Data analysis server, data analysis system and data analysis methods

Abstract

A data analytics server holds added-basis-point information, wherein the added-basis-point information comprises a value of an explanatory variable encrypted by first-level high-performance encryption, a value of a response variable encrypted by a predetermined encryption scheme, and a basis point based on frequencies of the value of the explanatory variable in training information, each mapped to the other, wherein the data analytics server performs: a decision tree generation process to generate a decision tree with a leaf node mapped to the value of the response variable encrypted by a predetermined encryption scheme contained in the added-basis-point information, and a branching rule determination process during the decision tree generation process.without deciphering the value of the explanatory variable and the corresponding base value.

Description

Priority claim

[0001] This application claims priority from Japanese patent application JP 2018-076363, filed on April 11, 2018, the contents of which are hereby incorporated by reference into this application. Background of the invention

[0002] The present invention relates to a data analysis server, a data analysis system and a data analysis method.

[0003] In recent years, instead of maintaining an information system within one's own organization, attention has been paid to using a data analysis agent service to request data analysis from an information system provided by another organization for the purpose of efficient data analysis. In addition, decision tree analysis, which is a type of data analysis method, and random forest, which originated from decision tree analysis, are widely used. Examples of decision tree analysis and random forest are described in "The Element of Statistical Learning" by Trevor Hastie, Robert Tibshirani, and Jerome Friedman, Springer Series in Statics, Springer New York Inc., 2001, pp. 305-316 and pp. 587-604.

[0004] When a data analysis agent service is used as described above, the data content is passed to an external organization that serves as an agent for the analysis. In view of this, "Privately Evaluating Decision Trees and Random Forests" by David J. Wu, Tony Feng, Michael Naehrig, and Kristin Lauter, PETS Symposium in the United States, 2016 (hereinafter referred to simply as "Privately Evaluating Decision Trees and Random Forests") describes a technology for securely performing random forest analysis by applying encryption technology to data containing private information or other such sensitive information. Specifically, "Privately Evaluating Decision Trees and Random Forests" describes a method for dividing random forest analysis into a learning phase and an analysis phase, and preventing data content from entering the analysis phase.

[0005] Patent document US 2016 / 0 156 595 A1 describes the evaluation of decision trees using a user device. The user device encrypts the input vectors with a client's public key in an additive homomorphic encryption system. A server computer randomizes the decision tree each time it is used. The server computer homomorphically calculates the scores of each decision node. The server computer provides the value specifying the path through the decision tree as a client-accessible part and a server-accessible part. The server computer uses the parts to search for a corresponding output value from a database of output values ​​for each path.

[0006] Patent US 2012 / 0201378 A1 describes a method and apparatus for classification. In one embodiment, the method comprises performing a tree-based classification of a user input by a classifier having a classification tree at a first location, including exchanging data with a second location to obtain the user input and provide classification results to a user using a single homomorphic key. The classifier is unaware of either the user input or the classifier's output, and the user is unaware of the classification tree.

[0007] The publication "Privately Evaluating Decision Trees and Random Forests" by WU, DJ [et al.] appeared in the journal "Proceedings on Privacy Enhancing Technologies", Vol. 2016, No. 4, pp. 335-355 (DOI: 10.1515 / popets-2016-0043). The publication describes two protocols for the private evaluation of decision trees and random forests. The publication assumes a standard two-party environment in which the server has a model (either a tree or a forest) and the client has an input (a feature vector). At the end of the protocol, the client receives only the output of the model for its input and some general parameters related to the model. The first described protocol attempts to provide security against semi-honest attackers. Next, an extension of the semi-honest protocol is described, which attempts to be robust against malicious attackers. Summary of the invention

[0008] However, there is a possibility, for example, that learning data contains sensitive information, which requires improving data confidentiality even during a learning phase of a decision tree analysis. Therefore, one object of the present invention is to improve data confidentiality during a learning phase of a decision tree analysis.

[0009] The above problems are solved by the independent main claim and the independent subclaims. The dependent subclaims represent advantageous specifications of the respective solutions.

[0010] An aspect of the present invention can improve data privacy in a learning phase of a decision tree analysis.

[0011] Problems, constructions and effects not mentioned above will be explained in the following embodiments. Brief description of the drawings

[0012] The present invention can be understood from the following description in conjunction with the following figures, in which: Fig. 1 is a block diagram illustrating a configuration example of a data analysis system according to a first embodiment; Fig. 2 is a block diagram illustrating a configuration example of a provider server according to the first embodiment; Fig. 3 is a block diagram illustrating a configuration example of an analysis agent server according to the first embodiment; Fig. 4 is a block diagram illustrating a configuration example of a delegation server according to the first embodiment; Fig. 5 is an example of the table for learning according to the first embodiment; Fig. 6 is an explanatory diagram for illustrating an example of a decision tree according to the first embodiment; Fig. 7 is a sequence diagram for illustrating an example of the processing performed by the data analysis system according to the first embodiment; Fig. 8 is a flowchart showing an example of the processing of creating the base point added table according to the first embodiment; Fig. 9 is an explanatory diagram for illustrating an example of an outline of the processing for generating a base point added table from the table for learning according to the first embodiment; Fig. 10 is a flowchart illustrating exemplary decision tree generation processing performed according to the first embodiment; Fig. 11 is an explanatory diagram for illustrating an example of an outline of the decision tree generation processing according to the first embodiment; Fig. 12A is an example of a decision tree according to the first embodiment; Fig. 12B is an example of a decision tree table according to the first embodiment; Fig. 13 is a flowchart showing an example of node search processing performed according to the first embodiment; Fig. 14 is an explanatory diagram for illustrating an exemplary encryption process according to the first embodiment; Fig. 15 is a flowchart showing an example of analysis processing according to the first embodiment, Fig. 16A is an explanatory diagram for illustrating an example of an outline of the analysis processing according to the first embodiment; Fig. 16B is an example of a leaf node table according to the first embodiment; Fig. 17 is a flowchart for illustrating an example of the decision tree generation processing according to the second embodiment; Fig. 18 is an explanatory diagram illustrating an example of an outline of the processing for extracting a record from an encrypted table with a base point added according to the second embodiment; and Fig. 19 is a flowchart for illustrating an example of analysis processing performed using a plurality of decision tree tables according to the second embodiment. Detailed description of the preferred embodiments

[0013] Embodiments will be described below with reference to the accompanying drawings. Elements common to the drawings are denoted by the same reference numerals throughout the embodiments. It should be noted that the embodiments are merely examples for implementing the present invention and are not intended to limit the technical scope of this disclosure.

