ABNORMALITY ESTIMATING APPARATUS, ABNORMALITY DETECTION APPARATUS, ABNORMALITY DETECTION METHOD, AND ABNORMALITY DETECTION PROGRAM

Abstract

Provided is an anomaly detection device capable of acquiring a degree of anomaly required for anomaly detection even when a feature pattern of time series data changes over time. The anomaly detection device of the present invention is a device that detects the degree of anomaly in the time series data. The anomaly detection device includes a first acquisition unit, a prediction unit, and an anomaly degree acquisition unit. The first acquisition unit acquires, from a first section that is a partial section of the time series data, a dynamic feature pattern of the first section. The prediction unit predicts data of a second section that is a partial section of the time series data later than the first section by using the feature pattern to obtain predicted second section data. The anomaly degree acquisition unit acquires the degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

Claims

1. An anomaly estimation device for estimating the time when an anomaly occurred in a vehicle available for multiple users, the anomaly estimation device comprising: a processor; and a memory storing computer-executable instructions that when executed by the processor cause the device to execute a method comprising: acquiring time series data related to vibration; predicting, based on first section data that is data of a first section that is a partial section of the time series data, data of a second section that is a partial section of the time series data later than the first section to obtain predicted second section data; acquiring a degree of anomaly in the second section based on a difference between the predicted second section data and second section data that is actual data of the second section in the time series data; and determining whether an anomaly has occurred in the second section based on the acquired degree of anomaly.

2. The anomaly estimation device according to claim 1, the computer-executable instructions when executed further causing the device to execute a method comprising: acquiring a dynamic feature pattern of the first section, wherein the predicting predicts the predicted second section data using the feature pattern.

3. An anomaly detection device that detects a degree of anomaly in time series data, the anomaly detection device comprising: a processor; and a memory storing computer-executable instructions that when executed by the processor cause the device to execute a method comprising: acquiring, from a first section that is a partial section of the time series data, a dynamic feature pattern of the first section; predicting data of a second section that is a partial section of the time series data later than the first section by using the feature pattern to obtain predicted second section data; and acquiring a degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

4. An anomaly detection device that detects a degree of anomaly in time series data, the anomaly detection device comprising: a processor; and a memory storing computer-executable instructions that when executed by the processor cause the device to execute a method comprising: acquiring a feature pattern related to periodic vibration in the first section that is a partial section of the time series data and a damping rate of the periodic vibration; predicting data of a second section that is a partial section of the time series data later than the first section by using the feature pattern to obtain predicted second section data; and acquiring a degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

5-8. (canceled)

9. The anomaly detection device according to claim 1, wherein the acquiring the dynamic feature pattern obtains an eigenmode and an eigenvalue by a dynamic mode decomposition for the data of the first section, wherein the predicting predicts the data of the second section later than the first section using a predetermined number of first pieces of data of the second section, the eigenmode, and the eigenvalue to obtain predicted second section data; and wherein the acquiring the degree of anomaly acquires the degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

10. The anomaly detection device according to claim 1, wherein the acquiring the dynamic feature pattern uses, for data of a first section that is a partial section of the time series data, x(1+(k−L−1)(M+N−1)), . . . , x(N+(k−L−1)(M+N−1)+M−1), a low-rank approximated pseudo-inverse matrix X.sub.k-L,1.sup.+ obtained based on a result of singular value decomposition for X.sub.k-L,1 to obtain a linear operator A as
A=X.sub.k-L,2X.sub.k-L,1.sup.+, and obtains an eigenmode Φ.sub.k-L and an eigenvalue Λ.sub.k-L that satisfy
A=Φ.sub.k-LΛ.sub.k-LΦ.sub.k-L.sup.−1, where M, N are integers of 2 or more, n is an integer of 1 or more and N or less, L is an integer of 1 or more, k is an integer of L+1 or more, i is an integer of 1 or more, t is an integer of 1 or more and M+N−1 or less, [ ] is a symbol indicating a matrix in which numerical values are arranged in a row direction or in which column vectors are arranged in a row direction, T is a symbol indicating transpose, and x(i) is the time series data, x.sub.k,n is a column vector as x.sub.k,n=[x(n+(k−1)(M+N−1)), . . . , x(n+(k−1)(M+N−1)+M−1)], X.sub.k-L,1 is a matrix as X.sub.k-L,1=[x.sub.k-L,1 . . . x.sub.k-L,n . . . x.sub.k-L,N.sup.−1], and X.sub.k-L,2 is a matrix as X.sub.k-L,2=[x.sub.k-L,2 . . . x.sub.k-L,n . . . x.sub.k-L,N]; wherein the predicting predicts the data of the second section that is the partial section of the time series data later than the first section as
{circumflex over ( )}x.sub.k,n=Φ.sub.k-LΛ.sub.k-L.sup.n-1Φ.sub.k-Lx.sub.k,1 to obtain the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1); and wherein the acquiring the degree of anomaly acquires, from the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1) and actual data x(1+(k−1)(M+N−1)), . . . , x(N+(k−1)(M+N−1)+M−1) of the second section in the time series data, a degree of anomaly c(k) as:
c(k)=(({circumflex over ( )}x(1+(k−1)(M+N−1))−x(1+(k−1)(M+N−1))).sup.2+({circumflex over ( )}x(2+(k−1)(M+N−1))−x(2+(k−1)(M+N−1))).sup.2+, . . . ,+({circumflex over ( )}x(t+(k−1)(M+N−1))−x(t+(k−1)(M+N−1))).sup.2+, . . . ,+(({circumflex over ( )}x(k(M+N−1))−x(k(M+N−1))).sup.2).sup.1/2.

