Anomaly detection system

An anomaly detection system that detects an anomaly or an omen of an anomaly of equipment of a monitoring target on a basis of operation data of the equipment, comprising:

• a device that collects operation data from the equipment;
• and
• an information processing apparatus that detects an anomaly or an omen of an anomaly on a basis of anomaly detection models constructed from the operation data,
• the information processing apparatus including
• means for collecting the operation data,
• means for learning anomaly detection models from the operation data, and
• means for calculating an anomaly score of respective operation data from the operation data and the anomaly detection models, and
• means for learning an anomaly detection mode from the operation data and the means for learning anomaly detection models in which a dispersion of elements of the anomaly detection models is small among the anomaly detection models,
• wherein the means for learning anomaly detection models from the operation data synthesize an anomaly score of an anomaly detection model generated from a plurality of anomaly detection models by weighted linear sum,
• wherein, the means for learning anomaly detection models from the operation data generate, when generating a new anomaly detection model from a plurality of anomaly detection models, the new anomaly detection model by sampling the operation data from the plurality of anomaly detection models,
• wherein the means for learning anomaly detection models from the operation data perform the sampling with a high probability for an anomaly detection model whose anomaly score is high.

An anomaly detection system that detects an anomaly or an omen of an anomaly of equipment of a monitoring target on a basis of operation data of the equipment, comprising:

• a device that collects operation data from the equipment;
• and
• an information processing apparatus that detects an anomaly or an omen of an anomaly on a basis of anomaly detection models constructed from the operation data,
• the information processing apparatus including
• means for collecting the operation data,
• means for learning anomaly detection models from the operation data, and
• means for calculating an anomaly score of respective operation data from the operation data and the anomaly detection models, and
• means for learning an anomaly detection mode from the operation data and the means for learning anomaly detection models in which a dispersion of elements of the anomaly detection models is small among the anomaly detection models,
• wherein the means for learning anomaly detection models from the operation data synthesize an anomaly score of an anomaly detection model generated from a plurality of anomaly detection models by weighted linear sum,
• wherein, the means for learning anomaly detection models from the operation data generate, when generating a new anomaly detection model from a plurality of anomaly detection models, the new anomaly detection model by sampling the operation data from the plurality of anomaly detection models,
• wherein the means for learning anomaly detection models from the operation data perform the sampling by any one of sampling performed based on a random distribution, sampling using an interpolation value or an estimation value, and sampling from a result of learning of a generation model from the operation data.