[0014] First, the terms and symbols used in the embodiments are defined as follows. (1) Table

[0015] A table is a type of data structure. In this embodiment, data treated in a tabular form is referred to as a "table." Each set of data obtained by dividing the table into units of rows (in a horizontal axis direction) is called a "record," and an element in the table is called a "cell." Each cell has data entered into it. Meanwhile, the table is divided into units of columns (in a vertical axis direction), and each of the columns indicates an attribute. For example, "name," "gender," "age," and other such variables are used as attributes in the table. Values ​​that can be entered are defined for the respective attributes, and a set of such values ​​is referred to as a "plaintext space." If the attribute is "gender," (male and female) is a plaintext space.For example, if the attribute is "cancer," "esophagus," "colon," "skin," and "bladder" are contained in a plaintext space. If the attribute is "age," a set of integers from 0 to approximately 100 is an example of a plaintext space.

[0016] The embodiments are described using an example in which information used by a data analysis system described later represents a table, but the information may be expressed by any data structure without depending on that data structure. For example, in addition to a table, a data structure appropriately selected from a group including a list, a database, and a queue may store the information.

[0017] The table is described using a learning table as an example. Fig. Figure 5 is an example of the learning table. Attributes of patients in a particular hospital are described in respective cells in a dataset in the zeroth row of the learning table. The attribute in the first column is the patient's sex, and the plaintext space of sex is formed by "male" and "female." Therefore, the value of each cell in the first column is either "male" or "female." A site of cancer occurrence in a patient is described as the attribute in the second column, and the value of each cell in the second column has any of the values ​​contained in the plaintext space (esophagus, colon, skin, and bladder). The third column contains the attribute of a body part of cancer that a patient is likely to suffer from. (2) Encryption and decryption

[0018] In the embodiments, non-encrypted data is referred to as "plaintext data." Encryption refers to receiving an encryption key and plaintext data as input and outputting the encrypted data obtained by converting the plaintext data. In the embodiments, the encrypted data is represented by E(). For example, 0 and 1 are encrypted to obtain pieces of encrypted data E(0) and E(1), respectively. Meanwhile, decryption refers to receiving a decryption key and encrypted data as input and outputting plaintext data converted in the reverse direction from the encrypted data. (3) Standard encryption

[0019] Standard encryption refers to an encryption scheme that has encryption and decryption functions. (4) Searchable encryption

[0020] Searchable encryption refers to an encryption scheme that not only has encryption and decryption functions, but also a determination function for determining equality between encrypted pieces of data in a searchable manner without decrypting the data. The determination function receives two pieces of encrypted data as input and performs the determination based on the values ​​of the respective pieces of plaintext data before encryption. For example, a search function of searchable encryption outputs a symbol indicating that the values ​​are different (0=1) when E(0) and E(1) are input. Conversely, when E(0) and E(0) are input, the search function outputs a symbol indicating that the values ​​are equal (0=0). Searchable encryption is an example of high-performance encryption and functional encryption.

[0021] (5) Summable and comparable encryption Summable and comparable encryption refers to an encryption scheme that has not only the encryption and decryption functions, but also a summation function for performing summation without performing decryption and a comparison function for comparing sizes of the values ​​of the summed pieces of encrypted data without decrypting the data. The comparison function receives two pieces of encrypted data as input and outputs their size relationship based on their values ​​as the result of determining. For example, when E(0) and E(1) are input, the comparison function outputs a symbol indicating that one of the values ​​is larger (0<1). Meanwhile, when E(0) and E(0) are input, the comparison function outputs a symbol indicating that the values ​​are equal (0=0).Additionally, the comparison function can compare E(0+1), which is obtained by summing E(0) and E(1), and E(1+1), which is obtained by summing E(1) and E(1), to determine that E(0+1) < E(1+1). Summarizable and comparable encryption includes completely homomorphic encryption, which can achieve any arithmetic operation in an encrypted state, secret computation performed over a network, and other such means. Summarizable and comparable encryption is an example of high-performance encryption and functional encryption.

[0022] (6) Decision tree and decision tree analysis Decision tree analysis refers to a type of machine learning that aims at things like prediction and discrimination. Generally, in decision tree analysis, a learning model called a "decision tree" is constructed in a learning phase using a table for learning, and in an analysis phase, the decision tree is used to perform discrimination and prediction on a table for analysis. The variables (data sets) of the table for learning are assigned to a root node located at the highest level of the decision tree and internal nodes different from the root node, and values ​​related to discrimination and prediction results are assigned to a leaf node located at the deepest level.

[0023] Fig. 6 is an example diagram for showing an example of a decision tree obtained when a value of attribute 3 is calculated using values ​​of attribute 1 and attribute 2 in the table for learning Fig. 5 is predicted. The root node is associated with a learning table 222 and has the number "1" assigned as its node number. When branches branching from the root node are set to attribute 1 (gender) in the learning table 222, the learning table 222 undergoes sorting based on whether the gender is "male" or "female." In other words, the number "2" is assigned to a node that branches based on "male," and the node is only associated with records that have "male" as attribute 1 (gender). Similarly, the number "3" is assigned to a node that branches based on "female," and the node is only associated with records that have "female" as attribute "1" (gender).

[0024] Node "2" and node "3" each branch downward into branches that reach leaf nodes at the deepest level related to attribute 2 (cancer). The leaf nodes are each assigned to the learning table 222, which, as a result, satisfies a condition related to classification and prediction. For example, if leaf node "8" is reached as a result of a decision tree analysis, oral cancer of attribute 3 is obtained as the analysis result.

[0025] In decision tree analysis, after constructing a decision tree, an analysis phase is performed to perform discrimination and classification on a table for analysis. In the analysis phase, a path from the root node to the leaf node is traced based on the branches of the decision tree to output a result related to the classification and prediction associated with the leaf node. Random forest analysis

[0026] Random forest analysis refers to a type of decision tree analysis. In random forest analysis, a large number of decision trees are generated by repeatedly performing random data extraction from the table for learning in the learning phase. In the analysis phase, the decision tree analysis results based on a large number of decision trees are summarized to generate final classification and prediction results. When summarizing the results, a determination method based on a majority vote, an average value, a median value, or other such value of the multiple results is used. [First embodiment]

[0027] Fig. 1 is a block diagram illustrating a configuration example of a data analysis system according to a first embodiment of this invention. The data analysis system includes, for example, a provider server 200, an analysis agent server 300, and a delegation server 400. For example, the provider server 200 and the analysis agent server 300 can send and receive data to / from each other via a network 100. The delegation server 400 and the analysis agent server 300 can also send and receive data to / from each other via the network 100.

[0028] The provider server 200 encrypts a learning table to generate a decision tree and delivers the learning table to the analysis agent server 300. The delegation server 400 encrypts the data for analysis and sends the data for analysis to the analysis agent server 300 to delegate the analysis to the analysis agent server 300. The analysis agent server 300 generates a decision tree from the encrypted learning table and uses the decision tree to analyze the data for analysis.