11. The anomaly detection device according to claim 3, the computer-executable instructions when executed further causing the device to execute a method comprising: acquiring a dynamic feature pattern of the first section, wherein the predicting predicts the predicted second section data using the feature pattern.

12. The anomaly detection device according to claim 3, wherein the acquiring the dynamic feature pattern obtains an eigenmode and an eigenvalue by a dynamic mode decomposition for the data of the first section, wherein the predicting predicts the data of the second section later than the first section using a predetermined number of first pieces of data of the second section, the eigenmode, and the eigenvalue to obtain predicted second section data; and wherein the acquiring the degree of anomaly acquires the degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

13. The anomaly detection device according to claim 3, wherein the acquiring the dynamic feature pattern uses, for data of a first section that is a partial section of the time series data, x(1+(k−L−1)(M+N−1)), . . . , x(N+(k−L−1)(M+N−1)+M−1), a low-rank approximated pseudo-inverse matrix X.sub.k-L,1.sup.+ obtained based on a result of singular value decomposition for X.sub.k-L,1 to obtain a linear operator A as
A=X.sub.k-L,2X.sub.k-L,1.sup.+, and obtains an eigenmode Φ.sub.k-L and an eigenvalue Λ.sub.k-L that satisfy
A=Φ.sub.k-LΛ.sub.k-LΦ.sub.k-L.sup.−1, where M, N are integers of 2 or more, n is an integer of 1 or more and N or less, L is an integer of 1 or more, k is an integer of L+1 or more, i is an integer of 1 or more, t is an integer of 1 or more and M+N−1 or less, [ ] is a symbol indicating a matrix in which numerical values are arranged in a row direction or in which column vectors are arranged in a row direction, T is a symbol indicating transpose, and x(i) is the time series data, x.sub.k,n is a column vector as x.sub.k,n=[x(n+(k−1)(M+N−1)), . . . , x(n+(k−1)(M+N−1)+M−1)], X.sub.k-L,1 is a matrix as X.sub.k-L,1=[x.sub.k-L,1 . . . x.sub.k-L,n . . . x.sub.k-L,N.sup.−1], and X.sub.k-L,2 is a matrix as X.sub.k-L,2=[x.sub.k-L,2 . . . x.sub.k-L,n . . . x.sub.k-L,N]; wherein the predicting predicts the data of the second section that is the partial section of the time series data later than the first section as
{circumflex over ( )}x.sub.k,n=Φ.sub.k-LΛ.sub.k-L.sup.n-1Φ.sub.k-Lx.sub.k,1 to obtain the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1); and wherein the acquiring the degree of anomaly acquires, from the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1) and actual data x(1+(k−1)(M+N−1)), . . . , x(N+(k−1)(M+N−1)+M−1) of the second section in the time series data, a degree of anomaly c(k) as:
c(k)=(({circumflex over ( )}x(1+(k−1)(M+N−1))−x(1+(k−1)(M+N−1))).sup.2+({circumflex over ( )}x(2+(k−1)(M+N−1))−x(2+(k−1)(M+N−1))).sup.2+, . . . ,+({circumflex over ( )}x(t+(k−1)(M+N−1))−x(t+(k−1)(M+N−1))).sup.2+, . . . ,+(({circumflex over ( )}x(k(M+N−1))−x(k(M+N−1))).sup.2).sup.1/2.

14. The anomaly detection device according to claim 4, the computer-executable instructions when executed further causing the device to execute a method comprising: acquiring a dynamic feature pattern of the first section, wherein the predicting predicts the predicted second section data using the feature pattern.

15. The anomaly detection device according to claim 4, wherein the acquiring the dynamic feature pattern obtains an eigenmode and an eigenvalue by a dynamic mode decomposition for the data of the first section, wherein the predicting predicts the data of the second section later than the first section using a predetermined number of first pieces of data of the second section, the eigenmode, and the eigenvalue to obtain predicted second section data; and wherein the acquiring the degree of anomaly acquires the degree of anomaly based on a difference between the predicted second section data and actual data of the second section in the time series data.

