Program, apparatus and method for determining anomalous period in time-series target log data

Abstract

To provide a determination apparatus, method and program for determining an anomalous period of an unusual event in time-series data.SOLUTION: A determination apparatus 1 includes: a period feature extraction unit which extracts, as a training stage, a plurality of training period features in units of predetermined period, from training log data and extracts, as an estimation stage, a plurality of target period features in units of the predetermined period, from target log data; a latent representation extraction unit which inputs, as a training stage, the training period features for training in units of the predetermined period and extracts training period latent representations, and inputs, as an estimation stage, the target period features to extract target period latent representations; a latent representation storage unit which stores the training period latent representations in units of the predetermined period; and an anomalous period determination unit which determines, as an estimation stage, as anomalous periods, predetermined periods in units of the predetermined period, when a vector distance between the training period latent representation stored in the latent representation storage means and the target period latent representation output from the latent representation extraction unit is equal to or larger than a predetermined threshold, in units of the predetermined period.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for determining peculiar periods based on rare events in time-series big data. [Background technology]

[0002] Conventionally, there is a technology for predicting future traffic conditions for multiple road sections (see, for example, Patent Document 1). According to this technology, a supervised learning engine is used to predict future traffic volume from past traffic volume, and a large amount of diverse past data is required in advance. Multiple road sections are divided into multiple clusters based on the similarity of traffic condition data. The learning engine then inputs past traffic condition data before a specified time point in the past for each cluster, and trains a prediction model to output past traffic condition data after the specified time point. The learning engine then inputs current traffic condition data collected from a road information collection terminal for each road section, and predicts future traffic condition data using a prediction model associated with the cluster to which the road section belongs.

[0003] There is also a technology that uses a supervised learning engine to detect a botnet's command center server that causes a network abnormality even with a small amount of training data (see, for example, Patent Document 2). According to this technology, from network communication information, servers that communicate between hosts with at least one similar connection structure of the communication protocol between a bot infected with malware and the command center server that controls that bot are extracted as command center server candidates. For each command center server candidate, network communication characteristics based on the communication information are generated. Then, command center server candidates with similar network communication characteristics are classified into the same group, and external threat information is compared with each classified group, and all candidates that belong to a group that includes a predetermined amount or more of command center servers are detected as command center servers. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2023-005015 A [Patent Document 2] JP 2018-169897 A [Non-patent literature]

[0005] [Non-Patent Document 1] Data Augmentation, CVML Expert Guide, [online], [Retrieved October 4, 2023], Internet <URL:https: / / cvml-expertguide.net / terms / dl / regularization / data-augmentation / #:~:text=%E3%83%87%E3%83%BC%E3%82%BF%E6%8B%A1%E5%BC%B5%20(Data%20Augmentation%2C%20%E3%83%87%E3%83%BC%E3%82%BF,%E3%82%92%E6%8B%A1%E3%81%92%E3%82%8B%E5%87%A6%E7%90%86%E3%81%A7%E3%81%82%E3%82%8B%EF%BC%8E> Summary of the Invention [Problem to be solved by the invention]

[0006] However, according to Patent Document 1, a large amount of diverse and large amounts of past data is required to use a supervised learning engine, and there is a problem in that prediction corresponding to a small amount of past data based on rare events is difficult. In other words, the prediction accuracy for the occurrence of rare events will not improve until a large amount of unknown data that did not exist in the past is collected and retrained.

[0007] According to Patent Document 2, by secondarily using communication information with external servers, it is possible to detect rare network anomalies even with a small amount of data. However, since it relies on external servers, there is a problem in that retraining cannot be done at low cost (computation time and amount of calculations).

[0008] In response to this, the inventors of the present application wondered whether it would be possible to determine peculiar periods based on rare events in time-series big data. They also thought that if peculiar periods could be extracted, it would be possible to retrain the learning engine by expanding (padding) only the data that occurred during the peculiar periods. In other words, even if a peculiar period based on a rare event is extracted, it is possible to retrain the learning engine so that the prediction accuracy of the learning engine during normal periods does not decrease.

