Abnormality detection device, learning device, abnormality detection method, and learning method

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2016-183085, filed Sep. 20, 2016; the entire contents of which are incorporated herein by reference.

Embodiments described herein relate generally to an abnormality detection device, a learning device, an abnormality detection method, and a learning method.

Abnormality detection is a technology of modeling major trends in data and discovering data that should not originally exist. This is applied in various fields such as device failure detection or prediction, and network fraud detection, and is expected to be more widely applied with the development of the Internet of Things (IoT). As a method for detecting an abnormality of data, an abnormality detection method using an auto encoder is known. In this abnormality detection method, an abnormality is detected using a model which compresses and reconstructs data with as little loss as possible using a pattern or a relationship between pieces of normal data. This model performs compression and reconstruction processing with little data loss (reconstruction errors) when normal data is processed, but data loss is great when abnormal data is processed. In this abnormality detection method, an abnormality of data is detected on the basis of a magnitude of this data loss.

The auto encoder models low dimensional manifolds with high density among high dimensional data. That is, data is projected to the manifolds in compression processing, and manifolds are projected to a high dimensional space in reconstruction processing. For example, as shown in FIG. 7 , a plurality of pieces (plots) of data displayed in two dimensions are projected onto a one-dimensional manifold A by compression processing. In addition, the data projected onto a one-dimensional manifold A is projected into a two-dimensional space by reconstruction processing. For this reason, an abnormality (reconstruction error) detected by the auto encoder is determined on the basis of a Euclidean distance from data to a manifold (for example, a distance D 1 shown in FIG. 7 ). For example, when image data (normal data) of the vehicle of the data number 1 shown in FIG. 6 is processed by the auto encoder, a reconstruction error between original image data and reconstruction data is small, and thus the image data is determined to be normal. On the other hand, when image data (abnormal data) in which part of the vehicle of the data number 2 is missing is processed by the auto encoder, reconstruction data in which the missing part is supplemented is generated, and thus a reconstruction error between original image data and reconstruction data increases, and the image data is determined to be abnormal.

However, since data density on a manifold is not considered in the processing by the auto encoder, an abnormality of data cannot be detected in some cases. For example, image data (abnormal data) of a vehicle compressed in a height direction of a data number 3 shown in FIG. 6 is data (for example, data B 1 shown in FIG. 7 ) positioned in a range with a low data density. When the image data is processed by the auto encoder, a reconstruction error between original image data and reconstruction data is not large, and thus the image data is determined to be normal. In addition, in the same manner, image data (abnormal data) of a vehicle in which a doorknob of a data number 4 shown in FIG. 6 is missing is also determined to be normal.

In addition, when squared error minimization is used to obtain a reconstruction error in the processing by the auto encoder, methods in which respective data are separated from manifolds are uniformly assumed to be a normal distribution, and thus an accurate reconstruction error may not be obtained in some cases.

In addition, as an image processing technology using learning data, a hostile network (Generative Adversarial Network: GAN) which can define a prior distribution with high degrees of freedom has been studied. In the GAN, a decoder which generates database on a prior distribution and an identifier which determines whether data is true data or generated data are used. The GAN is a data generation model and has a function of generating data based on a prior distribution, but does not have a function of reversely converting data into a prior distribution, and thus cannot be used for abnormality detection.

FIG. 1 is a flowchart which shows an outline of processing by a learning device and an abnormality detection device according to an embodiment.

FIG. 2 is a functional block diagram which shows an example of the learning device according to the embodiment.

FIG. 3 is a functional block diagram which shows an example of the abnormality detection device according to the embodiment.

FIG. 4 is a flowchart which shows an example of a flow of processing by the learning device according to the embodiment.

FIG. 5 is a flowchart which shows an example of a flow of processing by the abnormality detection device according to the embodiment.

FIG. 6 is a view which shows an example of a detection result by an auto encoder and the abnormality detection device according to the embodiment.

FIG. 7 is a view which describes compression and reconstruction processing of data by the auto encoder.