16. The anomaly detection device according to claim 4, wherein the acquiring the dynamic feature pattern uses, for data of a first section that is a partial section of the time series data, x(1+(k−L−1)(M+N−1)), . . . , x(N+(k−L−1)(M+N−1)+M−1), a low-rank approximated pseudo-inverse matrix X.sub.k-L,1.sup.+ obtained based on a result of singular value decomposition for X.sub.k-L,1 to obtain a linear operator A as
A=X.sub.k-L,2X.sub.k-L,1.sup.+, and obtains an eigenmode Φ.sub.k-L and an eigenvalue Λ.sub.k-L that satisfy
A=Φ.sub.k-LΛ.sub.k-LΦ.sub.k-L.sup.−1, where M, N are integers of 2 or more, n is an integer of 1 or more and N or less, L is an integer of 1 or more, k is an integer of L+1 or more, i is an integer of 1 or more, t is an integer of 1 or more and M+N−1 or less, [ ] is a symbol indicating a matrix in which numerical values are arranged in a row direction or in which column vectors are arranged in a row direction, T is a symbol indicating transpose, and x(i) is the time series data, x.sub.k,n is a column vector as x.sub.k,n=[x(n+(k−1)(M+N−1)), . . . , x(n+(k−1)(M+N−1)+M−1)], X.sub.k-L,1 is a matrix as X.sub.k-L,1=[x.sub.k-L,1 . . . x.sub.k-L,n . . . x.sub.k-L.sup.−1], and X.sub.k-L,2 is a matrix as X.sub.k-L,2=[x.sub.k-L,2 . . . x.sub.k-L,n . . . x.sub.k-L,N]; wherein the predicting predicts the data of the second section that is the partial section of the time series data later than the first section as
{circumflex over ( )}x.sub.k,n=Φ.sub.k-LΛ.sub.k-L.sup.n-1Φ.sub.k-Lx.sub.k,1 to obtain the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1); and wherein the acquiring the degree of anomaly acquires, from the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1) and actual data x(1+(k−1)(M+N−1)), . . . , x(N+(k−1)(M+N−1)+M−1) of the second section in the time series data, a degree of anomaly c(k) as:
c(k)=(({circumflex over ( )}x(1+(k−1)(M+N−1))−x(1+(k−1)(M+N−1))).sup.2+({circumflex over ( )}x(2+(k−1)(M+N−1))−x(2+(k−1)(M+N−1))).sup.2+, . . . ,+({circumflex over ( )}x(t+(k−1)(M+N−1))−x(t+(k−1)(M+N−1))).sup.2+, . . . ,+(({circumflex over ( )}x(k(M+N−1))−x(k(M+N−1))).sup.2).sup.1/2.

17. The anomaly detection device according to claim 1, wherein the vibration is associated with the vehicle.

18. The anomaly detection device according to claim 1, wherein the anomaly includes a crash of the vehicle.

19. The anomaly detection device according to claim 3, wherein the time series is associated with vibration of a vehicle.

20. The anomaly detection device according to claim 3, wherein the anomaly includes a crash of a vehicle.

21. The anomaly detection device according to claim 4, wherein the periodic vibration is associated with a vehicle.

22. The anomaly detection device according to claim 4, wherein the anomaly includes a crash of a vehicle.

Description

BRIEF DESCRIPTION OF DRAWINGS

[0011] FIG. 1 illustrates an example of probability distributions for normal and anomaly.

[0012] FIG. 2 illustrates the outline of a method using a singular spectrum transformation.

[0013] FIG. 3 illustrates a procedure of generating a data matrix.

[0014] FIG. 4 illustrates a method of calculating a degree of change using a singular spectrum transformation.

[0015] FIG. 5 illustrates results of change detection using a singular value spectrum transformation for time series data actually observed in a vehicle.

[0016] FIG. 6 illustrates a functional configuration example of an anomaly estimation device.

[0017] FIG. 7 illustrates an example of a processing flow of the anomaly estimation device.

[0018] FIG. 8 illustrates a method according to the present invention.

[0019] FIG. 9 illustrates results of estimating an anomaly for time series data actually observed in a vehicle by a procedure of the anomaly estimation device according to the present invention.

[0020] FIG. 10 illustrates a functional configuration example of an anomaly detection device.

[0021] FIG. 11 illustrates an example of a processing flow of the anomaly detection device.

[0022] FIG. 12 illustrates a configuration of a computer.

DESCRIPTION OF EMBODIMENTS

[0023] Embodiments of the present invention will be described below in detail. Note that components having the same function are given the same numeral, and duplicate description will be omitted.