[0029] Fig. Figure 2 is a block diagram illustrating a configuration example of the provider server 200 in the first embodiment. The provider server 200 includes, for example, an input unit 201, an output unit 202, a communication unit 203, a computing unit 210, and a storage unit 220. The input unit 201 is, for example, an interface connected to a keyboard, a mouse, or other similar peripheral device, and is configured to receive input from an operator.

[0030] The output unit 202 is, for example, an interface connected to a display, a printer, or other similar peripheral device and configured to output an execution result obtained from a program in a format visually recognizable by the operator. The communication unit 203 is a network interface device configured to control communication to / from another device via the network 100 according to a predetermined protocol.

[0031] Computing unit 210 includes a processor and executes a program stored in storage unit 220. Storage unit 220 includes a read-only memory and an auxiliary storage device. Read-only memory includes a ROM, which is a non-volatile storage device, and a RAM, which is a volatile storage device. The ROM stores, for example, an unchangeable program (e.g., BIOS). The RAM is a dynamic random-access memory (DRAM) or other such volatile high-speed storage device and temporarily stores a program to be executed by the processor and data used at program execution time.

[0032] The auxiliary storage device is, for example, a magnetic storage device (HDD), a flash memory (SSD), or other such high-capacity non-volatile storage device, and stores the program to be executed by the processor included in the computing unit 210 and the data to be used at program execution time. In other words, the program is read from the auxiliary storage device and loaded into the read-only memory to be executed by the processor.

[0033] The program to be executed by the computing unit 210 is delivered to the provider server 200 via a removable medium (CD-ROM or flash memory) or via the network 100 and is stored in a non-volatile auxiliary storage device, which is a non-volatile storage medium. Therefore, the provider server 200 may include an interface configured to read data from the removable medium. The same applies to the analysis agent server 300 and the delegation server 400.

[0034] The provider server 200 is a computer system that is physically implemented on one computer or on multiple computers that are logically or physically implemented. It can run on separate threads on the same computer or on a virtual machine consisting of multiple physical computer resources. The same applies to the analysis agent server 300 and the delegation server 400.

[0035] The computing unit 210 includes, for example, a base-point-added table generation module 211 and an encryption module 212. For example, the computing unit 210 operates according to a base-point-added table generation program loaded into the storage unit 220, thereby functioning as the base-point-added table generation module 211. The computing unit 210 also operates according to an encryption program loaded into the storage unit 220, thereby functioning as the encryption module 212. The same applies to respective units and modules included in the computing units of the analysis agent server 300 and the delegation server 400. The storage unit 220 stores an encryption key 221, the learning table 222, and the evaluation function 223.

[0036] The basepoint-added table generation module 211 uses the learning table 222 and the evaluation function 223 to generate a basepoint-added table. The encryption module 212 uses the encryption key 221 to encrypt a range defined in the learning table 222 using standard encryption or summable and comparable encryption, thereby encrypting the basepoint-added table.

[0037] The encryption key 221 is an encryption key for encrypting a value in the learning table 222. The learning table 222 stores a learning table to be used by the analysis agent server 300 to generate a decision tree. The evaluation function 223 is a function for calculating a base point from the learning table.

[0038] Fig. 3 is a block diagram illustrating a configuration example of the analysis agent server 300 in the first embodiment. The analysis agent server 300 includes, for example, an input unit 301, an output unit 302, a communication unit 303, a computing unit 310, and a storage unit 320. Descriptions of the input unit 301, the output unit 302, the communication unit 303, the computing unit 310, and the storage unit 320 are the same as those of the input unit 201, the output unit 202, the communication unit 203, the computing unit 210, and the storage unit 220, and are therefore omitted.

[0039] The computing unit 310 includes, for example, a decision tree generation module 311, a node search module 312, a decision tree analysis module 313, and an encryption determination module 314. The storage unit 320 stores, for example, an evaluation function 321. The decision tree generation module 311 uses the encrypted base point-added table to generate a decision tree without decrypting the base point-added table. The node search module 312 performs a node search when the decision tree generation module 311 generates a decision tree.

[0040] The decision tree analysis module 313 uses the decision tree generated by the decision tree generation module 311 and an encrypted analysis table, which will be described later, to analyze the analysis table without decrypting the analysis table. The encryption determination module 314 performs a comparison and matching determination on the analysis table without decrypting the analysis table. The evaluation function 321 is a function for calculating an evaluation score for the node search.

[0041] Fig. 4 is a block diagram illustrating a configuration example of the delegation server 400 in the first embodiment. The delegation server 400 includes, for example, an input unit 401, an output unit 402, a communication unit 403, a computing unit 410, and a storage unit 420. Descriptions of the input unit 401, the output unit 402, the communication unit 403, the computing unit 410, and the storage unit 420 are the same as those of the input unit 201, the output unit 202, the communication unit 203, the computing unit 210, and the storage unit 220, respectively, and are therefore omitted.

[0042] Computing unit 410 includes an encryption module 411 and a decryption module 412. Storage unit 420 stores a table 421 for analysis, an encryption key 422, and a decryption key 423. Encryption module 411 uses encryption key 422 to encrypt a region defined in learning table 422 using standard encryption or summable and comparable encryption. Decryption module 412 decrypts the received analysis result.

[0043] The analysis table 421 consists of data to be analyzed by the analysis agent server 300 using the decision tree. The encryption key 422 is an encryption key for encrypting a value in the analysis table 421. The decryption key 423 is a decryption key for decrypting the analysis result received by the analysis agent server 300.

[0044] The provider server 200 may perform some or all of the functions of the delegation server 400, or the delegation server 400 may perform some or all of the functions of the provider server 200.

[0045] Fig. Fig. 7 is a sequence diagram illustrating an example of processing performed by the data analysis system according to the first embodiment. Specifically, Fig. 7 is a diagram showing an example of an outline of the processing performed by each of the provider server 200, the analysis agent server 300, and the delegation server 400, and an example of an outline of the data sent and received via the network 100.

[0046] The processing performed by the data analysis system includes a learning phase and an analysis phase. In the learning phase, the provider server 200 encrypts the table 222 for learning, and the analysis agent server 300 generates a decision tree from the encrypted table 222 for learning. In the analysis phase, the delegation server 400 encrypts a table for analysis, and the analysis agent server 300 uses the decision tree to analyze the encrypted table for analysis and delivers the analysis result to the delegation server 400.

[0047] First, the learning phase will be described. The base point added table generation module 211 calculates a base point of the learning table 222 and generates a base point added table obtained by adding the calculated base point to the learning table 222 (step S210). Details of the base point added table generation processing will be described later. Next, the encryption module 212 encrypts the base point added table (step S220) and sends the encrypted base point added table to the analysis agent server 300 (step S230).

