IP Library › Granted Patent US 11,640,459
Granted Patent B2
US 11,640,459 · App. 17/255,518 · Granted May 2, 2023

Abnormality detection device

Inventor: Takehiko Mizoguchi (Tokyo, JP)
Assignee: NEC CORPORATION
G06F21/552G06F21/54G06F21/554G06F21/566
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,640,459
App. No.
17/255,518
Granted
May 2, 2023
Kind
B2
Abstract

A first anomaly detection unit detects anomalous first monitored data from among a plurality of first monitored data obtained from a monitored system. A second anomaly detection unit operates in parallel with the first anomaly detection unit and detects anomalous second monitored data from among a plurality of second monitored data obtained from the monitored system. In a first storage unit, the anomalous first monitored data and the anomalous second monitored data detected before lapse of a given time from detection time of the anomalous first monitored data are stored in association with each other. A first determination unit, when the anomalous first monitored data is detected, retrieves the anomalous second monitored data associated with the detected anomalous first monitored data from the first storage unit and outputs a first anomaly detection result including the retrieved anomalous second monitored data and the detected anomalous first monitored data.

Claims (34)

1. An anomaly detection device comprising:

a first memory containing program instructions; and

a processor coupled to the first memory, wherein the processor is configured to execute the program instructions to:

from each of a plurality of devices constituting a monitored system, regularly collect sensor data measured by a sensor provided to the device and log data of the device, one of the collected sensor data and the log data being first monitored data, another of the collected sensor data and the log data being second monitored data;

detect anomalous first monitored data from among a plurality of pieces of the first monitored data;

in parallel with detection of the anomalous first monitored data, detect anomalous second monitored data from among a plurality of pieces of the second monitored data;

when the anomalous first monitored data is detected, determine whether or not the anomalous second monitored data associated with the detected anomalous first monitored data is stored in a second memory;

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is not stored, store the detected anomalous first monitored data into the second memory, and when the anomalous second monitored data is detected before lapse of a given time from detection time of the anomalous first monitored data, store the detected anomalous second monitored data into the second memory in association with the stored anomalous first monitored data; and

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is stored, retrieve the anomalous second monitored data associated with the detected anomalous first monitored data from the second memory and output a first anomaly detection result including the retrieved anomalous second monitored data and the detected anomalous first monitored data.

2. The anomaly detection device according to claim 1 , wherein the processor is further configured to execute the instructions to, when the anomalous first monitored data is detected, in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is not stored in the second memory, output a second anomaly detection result including the detected anomalous first monitored data.

3. The anomaly detection device according to claim 1 , further comprising:

a third memory configured to have the anomalous second monitored data and the anomalous first monitored data stored therein in association with each other, the anomalous first monitored data having been detected before lapse of a given time from detection time of the anomalous second monitored data, wherein the processor is further configured to execute the instructions to,

when the anomalous second monitored data is detected, retrieve the anomalous first monitored data associated with the detected anomalous second monitored data from the third memory and output a third anomaly detection result including the retrieved anomalous first monitored data and the detected anomalous second monitored data.

4. The anomaly detection device according to claim 3 , wherein the processor is further configured to execute the instructions to, when the anomalous second monitored data is detected, in a case where the anomalous first monitored data associated with the detected anomalous second monitored data is not stored in the third memory, store the detected anomalous second monitored data into the third memory and, when the anomalous first monitored data is detected before lapse of a given time from detection time of the anomalous second monitored data, store the detected anomalous first monitored data into the third memory in association with the stored anomalous second monitored data.

5. The anomaly detection device according to claim 3 , wherein the processor is further configured to execute the instructions to, when the anomalous second monitored data is detected, in a case where the anomalous first monitored data associated with the detected anomalous second monitored data is not stored in the third memory, output a fourth anomaly detection result including the detected anomalous second monitored data.

6. An anomaly detection method comprising:

from each of a plurality of devices constituting a monitored system, regularly collecting sensor data measured by a sensor provided to the device and log data of the device, one of the collected sensor data and the log data being first monitored data, another of the collected sensor data and the log data being second monitored data;

detecting anomalous first monitored data from among a plurality of pieces of the first monitored data;

in parallel with detecting the anomalous first monitored data, detecting anomalous second monitored data from among a plurality of pieces of the second monitored data; and

when the anomalous first monitored data is detected,

determining whether or not the anomalous second monitored data associated with the detected anomalous first monitored data is stored in a first memory;

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is not stored, storing the detected anomalous first monitored data into the first memory, and when the anomalous second monitored data is detected before lapse of a given time from detection time of the anomalous first monitored data, storing the detected anomalous second monitored data into the first memory in association with the stored anomalous first monitored data; and

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is stored, retrieving the anomalous second monitored data associated with the detected anomalous first monitored data from the first memory, and outputting a first anomaly detection result including the retrieved anomalous second monitored data and the detected anomalous first monitored data.

7. The anomaly detection method according to claim 6 , comprising, when the anomalous first monitored data is detected, in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is not stored in the first memory, outputting a second anomaly detection result including the detected anomalous first monitored data.

8. The anomaly detection method according to claim 6 , comprising, when the anomalous second monitored data is detected, retrieving the anomalous first monitored data associated with the detected anomalous second monitored data from a second memory in which the anomalous second monitored data and the anomalous first monitored data having been detected before lapse of a given time from detection time of the anomalous second monitored data are stored in association with each other, and outputting a third anomaly detection result including the retrieved anomalous first monitored data and the detected anomalous second monitored data.

9. The anomaly detection method according to claim 8 , comprising, when the anomalous second monitored data is detected, in a case where the anomalous first monitored data associated with the detected anomalous second monitored data is not stored in the second memory, storing the detected anomalous second monitored data into the second memory and, when the anomalous first monitored data is detected before lapse of a given time from detection time of the anomalous second monitored data, storing the detected anomalous first monitored data into the second memory in association with the stored anomalous second monitored data.

10. The anomaly detection method according to claim 8 , comprising, when the anomalous second monitored data is detected, in a case where the anomalous first monitored data associated with the detected anomalous second monitored data is not stored in the second memory, outputting a fourth anomaly detection result including the detected anomalous second monitored data.

11. A non-transitory computer-readable recording medium having a program stored thereon, the program comprising instructions for causing a computer to execute the instructions to:

from each of a plurality of devices constituting a monitored system, regularly collect sensor data measured by a sensor provided to the device and log data of the device, one of the collected sensor data and the log data being first monitored data, another of the collected sensor data and the log data being second monitored data;

detect anomalous first monitored data from among a plurality of pieces of the first monitored data;

in parallel with detection of the anomalous first monitored data, detect anomalous second monitored data from among a plurality of pieces of the second monitored data;

when the anomalous first monitored data is detected, determine whether or not the anomalous second monitored data associated with the detected anomalous first monitored data is stored in a first memory;

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is not stored, store the detected anomalous first monitored data into the first memory, and when the anomalous second monitored data is detected before lapse of a given time from detection time of the anomalous first monitored data, store the detected anomalous second monitored data into the first memory in association with the stored anomalous first monitored data; and

in a case where the anomalous second monitored data associated with the detected anomalous first monitored data is stored, retrieve the anomalous second monitored data associated with the detected anomalous first monitored data from the first memory, and output a first anomaly detection result including the retrieved anomalous second monitored data and the detected anomalous first monitored data.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 10, 2022
From: MIZOGUCHI, TAKEHIKO
To: NEC CORPORATION
Reel/Frame 061716/0578 →
Continuity (1)
Related Publication 20210224383A1 · Jul 22, 2021