An abnormality detection device of an embodiment includes an encoder, a first identifier, a decoder, and a second identifier. The encoder is configured to compress input data using a compression parameter to generate compressed data. The first identifier is configured to determine whether a distribution of the compressed data input by the encoder is a distribution of the compressed data or a predetermined prior distribution, and input a first identification result to the encoder. The decoder is configured to decode the compressed data using a compressing parameter to generate reconstructed data. The second identifier is configured to determine whether the reconstructed data input by the decoder is the reconstruction data or the input data and output a second identification result to the encoder and the decoder. Hereinafter, an abnormality detection device, a learning device, and an abnormality detection method, of embodiments will be described with reference to the drawings.

FIG. 1 is a flowchart which shows an outline of processing of a learning device and an abnormality detection device of an embodiment. A learning device 1 performs compression processing and decoding processing (reconstruction processing) of normal data as a preparation for performing abnormality detection of data, thereby ascertaining patterns and relationships of data in the normal data and learning a procedure to perform the compression and decoding processing with few reconstruction errors. For example, the learning device 1 performs compression and decoding processing of learning data D 1 , and calculates a learning parameter P 1 which adapts to the learning data D 1 .

The learning data D 1 includes, for example, arbitrary data such as sensor data measured by various types of sensors, operation log data of various types of apparatuses, data of various numerical values, and data of various categories. The learning data D 1 includes normal data of these types of data. The learning data D 1 may include a small amount of abnormal data. Hereinafter, a stage at which the learning processing is performed by the learning device 1 is referred to as a “learning stage.”

An abnormality detection device 1 A detects abnormality of detection data (input data) D 2 using the learning parameter P 1 calculated by the learning device 1 , and outputs a detection result R 1 . The abnormality detection device 1 A can perform compression and decoding processing with small reconstruction errors on normal data, but the reconstruction errors are large when the compression and decoding processing are performed on data with a different trend from the normal data (abnormal data). A reconstruction error shows a difference between normal data and reconstruction data generated by compressing and decoding the normal data. It is possible to detect abnormal data by detecting and identifying the reconstruction error. Hereinafter, the phase in which the abnormality detection processing is performed by the abnormality detection device 1 A refers to “abnormality detection stage”. The learning device 1 and the abnormality detection device 1 A are names classified according to the processing stage. For this reason, the learning device 1 and the abnormality detection device 1 A may be implemented by the same configuration and/or same hardware and software components.

FIG. 2 is a functional block diagram which shows an example of the learning device 1 of the embodiment. The learning device 1 includes, for example, an encoder 10 , a decoder 12 , a first identifier 14 , and a second identifier 16 .

The encoder 10 compresses the learning data D 1 and generates a compressed data and outputs the compressed data to the first identifier 14 and the decoder 12 . In addition, the encoder 10 adjusts a parameter (compression parameter) used for compression processing to adapt to the learning data D 1 on the basis of an identification result input from the first identifier 14 . For example, the encoder 10 adjusts a compression parameter so that a difference between a distribution of the compressed data generated by the encoder 10 and a prior distribution is reduced. The prior distribution is a probability distribution defined before the learning stage, and an arbitrary distribution such as a normal distribution, a multinomial distribution, or a uniform distribution is defined. That is, the encoder 10 adjusts the compressing parameter to bring the compressed data closer to the prior distribution so that the first identifier 14 determines that a distribution of the compressed data input from the encoder 10 is the prior distribution.

The decoder 12 generates reconstruction data by decoding the compressed data input from the encoder 10 , and outputs the reconstruction data to the second identifier 16 . In addition, the decoder 12 adjusts a parameter (decoding parameter) used for decoding processing to adapt to the learning data D 1 on the basis of an identification result input from the second identifier 16 . For example, the decoder 12 adjusts the decoding parameter so that a difference between the reconstruction data generated by the decoder 12 and the learning data D 1 is reduced. That is, the decoder 12 adjusts the decoding parameter so that the second identifier 16 determines that the reconstruction data input from the decoder 12 is the learning data D 1 .

The first identifier 14 determines whether a distribution of compressed data input by the encoder 10 is the distribution of the compressed data or the prior distribution prepared in advance, and outputs an identification result (a first identification result) to the encoder 10 . For example, the first identifier 14 processes the compressed data input from the encoder 10 using a neural net, and generates final layer data and intermediate layer data. The final layer data corresponds to an output value of the neural net and the intermediate layer data corresponds to data of all layers except the final layer data and input layer data. For example, data of a layer immediately before a final layer is referred to as intermediate layer data. In addition, the first identifier 14 processes data sampled from the prior distribution using the neural net, and generates the final layer data and the intermediate layer data. The first identifier 14 compares intermediate layer data obtained from the compressed data with intermediate layer data obtained from the data sampled from the prior distribution, and performs the identification processing.

