Information processing device, control method of information processing device, and control program of information processing device

Abstract

To provide a technology which detects an abnormality in an apparatus, with high accurately, from data in which noise is included.SOLUTION: An information processing device comprises: an acquisition unit which acquires time-series data measured at predetermined time intervals, from a monitoring object; a generation unit which creates a learning model which detects an abnormality in the monitoring object, on the basis of a feature amount of a plurality of sub-data sets extracted by moving a predetermined width window by a predetermined shift width in a time axis direction, from the acquired past time-series data, and the latest data among the data included in the sub-data set; and a determination unit which determines presence / absence of the abnormality in the monitoring object, by using the learning model, from the feature amount of the sub-data set including the latest data and the latest data, extracted from the time-series data newly acquired from the monitoring object.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, a control method for an information processing device, and a control program for an information processing device. [Background technology]

[0002] 2. Description of the Related Art Conventionally, there have been disclosed fault monitoring devices that monitor the operating status of devices and notify of detected faults (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2010-049551 A Summary of the Invention [Problem to be solved by the invention]

[0004] Data acquired by a fault monitoring device from equipment may contain noise that is essentially unrelated to equipment abnormalities, such as noise generated in the equipment itself, noise generated in a communication path, etc. There has been a demand for technology that can accurately detect equipment abnormalities based on data that contains this noise. [Means for solving the problem]

[0005] An information processing device according to one embodiment of the present disclosure includes an acquisition unit that acquires time series data measured at a predetermined time interval from a monitoring target, a generation unit that generates a learning model to detect anomalies in the monitoring target based on features of multiple sub-datasets extracted from the acquired past time series data by moving a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-datasets, and a determination unit that determines the presence or absence of anomalies in the monitoring target using the learning model from the features of the sub-dataset including the latest data and the latest data extracted from time series data newly acquired from the monitoring target.

[0006] In the information processing device according to an embodiment of the present disclosure, the determination unit may use the average and standard deviation of the data included in the sub data set as the feature amount of the sub data set.

[0007] In an information processing device according to an embodiment of the present disclosure, a generation unit may generate a learning model by supervised machine learning in which data indicating an anomaly in the monitored object is labeled as an anomaly in past time series data acquired from the monitored object.

[0008] In an information processing device according to an embodiment of the present disclosure, the generation unit may generate a learning model by unsupervised machine learning using past time-series data acquired from a monitoring target.

[0009] In an information processing device according to one embodiment of the present disclosure, the generation unit may determine the specified width when generating a learning model based on the time required for the judgment unit to determine whether or not an abnormality exists and the accuracy rate of the judgment of whether or not an abnormality exists when the specified width is varied.

[0010] In an information processing device according to one embodiment of the present invention, the monitored object is a network device, and the time series data may include at least one of noise generated in the monitored object and noise generated in the communication path from the monitored object to the information processing device.

[0011] In an information processing device according to one embodiment of the present invention, the generation unit may generate a learning model using any one of linear discrimination, logistic regression, SVM (Support Vector Machine), neural network, K-nearest neighbor method, decision tree, and deep learning.

[0012] A control method of an information processing device according to one embodiment of the present disclosure includes the steps of: by the information processing device, acquiring time series data measured at a predetermined time interval from a monitoring target; generating a learning model for detecting anomalies in the monitoring target based on features of multiple sub-datasets extracted from the acquired past time series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-datasets; and determining the presence or absence of anomalies in the monitoring target using the learning model from the features of the sub-dataset including the latest data extracted from time series data newly acquired from the monitoring target and the latest data.

[0013] A control program for an information processing device according to an embodiment of the present disclosure enables the information processing device to realize the following functions: a function for acquiring time series data measured at a predetermined time interval from a monitored object; a function for generating a learning model for detecting anomalies in the monitored object based on features of multiple sub-datasets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-datasets; and a function for determining the presence or absence of anomalies in the monitored object using the learning model from the features of the sub-dataset including the latest data and the latest data extracted from time-series data newly acquired from the monitored object. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a schematic diagram showing an example of a monitoring system configuration and an information processing device configuration according to an embodiment of the present invention. [Diagram 2] FIG. 2 is an example of a flowchart showing a process performed by an information processing device according to an embodiment of the present invention. [Diagram 3] FIG. 3 is an example of time-series data acquired by an information processing device from a monitored device. [Figure 4] 4(a) and (b) are diagrams illustrating generation of a learning model by an information processing device according to one embodiment of the present invention. [Diagram 5] FIG. 5 is a diagram illustrating generation of a learning model by an information processing device according to an embodiment of the present invention. [Figure 6] FIG. 6 is a diagram illustrating the determination of a window width according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the invention (also referred to as the present invention) according to the present disclosure will be described with reference to the drawings. Note that the drawings are merely examples, and the present invention is not limited to those shown in the drawings. For example, the illustrated information processing device (server), the number of monitored devices, the graph of time-series data, the data set (table), and the flow chart are merely examples, and the present invention is not limited to these.