[0009] Therefore, the present invention aims to provide a program, device, and method capable of determining a peculiar period based on a rare event in time-series big data. In addition, according to the present invention, generalization performance can be improved by expanding only the data in the determined peculiar period and retraining only the latent expression in the period unit of the peculiar period. [Means for solving the problem]

[0010] According to the present invention, there is provided a program for causing a computer to function to determine an anomalous period in time-series target log data for time-series teacher log data, the program comprising: a period feature extraction means for inputting teacher log data as a training stage and extracting a plurality of teacher period features in a predetermined period unit, and for inputting target log data as an estimation stage and extracting a plurality of target period features in a predetermined period unit; A latent expression extraction means for inputting each teacher period feature amount for each predetermined period and training and extracting each teacher period latent expression as a training stage, and inputting each target period feature amount for each predetermined period and extracting each target period latent expression as an estimation stage; A latent expression storage means for storing latent expressions for a predetermined period of time as a training stage; a specific period determination means for determining, as an estimation step, a specific period of the specific period unit as a specific period when a vector distance between a teacher period latent expression stored in the latent expression storage means and a target period latent expression output from the latent expression extraction means is greater than or equal to a specific threshold value; The present invention is characterized in that it causes a computer to function.

[0011] According to another embodiment of the program of the present invention, The peculiar period determination means includes: When the vector distance between the average vector calculated from the multiple teacher term latent expressions and the target term latent expression is greater than or equal to a predetermined threshold, or Calculate the vector distance between each teacher term latent expression and the target term latent expression, and if the minimum vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period. It is also preferable to function the computer in such a manner.

[0012] According to another embodiment of the program of the present invention, defining a first unit of time and a plurality of second units of time in a time series shorter than the first unit of time; The period feature extraction means includes: A first period feature extraction means extracts a plurality of first teacher period features from the teacher log data in a first period unit as a training stage, and extracts a plurality of first target period features from the target log data as an estimation stage; a second period feature extraction means for extracting a plurality of second teacher period features from the teacher log data in a second period unit as a training stage, and extracting a plurality of second target period features from the target log data as an estimation stage; The latent expression extraction method is as follows: A first latent expression extraction means for inputting and training each first teacher period feature in a first period unit as a training stage, and extracting each first teacher period latent expression; a second latent expression extraction means for inputting the first teacher period latent expression and each second teacher period feature quantity for training in a second period unit as a training stage, and extracting each second teacher period latent expression; The latent expression storage means stores a first teacher term latent expression of the first time unit and a second teacher term latent expression of the second time unit; The first latent expression extraction means, in the estimation step, inputs each first target period feature amount in a first period unit and extracts each first target period latent expression; The second latent expression extraction means, in the estimation step, inputs the first target period latent expression and each second target period feature amount in a second period unit, and extracts each second target period latent expression; The specific period determination means determines a specific period of the second period unit as a specific period when a vector distance between a second teacher period latent expression stored in the latent expression storage means and a second target period latent expression output from the second latent expression extraction means is greater than or equal to a predetermined threshold value in the second period unit. It is also preferable to function the computer in such a manner.

[0013] According to another embodiment of the program of the present invention, The peculiar period determination means includes: When the vector distance between the average vector calculated from the plurality of second teacher period latent expressions and the second target period latent expression is greater than or equal to a predetermined threshold value, or Calculate the vector distance between each second teacher term latent expression and the second target term latent expression, and if the minimum vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period. It is also preferable to function the computer in such a manner.

[0014] According to another embodiment of the program of the present invention, a data expansion means for expanding the second target period feature amount determined to be the peculiar period into a plurality of second target period feature amounts; And further enhance its functionality. The second latent expression extraction means is trained by inputting the expanded second target period features as teacher period features in the specific period as a training stage. It is also preferable to function the computer in such a manner.

[0015] According to another embodiment of the program of the present invention, further defining a plurality of third time units in a time series shorter than the second time unit; a third period feature extraction means for extracting a plurality of third teacher period features from the teacher log data in a third period unit as a training stage, and extracting a plurality of third target period features from the target log data in a third period unit as an estimation stage; a third latent expression extraction means for inputting the second teacher period latent expression and each third teacher period feature quantity for training in a third period unit as a training stage and extracting each third teacher period latent expression; And further enhance its functionality. The latent expression storage means further stores latent expressions of the third teacher period of the third period unit; The third latent expression extraction means, in the estimation step, inputs the second target period latent expression and each of the third target period features in a third period unit, and extracts each of the third target period latent expressions; The specific period determination means determines a specific period of the third period unit as a specific period when a vector distance between a third teacher period latent expression stored in the latent expression storage means and a third target period latent expression output from the third latent expression extraction means is greater than or equal to a predetermined threshold value in the third period unit. It is also preferable to function the computer in such a manner.