The second identifier 16 determines whether the reconstruction data input from the decoder 12 is the reconstruction data or the learning data D 1 on which the compression and decoding processing are not performed, and outputs an identification result (a second identification result) to the encoder 10 and the decoder 12 . For example, the second identifier 16 processes the reconstruction data input from the decoder 12 using the neural net, and generates final layer data and intermediate layer data. In addition, the second identifier 16 processes the learning data D 1 using the neural net, and generates final layer data and intermediate layer data. The second identifier 16 compares the intermediate layer data obtained from the reconstruction data with the intermediate layer data obtained from the learning data, and performs the identification processing.

Each of the encoder 10 and the decoder 12 adjusts the compressing parameter and the decoding parameter on the basis of the second identification result so that a difference between the reconstruction data and the learning data D 1 is reduced. That is, each of the encoder 10 and the decoder 12 adjusts the compressing parameter and the decoding parameter to bring the reconstruction data closer to the learning data D 1 so that the second identifier 16 determines that the reconstruction data input from the decoder 12 is the learning data D 1 .

By repeatedly performing the identification processing of the first identifier 14 and the parameter adjustment processing of the encoder 10 on a plurality of pieces of learning data, the encoder 10 ascertains patterns and relationships in normal data, and learns a procedure for performing compression processing to generate compressed data having a distribution close to the prior distribution. In addition, by repeatedly performing the identification processing of the second identifier 16 and the parameter adjustment processing of the encoder 10 and the decoder 12 on a plurality of pieces of learning data, the encoder 10 and the decoder 12 ascertain patterns and relationships in normal data, and learn a procedure for performing the compression and decoding processing with few reconstruction errors.

FIG. 3 is a functional block diagram which shows an example of the abnormality detection device 1 A of the embodiment. The abnormality detection device 1 A includes, for example, the encoder 10 , the decoder 12 , the first identifier 14 , and the second identifier 16 in the same manner as the learning device 1 .

The encoder 10 compresses the detection data D 2 , and outputs the compressed data to the first identifier 14 and the decoder 12 . For example, the encoder 10 encodes the detection data D 2 into a prior distribution. Accordingly, it is possible to calculate a logarithm probability on the prior distribution of the detection data D 2 . The detection data D 2 includes arbitrary data, for example, sensor data measured by various types of sensors, operation log data of various types of apparatuses, data of various numerical values, and data of various categories.

The decoder 12 generates reconstruction data by decoding the compressed data input from the encoder 10 , and outputs the reconstruction data to the second identifier 16 .

The first identifier 14 determines that the compressed data is abnormal (a first abnormality) when a sum of a logarithm probability density on the prior distribution of the compressed data input from the encoder 10 and a logarithm density of a compressed data distribution and a prior distribution is equal to or less than a predetermined threshold value (a first threshold value), and determines that the compressed data is normal when the sum is greater than the first threshold value. A logarithm density ratio of the compressed data distribution to the prior distribution is obtained as a logarithm of the quotient of a priority distribution probability with respect to a compressed data probability output as a final layer of the first identifier 14 . That is, the first identifier 14 sets a definition of abnormal data as rare data viewed from a normal data distribution. An occurrence probability p(x) of data x is modeled to detect rare data. The first identifier 14 may display an abnormality detection result on a display unit (not shown). In addition, the first identifier 14 may also output the abnormality detection result to an external management terminal (not shown).

The second identifier 16 calculates an abnormality degree indicating a degree of a difference between the reconstruction data input from the decoder 12 and the detection data D 2 , and performs abnormality detection of the detection data D 2 on the basis of the abnormality degree. The second identifier 16 determines that the detection data D 2 is abnormal (a second abnormality), for example, when the abnormality degree is equal to or greater than a predetermined threshold value (a second threshold value), and determines that the detection data D 2 is normal when the abnormality degree is less than the second threshold value. The second identifier 16 may display an abnormality detection result on a display unit (not shown). Moreover, the second identifier 16 may also output the abnormality detection result to an external management terminal.

