Program, device and method for detecting abnormal node group in business management by using graph where a plurality of offices are designated as nodes

Abstract

To provide a program and the like capable of indicating a comprehensive group of a plurality of offices where abnormality of situation change on business occurs to an operator.SOLUTION: A program causes a computer to function as: graph creation means for designating offices capable of acquiring office management actual values in time sequence as nodes and creating graphs by connecting a plurality of nodes based on specific connection conditions; individual abnormality node detection means for detecting an abnormal node satisfying specific abnormality conditions from the office management actual values in time sequence for each of the nodes; comprehensive abnormal node detection means for tracing back along a link of a graph from the abnormal node to a group of the nodes obtained by tracing back the link of the graph as long as the comprehensive office management values in time sequence satisfies the specific abnormality conditions; and operator interface means for indicating the comprehensive abnormal node group detected with the comprehensive abnormal node detection means to an operator.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a technology for detecting a business establishment that has experienced an abnormality in management among multiple business establishments, and is particularly suitable for analyzing alternative data in big data. [Background technology]

[0002] In recent years, technology that uses "alternative data" to predict economic indicators and corporate performance ahead of officially released traditional data has been attracting attention (see, for example, Non-Patent Document 1). This technology can collect location information from users' smartphones in real time and provide population data that has been expanded and estimated by referring to official demographic statistics. Examples of service types include the following: Movement / stay data (determination of movement / stay for each mesh on the map) OD (Origin-Destination) data (estimates of population movement between meshes) Road traffic data Designated area visit data (estimates of the population staying in a given area) Near real-time data Store opening strategy data Of course, alternative data is not limited to smartphone location information, but also includes big data such as POS (Point Of Sales) data, credit card data, satellite images, and SNS (Social Networking Service) data.

[0003] Alternative data finds use in financial engineering to estimate real-time trends in economic indicators and company performance. For example, in the case of individual stores of a retail company, the time lag for the release of sales reports for the current month is long, from two weeks to as late as three months. In response to this, by using alternative data, the number of visitors to the store can be calculated from location information, and sales figures for each month can be estimated. In fact, it is possible to easily estimate the sales amount for the current month from the regression correlation between the number of visitors based on location information and the sales amount, without performing time-series and complex prediction processing. For companies that conduct industrial activities that require the movement of people, it is possible to estimate the sales amount with a relatively high degree of accuracy. In this way, changes in the business situation can be understood from the trends in the behavior of third parties and employees at a company or business establishment.

[0004] Incidentally, there is also a conventional technique for recognizing the actual business transaction situation and predicting the probability of chain reactions between companies (see, for example, Patent Document 1). According to this technique, the number of movements of moving objects from a first company to each of the other companies is recorded. Then, the movement ratio T of the number of movements from the first company to the second company to the total number of movements from the first company to all other companies is calculated, and the chain reaction probability P from the first company to the second company can be calculated according to the movement ratio T from the first company to the second company. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2022-155617 A [Non-patent literature]

[0006] [Non-Patent Document 1] KDDI Location Data, [online], [searched on July 26, 2023], Internet<URL:https: / / k-locationdata.kddi.com / alternative / > [Non-Patent Document 2] KDDI, location information, [online], [searched on July 26, 2023], Internet<URL:https: / / biz.kddi.com / solution / location / > Summary of the Invention [Problem to be solved by the invention]

[0007] The alternative data mentioned above is big data, data that has been affected by various factors and disturbances. For example, a company may operate multiple business locations (stores, sales offices, etc.), including convenience stores and restaurant chains (as well as unmanned sales outlets, small to medium-sized apparel brands that do not have street-front stores, beauty salons, etc.). Even if a "change in the situation" occurs in the management of each business location, it is not easy for a company manager to deduce the cause from various big data. He or she would like to know what factors are responsible for the fluctuations in sales and profits of each store.

[0008] "Changes in circumstances" means that the business performance of a certain business establishment suddenly becomes good (positive) or bad (negative). In other words, it is necessary to analyze whether the business performance of the establishment is normal or abnormal. There are various factors behind this change in the situation, which can be analysed as follows: · Is it based on the location of the business? Is it based on the number of people or vehicles passing through a given area around the business? · Is it based on the size of the business or the building facilities?

[0009] First, managers may want to know what the business performance values ​​of other business locations that are close to the business location where an abnormality has been detected are. In other words, they want to know whether the business performance values ​​of other business locations that are close to the business location of the abnormality are also "abnormal" or not.

