Monitoring apparatus, method, and program

A method comprising:

• acquiring measurement values of sensors installed in a system;
• acquiring a control signal from the system;
• acquiring a model that generates second data including a prediction value of each of sensors belonging to a second sensor set including, as an element, a second sensor correlated with a first sensor when first data is input, the first data including a measurement value of each of sensors belonging to a first sensor set including, as an element, the first sensor of which a measurement value changes suddenly in a case where the control signal changes during a predetermined operation mode;
• generating a determination signal by determining a change in the control signal;
• generating the second data including a prediction value of each of the sensors belonging to the second sensor set from the first data included in the measurement value and the model;
• detecting an anomaly of the system or an anomaly of at least one sensor belonging to the second sensor set based on a measurement value of each of the sensors belonging to the second sensor set, the second data, the determination signal, and a threshold;
• and
• restricting detection of the anomaly in a case where the determination signal indicates that there is a change in the control signal.

A non-transitory computer-readable storage medium storing a program for causing a computer to execute:

• a function of acquiring measurement values of sensors installed in a system;
• a function of acquiring a control signal from the system;
• a function of acquiring a model that generates second data including a prediction value of each of sensors belonging to a second sensor set including, as an element, a second sensor correlated with a first sensor when first data is input, the first data including a measurement value of each of sensors belonging to a first sensor set including, as an element, the first sensor of which a measurement value changes suddenly in a case where the control signal changes during a predetermined operation mode;
• a function of generating a determination signal by determining a change in the control signal;
• a function of generating the second data including a prediction value of each of the sensors belonging to the second sensor set from the first data included in the measurement value and the model;
• a function of detecting an anomaly of the system or an anomaly of at least one sensor belonging to the second sensor set based on a measurement value of each of the sensors belonging to the second sensor set, the second data, the determination signal, and a threshold;
• and
• a function of restricting detection of the anomaly in a case where the determination signal indicates that there is a change in the control signal.