[0016] FIG. 1 is a schematic diagram showing a configuration of a monitoring system according to an embodiment. The monitoring system 600 may be an information processing system in which an information processing device (monitoring server) 100 monitors and manages a monitored device 200 via a network 500. The network 500 may include at least one of a radio access network (RAN), a wireless LAN (WLAN), a wide area network (WAN), LTE (long term evolution), LTE-Advanced, a fourth generation communication (4G), a fifth generation communication (5G), and a sixth generation communication (6G) or later mobile communication system. Note that the network 500 is not limited to these examples, and may be, for example, a public switched telephone network (PSTN), a satellite communication network, a dedicated network, or the like. The network 500 may also be a combination of these.

[0017] The information processing device 100 may be any device, for example, a server, as long as it is an information processing device capable of executing various processes related to monitoring the network 500. Although only one information processing device 100 is shown in FIG. 1, the present invention is not limited to this. That is, each function described below as being provided in the information processing device 100 may be realized by a plurality of servers. In addition, the information processing device 100 may be, for example, a distributed server system that cooperates by communicating via a network, or may be a so-called cloud server. That is, the information processing device 100 is not limited to a physical server, and may also include a virtual server created by software.

[0018] The monitored device 200 may be a network device such as a router or a switch, and may be a communication device connected to the information processing device 100 so as to be able to communicate with each other via the network 500. In addition, the monitored device may be a server, an IoT (Internet of Things) device, etc., but is not limited to these.

[0019] The monitored device 200 transmits and receives various time-series data to and from the information processing device 100 using various technologies such as SNMP (Simple Network Management Protocol), Syslog, and IPMI (Intelligent Platform Management Interface). In the following, the monitored device 200 will be described taking an example of a network device conforming to SNMP.

[0020] The hardware configuration and functional configuration of an information processing device 100 according to an embodiment of the present invention will be described with reference to FIG.

[0021] 1 is a configuration diagram of an information processing device 100 according to an embodiment of the present invention. The information processing device 100 may include, as hardware components, a control unit 110, a communication unit 120, an input / output unit 130, and a storage unit 170. Although not shown, the information processing device 100 may also include components of a general server as appropriate.

[0022] The control unit 110 is typically a processor, and may be a central processing unit (CPU), a micro processing unit (MPU), etc. The control unit 110 may execute the functions and methods described in each embodiment by reading a program stored in the storage unit 170 and executing a code or instruction included in the read program.

[0023] The storage unit 170 may store (contain) various programs and various data required for the operation of the information processing device 100. For example, the storage unit 170 may store various time-series data transmitted from the monitored device 200, which will be described in detail later. The storage unit 170 may include, for example, a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc. The storage unit 170 may also include a memory that provides a working area for the control unit 110. The various data acquired from the monitored device 200 may be stored in another database server (not shown).

[0024] In order to use the data acquired from the monitored device 200 as time-series data, pre-processing such as adding a time stamp and converting units may be required. Therefore, the information processing device 100 may store a program, software, etc. for performing the pre-processing.

[0025] Here, an integrated value may be used for the data acquired from the monitored device 200. Specifically, for example, when the number of packets transmitted and received by the monitored device 200 is acquired using SNMP, an integrated value of the number of packets transmitted and received by the monitored device 200 up to now is acquired. Such data may be referred to as a "counter value." When the information processing device 100 acquires a counter value from the monitored device 200, pre-processing such as a process of adding a timestamp and a process of calculating the difference from the previously acquired counter value is required. Such processing may be realized by known software such as Zabbix (registered trademark) and Cacti. When the data acquired by the information processing device 100 from the monitored device 200 is a counter value, the data after pre-processing may be treated as time-series data. In the following description, when the data is referred to as "time-series data," it is assumed that the necessary pre-processing has been appropriately performed.