[0010] In addition, managers may want to know what the business performance values ​​are of other establishments in the vicinity that have a similar number of active employees under normal circumstances to the establishment that has been detected as abnormal. In other words, managers may want to know whether the business performance values ​​of other establishments that have a similar number of active employees to that establishment are also "abnormal" or not.

[0011] Furthermore, managers may want to know what the business performance values ​​are of other business establishments with the same size or construction facilities as the business establishment that has been detected as abnormal. In other words, they would like to know whether the business performance values ​​of other business establishments with similar size or construction facilities are also "abnormal" or not.

[0012] Therefore, an object of the present invention is to provide a program, business management device and method that can clearly show an operator a comprehensive group of multiple business establishments where abnormal changes in business conditions are occurring. [Means for solving the problem]

[0013] According to the present invention, a graph creation means is provided for creating a graph in which business establishments capable of acquiring time-series business performance values ​​are regarded as nodes and a plurality of nodes are connected based on a predetermined connection condition; individual abnormal node detection means for detecting an abnormal node that satisfies a predetermined abnormal condition from a time series of business performance values ​​for each node; a comprehensive anomaly node detection means for following the links of the graph from the anomaly node to a set of nodes as long as a comprehensive time-series business performance value satisfies a predetermined anomaly condition; an operator interface means for indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; The present invention is characterized in that it causes a computer to function.

[0014] According to another embodiment of the program of the present invention, The graph creation means creates a graph in which nodes where the distance between the business establishments is equal to or less than a first threshold value are connected by links based on the locations of the business establishments. It is also preferable to function the computer in such a manner.

[0015] According to another embodiment of the program of the present invention, The graph creation means creates a graph in which nodes where the difference in the number of people or vehicles passing through a predetermined vicinity of the establishment is equal to or less than a second threshold value are connected by links. It is also preferable to function the computer in such a manner.

[0016] According to another embodiment of the program of the present invention, The graph creation means creates a graph in which nodes that are similar to each other and have a difference in size and / or construction equipment between business establishments that is equal to or less than a third threshold value are connected by links based on the size and / or construction equipment of the business establishments. It is also preferable to function the computer in such a manner.

[0017] According to another embodiment of the program of the present invention, The graph creation method is A graph in which nodes are connected by links, where the distance between the business establishments is equal to or less than a first threshold, based on the locations of the business establishments; A graph in which nodes are connected by links, where the difference in the number of people or vehicles passing through a specified vicinity of the establishment is equal to or less than a second threshold value; A graph that links nodes that are similar to each other and whose differences in size and / or building facilities between establishments are less than the third threshold based on the size of the establishments. Create multiple by combining one or more of the following: The comprehensive anomaly node detection means sequentially traces links from the anomaly node detected by the individual anomaly node detection means for each of the plurality of graphs formed from different viewpoints and created by the graph creation means; The operator interface means indicates to the operator the plurality of comprehensive abnormal node groups determined by the comprehensive abnormal node detection means. It is also preferable to function the computer in such a manner.

[0018] According to another embodiment of the program of the present invention, The comprehensive anomaly node detection means selects a comprehensive node group to be judged by: Select the inclusive set of nodes by traversing the nodes of the graph link by link, or A filter generated within a given range is slid across the graph to select a set of inclusive nodes. It is also preferable to function the computer in such a manner.

[0019] According to another embodiment of the program of the present invention, Regarding the individual abnormal node detection means, The time series of business performance values ​​is the sales or profits of the establishment, The specified abnormal condition is when the standard deviation is outside a specified range. It is also preferable to function the computer in such a manner.

[0020] According to another embodiment of the program of the present invention, Regarding the individual abnormal node detection means, The time series of business performance values ​​is the sales or profits of the establishment, The predetermined abnormal condition is a calculation amount based on dynamic time warping (DTW), and is a case where the calculation amount in a past predetermined period and the calculation amount in a current predetermined period are equal to or greater than a predetermined threshold. It is also preferable to function the computer in such a manner.

[0021] According to the present invention, a graph creation means is provided for creating a graph in which business establishments capable of acquiring time-series business performance values ​​are regarded as nodes and a plurality of nodes are connected based on a predetermined connection condition; individual abnormal node detection means for detecting an abnormal node that satisfies a predetermined abnormal condition from a time series of business performance values ​​for each node; a comprehensive anomaly node detection means for following the links of the graph from the anomaly node to a set of nodes as long as a comprehensive time-series business performance value satisfies a predetermined anomaly condition; an operator interface means for indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; The present invention is characterized by having the following.