Some or all of the respective functional units of the learning device 1 and the abnormality detection device 1 A may be realized by a processor executing a program (software). In addition, some or all of the respective functional units of the learning device 1 and the abnormality detection device 1 A may be realized by hardware such as a large scale integration (LSI), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA), and may also be realized by a combination of software and hardware.

Next, an operation of the learning device 1 of the embodiment will be described. FIG. 4 is a flowchart which shows an example of a flow of processing by the learning device 1 of the embodiment.

First, the encoder 10 samples at least one piece of learning data D 1 from a plurality of pieces of learning data D 1 (hereinafter referred to as a “learning data group”) stored in, for example, a learning database (not shown), compresses the learning data D 1 , and outputs the compressed data to the first identifier 14 and the decoder 12 (step S 101 ). The encoder 10 may randomly sample the learning data D from the learning database.

Next, the decoder 12 generates reconstruction data by decoding the compressed data input from the encoder 10 , and outputs the reconstruction data to the second identifier 16 (step S 103 ).

Next, the first identifier 14 identifies which vector of a vector of the compressed data input from the encoder 10 and a vector sampled from a prior distribution prepared in advance corresponds to the input data (step S 05 ). For example, the first identifier 14 processes the compressed data using the neural net and acquires vectors of final layer data and intermediate layer data. In addition, the first identifier 14 processes the vector sampled from the prior distribution using the neural net, and acquires vectors of final layer data and intermediate layer data. Next, the first identifier 14 calculates a difference (for example, a square of the difference) in mean between the vectors of the intermediate layer data of the compressed data and the vectors of the intermediate layer data of the vector sampled from the prior distribution. This difference is expressed by the following equation (1).

smse→(mean( f s )−mean( f′ s )) 2   (1)

In the above equation (1), mean(f s ) represents a mean of the vectors of the intermediate layer data of the compressed data, mean(f′ s ) represents a mean of the vectors of the intermediate layer data of the vector sampled from the prior distribution, and smse represents a value obtained by squaring the difference between these means.

Next, the second identifier 16 identifies which data of the reconstruction data input from the decoder 12 and the learning data D 1 on which the compression and decoding processing is not performed corresponds to the input data (step S 107 ). For example, the second identifier 16 processes the learning data D 1 using the neural net, and acquires vectors of final layer data and intermediate layer data. In addition, the second identifier 16 processes the reconstruction data using the neural net and acquires vectors of final layer data and intermediate layer data. Next, the second identifier 16 calculates a difference (for example, a square of the difference) between the vector of the intermediate layer data of the learning data D 1 and the vector of the intermediate layer data of the reconstruction data. This difference is represented by the following equation (2).

mse→( f−f ′) 2   (2)

In the above equation (2), f represents a vector of the intermediate layer data of the learning data D 1 , f′ represents a vector of the intermediate layer data of the reconstruction data, and mse represents a value obtained by squaring the difference between these vectors.

Furthermore, the second identifier 16 processes the compressed data obtained by compressing the vector sampled from the prior distribution using the neural net, and acquires vectors of final layer data and intermediate layer data. Next, the second identifier 16 calculates a difference in mean (for example, a square of the difference) between vectors of the intermediate layer data obtained by processing the learning data D 1 using the neural net and vectors of the intermediate layer data of the compressed data obtained by compressing the vector sampled from the priority distribution. This difference is represented by the following equation (3).

fmmse→(mean( f )−mean( f ″)) 2   (3)

In the above equation (3), mean(f) represents a mean of the vectors of the intermediate layer data of the learning data D 1 , mean(f″) represents a mean of the vectors of the intermediate layer data of the compressed data of the vector sampled from the prior distribution, and fmmse represents a value obtained by squaring the difference between these means.

