US 12,406,208 B2
Anomaly detection method using an autoencoder learning from data items collected by measuring devices
Yasuhiro Ikeda, Musashino (JP); Yusuke Nakano, Musashino (JP); Keishiro Watanabe, Musashino (JP); Keisuke Ishibashi, Musashino (JP); and Ryoichi Kawahara, Musashino (JP)
Assigned to NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Chiyoda-ku (JP)
Appl. No. 16/481,672
Filed by NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Chiyoda-ku (JP)
PCT Filed Nov. 7, 2017, PCT No. PCT/JP2017/040104
§ 371(c)(1), (2) Date Jul. 29, 2019,
PCT Pub. No. WO2018/142704, PCT Pub. Date Aug. 9, 2018.
Claims priority of application No. 2017-017920 (JP), filed on Feb. 2, 2017.
Prior Publication US 2019/0392350 A1, Dec. 26, 2019
Int. Cl. G06N 20/10 (2019.01)
CPC G06N 20/10 (2019.01) 5 Claims
OG exemplary drawing
 
1. A feature value generation device comprising:
processing circuitry configured to
generate vectors whose elements are feature values of data items collected at each of a plurality of timings, which are each upon an elapse of a predetermined time interval that is not greater than three minutes, from a target of anomaly detection, so as to perform normalization on the vectors, after a predetermined amount of vectors are stored, based on a set of predetermined vectors, the target being a system including a plurality of measuring devices that sample the data items within the system, the feature value generation device being connected to each of the plurality of measuring devices and the processing circuitry is configured to collect the data items from the measuring devices, wherein within the predetermined time interval the feature values are collected at sub-intervals such that a plurality of data items for a particular type of data item are collected at each of the plurality of timings and the normalization of the vectors includes at each of the plurality of timings, dividing each of the collected data items for a particular type of data item by a maximum value of the particular type of data item that is collected occurs during the respective timing;
generate an autoencoder that learns the predetermined vectors so as to output a learning result by duplicating a respective vector into two, applying one of the two vectors to the input layer to the autoencoder, and applying the other of the two vectors to the output layer, to execute learning so as to output the learning result; and
for each of the plurality of timings, detect, for each of the vectors normalized, an anomaly based on said each of the vectors and the learning result,
wherein the set of predetermined vectors is a set of vectors, stored as learning data in a learning data storage, with which no anomaly is detected by the processing circuitry, and for each of the plurality of timings, the entire set of vectors stored in the learning data storage based on the most recent collected vectors when no anomaly is detected by the processing circuitry and the entire set of vectors is not stored in the learning data storage based on the most recent collected vectors when an anomaly is detected by the processing circuitry based on a most recent learning result output by the autoencoder.