Anomaly Detection Method and Anomaly Detection System
First Claim
1. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
- data is acquired from a plurality of sensors;
learning data is generated and/or updated on the basis of similarities among data by adding/deleting data to/from learning data and, in a case of data with low similarity among data, using an occurrence/nonoccurrence of an anomaly in the data with low similarity among data; and
an anomaly in observation data is detected on the basis of deviances between newly acquired observation data and individual pieces of data included in the learning data.
1 Assignment
0 Petitions
Accused Products
Abstract
(1) A compact set of learning data about normal cases is created using the similarities among data as key factors, (2) new data is added to the learning data according to the similarities and occurrence/nonoccurrence of an anomaly, (3) the alarm occurrence section of a facility is deleted from the learning data, (4) a model of the learning data updated at appropriate times made by the subspace method, and an anomaly candidate is detected on the basis of the distance between each piece of the observation data and a subspace, (5) analyses of event information are combined and an anomaly is detected from the anomaly candidates, and (6) the deviance of the observation data is determined on the basis of the distribution of histograms of use of the learning data, and the abnormal element (sensor signal) indicated by the observation data is identified.
-
Citations
30 Claims
-
1. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
data is acquired from a plurality of sensors; learning data is generated and/or updated on the basis of similarities among data by adding/deleting data to/from learning data and, in a case of data with low similarity among data, using an occurrence/nonoccurrence of an anomaly in the data with low similarity among data; and an anomaly in observation data is detected on the basis of deviances between newly acquired observation data and individual pieces of data included in the learning data. - View Dependent Claims (10, 11)
-
-
2. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
learning data is read out from a database; and an amount of learning data is moderated by mutually obtaining similarities among learning data and deleting data so that data with high similarity is not duplicated.
-
-
3. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
with respect to learning data substantially including normal cases, similarities among individual pieces of data included in the learning data are obtained and k pieces of data with highest similarities to each of the individual pieces of data are obtained; and a histogram of data included in obtained learning data is obtained and a range of existence of normal cases is determined on the basis of the histogram.
-
-
4. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
with respect to learning data including substantially normal cases, similarities among individual pieces of data included in the learning data and observation data are obtained and, for a plurality of pieces of observation data, k pieces of data with highest similarities to the observation data are obtained; and a histogram of data included in the obtained learning data is obtained and, based on the histogram, at least one or more values such as a typical value, an upper limit, and a lower limit is set, and an anomaly is detected using the set values.
-
-
5. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
similarities among individual pieces of data included in learning data and observation data is obtained and, for a plurality of pieces of observation data, k pieces of data with highest similarities to the observation data are obtained; and a histogram of data included in the obtained learning data is obtained and a deviance of the observation data is obtained on the basis of the histogram to identify which element of the observation data is an anomaly.
-
-
6. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
observation data is acquired from a plurality of sensors; and alarm information generated by the facility and related to a facility shutdown or a warning is collected and a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.
-
-
7. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
observation data is acquired from a plurality of sensors; event information generated by the facility is acquired; an analysis is performed on the event information; and anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly. - View Dependent Claims (13)
-
-
8. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
observation data is acquired from a plurality of sensors; a model of learning data is made by a subspace method; and an anomaly is detected on the basis of a distance relationship between the observation data and a subspace. - View Dependent Claims (9)
-
-
12. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
data is acquired from a plurality of sensors, a trajectory of a data space is segmented into a plurality of clusters on the basis of temporal changes in the data, a model of a cluster group to which a point of interest does not belong is made by a subspace method; an outlier of the point of interest is calculated from a deviance from the model; and an anomaly is detected on the basis of the outlier.
-
-
14. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
observation data is acquired from a plurality of sensors; a model of learning data is made by a subspace method; an anomaly is detected on the basis of a distance relationship between the observation data and a subspace; event information generated by the facility is acquired; an analysis is performed on the event information; and anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.
-
-
15. An anomaly detection method for early detection of an anomaly of a plant or a facility, wherein:
-
observation data is acquired from a plurality of sensors; a model of learning data is made by a subspace method; an anomaly is detected on the basis of a distance relationship between the observation data and a subspace; event information generated by the facility is acquired; an analysis is performed on the event information; anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly; and an explanation of the anomaly is outputted.