[0016] According to another embodiment of the program of the present invention, The peculiar period determination means includes: When the vector distance between the average vector calculated from the multiple third teacher period latent expressions and the third target period latent expression is greater than or equal to a predetermined threshold value, or Calculate the vector distance between each third teacher period latent expression and the third target period latent expression, and if the minimum vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period. It is also preferable to function the computer in such a manner.

[0017] According to another embodiment of the program of the present invention, a data expansion means for expanding the third target period feature amount determined to be the peculiar period into a plurality of third target period feature amounts; And further enhance its functionality. The third latent expression extraction means is trained by inputting the expanded third target period features as teacher period features in the specific period as a training stage. It is also preferable to function the computer in such a manner.

[0018] According to the present invention, there is provided a determination device for determining an anomalous period in time-series target log data with respect to time-series teacher log data, comprising: a period feature extraction means for inputting teacher log data as a training stage and extracting a plurality of teacher period features in a predetermined period unit, and for inputting target log data as an estimation stage and extracting a plurality of target period features in a predetermined period unit; A latent expression extraction means for inputting each teacher period feature amount for each predetermined period and training and extracting each teacher period latent expression as a training stage, and inputting each target period feature amount for each predetermined period and extracting each target period latent expression as an estimation stage; A latent expression storage means for storing latent expressions for a predetermined period of time as a training stage; a specific period determination means for determining, as an estimation step, a specific period of the specific period unit as a specific period when a vector distance between a teacher period latent expression stored in the latent expression storage means and a target period latent expression output from the latent expression extraction means is greater than or equal to a specific threshold value; The present invention is characterized by having the following.

[0019] According to the present invention, there is provided a method for determining an anomalous period in time-series target log data for time-series teacher log data, the method comprising the steps of: The device is As a training stage, A first step of inputting teacher log data and extracting a plurality of teacher period features for a predetermined period unit; A second step of inputting and training each teacher period feature and extracting each teacher period latent expression for the predetermined period; a third step of storing the teacher-term latent representation for a given period of time; As an estimation stage, A fourth step of inputting target log data and extracting a plurality of target period feature quantities for a predetermined period unit; A fifth step of inputting each target period feature and extracting each target period latent representation; a sixth step of determining that a predetermined period of the predetermined period unit is an anomalous period when a vector distance between the teacher period latent expression stored in the third step and the target period latent expression output in the fifth step is greater than or equal to a predetermined threshold value; The present invention is characterized by carrying out the following steps. Effect of the Invention

[0020] According to the program, device, and method of the present invention, it is possible to determine a specific period based on a rare event in time-series big data. In addition, according to the present invention, it is also possible to improve generalization performance by expanding only the data in the determined specific period and retraining only the latent expression in the time unit of the specific period. [Brief description of the drawings]

[0021] [Figure 1] FIG. 2 is a functional configuration diagram based on a period feature amount of one period unit in the determination device of the present invention. [Diagram 2] 11 is an explanatory diagram illustrating calculation of a distance between vectors in the anomalous period determination unit. FIG. [Diagram 3] FIG. 2 is a functional configuration diagram of a training stage based on period feature amounts of a plurality of period units in the determination device of the present invention. [Figure 4] FIG. 11 is an explanatory diagram showing different predetermined time units. [Diagram 5] FIG. 2 is a functional configuration diagram of an estimation stage based on period feature amounts of a plurality of period units in the determination device of the present invention. [Figure 6] FIG. 2 is a functional configuration diagram including a data expansion unit in the determination device of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0023] FIG. 1 is a functional configuration diagram based on a period feature amount of one period unit in a determination device of the present invention.

[0024] According to FIG. 1, the determination device 1 determines an anomalous period in time-series "target log data" with respect to time-series "teacher log data." Log data refers to various time-series multivariate data collected from many users and devices, such as traffic volume, movement volume, location information, movement speed, temperature, and measurements from IoT (Internet of Things) devices. The teacher log data is log data in normal times, and the target log data is log data to be subjected to judgment.

[0025] Log data may be big data such as the volume of car and human traffic in the case of traffic congestion prediction, for example. Of course, it is not limited to traffic congestion prediction, but may be destination prediction from location information, purchase prediction from purchase history, service use / cancellation prediction from service usage history, and network traffic prediction. Log data can be applied to training and prediction using any time series data. Prediction can be applied to both regression and classification.

[0026] The determination device 1 in FIG. 1(a) has a period feature extraction unit 11, a latent expression extraction unit 12, and a latent expression storage unit 101 for the <training stage>. According to the determination device 1 of FIG. 1(b), in the <estimation stage>, a peculiar period determination unit 13 is further provided in addition to the functional configuration of FIG. These functional components may be realized by executing a program that causes a computer installed in the determination device to function. The process flow of these functional components can also be understood as a determination method.