[0022] According to the present invention, in a method for detecting an abnormality in an apparatus, The device is A first step of creating a graph in which business establishments for which time-series business performance values ​​can be obtained are treated as nodes and a plurality of nodes are connected based on predetermined connection conditions; a second step of detecting, for each node, an abnormal node that satisfies a predetermined abnormal condition from the time series of business performance values; a third step of following the links of the graph from the abnormal node to a set of nodes as long as the comprehensive time-series business performance value satisfies a predetermined abnormality condition; a fourth step of indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; The present invention is characterized by carrying out the following steps. Effect of the Invention

[0023] According to the program, business management device and method of the present invention, it is possible to clearly show to an operator a comprehensive group of a plurality of business establishments in which abnormal changes in business conditions are occurring. [Brief description of the drawings]

[0024] [Figure 1] 1 is an external view of a system according to the present invention. [Diagram 2] FIG. 2 is a functional configuration diagram of the business management device according to the present invention. [Diagram 3] FIG. 2 is an explanatory diagram of a business performance database and a business establishment database. [Figure 4] 1 is a graph connecting a plurality of nodes in the present invention. [Diagram 5] 1 is a graph of step S0 representing an abnormal node in the present invention. [Figure 6] 11 is a graph showing a comprehensive abnormal node group in step S11 according to the present invention. [Figure 7] 11 is a graph of step S12 showing a comprehensive abnormal node group in the present invention. [Figure 8] 11 is a graph of step S13 showing a comprehensive abnormal node group in the present invention. [Figure 9] 13 is a graph showing a comprehensive abnormality node group that is clearly indicated to an operator. [Figure 10] 11 is a graph showing a sequence of detection of a comprehensive anomaly node group. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0026] FIG. 1 is an external view of a system according to the present invention.

[0027] As shown in FIG. 1, there are multiple business establishments (stores and sales offices) distributed around the business establishments, and an unspecified number of people and vehicles carrying mobile terminals are constantly moving around the areas surrounding the establishments. 1, a business management device 1 is provided, and time-series business performance values ​​are collected from each business establishment. The "business performance values" may be, for example, sales or profits of the business establishment. The business management device 1 can detect a "change in the situation" by, for example, comparing the average business performance value of the past with the current business performance value. Here, a change in the situation means that the business performance value of the establishment becomes "abnormal." This "abnormality" may be either good or bad from the business perspective. Assume that an operator who operates the business management device 1 is analyzing from what viewpoint the situation change at a plurality of business establishments has occurred. According to the present invention, it is useful to analyze from what viewpoint the situation change has occurred, for example, the location of the business establishment, the number of people and vehicles passing through a specific vicinity of the business establishment, the size and / or the construction facilities.

[0028] FIG. 2 is a functional block diagram of the business management device according to the present invention.

[0029] 2, the business management device 1 has a business performance database 101, a business establishment database 102, a graph creation unit 11, an individual abnormal node detection unit 12, a comprehensive abnormal node detection unit 13, and an operator interface unit 14. These functional components are realized by executing a program that causes a computer mounted in the business management device to function. The process flow of these functional components can also be understood as a business management method for the device.

[0030] FIG. 3 is an explanatory diagram of the business performance database and the establishment database.

[0031] [Management Performance Database 101] The business performance database 101 records business performance values ​​(sales or profits) for each business establishment, for example, by day and time period. For example, for multiple business establishments (stores and sales offices) of the same company or in the same business format, the sales and profits of each business establishment are recorded for each predetermined time period in a predetermined period (for example, one month, one week, one day). The multiple business establishments may belong to the same business entity, or may be under the management of different business entities or in different business formats.

[0032] [Establishment Database 102] The establishment database 102 accumulates, for example, the following characteristic information for each establishment: Location of business establishment - Number of people and vehicles passing through the designated area around the business (average number of people and vehicles passing through) -Business size and / or building facilities

[0033] <Location of business office> The location of the business may be latitude and longitude, or an address on a map. It may also be a base station ID (IDentifier) ​​with which the business can directly communicate. This makes it possible to calculate the distance between multiple business locations on a brute force basis. It is possible that business locations located close to each other will have a high correlation (high degree of dependence) when it comes to changes in business conditions.