First Embodiment

[0024] <Candidate 1 for a Solution Different from the Present Invention>

[0025] As a solution, a large amount of observation data for normal and observation data for anomaly are prepared to generate probability distributions. FIG. 1 illustrates an example of probability distributions for normal and anomaly. There may be a method in which, when target observation data is obtained, conditional probabilities p(x|y=1) and p(x|y=0) are calculated, and a probability density ratio is calculated as follows:

In(p(x|y=1)/p(x|y=0)),

which is a degree of anomaly. However, since the situation inside a vehicle changes from moment to moment, it is not realistic to collect a large amount of data that covers all normal patterns and all anomaly patterns. Therefore, it is difficult to estimate the normal and anomaly probability distributions. As a result, Candidate 1 for a solution cannot be used in the present invention.

[0026] <Candidate 2 for a Solution Different from the Present Invention>

[0027] FIG. 2 illustrates a method of Candidate 2. This is a method using the singular spectrum transformation disclosed in NPL 1. A degree of difference between past and current probability distributions (probability density ratio) is evaluated using the subspace method. In the singular spectrum transformation, as illustrated in FIG. 2, feature patterns are extracted by singular value decomposition of time series data of past and current sections, and a degree of change is calculated from the size of an overlap between a subspace where a past feature pattern is present and a subspace where a current feature pattern is present. Note that the current section means a section for which the degree of change is to be calculated. Specifically, the degree of change is calculated as follows.

[0028] FIG. 3 illustrates a procedure of generating a data matrix. Here, K, M, N are integers of 2 or more, n is an integer of 1 or more and N or less, L is an integer of 1 or more, k is an integer of 1 or more and K or less, i and r are each an integer of 1 or more, t is an integer of 1 or more and M+N−1 or less, [ ] is a symbol indicating a matrix in which numerical values are arranged in the row direction or in which column vectors are arranged in the row direction, T is a symbol indicating transpose, and x(i) is time series data.

[0029] Time series data x(1), . . . , x(K(M+N−1)) is divided by every M+N−1 sections to generate sections D.sub.1, D.sub.2, . . . , D.sub.k, . . . , D.sub.x which have elements of the time series data. D.sub.k is a section having section data x (1+(k−1)(M+N−1)), . . . , x(k(M+N−1)). Note that D.sub.k may be expressed as:

[0030] D.sub.k=[x(1+(k−1)(M+N−1)) . . . , x(k(M+N−1))].sup.T, which is a column vector having M+N−1 elements. The section data D.sub.k is divided into N partial time series which is each a partial time series having a window length (length of the partial time series) M and a shift width of 1. The nth partial time series x.sub.k,n of the kth section D.sub.k has M elements of time series data x(n+(k−1) (M+N−1)), . . . ,x(n+(k−1)(M+N−1)+M−1), and is expressed as:

x.sub.k,n=[x(n+(k−1)(M+N−1)), . . . ,x(n+(k−1)(M+N−1)+M−1)].sup.T,

which is a column vector. Note that for restrictions on expression, the column vector is expressed as above, but this expression means the same as:

[00001]$\begin{array}{cc}{x}_{k,n}=\left[\begin{array}{c}x\left(n+\left(k-1\right)\left(M+N-1\right)\right)\\ .Math.\\ x\left(n+\left(k-1\right)\left(M+N-1\right)+M-1\right)\end{array}\right].& \left[\mathrm{Math}.1\right]\end{array}$

[0031] The same applies to the following. Next, N elements of partial time series x.sub.k,1, . . . , x.sub.k,N of the section D.sub.k are put together into a data matrix X.sub.k as:

X.sub.k=[X.sub.k,1 . . . x.sub.k,n . . . x.sub.k,N].

Note that, although the matrix is expressed as above due to restrictions on expression, this expression means the same as:

[00002]$\begin{array}{cc}{x}_k=\left[\begin{array}{ccccc}.Math.& & .Math.& & .Math.\\ x_{k,1}& .Math.& x_{k,n}& .Math.& x_{k,N}\\ .Math.& & .Math.& & .Math.\end{array}\right].& \left[\mathrm{Math}.2\right]\end{array}$

[0032] The lines extending up and down of x.sub.k,1, x.sub.k,n, and x.sub.k,N indicate that x.sub.k,1, x.sub.k,n, and X.sub.k,N are each a column vector.

[0033] Here, the kth section D.sub.k is set as the current section (second section), and the section D.sub.k-L earlier by L sections is set as a past section (first section) to be compared. FIG. 4 illustrates a method of calculating a degree of change in Candidate 2. Note that L is called a lag and represents a relative position between the past section (first section) and the current section (second section). Singular value decomposition is performed on the data matrices X.sub.k-L and X.sub.k of the first section and the second section, respectively, and left singular vectors of the top r singular values are obtained. A matrix of singular vectors u.sub.k-L,1, u.sub.k-L,2, . . . , u.sub.k-L,r extracted from the data matrix X.sub.k-L for the first section is defined as:

U.sub.k-L,r=[u.sub.k-L,1,u.sub.k-L,2, . . . ,u.sub.k-L,r].