Next, each of the encoder 10 and the decoder 12 adjusts a compressing parameter and a decoding parameter using a loss function defined on the basis on the above equations (1) to (3) (step S 109 ). The loss function loss, is expressed by the following equation (4). β and γ are weights which define a relative importance of the loss function.

loss AE →mse+βsmse+γfmmse  (4)

The encoder 10 adjusts the compressing parameter so that a distribution of the compressed data approaches the prior distribution on the basis of the first identification result input from the first identifier 14 . That is, the encoder 10 adjusts the compressing parameter so that the first identifier 14 determines that the compressed data input from the encoder 10 is the vector sampled from the prior distribution. In addition, each of the encoder 10 and the decoder 12 adjusts the compressing parameter and the decoding parameter so that a difference between the reconstruction data generated by the decoder 12 and the learning data D 1 on which the compression and decoding processing are not performed is reduced on the basis of the second identification result input from the second identifier 16 . That is, each of the encoder 10 and the decoder 12 adjusts the compressing parameter and the decoding parameter so that the second identifier 16 determines that the reconstruction data input from the decoder 12 is the learning data D 1 .

In the adjustment processing of parameters, the compressing parameter and the decoding parameter are adjusted using, for example, the following equations (5) to (8) to reduce the loss function loss AE .

In the above equation (5), W enc is a weight parameter (strength of connection) held by the neural net of the encoder 10 , and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of W enc which reduces the loss function loss AE .

W enc is updated by multiplying the gradient direction by a value of α. In the gradient calculation and the update processing of W enc , learning processing referred to as Stochastic Gradient Descent (SGD) method may be used, and other learning algorithms may also be used.

In the above equation (6), W dec is a weight parameter (strength of connection) held by the neural net of the decoder 12 , and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of W dec which reduces the loss function loss AE . W dec is updated by multiplying the gradient direction by a value of α.

In the above equation (7), b enc is a bias, and α is a coefficient (for example, a coefficient from 0 to 1). A differential equation on the right side determines a gradient of b enc which reduces the loss function loss AE . b enc is updated by multiplying the gradient direction by a value of α.

In the above equation (8), b dec is a bias, and α is a coefficient (for example, a coefficient from 0 to 1). A differential equation on the right side determines a gradient of b dec which reduces the loss function loss AE . b dec is updated by multiplying the gradient direction by a value of α.

Furthermore, after the adjustment processing of parameters, parameters of the first identifier 14 and the second identifier 16 are adjusted to reduce learning losses of the first identifier 14 and the second identifier 16 . A learning loss loss samlldis of the first identifier 14 and a learning loss loss dis of the second identifier 16 are represented by, for example, the following equations (9) and (10).

loss smalldis →−log y s [0]−log y′ s [1]  (9)

In the above equation (9), −log y s [0] is a term which becomes small so that the first identifier 14 can identify input compressed data as compressed data, and −log y s ′[1] is a term which becomes small so that a vector sampled from a prior distribution can be identified as the vector. The first identifier 14 adjusts parameters to minimize the learning loss loss smalldis . y s [0] and y′ s [1] are indexes of vectors handled by a program, and correspond to a first dimension and a second dimension of a two-dimensional vector ys output by the first identifier 14 .

loss dis →−log y [0]−log y′ [1]  (10)

In the above equation (10), −log y[0] is a term which becomes small so that the second identifier 16 can identify input learning data D 1 as learning data D 1 , and −log y′[1] is a term which becomes small so that reconstruction data can be identified as reconstruction data. The second identifier 16 adjusts parameters to minimize the learning loss loss dis . y[0] and y′[1] are indexes of vectors handled by a program, and correspond to a first dimension and a second dimension of a two-dimensional vector y output by the second identifier 16 .

In the adjustment processing in the first identifier 14 and the second identifier 16 , parameters are adjusted using, for example, the following equations (11) to (14) to reduce the learning loss loss smalldis and the learning loss loss dis .

In the above equation (11). W smalldis is a weight parameter (strength of connection) held by the neural net of the first identifier 14 , and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of W smalldis which reduces the learning loss loss smalldis . W smalldis is updated by multiplying the gradient direction by a value of α.

In the above equation (12), W dis is a weight parameter (strength of connection) held by the neural net of the second identifier 16 , and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of W dis which reduces the learning loss loss dis . W dis is updated by multiplying the gradient direction by a value of α.

In the above equation (13), b smalldis is a bias, and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of b smalldis which reduces the learning loss loss smalldis . b smalldis is updated by multiplying the gradient direction by a value of α.