[0034] <Current number of establishments> The active number of a business establishment may be the number of people or vehicles (big data updated in a time series) staying in a region within a specified radius of the business establishment as the center position. In addition, in the case of a business establishment such as a store, it may be the number of customers entering the store detected by an entrance / exit sensor. The active number here is assumed to be the average active number during a specified day and time period. It is expected that establishments with similar operating numbers under normal circumstances will have a high correlation when it comes to changes in their business situations.

[0035] The mobile communication carrier equipment is constantly in communication with the mobile terminals carried by the users, and can collect location information for each mobile terminal at each time. The location information may be information measured by the mobile terminal's GPS (Global Positioning System), or may be the ID of a base station with which the mobile terminal can directly communicate. An important point here is that the active number refers to users captured by the telecommunications equipment of a specific mobile phone carrier, and does not necessarily refer to all actual users. In other words, the number of people captured by a specific telecommunications carrier can be counted as fewer than the actual number of people staying in the area. It is not possible to collect location information of all users from all telecommunications carriers. Here, it is not necessary to specify the absolute active number in the surrounding area of ​​the business establishment.

[0036] <Business size and / or building facilities> As for the size of the business establishment and / or the building facilities, the size may be, for example, the area of ​​the business establishment (square meters). Furthermore, the building facilities may be, for example, whether it is a single-story building or a building, and if it is a building, whether it is in the basement or on an upper floor, how many floors it has, etc. Other information may be characteristic information such as the number of pieces of equipment in the business establishment, the cost of the equipment, the number of employees, whether a floor is occupied, etc. Furthermore, the size and / or the building facilities need to be quantified or vectorized so that they can be compared as similarities. Business establishments with similar size and / or construction facilities are expected to have a high correlation in terms of changes in business conditions.

[0037] FIG. 4 is a graph connecting a plurality of nodes in the present invention.

[0038] [Graph Creation Section 11] The graph creation unit 11 creates a graph in which a business establishment for which a time-series business performance value can be obtained is regarded as a "node," and multiple nodes are connected by links based on "predetermined connection conditions." Note that the graph is an undirected graph, and the weight of the length of the link is expressed as 0. Here, there are cases in which links are connected from one node to multiple nodes.

[0039] The graph creation unit 11 creates a graph under the following predetermined connection conditions, for example. Location of business establishment - Number of people and vehicles passing through the designated area around the business (average number of people and vehicles passing through) -Business size and / or building facilities

[0040] <Location of business office> (1) According to FIG. 4(a), the distance between the business establishments is calculated based on the locations of the business establishments, and a graph is created in which nodes whose distance is equal to or less than a first threshold are connected by links.

[0041] <Current number of establishments> (2) According to Figure 4(b), based on the number of people or vehicles passing through a designated area around a business establishment, a graph is created in which links are connected between nodes where the difference in the average number of people or vehicles passing through the designated area around a business establishment is less than or equal to a second threshold value. In another embodiment, a graph may be created by calculating the Pearson correlation coefficient between the dynamic numbers of nodes from the change in the dynamic number over time. The Pearson correlation coefficient calculates the probability that a change in the dynamic number of a first node will affect a change in the dynamic number of a second node. There are both positive and negative correlations. For example, a graph may be created in which nodes are connected by links only when the probability of a positive correlation is equal to or greater than a predetermined threshold.

[0042] <Business size and / or building facilities> (3) According to FIG. 4(c), a graph is created in which nodes whose similarity is equal to or less than a third threshold are connected by links based on the difference in the size of the business establishments and / or the building facilities. Specifically, the size of the establishment and / or building facilities are expressed as numerical values, for example, as follows: Size: square meter Construction equipment: Single-story (0) / Building (-1, 1, 2, ...), Number of equipment, Equipment cost, Number of staff, Floor occupancy The scale and / or construction facilities may be expressed as vectors of element strings. The similarity between business establishments may be expressed by, for example, normalizing the distance (e.g., Euclidean distance) between each vector.

[0043] <Creating multiple graphs> The graph creation unit 11 may create only one of the graphs, or may create multiple graphs. For example, the graphs in all three of Fig. 4(a) to (c) are created and output to the comprehensive abnormal node detection unit 13. Finally, a comprehensive abnormal node group can be detected from different perspectives, such as location, number of active nodes, size, and / or construction facilities. Such graphs based on different perspectives can be automatically created without manual intervention from the establishment database 102. Even if an additional store is opened or the scale and facilities of the establishment are changed, the graphs can be updated immediately from various perspectives (such as location, number of active businesses, scale and / or building facilities).