[0027] [Period feature extraction unit 11] The period feature extraction unit 11 inputs teacher log data as the <training stage> of FIG. 1(a) and extracts a plurality of teacher period features for one predetermined period unit. Furthermore, as the <estimation stage> of FIG. 1(b), the period feature extraction unit 11 inputs the target log data and extracts a plurality of target period features for one predetermined period unit, the same as the training stage.

[0028] The "predetermined period" may be, for example, any of the following: yearly, seasonal, monthly, day of the week, or unit time. The time-series log data is divided by sliding a filter for each predetermined period (for example, one year). The predetermined period is arbitrary and based on external knowledge (for example, people's prior knowledge or domain knowledge).

[0029] The "teacher period feature amount" is a period feature amount for a predetermined period extracted from the teacher log data. The "target period feature amount" is a period feature amount for a predetermined period extracted from the target log data for which a peculiar period is to be determined. The "period feature amount" refers to a plurality of feature amounts, for example, as follows, in a predetermined period unit. Maximum, minimum, opening, closing, statistics (average, variance, median, entropy, etc.)

[0030] [Latent expression extraction unit 12] The latent expression extraction unit 12 extracts latent expressions from period features in a predetermined period unit in the time-series log data. The latent expressions are used for predicting a predetermined purpose in the period unit. In the <training stage> of Fig. 1(a), the features of each teacher period are input for training in a predetermined period unit, and latent expressions of each teacher period are extracted. In the estimation step in Fig. 1(b), the features of each target period are input and a latent representation of each target period is extracted.

[0031] "Latent representation" refers to a vector transformed by a distributed representation generation algorithm (embedding). This is an encoded representation using, for example, a Convolutional Neural Network (CNN) or a Transformer, and is compressed into a low-dimensional vector while retaining the essential state of time-series data.

[0032] The "teacher period latent expression" is a latent expression extracted from the period feature quantity of a predetermined period unit in the teacher log data by a distributed expression generation algorithm. The "target period feature amount" is a latent expression extracted from the period feature amount of a predetermined period unit in the target log data by a distributed expression generation algorithm.

[0033] [Latent expression storage unit 101] The latent expression storage unit 101 stores latent expressions for each teaching period in a predetermined period unit as the "training stage" in FIG. 1(a).

[0034] [Special period determination unit 13] As an <estimation stage> in FIG. 1(b), the peculiar period determination unit 13 calculates the vector distance between the teacher period latent expression stored in the latent expression storage unit 101 and the target period latent expression extracted from the latent expression extraction unit 12 in a predetermined period unit, and if the vector distance is equal to or greater than a predetermined threshold, determines that the predetermined period in the predetermined period unit is a "peculiar period".

[0035] FIG. 2 is an explanatory diagram illustrating the calculation of the inter-vector distance in the peculiar period determination unit.

[0036] <Vector distance from the mean vector> According to FIG. 2(a), the peculiar period determination unit 13 performs the determination in the following steps. (S201) First, calculate an "average vector" from multiple teacher-term latent expressions. Specifically, plot the teacher-term latent expressions in a vector space and calculate their average vectors (e.g., centroids). If the specified period unit is a year, it is as follows. <Teacher period latent expression> ... Latent Expressions of 2019 Latent Expressions of 2020 Latent Representation in 2021 -> Average Vector (S202) Next, the inter-vector distance between the average vector and the target period latent expression is calculated. Mean vector <-> target period latent representation Specifically, the inter-vector distance may be Euclidean distance or cosine similarity in a vector space. (S203) Next, it is determined whether the inter-vector distance is equal to or greater than a predetermined threshold value. Distance between vectors <-> given threshold (S204) If S203 determines that the result is true, the predetermined period in the predetermined period unit is determined to be an "anomalous period." For example, if the vector distance between the average vector and the latent expression in 2022 is greater than or equal to a predetermined threshold, it can be detected that a rare event has occurred in the target log data corresponding to the latent expression in 2022.

