JP-7856865-B1 - Anomaly detection device and anomaly detection method

JP7856865B1JP 7856865 B1JP7856865 B1JP 7856865B1JP-7856865-B1

Abstract

[Problem] The objective is to more reliably estimate anomalies contained in the frequency spectrum of a signal. [Solution] The anomaly management device 1 includes a classification unit 13 that takes input data based on the intensity of each of the multiple frequency components for each observation unit as unknown input, provides it to a trained classification model 12A that reflects the correlation between the intensities of each of the multiple frequency components for each observation unit, performs calculations on the trained classification model 12A, and outputs a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit. [Selection Diagram] Figure 1

Inventors

柿島純

Assignees

株式会社インターネットイニシアティブ

Dates

Publication Date: 20260511
Application Date: 20260217

Claims (10)

An acquisition unit configured to acquire the intensity of each of the multiple frequency components contained in the frequency spectrum of the signal observed for each observation unit, An anomaly management device comprising: a classification unit configured to take input data based on the intensity of each of the multiple frequency components for each observation unit acquired by the acquisition unit as an unknown input, provide it to a trained classification model that has learned a pattern for identifying differences in distribution states based on the trend of the distribution of feature quantities relating to the correlation between the intensities of each of the multiple frequency components for each observation unit, perform calculations on the trained classification model, and output a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.
In the abnormality management device described in claim 1, Furthermore, the learning unit is configured to learn patterns that identify differences in distribution states based on the trend of the distribution of the feature quantities relating to the correlation between the intensities of each of the multiple frequency components, using training data in which a correct label indicating the presence or absence of anomalies in the frequency spectrum of the signal for each of the observation units is attached to the input data based on the intensity of each of the multiple frequency components for each observation unit, and a classification model. An anomaly management device comprising: a storage unit configured to store the learned classification model constructed by the learning unit; and a storage unit configured to store the learned classification model constructed by the learning unit.
In the abnormality management device described in claim 1, Furthermore, the system includes an input data creation unit configured to create matrix data representing the correlation between the intensities of each of the multiple frequency components based on the intensity of each of the multiple frequency components for each observation unit. The anomaly management device is characterized in that the classification unit provides the matrix data created by the input data creation unit as input data to the trained classification model.
In the abnormality management device described in claim 1, Furthermore, the abnormality management device is characterized by comprising a notification unit configured to provide notification indicating the occurrence of an abnormality when the classification result output by the classification unit indicates that an abnormality is included in the frequency spectrum of the signal.
In the abnormality management device according to claim 2, The classification model is characterized by comprising a convolutional neural network, and is used as an anomaly management device.
In the abnormality management device according to claim 5, An anomaly management device characterized in that the classification model further comprises an attention mechanism configured to emphasize the features extracted by the convolutional neural network by weighting them based on the importance of a plurality of feature maps constituting the features.
An acquisition step to obtain the intensity of each of the multiple frequency components contained in the frequency spectrum of the signal observed for each observation unit, An anomaly management method comprising: a classification step, which takes input data based on the intensity of each of the multiple frequency components for each observation unit acquired in the acquisition step as an unknown input, provides it to a trained classification model that has learned a pattern for identifying differences in distribution states based on the trend of the distribution of feature quantities relating to the correlation between the intensities of each of the multiple frequency components for each observation unit, performs calculations on the trained classification model, and outputs a classification result regarding the presence or absence of anomalies in the frequency spectrum of the signal for each observation unit.
In the abnormality management method described in claim 7, Furthermore, the learning step involves using training data, which is based on the intensity of each of the multiple frequency components for each observation unit, to learn patterns that identify differences in distribution states based on the trend of the distribution of the feature quantities relating to the correlation between the intensities of each of the multiple frequency components, using a classification model. An anomaly management method comprising: a storage step of storing the learned classification model constructed in the learning step in a memory unit.
In the abnormality management method described in claim 7, Furthermore, the system includes an input data creation step that creates matrix data representing the correlation between the intensities of each of the multiple frequency components based on the intensity of each of the multiple frequency components for each observation unit, The anomaly management method is characterized in that the classification step provides the matrix data created in the input data creation step to the trained classification model as the input data.
In the abnormality management method described in claim 7, Furthermore, the abnormality management method is characterized by comprising a notification step that provides notification indicating the occurrence of an abnormality when the classification result output in the classification step indicates that an abnormality is included in the frequency spectrum of the signal.