[0044] <Assigning weights to links> In another embodiment, the inverse of the distance between the positions, the inverse of the difference in the number of active nodes, or the inverse of the difference in the scale and / or the construction facilities (similarity) may be assigned as a weight (for example, normalized 0 to 1) to the link connecting the nodes. The function for calculating the weight may be any one.

[0045] <Clustering of business establishments> As another embodiment, the characteristic information of all business establishments may be clustered using, for example, k-means, and a graph may be created with each cluster as a node. For example, when there are a large number of business establishments, a graph may be created with each cluster consisting of multiple business establishments with similar characteristic information as one node.

[0046] [Individual abnormal node detection unit 12] The individual abnormal node detection unit 12 detects, for each node, an abnormal node that satisfies a "predetermined abnormal condition" from the time-series business performance value.

[0047] FIG. 5 is a graph of step S0 representing an abnormal node in the present invention.

[0048] (S0) The individual abnormal node detection unit 12 detects an abnormal node that satisfies a predetermined abnormality condition. According to Fig. 5, each node is associated with information on sales in a time series as a business performance value. Here, the past average sales amount and the current sales amount are shown on the time axis. The time axis may be a one-day period divided into a plurality of time zones, or a one-week period divided into a plurality of time zones for each day of the week.

[0049] Then, for example, one anomaly node that satisfies the "specified anomaly condition" is detected from the time-series business performance values ​​using the following method. <Standard deviation> The specified abnormal condition is when the standard deviation is outside a specified range. Specifically, for each business location, the condition can be whether or not the value falls within a specified standard deviation (such as ±2σ) above and below the moving average line. For example, if the value exceeds ±2σ, it is determined to be "abnormal."

[0050] <Dynamic time stretching method> (2) The specified abnormal condition is a calculation amount based on dynamic time warping (DTW), where the calculation amount in a specified past period and the calculation amount in a specified current period are equal to or greater than a specified threshold. The dynamic time warping method compares the past average time series of business performance values ​​with the current time series of business performance values, and calculates the distance (absolute value of error) of each point of the waveform in a brute force manner. The distance of each point may be Euclidean distance or Manhattan distance. Then, the path that is the shortest between the two time series is detected, and it is detected whether the calculation amount of the path is equal to or exceeds a predetermined threshold.

[0051] [Comprehensive anomaly node detection unit 13] The comprehensive anomaly node detection unit 13 follows the links of the graph from the anomaly node to a set of nodes as long as the comprehensive time-series business performance value satisfies the "predetermined anomaly condition." By following the links, it detects a group of abnormal nodes hierarchically on the graph while including multiple business establishments. In other words, it estimates the change in the situation comprehensively, including not only the business establishment (abnormal node) whose change in business performance value shows an anomaly, but also multiple business establishments whose change in business performance value is similar to that.

[0052] The comprehensive abnormal node detection unit 13 has the following two methods for detecting a comprehensive abnormal node group. (Comprehensive method 1) The graph is traced link by link. In other words, while expanding the subset of multiple nodes, the situation change is judged for each comprehensive set of nodes. (Inclusive method 2) A filter (convolution filter) of random numbers generated within a specified range is slid onto the graph. In other words, a filter used in a GCN (Graph Convolutional Network) is applied to determine changes in the situation for each set of inclusive nodes included in the feature map. However, it goes without saying that the size of the convolution filter is set so that it does not include all nodes.

[0053] Using these inclusion methods, the presence or absence of anomalies, i.e., the presence or absence of changes in the situation, is judged for the entire group of comprehensive nodes on the graph, based on the abnormal node. Since the method includes the neighboring nodes of the graph hierarchically, it is robust against slight changes in the situation.

[0054] If the comprehensive anomaly node detection unit 13 detects an anomaly after comprehensively examining all the nodes in the graph, this does not mean that an anomaly has occurred in terms of location or number of active nodes, etc. In other words, this means that an anomaly has occurred in the overall situation of the business entity that operates multiple business locations.

[0055] FIG. 6 is a graph of step S11 showing the comprehensive abnormal node group in the present invention.

[0056] (S11) For the node groups included in one link of the graph from the abnormal node detected in S0, it is determined whether the inclusive time series sales (business performance value) satisfies a predetermined abnormality condition. Here, it is assumed that two inclusive node groups are selected, and each inclusive node group is determined to be "abnormal."