Here, u.sub.k-L,1, u.sub.k-L,2, . . . , u.sub.k-L,r are each a column vector. Similarly, a matrix of singular vectors q.sub.k,1, q.sub.k,2, . . . , q.sub.k,r extracted from the data matrix X.sub.k-L for the second section is defined as:

Q.sub.k,r=[q.sub.k,1,q.sub.k,2, . . . ,q.sub.k,r].

Here, q.sub.k,1, q.sub.k,2, . . . , q.sub.k,r are each a column vector. Note that r may be set to a different value between the first section and the second section.

[0034] A degree of change c(k) is:

c(k)=1−//U.sub.k-L,r.sup.TQ.sub.k,r//.sub.2.

Here, // //.sub.2 represents a matrix 2-norm, and //U.sub.k-L,r.sup.TQ.sub.k,r//.sub.2 is equal to the maximum singular value of U.sub.k-L,r.sup.TQ.sub.k,r.

[0035] FIG. 5 illustrates results of change detection using a singular value spectrum transformation for time series data actually observed in a vehicle. The vertical axis in (A) of FIG. 5 indicates the amplitude of input time series data, the vertical axis in (B) of FIG. 5 indicates the degree of change, and the horizontal axis of both indicates time. The sampling frequency of time series data used in an experiment was 16 kHz. Ranges indicated by arrows in (A) of FIG. 5 are sections in which an anomaly is be detected. In this experiment, a partial time series was used in which the length was set to M=256, and a data matrix was used in which the number of columns was set to N=128 and the lag was set to L=128. Further, r which represents the number of extracted singular vectors was set to the number of top singular vectors having singular values whose cumulative contribution rate is up to 80%. In (B) of FIG. 5, a threshold value for a degree of change is set to 0.4, and points where the degree of change exceeds the threshold value are each marked with a triangle in order to emphasize the points determined to be anomalies. From FIG. 5, it can be seen that some points are determined to be anomalies in sections other than the sections for which an anomaly is be detected. Further, referring to (A) of FIG. 5, large vibrations around 43 seconds, 81 seconds, and 99 seconds are found. From the results of (B) of FIG. 5, it can be seen that only these three places can be detected even if the threshold value is changed as appropriate.

[0036] In the technique of NPL 1, a feature pattern is extracted by singular value decomposition for the section of interest. This corresponds to decomposing the eigenvalues of a variance matrix of a data matrix for the section of interest. Accordingly, since only the section of interest is focused on and direction vectors are extracted such that their variance becomes large, only the static feature patterns assuming that the section of interest is stationary are successfully extracted. However, in an environment where the situation changes from moment to moment, such stationarity cannot be assumed, so that it is believed that features fail to be extracted correctly and thus the error in the degree of change becomes large, resulting in an increase in false detection.

[0037] <Anomaly Estimation Device of the Present Invention>

[0038] FIG. 6 illustrates an example of a functional configuration of an anomaly estimation device, and FIG. 7 illustrates an example of a processing flow of the anomaly estimation device. FIG. 8 illustrates a method according to the present invention. An anomaly estimation device 10 is a device for estimating the time when an anomaly occurred in a vehicle available for multiple users. The anomaly estimation device 10 includes a sensor 210, a first acquisition unit 110, a prediction unit 120, an anomaly degree acquisition unit 130, and an anomaly determination unit 220. The sensor 210 is installed in a vehicle and acquires time series data x(i) related to vibration (S210). Note that, in the following, a first section (past section) is a section as a reference for obtaining a degree of anomaly, and a second section (current section) is a section for which the degree of anomaly is to be obtained.

[0039] The first acquisition unit 110 acquires a dynamic feature pattern of the first section (past section) D.sub.k-L, that is a partial section of the time series data x(i) (S110). The dynamic feature pattern is a feature pattern related to a periodic vibration and a damping rate of the periodic vibration. In other words, what periodic vibration causes changes over time and what damping (increase) rate the periodic vibration has are extracted. More specifically, a dynamic eigenmode m (matrix in which M-dimensional column vectors are arranged for the number of ranks) and an eigenvalue Λ=diag(λ.sub.1) for the first section are obtained by dynamic mode decomposition. Next, the dynamic mode decomposition will be described. Note that the “damping rate” described herein includes a case where it increases when the positive or negative sign is reversed.