[0048] When the analysis agent server 300 receives the base point-added table, the decision tree generation module 311, the decision tree analysis module 313, and the encryption determination module 314 create a decision tree from the received base point-added table (step S330). Details of the decision tree generation processing will be described later.

[0049] Next, a sequence representing the analysis phase will be described. The encryption module 411 encrypts the table 421 for analysis (step S410) and sends the encrypted table 421 to the analysis agent server 300 for analysis (step S420). When the analysis agent server 300 receives the table for analysis, the decision tree analysis module 313 analyzes the table for analysis (step S350) and sends the analysis result to the delegation server 400 (step S370). Details of the analysis processing will be described later. If the received analysis result is encrypted, the delegation server 400 decrypts the analysis result (step S430).

[0050] Fig. 8 is a flowchart illustrating an example of the processing for generating a base point added table executed in step S210. The base point added table generation module 211 classifies attributes in the learning table 222 as explanatory variables and response variables, and creates a temporary table from combinations of plaintext space values ​​of the respective attributes classified as explanatory variables (step S211). Which attribute is classified as an explanatory variable and which attribute is classified as a response variable can be defined in advance, for example, or can be defined based on input from a user of the provider server 200.

[0051] Fig. 9 is an explanatory diagram illustrating an example of an outline of the processing for generating a base point-added table from the learning table 222. For example, when the learning table 222 has three types of attributes (gender, cancer, and complication), the base point-added table generation module 211 classifies "gender" and "cancer" as the explanatory variables and "complication" as the response variable in step S211.

[0052] In step S211, the basepoint-added table generation module 211 creates a temporary table 251 containing the following records: (male and esophagus), (female and esophagus), (male and colon), (female and colon), (male and skin), (female and skin), (male and bladder), and (female and bladder), each of which is a combination of plaintext space values ​​of the respective explanatory variables. The basepoint-added table generation module 211 also adds a response variable field to the temporary table 251.

[0053] The base point-added table generation module 211 can generate a combination of plaintext space values ​​that include a value of an attribute that does not appear in the learning table 222. Specifically, with respect to a numeric attribute, such as "age," even a value that does not appear in the learning table 222 is treated as a plaintext space value as long as the value is within a predetermined range (e.g., "0" to "100" years old). Meanwhile, with respect to a text attribute (or a numeric attribute indicating a nominal scale), such as "gender," even if only one record for "male" exists in the learning table 222, both "male" and "female," which are predefined values, are treated as plaintext space values. This improves the secrecy of the learning table 222.

[0054] In addition, the basepoint-added table generation module 211 may summarize plaintext space values. Specifically, with respect to a numeric attribute, e.g., "age," the basepoint-added table generation module 211 may summarize values ​​for each of the predetermined ranges (e.g., "0" to "9" years old, "10" to "19" years old, ..., "90" to "99" years old, and "100" (or older)) to establish a new value for the plaintext space. With respect to a text attribute (or a numeric attribute specifying a nominal scale), e.g., B. “Complication” , the table generation module with added base point 211 can meanwhile summarize values ​​for each of the previously defined groups (e.g. “Large Intestine” and “Small Intestine” for group “1” and “Esophagus” and “Bladder” for group “2”) to define a new value of the plaintext space.This reduces the processing amounts for the learning phase and the analysis phase and a data set of a decision tree, which is described later.

[0055] For example, the base point added table generation module 211 also extracts an attribute value having the highest occurrence frequency among attribute values ​​of the response variables corresponding to the combinations of values ​​of the explanatory variables of the data records in the temporary table 251 in the learning table 222, respectively. The base point added table generation module 211 stores each extracted attribute value in the response variable field of the temporary table 251 as the value of the response variable corresponding to the combination of the values ​​of the explanatory variables in the temporary table 251.

[0056] In Fig. 9, for example, the attribute value that has the highest frequency of occurrence among the values ​​of the response variables corresponding to the explanatory variable in the table 222 for learning the combination of the values ​​(male and esophagus) is “oral cavity,” and therefore, the value “oral cavity” is stored in the response variable field of the data set for the combination of the values ​​(male and esophagus) of the explanatory variable in the temporary table 251. In Fig. 9 Furthermore, for example, there is no value of the response variable corresponding to the combination of the values ​​(male and skin) of the explanatory variables in the learning table 222, or there is no combination of the values ​​(male and skin) of the explanatory variables in the learning table 222, and therefore the value in the response variable field of the data set for the combination of the values ​​(male and esophagus) of the explanatory variables in the temporary table 251 is a blank value (e.g., a value of zero).

[0057] The base point added table generation module 211 can newly generate a value not included in the learning table 222 as the value of the response variable to be added to the temporary table 251. Now, assume that "oral cavity" appears 80 times and "small intestine" appears 20 times as the values ​​of the response variable, which correspond to the combination of the values ​​(male and esophagus) of the explanatory variables in the learning table 222. In this case, the base point added table generation module 211 can generate a new value "oral cavity: 80%; small intestine: 20%" of the response variable, indicating a complication ratio, and store the value in the corresponding record in the temporary table 251.

[0058] Subsequently, the base point added table generation module 211 summarizes the occurrence frequency with which the combination of the values ​​of the explanatory variables of each of the records in the temporary table 251 occurs in the learning table 222 (step S212). For example, if the learning table 222 contains 100 records containing (man and esophagus) as a combination of plaintext space values, the occurrence frequency of the record for (man and esophagus) in the temporary table 251 is evaluated as 100. The base point added table generation module 211 performs the same processing for each of the records in the temporary table 251 and generates, in the example of Fig. 9 a column 252, which indicates the frequency of occurrence.

[0059] Subsequently, the base point added table generation module 211 calculates a base point based on the evaluation function 223 (step S213). Examples of the evaluation function 223 include an error rate, an information entropy, and a Gini coefficient. In the first embodiment, processing performed when the evaluation function 223 is an error rate will be described (the same processing is also performed when the evaluation function 223 is a Gini coefficient or an information entropy, and therefore, a description of such a case will be omitted).

[0060] If the evaluation function 223 is an error rate, the base point added table generation module 211 calculates the occurrence frequency as it is as the base point and generates a base point added table obtained by adding a column indicating the base point to the temporary table 251 (step S214). Fig. 9, a description is given of an example in which only one response variable is stored in each data set in the base point added table (that is, a response variable is uniquely determined for each combination of the values ​​of the explanatory variables), but multiple response variables can be stored in one data set in the base point added table.