[0057] FIG. 7 is a graph of step S12 showing the comprehensive abnormal node group in the present invention.

[0058] (S12) Next, for each of the abnormal node groups detected in S11, it is determined whether the time series sales (business performance value) of the node groups included by one link meets a predetermined abnormality condition. Here, it is assumed that three comprehensive node groups are selected, two comprehensive node groups are determined to be "abnormal," and one comprehensive node group is determined to be "not abnormal."

[0059] FIG. 8 is a graph of step S13 showing the comprehensive abnormal node group in the present invention.

[0060] (S13) Next, for each of the two abnormal node groups detected in S12, it is determined whether the time series sales (business performance value) of the node groups included by one link meets a predetermined abnormality condition. Here, it is assumed that two comprehensive node groups are selected and both are determined to be "normal."

[0061] [Operator Interface Section 14] The operator interface unit 14 clearly displays to the operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection unit 13. This allows the operator to visually confirm the range of the abnormal node group and hierarchically analyze whether the abnormality of the situation change is local or global. When the graph creation unit 11 creates multiple graphs from different perspectives, the multiple graphs processed by the comprehensive anomaly node detection unit 13 are displayed to the operator. This allows the operator to recognize from what perspective the abnormal node group is spreading.

[0062] FIG. 9 is a graph showing a comprehensive abnormality node group that is clearly displayed to the operator.

[0063] 9, only the comprehensive abnormal node group determined in S12 (FIG. 7) is displayed, because the comprehensive abnormal node group has not been detected in S13 (FIG. 8). An operator visually viewing the graph in FIG. 9 can recognize the extent to which the group of abnormal nodes extends from the perspective from which the graph was created. In particular, when a plurality of graphs from different perspectives are created by the graph creation unit 11, the comprehensive abnormal node group for each graph is clearly displayed to the operator.

[0064] <Weighting of specific abnormal conditions according to the number of hops> In another embodiment, a weight may be assigned to the predetermined abnormal condition according to the number of hops as the link is followed. That is, the greater the number of hops, the higher the weight may be assigned to the predetermined abnormal condition, raising the hurdle for determining that an abnormality exists. On the other hand, the greater the number of hops, the lower the weight may be assigned to the predetermined abnormal condition, lowering the hurdle for determining that an abnormality exists. The weights can be freely set by the designer.

[0065] FIG. 10 is a graph showing a sequence of detection of a comprehensive anomaly node group.

[0066] (S0) As in (S0) of FIG. 5, it is assumed that an anomaly node that satisfies a predetermined anomaly condition is detected in a graph based on an arbitrary viewpoint. (S21) Next, for the node groups included in one link from the abnormal node S0, determine whether a situation change has occurred in the time-series business performance value. According to Figure 10, one comprehensive node group is determined to be "abnormal" and the other comprehensive node group is determined to be "normal." (S22) Next, for the node group included by one link from the comprehensive abnormal node group of S21, it is determined whether or not a change in the situation has occurred in the time-series business performance value. According to Figure 10, it is assumed that the comprehensive node group is determined to be "abnormal." (S23) Next, for the node group included by one link from the comprehensive abnormal node group of S22, it is determined whether or not a change in the situation has occurred in the time-series business performance value. According to Figure 10, it is assumed that the comprehensive node group is determined to be "abnormal." (S24) Next, for two node groups that are further included by one link from the comprehensive abnormal node group of S23, it is determined whether or not a change in the time-series business performance value has occurred. According to Figure 10, it is assumed that both comprehensive node groups are determined to be "normal." (S25) Finally, the comprehensive abnormal node group of S23 that was last determined to have an abnormality is displayed to the operator.

[0067] As described above in detail, the program, business management device and method of the present invention can clearly show to an operator a comprehensive group of multiple business establishments where abnormal changes in business conditions are occurring.

[0068] This will enable the company to, for example, "be aware of changes in the situation across multiple business locations," which will contribute to the UN-led Sustainable Development Goal 8 (SDG) of "promoting inclusive and sustainable economic growth, employment and decent work for all."