[0040] Similar to the description of Candidate 2 with reference to FIG. 3, the time series data x(i) is divided by every M+N−1 sections to obtain sections D.sub.1, D.sub.2, . . . , D.sub.k, . . . , D.sub.K. The (k−L)th section D.sub.k-L is the first section (past section), and the kth section D.sub.k is the second section (current section). The first acquisition unit 110 generates a partial time series x.sub.k,1, . . . , x.sub.k,N, which are each a column vector, in which the nth partial time series x.sub.k-L,n for the section D.sub.k-L is:

X.sub.k-L,n=[x(n+(k−L−1)(M+N−1)), . . . ,x(n+(k−L−1)(M+N−1)+M−1)].sup.T,

The first acquisition unit 110 generates a matrix X.sub.k-L,1=[x.sub.k,1 . . . x.sub.k,n . . . x.sub.k,N-1] and a matrix X.sub.k-L,2=[x.sub.k,2 . . . X.sub.k,n . . . x.sub.k,N]. Note that the matrix X.sub.k-L,1 and the matrix X.sub.k-L,2 are expressed as the above for convenience of expression, but these expressions mean the same as the following:

[00003]$\begin{array}{cc}{X}_{k-L,1}=\left[\begin{array}{ccccc}.Math.& & .Math.& & .Math.\\ x_{k-L,1}& .Math.& x_{k-L,n}& .Math.& x_{k-L,N-1}\\ .Math.& & .Math.& & .Math.\end{array}\right]& \left[\mathrm{Math}.3\right]\end{array}$$\begin{array}{cc}{X}_{k-L,2}=\left[\begin{array}{ccccc}.Math.& & .Math.& & .Math.\\ x_{k-L,2}& .Math.& x_{k-L,n}& .Math.& x_{k-L,N}\\ .Math.& & .Math.& & .Math.\end{array}\right].& \left[\mathrm{Math}.4\right]\end{array}$

[0041] The first acquisition unit 110 uses a low-rank approximated pseudo-inverse matrix X.sub.k-L,1.sup.+ obtained based on the result of singular value decomposition for X.sub.k-L,1 to obtain a linear operator A as:

A=X.sub.k-L,2X.sub.k-L,1.sup.+.

Then, the first acquisition unit 110 obtains an eigenmode Φ.sub.k-L and an eigenvalue Λ.sub.k-L so as to satisfy:

A=Φ.sub.k-LΛ.sub.k-LΦ.sub.k-L.sup.−1

(S110).

[0042] Note that the detailed procedure for obtaining the linear operator A from the singular value decomposition using a pseudo-inverse function is as follows. First, performing singular value decomposition on X.sub.k-L,1,

[0043] a singular matrix Σ.sub.k-L,1 and unitary matrices U.sub.k-L,1, V.sub.k-L,1 are obtained as:

X.sub.k-L,1=U.sub.k-L,1Σ.sub.k-L,1V.sub.k-L,1.sup.T.

Approximating these up to the number of ranks r results in:

X.sub.k-L,1,r=U.sub.k-L,1,rΣ.sub.k-L,1,rV.sub.k-L,1,r.sup.T.

The low-rank approximated pseudo-inverse matrix X.sub.k-L,1* can be obtained as:

X.sub.k-L,1.sup.+=V.sub.k-L,1,rΣ.sub.k-L,1,r.sup.−1U.sub.k-L,1,r.sup.T.

Thus, by the singular value decomposition and low-rank approximation for X.sub.k-L,1, the linear operator A can be obtained as:

A=X.sub.k-L,2V.sub.k-L,1,rΣ.sub.k-L,1,r.sup.−1U.sub.k-L,1,r.sup.T.

In this way, the low-rank approximation makes it possible to reduce the computation cost.

[0044] Further, the detailed procedure for obtaining the eigenmode Φ.sub.k-L and the eigenvalue Λ.sub.k-L is as follows. Again, the low-rank approximation is used to reduce costs. First,

[0045] .sup.˜A is obtained as:

.sup.˜A=U.sub.k-L,1,r.sup.TAU.sub.k-L,1,r

=U.sub.k-L,1,rX.sub.k-L,2V.sub.k-L,1,rΣ.sub.k-L,1,r.sup.−1.

By eigenvalue decomposition,

[0046] a matrix W in which rows of eigenvectors are arranged to satisfy

.sup.˜AW=WΛ

and an eigenvalue Λ.sub.k-L=diag(λ.sub.j) are obtained. Then, the unique mode Φ.sub.k-L is obtained as:

Φ.sub.k-L=X.sub.k-L,2V.sub.k-L,1,rΣ.sub.k-L,1,r.sup.−1W.

The eigenmode Φ.sub.k-L and the eigenvalue Λ.sub.k-L obtained in this way satisfy the following relation:

AΦ.sub.k-L=Φ.sub.k-LΛ.

[0047] The prediction unit 120 predicts, based on first section data that is data of the first section D.sub.k-L that is a partial section of the time series data, data of the second section D.sub.k that is a partial section of the time series data later than the first section D.sub.k-L to obtain predicted second section data (S120). Specifically, the data of the second section is predicted using the first partial time series x.sub.k,l of the second section and the feature pattern (eigenmode Φ.sub.k-L and eigenvalue Λ.sub.k-L), and the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1) (M+N−1)+M−1) is obtained. As described above, the eigenmode Φ.sub.k-L and the eigenvalue Λ.sub.k-L are acquired by the first acquisition unit 110. The prediction unit 120 obtains {circumflex over ( )}x.sub.k,n for n=2, . . . , N as:

{circumflex over ( )}x.sub.k,n=Φ.sub.k-LΛ.sub.k-L.sup.n-1Φ.sub.k-L.sup.−1x.sub.k,1.