[0026] The communication unit 120 may be implemented as hardware such as a network interface card (NIC), communication software, or a combination of these. The communication unit 120 may transmit and receive information between the information processing device 100 and other devices, and may, for example, receive data required for monitoring the monitored device 200 from other servers or storage devices (database servers) not shown, or transmit data related to monitoring the monitored device 200 to a terminal of an administrator not shown.

[0027] The input / output unit 130 may include an input device for inputting various operations to the information processing device 100, and an output device for outputting the results of processing performed by the information processing device 100. The input device may include, for example, a touch panel, a touch display, hardware keys such as a keyboard, a pointing device such as a mouse, a camera (operation input via images), and a microphone (operation input by voice). The output device outputs the results of processing performed by the control unit 110, and may include, for example, a touch panel, a speaker, etc.

[0028] Next, a functional configuration of the information processing device 100 will be described. The information processing device 100 may include an acquisition unit 111, a generation unit 112, a determination unit 113, a notification unit 114, and a calculation unit 115 as functions realized by a control unit 110. Note that in FIG. 1, functional units that are not essential to each embodiment described hereinafter may be omitted. Furthermore, the functions or processes of each functional unit may be realized by machine learning or AI to the extent that they can be realized.

[0029] The details will be described later, but the processing of each functional unit will be briefly described. The acquisition unit 111 may acquire time-series data measured at a predetermined time interval from the monitored device 200. The generation unit 112 may generate a learning model for detecting anomalies in the monitored device 200 based on the acquired past time-series data. The determination unit 113 may determine the presence or absence of anomalies in the monitored device 200 using the generated learning model from the latest data newly acquired from the monitored device 200. The notification unit 114 may output various notifications to a monitor or the like. The calculation unit 115 may perform various calculation processes.

[0030] Hereinafter, one embodiment of the present invention will be described with reference to FIGS. 2 to 6 along with the processing of each functional unit of the information processing device 100.

[0031] 2 is an example of a flowchart showing a process by the information processing device 100 according to an embodiment. First, the acquisition unit 111 may acquire time-series data measured at a predetermined time interval from the monitored device 200 (step S11). Here, the time-series data acquired from the monitored device 200 may be data capable of detecting the occurrence of an abnormality in the monitored device 200. The time-series data may be, for example, but is not limited to, a CPU usage rate, a memory usage rate, a device temperature, a traffic volume, and a number of error packets. In addition, the predetermined time interval may be, for example, every 3 minutes, every 5 minutes, or every 10 minutes, but is not limited to these.

[0032] An example of a graph showing a change in time-series data is shown in Fig. 3. In Fig. 3, the graph DT10 may be an example showing a change in time series of a value (hereinafter, referred to as a "difference rate") obtained by dividing the difference between the number of packets flowing into the router and the number of packets flowing out of the router by the number of packets flowing into the router when the monitored device 200 is a router.

[0033] Here, it is known that, depending on the timing of acquisition, such as when the acquisition unit 111 acquires time-series data from the monitored device 200 while the monitored device 200 is performing a switching process, incomplete time-series data may be acquired and data at a certain point in time in the time series may be missing (hereinafter referred to as "missing data"). If the time-series data used to calculate the difference rate includes missing data, the calculation of the difference rate will not be performed normally, which will have an adverse effect on monitoring of the monitored device 200.

[0034] For example, as shown in Fig. 3, noises n11 to n16 occur in the graph DT10. This may be caused by, for example, data related to packets being acquired during switching processing in the router, resulting in missing data, and does not indicate an abnormality in the router if the switching processing is performed normally.

[0035] In addition, when no abnormality occurs in the router, the packets that flow out are user traffic packets (hereinafter referred to as "user packets"), excluding a small number of packets such as management packets and multicast packets (hereinafter referred to as "control packets"), among the packets that flow in. When a sufficient number of user packets are flowing, the influence of control packets is very small, so they can be ignored, and the difference between the number of inflow packets and the number of outflow packets is close to "0", so the difference rate is close to "0" in the graph DT10 showing the difference rate. For the above reasons, when the monitored device 200 is operating normally, the part where the difference rate deviates from "0" due to the influence of missing data is not due to an abnormality in the router and should not be contributed to the abnormality detection. In other words, in the graph DT10, although noise n11 to n14 is included until time "t1", it is necessary to consider that no abnormality occurs in the router. Depending on the model of the monitored device 200, a difference between the number of inflow packets and the number of outflow packets may occur due to factors other than control packets. However, even in this case, in a situation where user packets account for the majority of the packets processed by the monitored device 200, the difference is small and can be ignored.

