Patent Application
20240095521
The present invention relates to a learning apparatus, an anomaly detection apparatus, a learning method, an anomaly detection method, and a program.
For business operators who operate information and communication technology (ICT) systems, it is one of the most important tasks to obtain a state of anomalies that occur within the ICT systems and quickly address the anomalies. For this reason, conventionally, approaches to early detect anomalies occurring within the ICT systems have been researched. In particular, an unsupervised anomaly detection approach using deep learning (DL) is proposed in which anomaly detection is performed by learning a normal state using normal data of the ICT system and by calculating a degree of a deviation from the normal state during testing (for example, Non-Patent Documents 1 and 2).
The ICT systems provide various services, and users who use these services have various tendencies. For this reason, a large amount of normal data is required to learn the normal state of the ICT system with the unsupervised anomaly detection approach using the DL. In general, because the ICT systems tend to have a normal time period greater than an abnormal time period, a large amount of normal data can be collected in the ICT systems that are operated for a long period of time.
However, in some cases, only a small amount of normal data can be collected. For example, a sufficient amount of normal data cannot be collected immediately after an ICT system is newly constructed. Therefore, the unsupervised anomaly detection approach cannot detect anomalies until a sufficient amount of normal data is collected.
Also, for example, in a case where the normal state of the ICT system changes upon providing a new service, conventional unsupervised anomaly detection approaches cannot be used, and thus anomalies cannot be detected until a sufficient amount of normal data is collected, as in the case discussed above. in view of the situation described above, one embodiment of the present invention is provided, and an object of the present invention is to realize unsupervised anomaly detection in a target system by using a small amount of normal data.
In order to achieve the object, a learning apparatus according to one embodiment includes an input unit configured to input a normal data collection for a first system that is a target domain and to input a normal data collection for a second system that is a source domain. The learning apparatus includes a learning unit configured to train a model that includes a first autoencoder configured to input normal data for the target domain, based on the normal data collection for the first system and the normal data collection for the second system. The model includes a second autoencoder configured to input normal data for the source domain, and includes a discriminator configured to use, as an input, output data of a first encoder included in the first autoencoder or a second encoder included in the second autoencoder to output a probability that the output data is output data representing a feature for any one of the target domain and the source domain.
Unsupervised anomaly detection in a target system can be realized with a small amount of normal data.
One embodiment of the present invention will be described below. In the present embodiment, in view of a fact that each of ICT systems has a different configuration and function but the ICT systems have similar normal states in a case where the ICT systems have similar configurations and functions, an unsupervised anomaly detection approach will be described, where the unsupervised anomaly detection approach transfers, to an ICT system having only a small amount of normal data, information that is obtained when learning a normal state of an ICT system having a large amount of normal data. With such an unsupervised anomaly detection approach, an anomaly detector capable of detecting an anomaly of the ICT system (hereinafter also referred to as a target system) having only the small amount of normal data can be obtained.
With the above unsupervised anomaly detection approach, an anomaly detection apparatus 10 that creates an anomaly detector and detects an anomaly in the target system through the anomaly detector will be described as follows.
<Unsupervised Anomaly Detection Approach>
Hereinafter, a theoretical configuration of the unsupervised anomaly detection approach according to the present embodiment will be described.
First, the ICT system having the large amount of normal data is given as a source domain S, and the ICT system having only a small amount of normal data (target system) is given as a target domain T.
Also, a piece of normal data that is obtained from the source domain S is represented as n-dimensional vector data xS=[x1, . . . , xn], and a data set comprised of the n-dimensional vector data xS is represented by the following equation.
D
S
={x
1
, . . . x
|D
|} [Math. 1]
Here, n represents the number of types of data that is obtained from the source domain S, and |DS| represents the number of pieces of the n-dimensional vector data.
Likewise, a certain piece of normal data that is obtained from the target domain T is represented by m-dimensional vector data xT=[x1, . . . , xm], and a data set comprised of the m-dimensional vector data xT is represented by the following equation.
D
T
={x
1
, . . . x
|D
|} [Math. 2]
Here, m represents the number of types of data obtained from the target domain T, and |DT| represents the number of pieces of the m-dimensional vector data.
Next, a model used with the unsupervised anomaly detection approach according to the present embodiment will be described. As an approach to detect anomalies in each of the source domain S and the target domain T, an autoencoder (AE), which is a kind of the DL, is used. See Non-Patent Documents 1 and 2 described above for details of the anomaly detection using the autoencoder.
The autoencoder is comprised of an encoder E and a decoder D, and is a model in which the encoder E compresses input data, and then the decoder D restores the compressed data. That is, an autoencoder AE is expressed by AE(x)=D(E(x)), where x is the input data.