-
-
16. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires data from a plurality of sensors; and a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein learning data is generated and/or updated on the basis of similarities among data by adding/deleting data to/from learning data and, in a case of data with low similarity among data, using an occurrence/nonoccurrence of an anomaly in the data with low similarity among data; and an anomaly in observation data is detected on the basis of deviances between newly acquired observation data and individual pieces of data included in the learning data. - View Dependent Claims (25, 26)
-
-
17. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a similarity calculating unit that calculates a similarity among data, and a data deletion instructing unit that instructs deletion of data from learning data, wherein an amount of learning data is moderated by mutually obtaining similarities among data and deleting data so that data with high similarity is not duplicated.
-
-
18. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, and an observation data histogram calculating unit, wherein with respect to learning data including normal cases, similarities among individual pieces of data included in the learning data are obtained and k pieces of data with highest similarities to each of the individual pieces of data are obtained, and a histogram of data included in obtained learning data is obtained and a range of existence of normal cases is determined on the basis of the histogram.
-
-
19. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, an observation data histogram calculating unit, and a setting unit that sets at least one or more values such as a typical value, an upper limit, and a lower limit, wherein with respect to learning data including normal cases, similarities among individual pieces of data included in the learning data and observation data are obtained, k pieces of data with highest similarities to the observation data are obtained for a plurality of pieces of observation data, a histogram of data included in obtained learning data is obtained, at least one or more values such as a typical value, an upper limit, and a lower limit are set on the basis of the histogram, and an anomaly is detected using the set values.
-
-
20. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a learning data unit including substantially normal cases, a similarity calculating unit that calculates a similarity among data, and an observation data histogram calculating unit, wherein similarities among individual pieces of data included in the learning data and observation data are obtained, k pieces of data with highest similarities to the observation data are obtained for a plurality of pieces of observation data, a histogram of data included in obtained learning data is obtained, and a deviance of the observation data is obtained on the basis of the histogram to identify which element of the observation data is an anomaly.
-
-
21. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires data from a plurality of sensors; and a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein alarm information generated by the facility and related to a facility shutdown or a warning is collected, and a section including the alarm information generated by the facility and related to a facility shutdown or a warning is removed from learning data.
-
-
22. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires data from a plurality of sensors; and a similarity calculating unit that calculates a similarity among data, a data anomaly inputting unit that inputs an occurrence/nonoccurrence of an anomaly of data, a data addition/deletion instructing unit that instructs addition/deletion of data to/from learning data, and a learning data generating/updating unit, wherein event information generated by the facility is acquired, an analysis is performed on the event information, and anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly. - View Dependent Claims (28)
-
-
23. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires observation data from a plurality of sensors;
a subspace method modeling unit that makes a model of learning data by a subspace method; and
a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace, whereinobservation data is acquired from a plurality of sensors, a model of learning data is made by a subspace method, and an anomaly is detected on the basis of a distance relationship between the observation data and a subspace. - View Dependent Claims (24)
-
-
27. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires observation data from a plurality of sensors;
a clustering unit that segments a trajectory of a data space into a plurality of clusters;
a subspace method modeling unit that makes a model of data by a subspace method; and
a deviance calculating unit that calculates an outlier of a point of interest from the model on the basis of a deviance, whereindata is acquired from a plurality of sensors, a trajectory of a data space is segmented into a plurality of clusters on the basis of temporal changes in the data, a cluster group to which a point of interest does not belong is modeled by a subspace method, an outlier of the point of interest is calculated from a deviance from the model, and an anomaly is detected on the basis of the outlier.
-
-
29. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires observation data from a plurality of sensors;
a subspace method modeling unit that makes a model of learning data by a subspace method;
a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace;
an anomaly detecting unit; and
an event information analyzing unit that performs analysis on event information, whereinobservation data is acquired from a plurality of sensors, a model of learning data is made by a subspace method, an anomaly is detected on the basis of a distance relationship between the observation data and a subspace; event information generated by the facility is acquired, an analysis is performed on the event information, and anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly.
-
-
30. An anomaly detection system for early detection of an anomaly of a plant or a facility, comprising:
-
a data acquiring unit that acquires observation data from a plurality of sensors;
a subspace method modeling unit that makes a model of learning data by a subspace method;
a distance relationship calculating unit that calculates a distance relationship between observation data and a subspace;
an anomaly detecting unit;
an event information analyzing unit that performs analysis on event information; and
an anomaly explaining unit that explains an anomaly, whereinobservation data is acquired from a plurality of sensors, a model of learning data is made by a subspace method, an anomaly is detected on the basis of a distance relationship between the observation data and a subspace; event information generated by the facility is acquired, an analysis is performed on the event information, an anomaly detection performed on a sensor signal and the analysis performed on the event information are combined to detect an anomaly, and an explanation of the anomaly is outputted.
-
Specification