[0036] In contrast, when an abnormality occurs in the monitored device 200, the difference rate deviates from "0" even after subtracting the effect of missing data. Specifically, for example, in the graph DT10, the value of the difference rate deviates from "0" after time "t1", indicating that an abnormality has occurred. Note that even when an abnormality occurs, noises n15 and n16 affected by missing data are included. As described above, such noises occur when the device acquires data or in the communication path, and can reduce the accuracy of detecting the occurrence of an abnormality. The present invention provides a technology that reduces the effect of these noises and accurately detects the occurrence of an abnormality in a monitored object.

[0037] 2, the generating unit 112 may generate a learning model for detecting anomalies in the monitored object based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-data sets (step S12). That is, the generating unit 112 may generate a classification model by machine learning for determining whether data newly acquired from the monitored object device 200 is classified as "abnormal" or "normal".

[0038] Here, the generation of the learning model according to one embodiment will be described with reference to FIG. 4. FIG. 4 shows a part of the time series data DT10 used to generate the learning model, and FIG. 4(a) may show data in a normal state, and FIG. 4(b) may show data in an abnormal state. The labeling of "abnormal" or "normal" will be described later. Here, the time series data DT10 is a collection of time series data acquired over a certain period of time in the monitored device 200 in the past, and it is desirable to include data when an abnormality occurs in order to generate the learning model. That is, although FIGS. 4(a) and 4(b) are shown separately, they may each show a part of continuous data. The certain period of time in the past may be, for example, one year, half a year, three months, etc., but is not limited thereto.

[0039] The generating unit 112 may learn past time series data using a sliding window concept known in anomaly detection of time series data. The window may be a concept of extracting data with a time width of the window width from time series data as shown in FIG. 4. For example, the generating unit 112 may generate a plurality of sub-data sets f11, f12, f13, etc. by shifting a window with a width of "9" as a predetermined width in the time axis direction by a predetermined shift width of "1". Note that the sub-data set may be a collection of a plurality of consecutive time series data. In the example of FIG. 4(a), the sub-data sets f11, f12, f13 may include nine pieces of data d1 to d9, d2 to d10, and d3 to d11, respectively. Note that, here, one window is five minutes long, and the window width "9" may mean extracting time series data for 45 minutes. Note that the size of the window width is not limited to "9", and the shift width is not limited to "1".

[0040] Here, the "feature of the sub-dataset" refers to the average and standard deviation of the data included in the sub-dataset. According to an embodiment of the present invention, for each sub-dataset, supervised learning may be performed with the average, standard deviation, and the latest data among the data included in the sub-dataset as input variables, and a binary value, for example, 1 or 0, as an output variable for labeling whether the sub-dataset is "normal" or "abnormal." In the example of FIG. 4(a), the average, standard deviation, and data d9 of data d1 to d9 included in the sub-dataset f11 may be used as input variables. Also, the average, standard deviation, and data d10 of data d2 to d10 included in the sub-dataset f12 may be used as input variables.

[0041] Here, the sub-datasets f11, f12, and f13 may be labeled as "normal" during machine learning. Also, the sub-dataset f20 in FIG. 4(b) may be labeled as "abnormal" during machine learning. Note that the label "abnormal" may be attached when the data d25 at the center C of the window indicates "abnormal" as shown in FIG. 4(b), but is not limited thereto, and may be attached when the latest data of the sub-dataset indicates "abnormal".

[0042] The determination unit 113 may determine whether or not there is an abnormality in the monitored device 200 using the learning model generated by the generation unit 112 from the features of the sub-data set including the latest data newly acquired from the monitored device 200 and the latest data (step S13).

[0043] The process of determining whether or not there is an abnormality will be described with reference to FIG. 5. FIG. 5 may show the transition of data currently acquired from the monitored device 200. The calculation unit 115 may calculate an average and a standard deviation as the feature amount of the sub-data set f31 including the latest data d39. The calculation unit 115 may input the feature amount of the sub-data set f31 and the value of the latest data d39 to the learning model generated by the generation unit 112. The determination unit 113 may determine whether or not there is an abnormality in the monitored device 200 depending on whether the output of the learning model is "abnormal" or "normal".