The encoder E and the decoder D are each defined using a neural network. In the following description, a parameter of the neural network included in the encoder E is denoted as and a parameter of the neural network included in the decoder D is denoted as θD. The number of layers of the neural network included in each of the encoder E and the decoder D can be arbitrarily set, but the number of layers of the neural network included in the encoder E needs to be the same as the number of layers of the neural network included in the decoder D. Further, for the neural network included in the encoder E, the number of dimensions of each of an intermediate layer and an output layer can be arbitrarily set, but the number of dimensions of an input layer needs to be the same as the number of dimensions of the input data. Also, for the neural network included in the decoder D, the number of dimensions of the intermediate layer can be arbitrarily set, but the number of dimensions of an input layer needs to be the same as the number of dimensions of the output layer in the encoder E, and further, the number of dimensions of the output layer needs to be the same as the number of dimensions of the input layer in the encoder E.
When training the autoencoder AE, a difference between input data x and output data AE(x) is calculated using a loss function L, and parameters θE and θD are learned such that the loss function L is minimized. That is, the parameters θE and θD are learned such that the loss function L set below is minimized.
L(θE,θD)=∥x−AE(x,θE,θD)∥2 [Math. 3]
In the following, an autoencoder used for the source domain S is represented by AES, and an autoencoder used for the target domain T is represented by AET. in this case, in the present embodiment, as an approach to transfer, to the autoencoder AET, information obtained when training the autoencoder AES, a model that includes a combination of the autoencoder AES and the autoencoder AET is used for a generative adversarial network (GAN)-based transfer learning approach as described in the reference document below.
Reference document “Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M.: Domainadversarial neural networks. arXiv preprint arXiv: 1412.4446 (2014)” Specifically, by extracting a feature quantity from each of the source domain S and the target domain T, a representation that can be transferred from the source domain S is acquired, and the representation is applied to the target domain T. This will be described below in detail.
Encoders of the autoencoders AES and AET are represented by the following equations.
E
S(·,θE
Outputs (that is, feature quantities derived by compressing normal data) of the encoders
E
S(xS,θE
are used as inputs, and a discriminator, which determines whether any one of the inputs is a feature quantity derived by compressing the normal data of the source domain S, or a feature quantity derived by compressing normal data of the target domain T, is represented by A(·, θA). The discriminator A is defined using a neural network, and θA is a parameter of the neural network. Here, it is assumed that the discriminator A outputs a probability that the input data represents the feature quality derived by compressing the normal data of the source domain S. For the neural network included in the discriminator A, the number of layers, and the number of dimensions, of the intermediate layer can be arbitrarily set, but the number of dimensions of the input layer needs to be the same as the number of dimensions of the output layer in each of the encoders ES and ET, and further, the number of dimensions of the output layer needs to be one.
The model comprised of the autoencoders AES, and AET and the discriminator A as described above is set as a model to be trained.
The loss function for the above-mentioned model is defined by the following equation.
L(θE
Where, α, β, γ>0 are hyperparameters, and are used to adjust respective weights for the loss function.
With use of a data set DS of the source domain S and a data set DDT of the target domain T, parameters are learned so as to minimize the loss function. That is, as described below, the parameters of the model are learned by minimizing a difference between the input and the output for each of the encoders AES and AET, and by maximizing a probability that the discriminator A performs correct discrimination.
There are various approaches to learn the parameters of the model, and an optimization technique such as Adam may be used, for example.
Instead of using Equation 6 above, the loss function may be defined by the following equation.
L(θE
In this case, the parameters of the model may be also learned using Equation 7 above.
In the present embodiment, the discriminator A outputs the probability that the input data represents the feature quality derived by compressing the normal data of the source domain S. However, such a manner is not limiting, and the discriminator A may output the probability that the input data represents the feature quality derived by compressing the normal data of the target domain T. In this case, “γ” of the third term of the loss function as given by Equation 6 above is read as “−γ,” and “log(1−A(ET(xT, θE_T), θA))” of the fourth term is read as “log(A(ET(xT, θE_T), θA)).” Likewise, “γ” of the third term of the loss function as given by Equation 8 above is read as “−γ,” and “1−A(ET(xT, θE_T), θA)” of the fourth and fifth terms is read as “A (ET(xT, θE_T), θA).” In this case, θE_T is a symbol that is obtained by adding “ET” to the lower right of θ.
Next, a case where anomaly detection in the target domain S (that is, anomaly detection in the target system) is performed will be described. The anomaly detection is performed using only an anomaly detector, where the autoencoder AET (that is, the autoencoder AET that is trained) included in a trained model as the anomaly detector. Specifically, m-dimensional vector data that is a target and is obtained from the target system is represented by the following equation, where anomaly detection is performed on the target.
