Anomaly detection apparatus, method, and storage medium

A method for detecting anomaly in a system comprising a plurality of sensors installed in power plants, water treatment plants, or manufacturing equipment, the method comprising:

• acquiring, by a processing circuit via a wired or wireless network, measured values from the plurality of sensors, the measured values including time-series data measured from time to time by each of the plurality of sensors;
• acquiring, by the processing circuit, a first function to output predicted values of the measured values upon receipt of the measured values, the first function being a trained model generated by machine learning using training data generated from history data of measured values of the plurality of sensors;
• acquiring, by the processing circuit, a first threshold;
• acquiring, by the processing circuit, a second function to output a second threshold upon receipt of feature quantities related to a change in the measured values over time, the second function being configured to output a higher value as the second threshold when the feature quantities indicate a rapid change in the measured values and output a lower value as the second threshold when the feature quantities indicate a minimal change;
• generating, by the processing circuit, the predicted values based on the measured values and the first function;
• temporarily detecting, by the processing circuit, that a deviation between the measured values and the predicted values exceeds the first threshold to generate a temporary detection signal related to a result of the temporary detection;
• counting, by the processing circuit, the number of consecutive times of the temporary detection at a time for monitoring based on the temporary detection signal;
• calculating, by the processing circuit, the feature quantities based on a change in the measured values over time;
• determining, by the processing circuit, a second threshold based on the feature quantities and the second function;
• determining, by the processing circuit, whether the number of consecutive times is equal to or larger than the second threshold to detect one of an anomaly of the system to be monitored and a sign of the anomaly, and generating a detection signal related to a result of the detection, the detection signal including a plurality of elements corresponding respectively to the plurality of sensors;
• and
• outputting, by the processing circuit, the detection signal to an external device.

A non-transitory computer-readable storage medium storing a program for detecting anomaly in a system comprising a plurality of sensors installed in power plants, water treatment plants, or manufacturing equipment, the program causes a computer to execute:

• a function of acquiring, via a wired or wireless network, measured values from the plurality of sensors, the measured values including time-series data measured from time to time by each of the plurality of sensors;
• a function of acquiring a first function to output predicted values of the measured values upon receipt of the measured values, the first function being a trained model generated by machine learning using training data generated from history data of measured values of the plurality of sensors;
• a function of acquiring a first threshold;
• a function of acquiring a second function to output a second threshold upon receipt of feature quantities related to a change in the measured values over time, the second function being configured to output a higher value as the second threshold when the feature quantities indicate a rapid change in the measured values and output a lower value as the second threshold when the feature quantities indicate a minimal change;
• a function of generating the predicted values based on the measured values and the first function;
• a function of temporarily detecting that a deviation between the measured values and the predicted values exceeds the first threshold to generate a temporary detection signal related to a result of the temporary detection;
• a function of counting the number of consecutive times of the temporary detection at a time for monitoring based on the temporary detection signal;
• a function of calculating the feature quantities based on a change in the measured values over time;
• a function of determining a second threshold based on the feature quantities and the second function;
• a function of determining whether the number of consecutive times is equal to or larger than the second threshold to detect one of an anomaly of the system to be monitored and a sign of the anomaly and generating a detection signal related to a result of the detection, the detection signal including a plurality of elements corresponding respectively to the plurality of sensors;
• and
• a function of outputting the detection signal to an external device.