Alternatively, the prediction unit 120 may first obtain

b=Φ.sub.k-L.sup.−1x.sub.k,1, and

[0048] obtain {circumflex over ( )}x.sub.k,n for n=2, . . . , N as:

{circumflex over ( )}x.sub.k,n=Φ.sub.k-LΛ.sub.k-L.sup.n-1b.

[0049] Then, the prediction unit 120 may set the first elements of the partial time series x.sub.k,1 and the predicted partial time series {circumflex over ( )}x.sub.k,2, . . . , {circumflex over ( )}X.sub.k,N-1 as the first to (N−1)th data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N−1+(k−1)(M+N−1)) of the predicted second section data, and set all elements of the predicted partial series {circumflex over ( )}x.sub.k,N as the Nth to (M+N−1)th data {circumflex over ( )}x(N+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1) of the predicted second section data. Note that, although “{circumflex over ( )}” is described in front of “x” due to restrictions on expression, it has the same meaning as “{circumflex over ( )}” placed on the top of “x” as illustrated in FIG. 8. Since the predicted second section data is obtained as described above, it is possible to obtain data for evaluating how much the dynamic pattern of the current section (second section) can be expressed by the dynamic feature pattern of the past section (first section).

[0050] The anomaly degree acquisition unit 130 acquires a degree of anomaly in the second section based on a difference between the predicted second section data and second section data that is actual data of the second section in the time series data (S130). Specifically, the anomaly degree acquisition unit 130 may acquire, from the predicted second section data {circumflex over ( )}x(1+(k−1)(M+N−1)), . . . , {circumflex over ( )}x(N+(k−1)(M+N−1)+M−1) and the actual data x(1+(k−1)(M+N−1)), . . . , x(N+(k−1)(M+N−1)+M−1) of the second section in the time series data, a degree of anomaly c(k) as:

c(k)=(({circumflex over ( )}x(1+(k−1)(M+N−1))−x(1+(k−1)(M+N−1))).sup.2+({circumflex over ( )}x(2+(k−1)(M+N−1))−x(2+(k−1)(M+N−1))).sup.2+, . . . ,+({circumflex over ( )}x(t+(k−1)(M+N−1))−x(t+(k−1)(M+N−1))).sup.2+, . . . ,+(({circumflex over ( )}x(k(M+N−1))−x(k(M+N−1))).sup.2).sup.1,2.

Note that the above expression is:

[00004]$\begin{array}{cc}c\left(k\right)=\sqrt{\underset{t=1+\left(k-1\right)\left(M+N-1\right)}{\overset{k\left(M+N-1\right)}{.Math.}}{\left(\hat{x}\left(t\right)-x\left(t\right)\right)}^2}& \left[\mathrm{Math}.5\right]\end{array}$

[0051] as having the same meaning.

[0052] The anomaly determination unit 220 determines whether or not an anomaly has occurred in the second section based on the acquired degree of anomaly (S220). For example, a threshold value for the degree of anomaly may be set, and when there is a difference exceeding the threshold value, it may be determined that an anomaly has occurred.

[0053] FIG. 9 illustrates results of estimating an anomaly for time series data actually observed in a vehicle by a procedure of the anomaly estimation device 10 according to the present invention. The vertical axis in (A) of FIG. 9 indicates the amplitude of input time series data, the vertical axis in (B) of FIG. 9 indicates the degree of anomaly, and the horizontal axis of both indicates time. The data in (A) of FIG. 9 is the same as that in (A) of FIG. 5. Similar to the experiment illustrated in FIG. 5, the sampling frequency of time series data used in an experiment was 16 kHz; ranges indicated by arrows in (A) of FIG. 9 are sections in which an anomaly is be detected. In this experiment, a partial time series was used in which the length was set to M=256, and a history matrix and a test matrix were used in which the number of columns was set to N=128 and the lag was set to L=128. Further, the number of ranks r was set to the number of top singular vectors having singular values whose cumulative contribution rate is up to 80%. In (B) of FIG. 9, a threshold value for a degree of anomaly is set to 0.3, and points where the degree of anomaly exceeds the threshold value are each marked with a triangle in order to emphasize the points determined to be anomalies. The setting of this threshold value corresponds to the above-mentioned anomaly determination unit 220. In (B) of FIG. 9, it can be seen that points determined to be anomaly are concentrated in sections where an anomaly is to be detected. In particular, in (B) of FIG. 9, only large vibrations around 43 seconds, 81 seconds, and 99 seconds are detected. Therefore, according to the anomaly estimation device of the present invention, a range where there is no anomaly can be excluded, so that it is possible to limit images to be checked to investigate the cause of a scratch on a vehicle available for multiple users.

