Anomaly diagnosis method and anomaly diagnosis apparatus

1. An anomaly diagnosis method performed by an anomaly diagnosis apparatus that performs a diagnosis to determine whether an observed value composed of values of multiple variables representing a state of a monitoring target obtained by observing the state of the monitoring target is anomalous, wherein

the anomaly diagnosis apparatus includes a processor and a memory,

the memory stores an anomaly detection model generated by learning by using multiple first observed values, with each of the first observed values including values of multiple variables of a first observed value representing a first state of the monitoring target, and

the processor

acquires a second observed value, the second observed value including values of multiple variables of the second observed value representing a second state of the monitoring target,

acquires group information indicating one or more groups in the second observed value, each group constituted by a combination of at least two variables that are related to each other among the multiple variables of the second observed value,

determines whether the second observed value is anomalous by employing the anomaly detection model that is read from the memory, and

in a case where the second observed value is determined to be anomalous, identifies a group including the combination of at least two variables causing an anomaly among the one or more groups in the second observed value in accordance with the second observed value and the one or more groups indicated by the acquired group information.

2. The anomaly diagnosis method according to claim 1 , wherein the anomaly detection model is generated, by using the multiple first observed values, by at least one of an autoencoder, a variational autoencoder, and a one-class support vector machine, as the learning.

3. The anomaly diagnosis method according to claim 2 , wherein in the determining of whether the second observed value is anomalous,

a score is calculated by feeding multiple second observed values to the anomaly detection model,

in a case where the calculated score is equal to or greater than a predetermined first threshold, the multiple second observed values are determined to be anomalous,

in a case where the calculated score is less than the first threshold, the multiple second observed values are determined to be non-anomalous.

4. The anomaly diagnosis method according to claim 3 , wherein

in the identifying of the group,

a displacement vector is calculated such that a value of a loss function for an input vector added by the displacement vector is a local minimum, the value of the loss function being obtained by adding the calculated score and a value of a group regularization term that regularizes respectively the one or more groups indicated by the group information, and

in the calculated displacement vector, a group including a variable whose value is equal to or greater than a second threshold less than 1 is identified as a group causing an anomaly.

5. The anomaly diagnosis method according to claim 4 , wherein the group regularization term satisfies Lp regularization where: between groups, 0<p≤1; and within a group, p>1.

6. The anomaly diagnosis method according to claim 1 , wherein

the anomaly detection model is generated in accordance with a ratio of probability density between normal first observed values for learning among the multiple first observed values and second observed values for diagnosis among multiple second observed values,

in the acquiring of the second observed value, the multiple second observed values are acquired, and

in the determining of whether the second observed value is anomalous,

a score is calculated by using the anomaly detection model that is read from the memory and the multiple second observed values,

in a case where the calculated score is equal to or greater than a predetermined first threshold, the acquired multiple second observed values are determined to be anomalous, and

in a case where the calculated score is less than the first threshold, the multiple second observed values are determined to be non-anomalous.

7. The anomaly diagnosis method according to claim 1 , wherein

a variable belongs to only one group among the one or more groups, such that a variable is associated with a single group and not multiple.

8. The anomaly diagnosis method according to claim 1 , wherein

a grouping of variables is set by a user.

9. An anomaly diagnosis apparatus that performs a diagnosis to determine whether an observed value composed of values of multiple variables representing a state of a monitoring target obtained by observing the state of the monitoring target is anomalous, the anomaly diagnosis apparatus comprising:

a memory that stores an anomaly detection model generated by learning by using multiple first observed values, with each of the first observed values including values of multiple variables of a first observed value representing a first state of the monitoring target; and

a processor

that acquires a second observed value, the second observed value including values of multiple variables of the second observed value representing a second state of the monitoring target,

that acquires group information indicating one or more groups in the second observed value, each group constituted by a combination of at least two variables that are related to each other among the multiple variables of the second observed value,

that determines whether the second observed value is anomalous by employing the anomaly detection model that is read from the memory, and

in a case where the second observed value is determined to be anomalous, that identifies a group including the combination of at least two variables causing an anomaly among the one or more groups in the second observed value in accordance with the acquired second observed value and the one or more groups indicated by the acquired group information.