[0069] Regarding the various embodiments of the present invention described above, various changes, modifications, and omissions within the scope of the technical idea and perspective of the present invention can be easily made by those skilled in the art. The above description is merely an example and is not intended to be restrictive in any way. The present invention is limited only by the scope of the claims and their equivalents. [Explanation of symbols]

[0070] 1. Business Management Device 101 Management Performance Database 102 Business Database 11 Graph Creation Section 12 Individual abnormal node detection unit 13 Comprehensive Anomaly Node Detection Unit 14 Operator Interface Section

Claims

1. a graph creation means for creating a graph in which a plurality of nodes are connected based on a predetermined connection condition, the nodes being each a business establishment for which a time-series business performance value can be obtained; individual abnormal node detection means for detecting an abnormal node that satisfies a predetermined abnormal condition from a time series of business performance values ​​for each node; a comprehensive anomaly node detection means for following the links of the graph from the anomaly node to a set of nodes as long as a comprehensive time-series business performance value satisfies a predetermined anomaly condition; an operator interface means for indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; A program for causing a computer to function.

2. The graph creation means creates a graph in which nodes where the distance between the establishments is equal to or less than a first threshold value are connected by links based on the locations of the establishments.

2. The program according to claim 1, which causes a computer to function as described above.

3. The graph creation means creates a graph in which nodes where the difference in the number of people or vehicles passing through a predetermined periphery of the establishment is equal to or smaller than a second threshold value are connected by links.

2. The program according to claim 1, which causes a computer to function as described above.

4. The graph creation means creates a graph in which nodes that are similar to each other and have a difference in size and / or construction equipment between the business establishments that is equal to or less than a third threshold value are connected by links based on the size and / or construction equipment of the business establishments.

2. The program according to claim 1, which causes a computer to function as described above.

5. The graph creation method is A graph in which nodes are connected by links, the distance between the business establishments being equal to or less than a first threshold, based on the locations of the business establishments; A graph in which nodes are connected by links, where the difference in the number of people or vehicles passing through a specified vicinity of the establishment is equal to or less than a second threshold value; A graph in which links are connected between nodes that are similar and have a difference in size and / or building facilities between business establishments that is equal to or less than a third threshold based on the size of the business establishments. Create a plurality by combining one or more of the following: The comprehensive anomaly node detection means sequentially traces links from the anomaly node detected by the individual anomaly node detection means for each of the plurality of graphs formed from different viewpoints and created by the graph creation means; The operator interface means indicates to the operator the plurality of comprehensive abnormal node groups determined by the comprehensive abnormal node detection means.

2. The program according to claim 1, which causes a computer to function as described above.

6. The comprehensive anomaly node detection means selects a comprehensive node group to be judged by: Select a set of inclusive nodes by traversing the nodes of the graph link by link, or A filter generated within a given range is slid across the graph to select a set of inclusive nodes.

2. The program according to claim 1, which causes a computer to function as described above.

7. Regarding the individual abnormal node detection means, The time series of business performance values ​​is the sales or profits of the establishment, The specified abnormal condition is when the standard deviation is outside a specified range.

7. The program according to claim 1, which causes a computer to function as follows.

8. Regarding the individual abnormal node detection means, The time series of business performance values ​​is the sales or profits of the establishment, The predetermined abnormal condition is a calculation amount based on dynamic time warping (DTW), and is a case where the calculation amount in a past predetermined period and the calculation amount in a current predetermined period are equal to or greater than a predetermined threshold.

7. The program according to claim 1, which causes a computer to function as follows.

9. a graph creation means for creating a graph in which a plurality of nodes are connected based on a predetermined connection condition, the nodes being each a business establishment for which a time-series business performance value can be obtained; individual abnormal node detection means for detecting an abnormal node that satisfies a predetermined abnormal condition from a time series of business performance values ​​for each node; a comprehensive anomaly node detection means for following the links of the graph from the anomaly node to a set of nodes as long as a comprehensive time-series business performance value satisfies a predetermined anomaly condition; an operator interface means for indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; An anomaly detection device comprising:

10. 1. A method for detecting an abnormality in an apparatus, comprising: The device is A first step of creating a graph in which business establishments for which time-series business performance values ​​can be obtained are regarded as nodes and a plurality of nodes are connected based on predetermined connection conditions; A second step of detecting an abnormal node that satisfies a predetermined abnormal condition from the time series of business performance values ​​for each node; a third step of following the links of the graph from the abnormal node to a set of nodes as long as the comprehensive time-series business performance value satisfies a predetermined abnormality condition; a fourth step of indicating to an operator the comprehensive abnormal node group detected by the comprehensive abnormal node detection means; 2. A method for detecting an abnormality in an apparatus, comprising:

Images