[0044] As described above, according to an embodiment of the present invention, the latest data of the sub-data set may be used as input variables when generating a learning model, which makes it possible to quickly detect the presence or absence of anomalies in newly acquired data using the generated learning model.

[0045] According to an embodiment of the present invention, the average and standard deviation may be calculated within the sub-dataset, and these values ​​may be used to generate a learning model. In this way, by learning the trends of the average values ​​in the abnormal and normal cases as well as the trends of the standard deviation when noise is included, the influence of noise can be reduced. Furthermore, by using the three-dimensional data of the latest data in the sub-dataset as input variables in addition to the average and standard deviation, it becomes easier to draw the boundary between abnormal data and normal data during learning, and the accuracy of the learning model can be improved.

[0046] As described above, noise may occur in the monitored device 200 or in a communication path from the monitored device 200 to the information processing device 100. According to an embodiment of the present invention, it may be possible to suppress the influence of noise that is essentially unrelated to these abnormalities.

[0047] In addition, if it is determined that an abnormality has occurred, the notification unit 114 may output the fact that an abnormality has occurred via the input / output unit 130, or may notify a monitor's terminal (not shown) via the communication unit 120.

[0048] In addition, in one embodiment of the present invention, the generation unit 112 may determine the specified range in generating a learning model depending on the time required for the judgment unit 113 to determine whether or not there is an abnormality and the accuracy rate of the judgment of whether or not there is an abnormality when the specified range is varied.

[0049] In general, the wider the window width of the window, the more the influence of noise can be reduced, and the more accurate the classification of abnormal and normal data becomes. However, the wider the window width, the longer it takes to make a judgment, especially at the beginning of the occurrence of an abnormality. If the window width is widened, at the beginning of the occurrence of an abnormality, more normal data is included in the window than abnormal data. Therefore, it is necessary to slide the window until the window contains enough abnormal data to be judged as an abnormality, and it takes time to make a judgment. FIG. 6 shows an example of a table TB10 showing the change in the accuracy of the learning model and the time required for judgment when the window width is changed. Note that the accuracy may be the accuracy rate of the judgment using the generated learning model. As shown in FIG. 6, the larger the window width, the higher the accuracy, but the longer the time until the judgment. The generation unit 112 may use a window width that requires a higher accuracy rate and takes, for example, one hour or less to judge the presence or absence of an abnormality when generating the learning model. Note that the numerical values ​​are not limited to these.

[0050] In this way, according to one embodiment of the present invention, a learning model is generated that takes into consideration the time and accuracy required for determining an anomaly, thereby enabling accurate anomaly detection while reducing the processing load on the information processing device.

[0051] In the above, a learning model is generated by supervised machine learning with abnormal and normal labels. This makes it possible to generate a highly accurate learning model for a monitored device for which past time-series data has been acquired.

[0052] However, according to one embodiment of the present invention, the generation unit 112 may generate a learning model by unsupervised machine learning using past time-series data acquired from the monitored device 200. This makes it possible to generate a more versatile learning model.

[0053] In addition, the machine learning in one embodiment of the present invention may use any one of linear discrimination, logistic regression, SVM (Support Vector Machine), neural network, K nearest neighbor method, decision tree, and deep learning.

[0054] Although the present invention has been described based on the drawings and examples, it should be noted that a person skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these modifications and corrections are included in the scope of the present invention. For example, the functions included in each component, each step, etc. can be rearranged so as not to be logically contradictory, and multiple components, steps, etc. can be combined into one or divided. In addition, the configurations shown in the above embodiments may be appropriately combined. For example, each component described as being included in the information processing device 100 may be realized by being distributed by multiple servers.

[0055] For example, in the above description, a router is used as a monitored device and a difference rate is used as time-series data, but anomalies may be determined based on other types of data.

[0056] In addition, in the above, an example of a learning model that classifies data newly acquired from a monitored device as being “abnormal” or “normal” has been described. However, a learning model that predicts the occurrence of an abnormality based on the tendency of data newly acquired from the monitored device 200 may be generated.