[0037] <Minimum vector distance> According to FIG. 2(b), the peculiar period determination unit 13 performs the determination in the following steps. (S211) First, calculate the vector distance between each teacher-term latent expression and the target-term latent expression. Specifically, plot each teacher-term latent expression in a vector space, and calculate the vector distance between each target-term latent expression. <Latent expression of teacher period> <Latent expression of subject period> <Distance between vectors> .................................................................................................................... Latent expression in 2019 -> Latent expression in 2022 Vector distance in 2019 Latent expression in 2020 -> Latent expression in 2022 Vector distance in 2020 Latent expression in 2021 -> Latent expression in 2022 Vector distance in 2021 (S212) Next, it is determined whether the smallest inter-vector distance is equal to or greater than a predetermined threshold value. 2019 vector distance min <-> given threshold (S213) If S212 determines that the result is true, the predetermined period in the predetermined period unit is determined to be an "anomalous period." For example, if the minimum inter-vector distance in 2019 is greater than or equal to a predetermined threshold, it can be detected that a rare event has occurred in the target log data corresponding to the latent expression in 2022.

[0038] FIG. 3 is a functional configuration diagram of a training stage based on period feature amounts of a plurality of period units in the determination device of the present invention. FIG. 4 is an explanatory diagram showing different predetermined time units. FIG. 5 is a functional configuration diagram of an estimation stage based on period feature amounts of a plurality of period units in the determination device of the present invention.

[0039] The different predetermined time units are defined as follows: 1st time unit > 2nd time unit > 3rd time unit First period unit Second period unit: shorter than the first period unit ·Third period unit: shorter than the second period unit According to Fig. 4, for example, the data is divided into multiple categories, such as "annual change", "seasonal change", "monthly change", "change by day of the week", and "change by unit time". As long as the length of the different predetermined time units is clear, the log data can be simply divided from the longest time unit to the shortest time unit. Here, it is not required that the longest time unit be a multiple of the shortest time unit.

[0040] First period feature extraction unit 111-> .... Period features for 2019 Period features for 2020 Period features for 2021 Period features for 2022 Second period feature extraction unit 112-> .... Period features for Spring 2019 2019 Summer Period Features Period features for autumn 2019 2019 Winter period feature .... 2022 Spring Period Features 2022 Summer Period Features 2022 Autumn Period Features 2022 Winter Period Features Third period feature extraction unit 113-> .... Period feature for winter 2019, January Period features for winter 2019, February Period features for spring and March 2019 .... Period features for Fall 2022 and October Period features for Fall 2022 and November Period features for 2022 Winter December

[0041] For example, teacher log data of traffic volume over time can be considered to have the following trends. Annual change: increasing As for seasonal changes, for example, there is a decreasing trend only in autumn Monthly changes, for example, there is an increasing trend only in August and December As for changes by day of the week, for example, there is an increasing trend on Saturdays and Sundays As for the change by unit time, for example, there is an increasing trend during the day and a decreasing trend at night. For example, teacher log data that is a unit of time for monthly changes is affected by yearly changes and seasonal changes.Similarly, teacher log data that is a unit of time for unit time changes is affected by yearly changes, seasonal changes, monthly changes, and changes by day of the week. For example, it is possible to extract peculiar periods when, due to the outbreak of a new infectious disease, the traffic congestion that usually occurs in the summer is not occurring, and the traffic congestion that usually occurs on Sundays is also not occurring.

[0042] [First period feature extraction unit 111] The first period feature amount extraction unit 111 performs the following process. In the <training stage>, a plurality of first teacher period features are extracted from the teacher log data in a first period unit. In the estimation step, a plurality of first target period feature amounts are extracted from the target log data in a first period unit.

[0043] [Second period feature extraction unit 112] The second period feature amount extraction unit 112 performs the following process. In the <training stage>, a plurality of second teacher period features are extracted from the teacher log data in second period units. In the estimation step, a plurality of second target period feature amounts are extracted from the target log data in second period units.

[0044] [Third period feature extraction unit 113] The third period feature amount extraction unit 113 performs the following process. In the <training stage>, a plurality of third teacher period features are extracted from the teacher log data in third period units. In the estimation step, a plurality of third target period feature amounts are extracted from the target log data in third period units.

[0045] [First latent expression extraction unit 121] The first latent expression extraction unit 121 performs the following process. In the <training stage>, the feature values ​​of each first teacher term are inputted and trained in units of a first period, and a latent expression of each first teacher term is extracted. In the <estimation step>, the first target period feature amounts are input in units of a first period, and each first target period latent expression is extracted.

[0046] [Second latent expression extraction unit 122] The second latent expression extraction unit 122 performs the following process. In the <training stage>, the first teacher term latent expression and each second teacher term feature are inputted in units of the second period to perform training, and each second teacher term latent expression is extracted. In the <estimation step>, the first target period latent expression and each second target period feature amount are input in second period units, and each second target period latent expression is extracted. Here, an important point of the present invention is that the second latent expression extraction unit 122 also inputs the first-period latent expressions. As a result, each second-period latent expression extracted by the second latent expression extraction unit 122 takes into account the first-period latent expressions.