Description

This invention relates to an abnormality management device and an abnormality management method. Conventionally, techniques for analyzing the characteristics of time-series signals in the frequency domain and detecting anomalies in the signals have been known. For example, Patent Document 1 discloses a technique for estimating anomalies in signals measured by a sensor using a machine learning model constructed with the frequency spectra of normal and abnormal signals as training data. However, the technology disclosed in Patent Document 1 primarily uses the intensity of each frequency component of a signal in the frequency domain as individual features for learning and inference. This configuration makes it difficult to obtain feature representations that adequately reflect the relationships and structural characteristics between frequency components. Therefore, it was sometimes difficult to accurately capture changes in the overall frequency spectrum of the signal or signs of anomalies appearing across multiple frequency components. Japanese Patent Publication No. 2020-027386 Figure 1 is a block diagram showing the configuration of an abnormality management system equipped with an abnormality management device according to an embodiment of the present invention.Figure 2 is a diagram illustrating the overview of the abnormality management system according to this embodiment.Figure 3 is a diagram illustrating the configuration of the learning unit of the abnormality management device according to this embodiment.Figure 4 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment.Figure 5 is a flowchart showing the operation of the abnormality management device according to this embodiment.Figure 6 is a flowchart showing the operation of the abnormality management device according to this embodiment. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to Figures 1 to 6. [Configuration of the abnormality control system] First, with reference to Figure 1, an overview of an abnormality management system comprising an abnormality management device 1 according to an embodiment of the present invention will be described. The abnormality management system comprises an abnormality management device 1 and a communication terminal 2. The abnormality management device 1 and the communication terminal 2 are connected via a network NW. The abnormality management system estimates abnormalities contained in the frequency spectrum of the observed signal. The network NW includes, for example, wired networks such as LAN, WAN, the Internet, and ISDN, as well as wireless networks such as wireless LAN, LTE/4G, 5G, and 6G wireless communication systems, and Bluetooth (registered trademark). However, the scope of the present invention is not limited to these. The communication terminal 2 can be implemented as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, or a wearable device. In this embodiment, there are n communication terminals 2 (where n is a positive integer of 1 or more). The communication terminal 2 includes a terminal that supports a mobile communication network, having a SIM (Subscriber Identity Module), and the SIM's contract profile includes identifier information such as the subscriber identification number (IMSI: International Mobile Subscriber Identity). Furthermore, the communication terminal 2 includes devices that have an IP address and are configured as IoT terminals. The communication terminal 2 is equipped with a mobile communication module and various sensors, capable of detecting various physical quantities and measuring them as electrical signals. The communication terminal 2 transmits the measured signals via the network NW to a gateway (not shown) or to the anomaly management device 1. In this embodiment, as an example, the reception level and signal strength of signals received from the base station, which are periodically measured and recorded by the mobile communication module of the communication terminal 2, are used as the signals subject to anomaly management. As shown in region 2a of Figure 1, the communication terminal 2 measures and records time-series data of signal strength ("power [dB]"). It is difficult to directly detect anomalies from the signal strength waveform data shown in region 2a. Therefore, the anomaly management device 1, described later, converts the time-series data of signal strength into a frequency domain spectrum and detects signal anomalies by analyzing the frequency components. In this specification, "anomaly" refers to a state in the frequency spectrum of a signal that differs from the state expected under normal conditions. This includes cases where the intensity of frequency components exhibits an unusual distribution, or where significant changes occur in a specific frequency band. Such anomalies are not limited to c