In the above equation (14), b dis is a bias, and α is a coefficient (for example, a coefficient from 0 to 1). A differential calculation on the right side determines a gradient of b dis which reduces the learning loss loss dis . b dis is updated by multiplying the gradient direction by a value of α.

Next, the encoder 10 determines whether sampling of the learning data D 1 stored in the learning database is completed (step S 111 ). When it is determined that the sampling of the learning data D 1 is not completed, the encoder 10 samples at least one piece of the remaining learning data D 1 and performs the compression and decoding processing, and parameter adjustment processing thereon. On the other hand, when it is determined that the sampling of the learning data D 1 is completed, the encoder 10 determines that one learning processing cycle for the above learning data group is completed, and counts the number of times learning processing has been performed. For example, the encoder 10 counts the number of times learning processing has been performed by incrementing parameters for measuring the number of times processing has been performed set on a memory (not shown) provided therein.

Next, the encoder 10 determines whether the number of times learning processing has been performed has reached a predetermined number of times (step S 113 ). The encoder 10 performs learning processing on the learning data group again when it is determined that the number of times learning processing has been performed is less than the predetermined number of times. In this manner, it is possible to improve accuracy in parameter adjustment by repeatedly performing the learning processing on the same learning data group. On the other hand, the encoder 10 ends processing of the present flowchart when it is determined that the number of times learning processing has been performed is equal to or greater than the predetermined number of times.

In the learning processing by the learning device 1 , a multilayered neural network (Deep Neural Network: DNN), a convolutional neural network (CNN), or a recurrent neural network (RNN) may also be adopted.

Next, an operation of the abnormality detection device 1 A of the embodiment will be described. FIG. 5 is a flowchart which shows an example of a flow of processing by the abnormality detection device 1 A according to the embodiment. FIG. 6 is a view which shows an example of a detection result by the abnormality detection device 1 A according to the embodiment.

First, the encoder 10 compresses the detection data D 2 and outputs the compressed data to the first identifier 14 and the decoder 12 (step S 201 ).

Next, the first identifier 14 performs abnormality detection on the compressed data input from the encoder 10 (step S 203 ). For example, the first identifier 14 determines that the compressed data is abnormal (a first abnormality) when a sum of a logarithm probability density on the prior distribution of the compressed data input from the encoder 10 and a logarithm density ratio of the compressed data distribution to the prior distribution is equal to or less than a predetermined threshold value (a first threshold value), and determines that the compressed data is normal when it is greater than the first threshold value. The logarithm density ratio of the compressed data distribution to the prior distribution is obtained as a logarithm of the quotient of a prior distribution probability with respect to a compressed data probability output as a final layer of the first identifier 14 .

In the abnormality detection processing by the first identifier 14 , in consideration of density on a manifold, data positioned in a range with a low density on a manifold is determined to be abnormal and data positioned in a range with a high density on a manifold is determined to be normal. For example, when the encoder 10 outputs compressed data of data (normal data) indicating an image of a vehicle of a data number 1 shown in FIG. 6 to the first identifier 14 , the compressed data is data positioned in the range with a high density on a manifold, and thus the first identifier 14 determines that the compressed data is normal. On the other hand, data (abnormal data) indicating an image compressed in a height direction of a vehicle of a data number 3 shown in FIG. 6 is data positioned in the range with a low density on a manifold. When the encoder 10 outputs compressed data of the image data to the first identifier 14 , the compressed data has a density on a manifold lower than the first threshold value, and thus the first identifier 14 determines that the compressed data is abnormal.

Next, the decoder 12 generates reconstruction data by decoding compression data input from the encoder 10 , and outputs the reconstruction data to the second identifier 16 (step S 205 ).

Next, the second identifier 16 calculates an abnormality degree indicating a degree of the difference between the reconstruction data input from the decoder 12 and the detection data D 2 , and performs abnormality detection of data on the basis of this abnormality degree (step S 207 ). The second identifier 16 determines that data is abnormal (a second abnormality) when the abnormality degree is equal to or greater than a predetermined threshold value (a second threshold value), and determines that data is normal when the abnormality degree is less than the second threshold value.