[0047] [Third latent expression extraction unit 123] The third latent expression extraction unit 123 performs the following process. In the <training stage>, the second teacher term latent expression and each third teacher term feature are inputted in third period units for training, and each third teacher term latent expression is extracted. In the <estimation step>, the second target period latent expression and each of the third target period features are input in third period units to extract each of the third target period latent expressions. Similarly, an important point of the present invention is that the third latent expression extraction unit 123 also inputs the second-period latent expressions. As a result, each third-period latent expression extracted by the third latent expression extraction unit 123 takes the second-period latent expressions into consideration.

[0048] [Latent expression storage unit 101] The latent expression storage unit 101 stores information, for example, as follows. Each first teacher period latent representation of the first period unit Each second teacher period latent representation of the second period unit Each third teacher-term latent representation of the third-term unit According to the training stage in Figure 3, multiple period feature extraction units and latent expression extraction units are provided as "layers" for each period unit. For the time-series teacher log data, latent expressions are recorded while narrowing the period unit (resolution) layer by layer.

[0049] [Special period determination unit 13] The peculiar period determination unit 13 makes the following determination, similarly to FIG. (1) In a first period unit, if the vector distance between the first teacher period latent expression stored in the latent expression memory unit 101 and the first target period latent expression output from the first latent expression extraction unit 121 is greater than or equal to a predetermined threshold, the predetermined period of the first period unit is determined to be a “peculiar period.” (2) In a second period unit, if the vector distance between the second teacher period latent expression stored in the latent expression memory unit 101 and the second target period latent expression output from the second latent expression extraction unit 122 is greater than or equal to a predetermined threshold, the predetermined period of the second period unit is determined to be a “peculiar period.” (3) If, in a third period unit, the vector distance between the third teacher period latent expression stored in the latent expression memory unit 101 and the third target period latent expression output from the third latent expression extraction unit 123 is greater than or equal to a predetermined threshold, the predetermined period of the third period unit is determined to be a “peculiar period.”

[0050] FIG. 6 is a functional configuration diagram including a data expansion unit in the determination device of the present invention.

[0051] 6, the determination device 1 further includes a data expansion unit 14. Here, only latent expressions in a "peculiar period" based on rare events are expanded. Since the amount of data for rare events is small, data expansion is necessary to improve the accuracy of prediction using the latent expressions.

[0052] For example, when the second target period feature is determined to be a specific period, the data extension unit 14 extends the second target period feature to a plurality of target period features. The plurality of extended second target period features are input to the second latent expression extraction unit 122 and become retraining data. In addition, for example, when the third target period feature is determined to be a specific period, the data is expanded to a plurality of target period feature values. The expanded plurality of third target period feature values ​​are input to the third latent expression extraction unit 123 and become retraining data.

[0053] "Data Augmentation" refers to the generation of diverse training data by augmenting it while retaining the statistical or latent characteristics of the actual training data (see, for example, Non-Patent Document 1). This is a process of expanding the amount and distribution (variation) of a data set by transforming or combining each sample of training data to augment new data (Augmentation) as a preprocessing step for machine learning. In particular, when extracting latent representations using DNNs (Deep Neural Networks) such as CNNs and Transformers, there is a problem of overfitting. Because a large number of parameters are used, overfitting can easily occur when training with a small amount of training data generated by rare events. For this reason, overfitting of DNNs can be reduced by using a set of training data that expands on that small amount of training data. Increasing the diversity of training data also has the effect of regularization, improving the generalization performance of DNNs.

[0054] Data augmentation may be, for example, the application of the following image processing algorithm: Data augmentation can augment training data for rare events with minimal preprocessing costs (computation time and amount of calculations). (Example 1) Creating a new latent representation by adding normal noise. (Example 2) Dropping some of the connections from the previous layer to create multiple slightly different latent representations (dropout). (Example 3) Perform an affine transformation to create a new latent representation. (Example 4) Create a new latent expression from the division point of three latent expressions or the center of gravity of three or more latent expressions (Mixup). (Example 5) Creating a new latent expression by cutting and pasting parts of multiple latent expressions (CutMix). Of course, the present invention is not limited to these examples, and any data augmentation method that has a wide variety of variations and preserves the statistical or latent characteristics of the training data may be used.