[0061] As described above, in step S220, the encryption module 212 encrypts each cell of the table with the added base point. Specifically, the encryption module 212 encrypts, for example, a base point field with summable and comparable encryption, explanatory variable fields with searchable encryption, and the response variable field with standard encryption. The response variable field may be encrypted with encryption other than the standard encryption (for example, with searchable encryption or summable and comparable encryption). However, it is desirable to use standard encryption, which is an encryption scheme that has a low processing overhead for encryption and decryption processing and a high level of security.The basepoint added table is encrypted to create an encrypted basepoint added table 253.

[0062] Fig. 10 is a flowchart showing an example of decision tree generation processing performed in step S330. Fig. 11 is an explanatory diagram for illustrating an example of an outline of the decision tree generation processing. Fig. 12A is an example of the decision tree. Fig. 12B is an example of a decision tree table that represents the Fig. 12A represents the decision tree shown. Fig. Figure 16B is an example of a leaf node table.

[0063] In the decision tree generation processing, the decision tree generation module 311 proceeds downward from the root node located at the highest level while sequentially searching for a branch that outputs the most satisfactory value using the evaluation function 321, thereby generating a decision tree.

[0064] First, the decision tree generation module 311 initializes the variable i to 0 and adds a column for managing a parent node number and a column for managing a child node number (hereinafter referred to as "parent node management column" and "child node management column") to the base point added table 253 (step S331). However, the initial value of the parent node management column number is set to 1 (root node number), and the initial value of the child node management column number is set to "-" (no value) (see the base point added table 253 shown in the upper part of Fig. 11 is shown.

[0065] Subsequently, the decision tree generation module 311 generates a decision tree table in which no value is stored in each cell (step S332). The decision tree table is a table with four columns (parent node number, branch attribute, branch condition, and child node number). The first row of the decision tree table indicates a root node, and 1 is stored in a parent node number field in the first row, as shown in Fig. 12B. The decision tree generation module 311 sets the minimum value of the parent node number for the variable i (step S333).

[0066] Next, the decision tree generation module 311 searches for a child node from the parent node of variable i (step S334). Details of the child node search processing will be described later. The decision tree generation module 311 determines whether the child node is found (step S335). The decision tree generation module 311 proceeds to step S336 if a child node is found (Yes in step S335), and proceeds to step S337 if no child node is found (No in step S335).

[0067] The decision tree generation module 311 inputs a child node number of the found child node into the child node number field of the decision tree table (step S336). To describe an example of generating a binary tree, in the first embodiment, the child node numbers are set to twice i (2i), and a value is obtained by adding one to twice the value (2i + 1). The base point-added table 253, which is shown in the middle part of Fig. 11 indicates that an attribute for deciding how to branch from the parent node (root node) (hereinafter also referred to as a "branching attribute") is "gender." The base point added table 253 further indicates that the parent node branches to the child node with node number 2 when the "gender" is "male," and the parent node branches to the child node with node number 3 when the "gender" is "female." The attribute value for determining a node of a branching destination in the branching attribute is also referred to as a "branching condition."

[0068] Then, in step S336, the decision tree generation module 311 overwrites the parent node number field with the value in the child node number field of the table with the added base point 253 and changes the child node number to an empty value (e.g., value of zero) (see the table with added base point 253 shown in the lower part of Fig. 11). In step S336, the decision tree generation module 311 stores, in the decision tree table, the branch attribute in a branch attribute field corresponding to the parent node number, the branch conditions in a branch condition field corresponding to the parent node number, and the child node numbers of the found child nodes in the child node number field. Furthermore, the child node numbers are each registered in the parent node number.

[0069] In the example of Fig. 12B, the first row of the decision tree table indicates that the branching attribute for the parent node with node number 1 (root node) is E(gender), the branching conditions are E(male) and E(female), and the child nodes of branching targets are the child node with node number 2 and the child node with node number 3. Respective values ​​in the branching condition field and respective values ​​in the child node number field that are at the same order position correspond to each other. In particular, the first row of the decision tree table shown in Fig. 12B, the branching target is the child node with node number 2 when the attribute value is E(male), while the branching target is the child node with node number 3 when the attribute value is E(female).

[0070] Referring again to the description of Fig. 10, if no child node is found (No in step S335), the decision tree generation module 311 updates a leaf node table 336 (step S337). Specifically, the decision tree generation module 311 registers i as the leaf node number and registers the corresponding response variable in the base point-added table 253 as the analysis result.

[0071] In the example of Fig. 16B, the leaf node table 336 includes a leaf node number field and a response variable field. Next, the decision tree generation module 311 determines whether a parent node number in the parent node management column is greater than i (step S338). If it is determined that a parent node number is greater than i (Yes in step S338), the decision tree generation module 311 returns to step S333. If it is determined that no parent node number is greater than i (No in step S338), the decision tree generation module 311 ends the decision tree generation processing.

[0072] The decision tree that Fig. 12A is described. In the decision tree shown in Fig. As shown in Figure 12A, branches extend from the root node (number 1) as binary trees through the interior nodes (number 2, number 3, ..., number 7) to reach the leaf nodes (number 8, number 9, ..., number 15). The branching conditions are written on the branches (it would be desirable to also write the branching attributes, but they are omitted for space reasons). For example, the branching condition that causes the root node to branch to the interior node with number 2 is that the branching attribute matches E(gender) and the value matches E(male). Similarly, the branching condition for the branch to the interior node with number 3 is that the branching attribute matches E(gender) and the value matches E(female).

[0073] Fig. Fig. 13 is a flowchart illustrating an example of node search processing performed in step S334. The node search module 312 selects one of the attributes from the encrypted table with added base point 253 (step S334-1). In the example of Fig. 9 and other figures, the node search module 312 selects, for example, E(gender) or E(cancer) from the encrypted table with added base point 253.

[0074] Next, the node search module 312 searches the branching rules of the encrypted data for the selected attribute to select one of the branching rules (step S334-2). For example, if the node search module 312 selects branching through the attribute E(gender), there are only two types of points, E(male) and E(female), in the plaintext space for the attribute E(gender), and thus there is only one branching rule for branching to E(male) or E(female). Therefore, in this case, the node search module 312 selects the one branching rule in step S334-2.

[0075] Meanwhile, if the node search module 312 selects the attribute E(cancer), for example, there are four types of points E(esophagus), E(colon), E(skin), and E(bladder) in the plaintext space for the attribute E(cancer). Therefore, in this case, there are three types of branching rules, including a branching rule for branching to a point of E(esophagus) or E(colon) and E(skin) and E(bladder), a branching rule for branching to a point of E(esophagus) or E(skin) and E(colon) and E(bladder), and a branching rule for branching to a point of E(esophagus) or E(bladder) and E(colon) and E(skin). In step S334-2, the node search module 312 randomly selects a non-selected branching rule from these branching rules.