Second Embodiment

Anomaly Detection Device of the Present Invention

[0054] In the first embodiment, the application is limited to a vehicle available for multiple users such as a shared vehicle and a rental car. However, the present invention can be widely applied to time series data in which a feature pattern may change over time. In other words, the data to be acquired by the sensor does not have to be limited to data related to vibration. Accordingly, in a second embodiment, an anomaly detection device will be described that receives input of some time series data and outputs a degree of anomaly for which an anomaly is likely to be detected.

[0055] FIG. 10 illustrates an example of a functional configuration of the anomaly detection device of the present invention, and FIG. 11 illustrates an example of a processing flow of the anomaly detection device of the present invention. The anomaly detection device 20 is a device for detecting a degree of anomaly in time series data. The anomaly detection device 20 includes the first acquisition unit 110, the prediction unit 120, and the anomaly degree acquisition unit 130. In order to show the relationship with the anomaly estimation device 10 of the first embodiment, the anomaly estimation device 10, the sensor 210, and the anomaly determination unit 220 are illustrated by dotted lines in FIG. 10.

[0056] To the anomaly detection device 20, time series data x(i) is input (S211). The first acquisition unit 110 acquires, from the first section (past section) D.sub.k-L, that is a partial section of the time series data, a dynamic feature pattern of the first section (S110). The prediction unit 120 predicts, based on first section data that is data of the first section D.sub.k-L that is a partial section of the time series data, data of the second section D.sub.k that is a partial section of the time series data later than the first section D.sub.k-L to obtain predicted second section data (S120). The anomaly degree acquisition unit 130 acquires a degree of anomaly in the second section based on a difference between the predicted second section data and second section data that is actual data of the second section in the time series data (3130). Steps S110, S120, and S130 are the same as in the first embodiment.

[0057] In the method of obtaining the degree of change from a degree of overlap between the eigenmode of the past section and the eigenmode of the current section as described as Candidate 2 in the first embodiment, an eigenvalue representing a damping (increase) rate is not taken into consideration. Therefore, even if there is an eigenmode with the same frequency, in a case where a damping feature pattern is for the past section and an increase feature pattern is for the current section, they are distinguished only by comparing their eigenmodes, so that a degree of change available for anomaly detection cannot be acquired.

[0058] According to the present invention, a dynamic feature pattern of the section of interest can be estimated only from time series data, so that the accuracy of estimating a degree of change of the time series data obtained from a system in which the situation changes dynamically is improved, and thus the detection accuracy of the changed part is improved. Since the feature pattern extracted in the observation section is a signal corresponding to an eigenmode (eigenfrequency), the data can be easily interpreted. Therefore, according to the anomaly detection device of the present invention, the predicted second section data is obtained based on the dynamic feature pattern, so that it is possible to acquire the degree of anomaly required for anomaly detection even when the feature pattern of the time series data changes over time.

[0059] [Program, Storage Medium]

[0060] The various types of processing described above can be performed in a manner that a program for executing the respective steps of the above method is loaded on a storage unit 2020 of a computer illustrated in FIG. 12 and operates through a control unit 2010, an input unit 2030, an output unit 2040, and the like.

[0061] The program describing the processing content can be stored in a computer-readable storage medium. The computer-readable storage medium may be, for example, a magnetic storage device, an optical disk, a magneto-optical storage medium, a semiconductor memory, or the like.

[0062] Further, the distribution of such a program is performed, for example, by selling, transferring, or renting a portable storage medium such as a DVD or CD-ROM in which the program is stored. In addition, the program may be stored in a storage device of a server computer, and then the program may be distributed by being transferred from the server computer to another computer via a network.

[0063] A computer that executes such a program first temporarily stores, for example, the program stored in a portable storage medium or the program transferred from a server computer in its own storage device. Then, to execute processing, the computer reads the program stored in its own storage medium and executes the processing according to the read program. Further, as another execution form of this program, a computer may read the program directly from a portable storage medium and execute processing according to the program, and also, every time the program is transferred from a server computer to this computer, processing according to the received program may be executed sequentially. Further, the above-mentioned processing may be executed by a so-called ASP (Application Service Provider) type service, which implements processing function only by executing a program in accordance with an instruction and acquiring a result without transferring the program from a server computer to this computer. Note that the program in this form includes information to be used for processing performed by a computer and equivalent to the program (data that is not a direct command to the computer but has a property for defining the processing of the computer, etc.).

[0064] Further, in this form, the present device is configured by executing a predetermined program on a computer, but at least a part of these processing contents may be realized by hardware.

REFERENCE SIGNS LIST

[0065] 10 Anomaly estimation device [0066] 20 Anomaly detection device [0067] 110 First acquisition unit [0068] 120 Prediction unit [0069] 130 Anomaly degree acquisition unit [0070] 210 Sensor [0071] 220 Anomaly determination unit