[0057] The programs of the embodiments of the present disclosure may be provided in a state stored in a storage medium readable by an information processing device. The storage medium can store the programs in a "non-transitory tangible medium." The programs include, for example, software programs and information processing device programs. When each functional unit of the information processing device 100 as an information processing device is realized by software, the information processing device 100 functions as an acquisition unit 111, a generation unit 112, a determination unit 113, and a notification unit 114 by the processor executing the programs loaded on the memory.

[0058] The storage medium may, where appropriate, include one or more semiconductor-based or other integrated circuits (ICs) (e.g., field programmable gate arrays (FPGAs), application specific ICs (ASICs), etc.), hard disk drives (HDDs), hybrid hard drives (HHDs), optical disks, optical disk drives (ODDs), magneto-optical disks, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid state drives (SSDs), RAM drives, secure digital cards or drives, any other suitable storage media, or any suitable combination of two or more of these. The storage medium may, where appropriate, be volatile, non-volatile, or a combination of volatile and non-volatile.

[0059] Furthermore, the program of the present disclosure may be provided to the information processing device 100 via any transmission medium (such as a communication network or broadcast waves) capable of transmitting the program.

[0060] In addition, each embodiment of the present disclosure may be realized in the form of a data signal embedded in a carrier wave in which a program is embodied by electronic transmission. The program of the present disclosure may be implemented using, for example, a script language such as JavaScript (registered trademark) or Python, C language, Go language, Swift, Koltin, Java (registered trademark), or the like.

[0061] According to each aspect of the present disclosure described above, in a world beyond 5G where all devices will be connected to networks, technology can be provided to monitor devices and detect abnormalities early, thereby contributing to the achievement of Goal 9 of the Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote industry, innovation and infrastructure." [Explanation of symbols]

[0062] 100 Information processing device (monitoring server) 110 Control section 111 Acquisition Department 112 Generation part 113 Judgment section 114 Notification Department 115 Calculation section 120 Communications Department 130 Input / output section 170 Storage section 200 monitored devices 500 Network 600 Information Processing Systems (Monitoring Systems)

Claims

1. an acquisition unit that acquires time-series data measured at a predetermined time interval from a monitoring target; a generation unit that generates a learning model for detecting anomalies in the monitoring target based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-data sets; a determination unit that determines the presence or absence of an abnormality in the monitoring target by using the learning model from features of a sub-data set including latest data extracted from time-series data newly acquired from the monitoring target and the latest data; An information processing device comprising:

2. The determination unit uses an average and a standard deviation of data included in the sub data set as the feature amount of the sub data set. The information processing device according to claim 1 .

3. The generation unit generates the learning model by supervised machine learning in which data indicating an anomaly in the monitoring target is labeled as an anomaly in the past time-series data acquired from the monitoring target. The information processing device according to claim 1 .

4. The generation unit generates the learning model by unsupervised machine learning using the past time-series data acquired from the monitoring target. The information processing device according to claim 1 .

5. The generation unit determines the predetermined range in accordance with a time required for the determination unit to determine the presence or absence of the abnormality when the predetermined range is varied in generating the learning model, and an accuracy rate of the determination of the presence or absence of the abnormality. The information processing device according to claim 1 .

6. the monitoring target is a network device, and the time-series data includes at least one of noise occurring in the monitoring target and noise occurring in a communication path from the monitoring target to the information processing device; The information processing device according to claim 1 .

7. The generation unit generates the learning model by using any one of linear discrimination, logistic regression, SVM (Support Vector Machine), neural network, K-nearest neighbor method, decision tree, and deep learning. The information processing device according to claim 1 .

8. An information processing device, acquiring time-series data measured at a predetermined time interval from a monitoring target; generating a learning model for detecting anomalies in the monitored object based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-data sets; determining the presence or absence of an abnormality in the monitoring target from the latest data and feature amounts of a sub-data set including the latest data extracted from time series data newly acquired from the monitoring target, using the learning model; A method for controlling an information processing device.

9. In the information processing device, A function to acquire time series data measured at a specified time interval from the monitored object, a function of generating a learning model for detecting anomalies in the monitoring target based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data among the data included in the sub-data sets; a function of determining the presence or absence of an abnormality in the monitoring target by using the learning model from features of a sub-data set including latest data extracted from newly acquired time-series data from the monitoring target and the latest data; A control program for an information processing device that realizes the above.

Images