[0055] For example, when the training data is based on a time series of traffic volume, a decrease in traffic volume due to a "seasonal pandemic" or an increase in traffic volume due to a "weekday event" may occur as a rare event. According to the present invention, a specific period in which a rare event occurred is extracted from the time series of training data, and only "latent expressions of seasonal data" and "latent expressions of data by day of the week" can be data expanded from a small amount of training data in that specific period.

[0056] First, this makes it possible to ensure that the latent representations of periods that are not unusual (i.e., periods that are no different from normal times) are not biased by rare events. Secondly, it is only necessary to retrain with the data-augmented teaching data for the period unit from which the peculiar period was extracted, thereby improving generalization performance at low cost. According to the present invention, only the layer (latent expression extraction unit) from which the specific period was extracted needs to be retrained, and low cost (short time and low amount of calculation) can be maintained. At this time, for the other layers, the parameters in normal times can be fixed, and retraining is not required. In other words, even if a rare event occurs, the bias caused by the event does not affect the layers that remain in normal times (fine tuning), and the prediction accuracy of each layer can be maintained. Since only the rare layer is required, re-learning can be performed in a short time. Compared to shallower layers with longer time units (coarse latent expressions such as annual changes), deeper layers with shorter time units (finer latent expressions such as hourly units) tend to extract more task-specific latent expressions.

[0057] As described above in detail, the program, device, and method of the present invention can determine a specific period based on a rare event in time-series big data. In addition, the present invention can improve generalization performance by expanding only the data in the determined specific period and retraining only the latent expression in the time unit of the specific period.

[0058] Furthermore, this will make it possible, for example, to "improve prediction accuracy using latent representations for time-series big data," which will contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0059] Regarding the various embodiments of the present invention described above, various changes, modifications, and omissions within the scope of the technical idea and perspective of the present invention can be easily made by those skilled in the art. The above description is merely an example and is not intended to be restrictive in any way. The present invention is limited only by the scope of the claims and their equivalents. [Explanation of symbols]

[0060] 1 Judgment device 11 Period feature extraction unit 111 First period feature extraction unit 112 Second period feature extraction unit 113 Third Period Feature Extraction Unit 12 Latent expression extraction part 121 First latent expression extraction unit 122 Second Latent Expression Extraction Unit 123 Third Latent Expression Extraction Unit 101 Latent representation memory 13 Singular period determination section 14 Data Extension Section

Claims

1. A program for causing a computer to function to determine a peculiar period in time-series target log data for time-series teacher log data, a period feature extraction means for inputting teacher log data as a training stage and extracting a plurality of teacher period features in a predetermined period unit, and for inputting target log data as an estimation stage and extracting a plurality of target period features in a predetermined period unit; A latent expression extraction means for inputting each teacher period feature amount for each predetermined period and training and extracting each teacher period latent expression as a training stage, and inputting each target period feature amount for each predetermined period and extracting each target period latent expression as an estimation stage; A latent expression storage means for storing latent expressions for a predetermined period of time as a training stage; a specific period determination means for determining, as an estimation step, a specific period of the specific period unit as a specific period when a vector distance between a teacher period latent expression stored in the latent expression storage means and a target period latent expression output from the latent expression extraction means is greater than or equal to a specific threshold value; A program for causing a computer to function.

2. The peculiar period determination means includes: When the vector distance between the average vector calculated from the multiple teacher term latent expressions and the target term latent expression is greater than or equal to a predetermined threshold, or Calculate the vector distance between each teacher term latent expression and the target term latent expression, and if the minimum vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period.

2. The program according to claim 1, which causes a computer to function as described above.

3. defining a first time unit and a plurality of second time units in a time series shorter than the first time unit; The period feature extraction means includes: a first period feature extraction means for extracting a plurality of first teacher period features from teacher log data in a first period unit as a training stage, and extracting a plurality of first target period features from target log data as an estimation stage; a second period feature extraction means for extracting a plurality of second teacher period features from the teacher log data in a second period unit as a training stage, and extracting a plurality of second target period features from the target log data as an estimation stage; The latent expression extraction method is as follows: A first latent expression extraction means for inputting and training each first teacher period feature in a first period unit as a training stage, and extracting each first teacher period latent expression; a second latent expression extraction means for inputting the first teacher period latent expression and each second teacher period feature quantity for training in a second period unit as a training stage, and extracting each second teacher period latent expression; The latent expression storage means stores a first teacher period latent expression of the first period unit and a second teacher period latent expression of the second period unit; The first latent expression extraction means, in the estimation step, inputs each first target period feature amount in a first period unit and extracts each first target period latent expression; The second latent expression extraction means, in the estimation step, inputs the first target period latent expression and each of the second target period features in a second period unit, and extracts each of the second target period latent expressions; The specific period determination means determines a specific period of the second period unit as a specific period when a vector distance between a second teacher period latent expression stored in the latent expression storage means and a second target period latent expression output from the second latent expression extraction means is greater than or equal to a specific threshold value in the second period unit.