{circumflex over (x)}
T [Math. 9]
If the result of calculation set above exceeds a threshold it is determined to be abnormal, and it is determined to be normal otherwise.
β∥{circumflex over (x)}T−AET({circumflex over (x)}T,θE
Here, various approaches to set the threshold τ are contemplated, and for example, an approach to set τ=μ+2σ is contemplated, where μ is an average, and σ is a variance, of results that are obtained by performing a calculation using Equation 10 above for each m-dimensional vector data xT included in the data set DT. However, this is an example, and the threshold τ may be set with any other approach. In the following text in the specification, the target m-dimensional vector data on which the anomaly detection is performed is denoted as “{circumflex over ( )}xT”.
<Hardware Configuration of Anomaly Detection Apparatus 10>
Next, a hardware configuration of the anomaly detection apparatus 10 according to the present embodiment will be described with reference to
As illustrated in
The input device 101 includes, for example, a keyboard, a mouse, or a touch panel, or the like. The display device 102 includes, for example, a display or the like.
The external I/F 103 is an interface with an external device such as a recording medium 103a. The anomaly detection apparatus 10 can perform reading and writing on the recording medium 103a via the external I/F 103. Examples of the recording medium 103a include a compact disc (CD), a digital versatile disk (DVD), a secure digital (SD) memory card, a universal serial bus (USB) memory card, and the like.
The communication I/F 104 is an interface used to couple the anomaly detection apparatus 10 to a communication network. The processor 105 may include, for example, various arithmetic devices such as a central processing unit (CPU) and a graphics processing unit (GPU). The memory device 106 may include, for example, various storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read only memory (ROM), and a flash memory.
The anomaly detection apparatus 10 according to the present embodiment has the hardware configuration illustrated in
<Functional Configuration of Anomaly Detection Apparatus 10>
Thereinafter, a functional configuration of the anomaly detection apparatus 10 according to the present embodiment will be described with reference to
As illustrated in
The anomaly detection apparatus 10 according to the present embodiment includes a target domain DB 204, a source domain DB 205, and a trained model DB 206. These databases (DBs) are implemented, for example, by the memory device 106.
The learning unit 201 trains the model illustrated in
While using the autoencoder AET included in the trained model stored in the trained model DB 206 as an anomaly detector, the inference unit 202 determines whether an anomaly has occurred in the target system by using the anomaly detector and the m-dimensional vector data {circumflex over ( )}xT that is the target on which anomaly detection is performed.
The user interface unit 203 outputs a result of determination obtained by the inference unit 202 to a user. For example, the user interface unit 203 outputs the result of the determination to a terminal or the like that an operator or the like of the target system uses.
The target domain DB 204 stores the data set D T for the target domain T. The source domain DB 205 stores the data set D s for the source domain S. The trained model DB 206 stores one or more trained models.
The functional configuration of the anomaly detection apparatus 10 illustrated in
<Flow of Overall Process Executed by Anomaly Detection Apparatus 10>
Hereinafter, a flow of the overall process executed by the anomaly detection apparatus 10 according to the present embodiment will be described with reference to
Step S101: The learning unit 201 trains the model illustrated in
Step S102: While using the autoencoder AET included in the trained model stored in the trained model DB 206 as an anomaly detector, the inference unit 202 determines whether an anomaly has occurred in the target system by using the anomaly detector and the m-dimensional vector data {circumflex over ( )}xT that is the target on which anomaly detection is performed. That is, if the result of calculation obtained using Equation 10 above exceeds the threshold value τ, the inference unit 202 determines that it is abnormal, and otherwise it is determined to be normal.
Step S103: The user interface unit 203 outputs the result (normal or abnormal) of determination obtained in step S102 to the user. The user interface unit 203 may output the result to the user, only if the result of determination obtained in step S102 is abnormal.
As described above, in the anomaly detection apparatus 10 according to the present embodiment, even in a case where the target system has only a small amount of normal data, information on the normal state of the ICT system having a large amount of normal data is transferred to the target system, thereby enabling anomalies of the target system to be detected with the unsupervised anomaly detection approach using the DL.
As described above, the learning phase and the inference phase are present in the anomaly detection apparatus 10, and a single anomaly detection apparatus 10 enables the learning phase and the inference phase in the present embodiment. However, these phases may be respectively enabled by different apparatuses. The anomaly detection apparatus 10 in the learning phase may be also referred to as a “learning apparatus” or the like.
The present invention is not limited to the above embodiments described specifically, and various modifications, changes, and combinations of any other known techniques, and the like can be made without departing from the scope set forth in the claims.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2021/004784 | 2/9/2021 | WO |