[0076] In the above example, if the number of plaintext space values ​​is 2n (where n is a natural number greater than or equal to 1), a branching rule for branching to a set of n values ​​among the 2n values ​​or a set of the other n values ​​is the branching rule to be selected, but these sets may not be defined in units of n values. For example, in the above example, where four types of values ​​E(esophagus), E(colon), E(skin), and E(bladder) exist as plaintext space values ​​for the attribute E(cancer), there may be a branching rule for branching to E(esophagus) or E(colon) or E(skin) and E(bladder).

[0077] In the same way, if the number of plaintext space values ​​is equal to 2n+1 (where n is a natural number greater than or equal to 1), a branching rule for branching to a set of n values ​​among the 2n values ​​or a set of the remaining n+1 values ​​is the branching rule to be selected, but the number of values ​​in these sets may differ from the combination of n and n+1.

[0078] Subsequently, the node search module 312 sums the base points of the branching rule according to the selected branching rule (step S334-3). For example, if E(gender) in the Fig. 9 with the base point 253 added, the base point of E(male) is a total sum of the base points (in the first embodiment, the occurrence frequency) in the first row, the third row, the fifth row, and the seventh row of the data set. That is, E(100+60+40+20) = E(220). Similarly, the base point of E(female) is E(100+60+20+5) = E(185).

[0079] Next, the node search module 312 inputs all the summed base points into the evaluation function 321 to obtain an evaluation point (step S334-4). The following calculation expressions are known as the evaluation function 321 for calculating the evaluation point. (1) Error rate: E(t)=1-max{Pr(C i |t)} (2) Information entropy: -ΣPr(C i |t)log{Pr(C i |t)} (3) Gini coefficient: 1-Σ{Pr(C i |t) 2}

[0080] In the calculation expressions, Pr represents a probability of occurrence, C i the value of a record, and t the number of a node. Generally, in decision tree analysis, each of these evaluation functions 321 is used to calculate the evaluation point, and the lowest evaluation point is used as a child node. The occurrence probability is a value obtained by dividing the number of occurred records by the total number of records, and therefore, in the first embodiment, it is assumed that the occurrence frequency is used instead of the occurrence probability for the evaluation function 321.

[0081] For example, in the case of an error rate, the number of records is represented by n and the evaluation function 321 is given by nE(t) = n-nmax {Pr(C i |t)}. In other words, nmax{Pr(C i|t)} is the occurrence frequency of node t, and thus the evaluation function 321 is represented by the number of records. For example, E(220+185) - max{E(220), E(185)} = E(405) - E(220) = E(185) is obtained as the evaluation point for the branching rule based on whether the gender is "male" or "female."

[0082] Next, the node search module 312 determines whether all branching rules for the selected attribute have been evaluated (step S334-5). If it is determined that there is a branching rule that has not been evaluated (No in step S334-5), the node search module 312 returns to step S334-2. If it is determined that all branching rules have been evaluated (Yes in step S334-5), the node search module 312 determines whether all attributes have been selected (step S334-6).

[0083] If it is determined that an unselected attribute exists (No in step S334-6), the node search module 312 returns to step S334-1. If it is determined that all attributes have been selected (Yes in step S334-6), the node search module 312 arrives at a minimum evaluation point (step S334-7) and uses a branching rule with the minimum evaluation value for a branch in the decision tree (step S334-8).

[0084] The example in which the evaluation function 321 is an error rate is described above, but the expression of an information entropy or a Gini coefficient can also be used. In this case, the node search module 312 sets (frequency of occurrence) × log(frequency of occurrence) or the square of (frequency of occurrence) as the base point.

[0085] The above description has been given of the processing related to the learning phase performed until the analysis agent server 300 generates a decision tree from the encrypted learning table 222. The above-mentioned learning phase allows the decision tree to be generated without decrypting the learning table 222, that is, it takes place in a state where the learning table 222 is kept secret from the analysis agent server 300.

[0086] Next, a description will be given of the processing related to the analysis phase until the analysis phase analysis agent server 300 outputs the analysis result from the encrypted table for analysis. Fig. 14 is an explanatory diagram illustrating an example of encryption processing for the analysis table 421 performed in step S410. The encryption module 212 encrypts each cell of the analysis table 421 with searchable encryption.

[0087] Fig. 15 is a flowchart illustrating an example of the analysis processing performed in step S350. First, the decision tree analysis module 313 selects a record from the encrypted table for analysis (step S351). In the following description, the selected record is referred to as the "data set for analysis."

[0088] Subsequently, the decision tree analysis module 313 initializes the variable i to 0 (step S352). The decision tree analysis module 313 selects a record with the i-th node designated as the parent node from the decision tree table, and the encryption determination module 314 selects the attribute of the record for analysis that matches the attribute of the selected record (step S353). In the following description, the record selected by the decision tree analysis module 313 from the decision tree table is referred to as a "decision tree record."

[0089] In step S353, the encryption determination module 314 uses the searchable encryption determination function to determine whether the decision tree data set and the analysis data set have the same attribute or not, without decrypting the decision tree data set and the analysis data set. The encryption determination module 314 also determines whether the encrypted data related to the selected attribute of the analysis data set is the same as the encrypted data listed in the branching condition of the decision tree data set (step S354).

[0090] If it is determined that the same encrypted data is included in the branching condition (Yes in step S354), the encryption determination module 314 assigns the child node number to the variable i (step S355) and returns to step S353. Meanwhile, if it is determined that the same encrypted data is not included in the branching condition (No in step S354), the encryption determination module 314 outputs the response variable cell of the record whose leaf node number corresponds to the variable i in the leaf node table 336 as the analysis result (step S336).

[0091] The description has been given of the processing from step S351 to step S356 performed when a record is selected from the table for analysis. However, the analysis agent server 300 executes these processing steps for all records of the table for analysis in step S350 to output the analysis results.

[0092] Fig. 16A is an explanatory diagram for illustrating an example of an outline of the analysis processing. Fig. Figure 16A shows an example where the attribute E(sex) is E(male) and the attribute E(cancer) is E(colon). Fig. 16B is the leaf node table 336 used for the Fig. 16A is used. In the example of Fig. 16A, an analysis result indicating that the attribute value E(Complication) is E(Oral Cavity) is returned to the delegation server 400.

[0093] As described above, the data analysis system according to the first embodiment can perform the learning (creating a decision tree) in the state where the table 222 for learning is kept secret from the analysis agent server 300, and can also perform the decision tree analysis in a state where the table 421 for analysis is kept secret from the analysis agent server 300.

[0094] The description of the first embodiment focused on the example where the analysis agent server 300 generates a decision tree, but the provider server 200 may generate a decision tree itself and send the generated decision tree to the analysis agent server 300. In this case, the provider server 200 may generate a decision tree table without encrypting the base point-added table 253. However, the provider server 200 must have encrypted the values ​​in each column of the decision tree table before sending the decision tree table to the analysis agent server 300. [Second embodiment]

[0095] A data analysis system according to a second embodiment of this invention obtains a random forest, which is one of the data analysis methods achieved by extending decision tree analysis. The following description indicates points that differ from those of the first embodiment. The second embodiment differs from the first embodiment in the decision tree generation processing executed in step S330 and the analysis processing executed in step S350.