For example, the encoder 10 compresses the data (normal data) indicating the image of the vehicle of the data number 1 shown in FIG. 6 as the detection data D 2 , and when the decoder 12 decodes the compressed data and outputs the data to the second identifier 16 , the reconstruction data is the same data as the detection data D 1 , and thus the second identifier 16 determines that the detection data D 2 is normal. On the other hand, the encoder 10 compresses data such as data (abnormal data) indicating an image in which part of a vehicle of a data number 2 shown in FIG. 6 is missing and data (abnormal data) indicating an image in which a doorknob of a vehicle of a data number 4 is missing as the detection data D 2 , and when the decoder 12 decodes the compressed data and outputs the data to the second identifier 16 , the detection data D 2 has a big difference between the reconstruction data and the detection data D 1 (the abnormality degree is higher than the second threshold value), and thus the second identifier 16 determines that the detection data D 2 is abnormal. Accordingly, the processing of the present flowchart ends.

According to at least one of the embodiments described above, the encoder is configured to compress input data using a compression parameter to generate compressed data. The first identifier is configured to determine whether a distribution of the compressed data input by the encoder is a distribution of the compressed data or a predetermined prior distribution, and inputs a first identification result to the encoder. The decoder is configured to decode the compressed data using a compressing parameter to generate reconstructed data. The second identifier is configured to determine whether the reconstructed data input by the decoder is the reconstruction data or the input data and outputs a second identification result to the encoder and the decoder.

In addition, some functions of the learning device 1 and the abnormality detection device 1 A may be realized by a computer. In this case, a program for realizing the functions is recorded in a computer-readable information recording medium. Then, the program recorded in the information recording medium in which the program is recorded may also be realized by being read and executed by a computer system. The “computer system” herein includes an operating system and hardware such as a peripheral apparatus. Moreover, the “computer-readable information recording medium” refers to a portable medium, a storage device, or the like. The portable medium is a flexible disk, a magneto-optical disc, a ROM, a CD-ROM, or the like. Furthermore, the storage device is a hard disk embedded in the computer system, or the like.

Furthermore, the “computer-readable information recording medium” dynamically holds a program for a short period of time like a communication line when a program is transmitted via the communication line. The communication line is a network such as the Internet, a telephone line, or the like. In addition, the “computer-readable information recording medium” may be a volatile memory in the computer system serving as a server or a client. The volatile memory holds a program for a certain period of time. Moreover, the program may be a program for realizing some of the functions described above. Furthermore, the program may also be realized by combining the functions described above with a program which has been recorded in the computer system.

Further, the learning apparatus 1 and the abnormality detection apparatus 1 A in the above-described embodiment may be integrated into an abnormality detection system described as follows. An abnormality detection system includes an encoder, a first identifier, a first identifier, a decoder and a second identifier. The encoder is configured to compress input data using a compression parameter to generate compressed data. The first identifier is configured to determine whether a distribution of the compressed data input by the encoder is a distribution of the compressed data or a predetermined prior distribution, and inputs a first identification result to the encoder. The decoder is configured to decode the compressed data using a compressing parameter to generate reconstructed data. The second identifier is configured to determine whether the reconstructed data input by the decoder is the reconstruction data or the input data and outputs a second identification result to the encoder and the decoder. The encoder adjusts the compressing parameter on the basis of the first identification result and the second identification result. The decoder adjusts the decoding parameter on the basis of the second identification result. The process of adjusting the compressing parameter and the process of adjusting the decoding parameter are repeated for a predetermined number of the input data. The encoder compresses a first input data using the adjusted compressing parameter and generates a first compressed data, after the process of adjusting the compressing parameter and the process of adjusting the decoding parameter are repeated for a predetermined number of the input data. The first identifier detects a first abnormality of the first input data on the basis of a logarithm probability density on a prior distribution of the compressed data and a logarithm density ratio of the first compressed data distribution to a prior distribution. The decoder decodes the first compressed data using the adjusted decoding parameter and generates a first reconstructed data, after the process of adjusting the compressing parameter and the process of adjusting the decoding parameter are repeated for a predetermined number of the input data. The second identifier calculates a difference between the first reconstruction data and the first input data, and detects a second abnormality of the first input data on the basis of the difference.

The system is implemented by the combination of the learning device and the abnormality detecting device. Whereas the configurations, the operations and functions would be anticipated by the descriptions in those for the learning device and the abnormality detecting device, the duplicate descriptions will be omitted.

While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirt of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.