2. The program according to claim 1, which causes a computer to function as described above.

4. The peculiar period determination means includes: When the vector distance between the average vector calculated from the plurality of second teacher period latent expressions and the second target period latent expression is greater than or equal to a predetermined threshold value, or A vector distance between each second teacher period latent expression and a second target period latent expression is calculated, and if the smallest vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period.

4. The program according to claim 3, which causes a computer to function as described above.

5. a data expansion means for expanding the second target period feature amount determined to be the peculiar period into a plurality of second target period feature amounts; And further enhance its functionality. The second latent expression extraction means is trained by inputting the expanded second target period features as teacher period features in the specific period as a training stage.

4. The program according to claim 3, which causes a computer to function as described above.

6. further defining a plurality of third time units in time sequence shorter than the second time units; a third period feature extraction means for extracting a plurality of third teacher period features from the teacher log data in a third period unit as a training stage, and extracting a plurality of third target period features from the target log data in a third period unit as an estimation stage; a third latent expression extraction means for inputting the second teacher period latent expression and each third teacher period feature quantity for training in a third period unit as a training stage, and extracting each third teacher period latent expression; And further enhance its functionality. The latent expression storage means further stores a third teacher period latent expression of each third period unit, The third latent expression extraction means, in the estimation step, inputs the second target period latent expression and each of the third target period features, and extracts each of the third target period latent expressions in third period units; The specific period determination means determines a specific period of the third period unit as a specific period when a vector distance between a third teacher period latent expression stored in the latent expression storage means and a third target period latent expression output from the third latent expression extraction means is greater than or equal to a predetermined threshold value.

4. The program according to claim 3, which causes a computer to function as described above.

7. The peculiar period determination means includes: When the vector distance between the average vector calculated from the plurality of third teacher period latent expressions and the third target period latent expression is greater than or equal to a predetermined threshold value, or A vector distance between each of the third teacher period latent expressions and the third target period latent expression is calculated, and if the smallest vector distance is greater than or equal to a predetermined threshold, The predetermined period in the predetermined period unit is determined to be an unusual period.

7. The program according to claim 6, which causes a computer to function as described above.

8. a data expansion means for expanding the third target period feature amount determined to be the peculiar period into a plurality of third target period feature amounts; And further enhance its functionality. The third latent expression extraction means is trained by inputting the expanded third target period features as teacher period features in the specific period as a training stage.

7. The program according to claim 6, which causes a computer to function as described above.

9. A determination device that determines a peculiar period in time-series target log data with respect to time-series teacher log data, comprising: a period feature extraction means for inputting teacher log data as a training stage and extracting a plurality of teacher period features in a predetermined period unit, and for inputting target log data as an estimation stage and extracting a plurality of target period features in a predetermined period unit; A latent expression extraction means for inputting each teacher period feature amount for each predetermined period and training and extracting each teacher period latent expression as a training stage, and inputting each target period feature amount for each predetermined period and extracting each target period latent expression as an estimation stage; A latent expression storage means for storing latent expressions for a predetermined period of time as a training stage; a specific period determination means for determining, as an estimation step, a specific period of the specific period unit as a specific period when a vector distance between a teacher period latent expression stored in the latent expression storage means and a target period latent expression output from the latent expression extraction means is greater than or equal to a specific threshold value; A determination device comprising:

10. A method for determining an anomalous period in time-series target log data for time-series teacher log data, comprising: The device is As a training stage, A first step of inputting teacher log data and extracting a plurality of teacher period features for a predetermined period unit; A second step of inputting and training each teacher period feature and extracting each teacher period latent expression for the predetermined period; A third step of storing the teacher term latent representation for a predetermined period unit; As an estimation stage, A fourth step of inputting target log data and extracting a plurality of target period feature amounts in predetermined time units; A fifth step of inputting each target period feature and extracting each target period latent expression; a sixth step of determining that a predetermined period of the predetermined period unit is an anomalous period when a vector distance between the teacher period latent expression stored in the third step and the target period latent expression output in the fifth step is greater than or equal to a predetermined threshold value; A determination method comprising:

Images