[0096] Fig. 17 is a flowchart illustrating an example of the decision tree generation processing performed in step S330. First, the decision tree generation module 311 sets the number (greater than or equal to 1) of decision trees to be generated (step S330-A). For example, the number of decision trees to be generated may be defined in advance or may be specified by a user of the analysis agent server 300 when starting the decision tree generation processing. The decision tree generation module 311 randomly extracts a record from the encrypted table with the base point added (step S330-B).

[0097] Fig. 18 is an explanatory diagram illustrating an example of an outline of the processing for extracting a record from the encrypted table with the base point added, which is performed in step S330-B. In the extraction processing, the decision tree generation module 311 adds a column for controlling extraction to the encrypted table with the base point added and stores "False" as the value of all cells in the column for controlling extraction.

[0098] Next, the decision tree generation module 311 generates a predetermined number of different random numbers. The random number has an upper limit equal to the number of records in the base point-added table and a lower limit equal to 1. For example, the random number is a natural number greater than or equal to 1. The predetermined number is greater than or equal to 1 and less than or equal to the number of records in the base point-added table, and it is desirable that it be greater than or equal to half the number of records in the base point-added table. Finally, the decision tree generation module 311 changes the value of the cell in the column for controlling the extraction of the record with the same row number as the generated random number to "True."With this configuration, it is possible to achieve the processing of randomly extracting a record from the table with base point added.

[0099] Subsequently, the decision tree generation module 311 generates a decision tree table from only the data set in which the value of the cell in the column for controlling extraction of the base point-added table is "True" (step S331 to step S338). Steps S331 to S338 are similar to those of the first embodiment.

[0100] The decision tree generation module 311 determines whether or not decision tree tables have been generated according to the number of decision trees set in step S330-A (step S330-C). If it is determined that decision tree tables have not been generated according to the number of decision trees (No in step S330-C), the decision tree generation module 311 resets all values ​​in the column for controlling extraction of the base point-added table to "False" and returns to step S330-B. If it is determined that decision tree tables have been generated according to the number of decision trees (Yes in step S330-C), the decision tree generation module 311 ends the decision tree generation processing. As a result, multiple decision tree tables are generated.

[0101] In the processing of step S330 in the second embodiment, for example, a computer including multiple processing units (CPUs) can generate multiple decision trees through parallel processing. Specifically, for example, random number generation processing is executed in parallel, and multiple columns are provided for controlling extraction, thereby enabling multiple decision trees to be generated through parallel processing.

[0102] Fig. 19 is a flowchart illustrating an example of the analysis processing performed in step S350 using multiple decision tree tables. The processing from step S351 to step S355 is the same as that of the first embodiment. In the second embodiment, steps S350-A, S350-B, and S350-C are added to these processing steps.

[0103] Following step S351, the decision tree analysis module 313 selects a decision tree table to be used for the decision tree analysis performed in steps S352 to S355 (step S350-A). However, the decision tree analysis module 313 is configured to select a decision tree table that was not used for the decision tree analysis of the data set selected for analysis in step S351, to prevent the same decision tree table from being selected again for the analysis of the same data set for analysis.

[0104] After the processing from step S352 to step S355 is executed, the decision tree analysis module 313 then determines whether all decision tree tables for the data set selected in step S351 have been selected for analysis (step S350-B). If it is determined that there is an unselected decision tree table (No in step S350-B), the decision tree analysis module 313 returns to step S350-A. If the decision tree analysis module 313 determines that all decision tree tables have been selected (Yes in step S350-B), the encryption determination module 314 summarizes the analysis results of the analysis of the multiple decision trees (step S350-C).

[0105] In general, the analysis result may vary depending on the structure of a decision tree. For example, the encryption determination module 314 calculates average values ​​and representative values ​​using a majority voting scheme to summarize the analysis results in step S350-C. For example, when the response variable is encrypted using deterministic encryption, which is an example of standard encryption, the encryption determination module 314 may determine which encrypted data has a large number, that is, use the majority voting scheme, and use the analysis results obtained by summarizing a large number of pieces of encrypted data.

[0106] For example, if a response variable is encrypted using an encryption scheme that allows a calculation to be performed in an encrypted state, such as summable and comparable encryption, the encryption determination module 314 may summarize analysis results in a state that allows averages and medians to be derived. That is, analysis results may be summarized based on the calculation of averages and representative values.

[0107] For example, if a user of the delegation server 400 wishes to summarize analysis results at a high level, after the analysis agent server 300 sends the analysis result of each decision tree to a delegation server (step S370), the delegation server 400 may decrypt the analysis result and further calculate the analysis result in plain text.

[0108] The description of the processing from step S351 to step S350-C was given above when a record is selected from the table for analysis. In step S350, the analysis agent server 300 performs the processing for all records of the table for analysis.

[0109] In the processing of step S350, a computer including a plurality of computing units (CPU) can execute the processing for selecting a decision tree and the analysis processing in parallel by parallel processing.

[0110] This invention is not limited to the above-described embodiments, but includes various modifications and similar configurations within the scope of the purpose of the appended claims. The above-described embodiments are described in detail for a better understanding of this invention and are not limited to those including all of the above-described configurations. A part of the configuration of one embodiment may be replaced by that of another embodiment; the configuration of one embodiment may be integrated with the configuration of another embodiment. A part of the configuration of each embodiment may be added, deleted, or replaced by another configuration.

[0111] The configurations, functions, and processors described above may be implemented in whole or in part by hardware, for example, by designing an integrated circuit. The configurations and functions described above may be implemented in software, meaning that a processor interprets and executes programs to provide the functions.

[0112] The information of programs, tables, and files for implementing the functions can be stored in a storage device such as a memory, a hard disk drive, or an SSD (solid state drive), or a storage medium such as an IC card or SD card.

[0113] The drawings show control lines and information lines that are considered necessary for explanation, but do not show all control lines or information lines in the products. It can be assumed that almost all components are actually interconnected.

