Anomaly Detection Method and Anomaly Detection System

• US 20120041575A1
• Filed: 10/29/2009
• Published: 02/16/2012
• Est. Priority Date: 02/17/2009
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Maeda, Shunji, Shibuya, Hisae
• Application Number:
  US13/144,343
• Publication Number:
  US 20120041575A1
• Time in Patent Office: Days
• US Class Current: 700/80
• CPC Class Codes: G05B 23/024 Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks
• CPC Class Codes: G05B 23/0254 based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks

Abstract

(1) A compact set of learning data about normal cases is created using the similarities among data as key factors, (2) new data is added to the learning data according to the similarities and occurrence/nonoccurrence of an anomaly, (3) the alarm occurrence section of a facility is deleted from the learning data, (4) a model of the learning data updated at appropriate times made by the subspace method, and an anomaly candidate is detected on the basis of the distance between each piece of the observation data and a subspace, (5) analyses of event information are combined and an anomaly is detected from the anomaly candidates, and (6) the deviance of the observation data is determined on the basis of the distribution of histograms of use of the learning data, and the abnormal element (sensor signal) indicated by the observation data is identified.

Claims

1. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

data is acquired from a plurality of sensors;

learning data is generated and/or updated on the basis of similarities among data by adding/deleting data to/from learning data and, in a case of data with low similarity among data, using an occurrence/nonoccurrence of an anomaly in the data with low similarity among data; and

an anomaly in observation data is detected on the basis of deviances between newly acquired observation data and individual pieces of data included in the learning data.

10. The anomaly detection method according to claim 1, wherein:

observation data is acquired from a plurality of sensors;

a model of the learning data is made by a subspace method; and

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace.

11. The anomaly detection method according to claim 10, wherein

a transition period in which data changes temporally is obtained, an attribute is added to transitional data, and the transitional data is collected or removed as learning data.

2. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

learning data is read out from a database; and

an amount of learning data is moderated by mutually obtaining similarities among learning data and deleting data so that data with high similarity is not duplicated.

3. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

with respect to learning data substantially including normal cases,

similarities among individual pieces of data included in the learning data are obtained and k pieces of data with highest similarities to each of the individual pieces of data are obtained; and

a histogram of data included in obtained learning data is obtained and a range of existence of normal cases is determined on the basis of the histogram.

4. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

with respect to learning data including substantially normal cases,

similarities among individual pieces of data included in the learning data and observation data are obtained and, for a plurality of pieces of observation data, k pieces of data with highest similarities to the observation data are obtained; and

a histogram of data included in the obtained learning data is obtained and, based on the histogram, at least one or more values such as a typical value, an upper limit, and a lower limit is set, and an anomaly is detected using the set values.

5. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

similarities among individual pieces of data included in learning data and observation data is obtained and, for a plurality of pieces of observation data, k pieces of data with highest similarities to the observation data are obtained; and

a histogram of data included in the obtained learning data is obtained and a deviance of the observation data is obtained on the basis of the histogram to identify which element of the observation data is an anomaly.

6. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

observation data is acquired from a plurality of sensors; and

alarm information generated by the facility and related to a facility shutdown or a warning is collected and a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.

7. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

observation data is acquired from a plurality of sensors;

event information generated by the facility is acquired;

an analysis is performed on the event information; and

anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.

13. The anomaly detection method according to claim 7, wherein

alarm information generated by the facility and related to a facility shutdown or a warning is collected, and a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.

8. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

observation data is acquired from a plurality of sensors;

a model of learning data is made by a subspace method; and

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace.

9. The anomaly detection method according to claim 8, wherein

the subspace method is any of a projection distance method, a CLAFIC method, a local subspace classifier performed on a vicinity of the observation data, a linear regression method, and a linear prediction method.

12. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

data is acquired from a plurality of sensors, a trajectory of a data space is segmented into a plurality of clusters on the basis of temporal changes in the data, a model of a cluster group to which a point of interest does not belong is made by a subspace method;

an outlier of the point of interest is calculated from a deviance from the model; and

an anomaly is detected on the basis of the outlier.

14. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

observation data is acquired from a plurality of sensors;

a model of learning data is made by a subspace method;

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace;

event information generated by the facility is acquired;

an analysis is performed on the event information; and

anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.

15. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:

observation data is acquired from a plurality of sensors;

a model of learning data is made by a subspace method;

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace;

event information generated by the facility is acquired;

an analysis is performed on the event information;

anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly; and

an explanation of the anomaly is outputted.

16. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires data from a plurality of sensors; and

a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein

learning data is generated and/or updated on the basis of similarities among data by adding/deleting data to/from learning data and, in a case of data with low similarity among data, using an occurrence/nonoccurrence of an anomaly in the data with low similarity among data; and

an anomaly in observation data is detected on the basis of deviances between newly acquired observation data and individual pieces of data included in the learning data.

25. The anomaly detection system according to claim 16, comprising:

a data acquiring unit that acquires observation data from a plurality of sensors;

a subspace method modeling unit that makes a model of the learning data by a subspace method; and

a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace, wherein

observation data is acquired from a plurality of sensors, a model of learning data is made by a subspace method, and

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace.

26. The anomaly detection system according to claim 25, wherein

a transition period in which data changes temporally is obtained, an attribute is added to transitional data, and the transitional data is collected or removed as learning data.

17. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a similarity calculating unit that calculates a similarity among data, and a data deletion instructing unit that instructs deletion of data from learning data, wherein

an amount of learning data is moderated by mutually obtaining similarities among data and deleting data so that data with high similarity is not duplicated.

18. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, and an observation data histogram calculating unit, wherein

with respect to learning data including normal cases, similarities among individual pieces of data included in the learning data are obtained and k pieces of data with highest similarities to each of the individual pieces of data are obtained, and

a histogram of data included in obtained learning data is obtained and a range of existence of normal cases is determined on the basis of the histogram.

19. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, an observation data histogram calculating unit, and a setting unit that sets at least one or more values such as a typical value, an upper limit, and a lower limit, wherein

with respect to learning data including normal cases,

similarities among individual pieces of data included in the learning data and observation data are obtained, k pieces of data with highest similarities to the observation data are obtained for a plurality of pieces of observation data,

a histogram of data included in obtained learning data is obtained, at least one or more values such as a typical value, an upper limit, and a lower limit are set on the basis of the histogram, and an anomaly is detected using the set values.

20. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, and an observation data histogram calculating unit, wherein

similarities among individual pieces of data included in the learning data and observation data are obtained, k pieces of data with highest similarities to the observation data are obtained for a plurality of pieces of observation data,

a histogram of data included in obtained learning data is obtained, and a deviance of the observation data is obtained on the basis of the histogram to identify which element of the observation data is an anomaly.

21. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires data from a plurality of sensors; and

a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein

alarm information generated by the facility and related to a facility shutdown or a warning is collected, and a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.

22. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires data from a plurality of sensors; and

a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein

event information generated by the facility is acquired,

an analysis is performed on the event information, and

anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.

28. The anomaly detection system according to claim 22, comprising:

an alarm information collecting unit that collects alarm information generated by the facility and related to a facility shutdown or a warning, wherein a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.

23. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires observation data from a plurality of sensors;

a subspace method modeling unit that makes a model of learning data by a subspace method; and

a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace, wherein

observation data is acquired from a plurality of sensors, a model of learning data is made by a subspace method, and

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace.

24. The anomaly detection system according to claim 23, wherein

the subspace method is any of a projection distance method, a CLAFIC method, a local subspace classifier performed on a vicinity of the observation data, a linear regression method, and a linear prediction method.

27. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires observation data from a plurality of sensors;

a clustering unit that segments a trajectory of a data space into a plurality of clusters;

a subspace method modeling unit that makes a model of data by a subspace method; and

a deviance calculating unit that calculates an outlier of a point of interest from the model on the basis of a deviance, wherein

data is acquired from a plurality of sensors, a trajectory of a data space is segmented into a plurality of clusters on the basis of temporal changes in the data, a cluster group to which a point of interest does not belong is modeled by a subspace method,

an outlier of the point of interest is calculated from a deviance from the model, and

an anomaly is detected on the basis of the outlier.

29. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires observation data from a plurality of sensors;

a subspace method modeling unit that makes a model of learning data by a subspace method;

a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace;

an anomaly detecting unit; and

an event information analyzing unit that performs analysis on event information, wherein

observation data is acquired from a plurality of sensors,

a model of learning data is made by a subspace method,

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace;

event information generated by the facility is acquired,

an analysis is performed on the event information, and

anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.

30. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:

a data acquiring unit that acquires observation data from a plurality of sensors;

a subspace method modeling unit that makes a model of learning data by a subspace method;

a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace;

an anomaly detecting unit;

an event information analyzing unit that performs analysis on event information; and

an anomaly explaining unit that explains an anomaly, wherein

observation data is acquired from a plurality of sensors,

a model of learning data is made by a subspace method,

an anomaly is detected on the basis of a distance relationship between the observation data and a subspace;

event information generated by the facility is acquired,

an analysis is performed on the event information,

an anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly, and

an explanation of the anomaly is outputted.