals as training data;
a derivation step of deriving a probability distribution of abnormal data showing a frequency spectrum including a frequency component of abnormal intensity based on the posterior probability estimated by the trained probability model, the probability distribution of the normal data, and a prior probability of normality;
a data processing step of determining a frequency spectrum of the abnormal data based on the derived probability distribution of the abnormal data;
a second learning step of learning a generator that generates pseudo-abnormal data that is statistically similar to the true abnormal data by using the frequency spectrum of the abnormal data obtained in the data processing step as true abnormal data;
a storage step of storing in a storage unit the pseudo-abnormal data generated using the trained generator constructed in the second learning step. The abnormality management method according to claim 5,
Further, a collection step of collecting a frequency spectrum of the signal to be managed;
and a determination step of determining that the signal to be managed is an abnormal signal if a frequency spectrum of the collected signal to be managed matches the pseudo-abnormal data stored in the memory unit. The abnormality management method according to claim 6,
The abnormality management method further comprises a notification step of, when the determination step determines that the signal is abnormal, notifying an external party that an abnormality has occurred in the communication terminal that measured the abnormal signal. The abnormality management method according to claim 5,
the second learning step performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo anomaly data generated by the generator and the true anomaly data.