Claims

[1] Data analysis server, which includes: a processor; and a memory, wherein the memory is designed to hold information generated from information for learning with added base point (211; 253), wherein the information with added base point (211; 253) comprises a plurality of data sets in each of which a value of an explanatory variable encrypted by first high-performance encryption, a value of a response variable encrypted by a predetermined encryption scheme, and a base point (211; 253) based on a frequency of occurrence of the value of the explanatory variable in the information for learning are associated with each other, wherein the base point (211; 253) held in the base point-added information (211; 253) is encrypted by second high-performance encryption, where the processor is designed to: performing decision tree generation processing for generating a decision tree having a leaf node associated with the value of the response variable encrypted by a predetermined encryption scheme included in the base point-added information (211; 253); and Determining a branching rule in the decision tree generation processing based on the value of the explanatory variable in the decision tree, and wherein the processor, in determining the branching rule, is configured to: Generating at least one branching rule candidate; and without decrypting the value of the explanatory variable for the at least one branching rule candidate and the base point (211; 253) corresponding to the value of the explanatory variable, performing the following: with reference to the base point added information (211; 253) for each of the at least one branching rule candidate, processing for summing the base point (211; 253) corresponding to the value of the explanatory variable for each of the at least one branching rule candidate in the base point added information (211; 253); for each of the at least one branching rule candidate, processing for calculating the evaluation point for each of the at least one branching rule candidate on the basis of the summed base point (211; 253) and a predetermined evaluation function (223; 321); and processing for determining the branching rule to be applied from the at least one branching rule candidate based on the calculated evaluation point. [2] The data analysis server of claim 1, wherein the first high-performance encryption comprises searchable encryption. [3] The data analysis server of claim 1, wherein the second high-performance encryption comprises summable and comparable encryption. [4] Data analysis server according to claim 1, wherein the processor is configured to perform processing for generating a plurality of decision trees, and wherein the processor is configured in the processing to generate each of the plurality of decision trees to: Extracting multiple records from the information with added base point (211; 253); and Execute decision tree generation processing for the multiple extracted data sets. [5] Data analysis server according to claim 1, wherein the memory is designed to hold information for analysis comprising the value of the explanatory variable encrypted by the first high-performance encryption, and where the processor is designed to: Performing processing to compare the value of the explanatory variable included in the information for analysis and the branching rule in the generated decision tree to identify a leaf node corresponding to the value of the explanatory variable without decrypting the value of the explanatory variable included in the decision tree and the value of the explanatory variable included in the information for analysis; and Outputting the value of the response variable encrypted by the predetermined encryption scheme, the value corresponding to the identified leaf node. [6] Data analysis system comprising: a data provider server; and a data analysis server, where the data provider server is designed to: Holding information for learning comprising a plurality of data sets in each of which a value of an explanatory variable and a value of a first response variable are associated with each other; Calculating a base point (211; 253) based on a frequency of occurrence of the value of the explanatory variable in the information for learning and a predetermined function; Generating base point added information (211; 253) comprising a plurality of data sets in each of which the value of the explanatory variable, a value of a second response variable and the calculated base point (211; 253) are associated with each other, wherein the second response variable is based on the value of the second response variable associated with the value of the explanatory variable in the learning information; Encrypting the value of the explanatory variable in the information with added base point (211; 253) by a first high-performance encryption; Encrypting the value of the second response variable in the base point added information (211; 253) by a predetermined encryption scheme; Encrypting the base point (211; 253) in the information with added base point (211; 253) by a second high-performance encryption; and Sending the encrypted information with added base point (211; 253) to the data analysis server, and The data analysis server is designed to: performing decision tree generation processing for generating a decision tree having a leaf node associated with the value of the response variable encrypted by a predetermined encryption scheme included in the base point-added information (211; 253); and Determining a branching rule in the decision tree generation processing based on the value of the explanatory variable in the decision tree, and wherein the processor, in determining the branching rule, is configured to: Generating at least one branching rule candidate; and without decrypting the value of the explanatory variable for the at least one branching rule candidate and the base point (211; 253) corresponding to the value of the explanatory variable, performing the following: with reference to the base point added information (211; 253) for each of the at least one branching rule candidate, processing for summing the base point (211; 253) corresponding to the value of the explanatory variable for each of the at least one branching rule candidate in the base point added information (211; 253); for each of the at least one branching rule candidate, processing for calculating the evaluation point for each of the at least one branching rule candidate on the basis of the summed base point (211; 253) and a predetermined evaluation function (223; 321); and processing for determining the branching rule to be applied from the at least one branching rule candidate based on the calculated evaluation point. [7] The data analysis system of claim 6, wherein the data provider server is configured to: Generating a value of the explanatory variable that is not included in the learning information; Adding an additional data set to the learning information in which the generated value of the explanatory variable and a blank value of the first response value are associated with each other; and Creating the base point added information (211; 253) using the learning information to which the additional data set is added. [8] The data analysis system of claim 6, further comprising an analysis delegation server, the analysis delegation server being configured to: Holding information for analysis that includes a value of the explanatory variable; Encrypting the value of the explanatory variables in the information for analysis by the first high-performance encryption; and Sending the encrypted information to the data analysis server for analysis, where the data analysis server is designed to: Performing processing to compare the value of the explanatory variable included in the information for analysis and the branching rule in the generated decision tree to identify a leaf node corresponding to the value of the explanatory variable without decrypting the value of the explanatory variable included in the decision tree and the value of the explanatory variable included in the information for analysis; and Sending the value of the second response variable encrypted by the predetermined encryption scheme to the analysis delegation server, wherein the value corresponds to the identified leaf node, and wherein the analysis delegation server decrypts the sent value of the second response variable encrypted by the predetermined encryption scheme. [9] Data analysis procedure by a data analysis server, wherein the data analysis server is designed to hold information generated from information for learning with added base point (211; 253), wherein the information with added base point (211; 253) comprises a plurality of data sets in each of which a value of an explanatory variable encrypted by first high-performance encryption, a value of a response variable encrypted by a predetermined encryption scheme, and a base point (211; 253) based on a frequency of occurrence of the value of the explanatory variable in the information for learning are associated with each other, wherein the base point (211; 253) held in the base point-added information (211; 253) is encrypted by second high-performance encryption, the data analysis procedure comprising: executing, by the data analysis server, decision tree generation processing for generating a decision tree having a leaf node associated with the value of the response variable encrypted by a predetermined encryption scheme included in the base point-added information (211; 253); and Determining a branching rule in the decision tree generation processing based on the value of the explanatory variable in the decision tree by the data analysis server, and wherein the data analysis server is configured to: Generating at least one branching rule candidate; and without decrypting the value of the explanatory variable for the at least one branching rule candidate and the base point (211; 253) corresponding to the value of the explanatory variable, performing the following: with reference to the base point added information (211; 253) for each of the at least one branching rule candidate, processing for summing the base point (211; 253) corresponding to the value of the explanatory variable for each of the at least one branching rule candidate in the base point added information (211; 253); for each of the at least one branching rule candidate, processing for calculating the evaluation point for each of the at least one branching rule candidate on the basis of the summed base point (211; 253) and a predetermined evaluation function (223; 321); and processing for determining the branching rule to be applied from the at least one branching rule candidate based on the calculated evaluation point.

Images