Anomaly detection device and anomaly detection method

Abstract

To accurately detect categorical data erroneously set.SOLUTION: An anomaly detection device comprises a saving unit, a correlation detection unit, a variable coupling unit, and a determination unit. The saving unit saves reference data including a categorical variable which is the same as determination object data including a plurality of categorical variables. The correlation detection unit detects a combination of the categorical variables having correlation with each other from among the plurality of categorical variables, by using the reference data. The variable coupling unit creates one or more coupling variables by coupling the categorical variables having the correlation with each other detected by the correlation detection unit. The determination unit determines whether the determination object data are normal or abnormal, by comparing the reference data with the determination object data, about each of one or more coupling variables.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an apparatus and method for detecting anomalies in categorical data. [Background technology]

[0002] In recent years, various equipment is controlled and managed by software. For this reason, many parameters are set during the initial setup of the equipment. Most of these parameters are categorical data. Categorical data is qualitative data that can be classified into categories. For example, in a wireless communication system, categorical data such as frequency (700 MHz or 1.8 GHz), bandwidth (5 MHz, 10 MHz, or 20 MHz), base station type (small cell or macro cell), area type (urban or suburban), and priority (high, medium, or low) are set.

[0003] Numeric data is an example of data other than categorical data. Numeric data represents a number that can take a continuous value, such as longitude or latitude.

[0004] In large-scale equipment, the amount of parameters (categorical data in this case) to be set is enormous. However, at least some of the parameters are set manually. For this reason, a method for automatically detecting erroneous settings is required. As an example, a method has been proposed for automatically determining the importance of a large amount of abnormal data and extracting important abnormal data from the large amount of abnormal data (e.g., Patent Document 1). Also, as a related technology, a method has been proposed for detecting a state and inferring the cause based on a bias in state data that indicates the degree to which a product is in a specific state (e.g., Patent Document 2). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2018-005714 A [Patent Document 2] JP 2022-092419 A Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, methods for detecting erroneously set data have been proposed. However, in the conventional techniques, erroneously set categorical data may not be detected with high accuracy.

[0007] An object of one aspect of the present invention is to provide an apparatus and method for accurately detecting erroneously set categorical data. [Means for solving the problem]

[0008] An anomaly detection device according to one embodiment of the present invention includes a storage unit that stores reference data including categorical variables that are the same as data to be judged, which includes a plurality of categorical variables; a correlation detection unit that uses the reference data to detect combinations of categorical variables that are correlated with each other from among the plurality of categorical variables; a variable combination unit that generates one or more combined variables by combining the correlated categorical variables detected by the correlation detection unit; and a judgment unit that judges whether the data to be judged is normal or abnormal by comparing the reference data with the data to be judged for each of the one or more combined variables. Effect of the Invention

[0009] According to the above-described aspect, erroneously set categorical data can be detected with high accuracy. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating an example of an anomaly detection device according to an embodiment of the present invention. [Diagram 2] FIG. 11 is a diagram illustrating an example of determination target data. [Diagram 3]FIG. 13 is a diagram illustrating an example of normal data and an example of the importance of categorical variables. [Figure 4] FIG. 13 is a diagram showing an example of normal data corresponding to a combination variable and an example of the importance of the combination variable. [Diagram 5] FIG. 11 is a diagram (part 1) showing an example of processing by a correlation detection unit. [Figure 6] FIG. 2 illustrates an example of the process of the correlation detection unit (part 2). [Figure 7] FIG. 13 is a diagram showing an example of a determination result based on a comparison with normal data. [Figure 8] 13 is a flowchart illustrating an example of a process performed by the anomaly detection device. [Figure 9] 13 is a flowchart illustrating an example of a process for determining the importance of each categorical variable. [Figure 10] 13 is a flowchart illustrating an example of a process for generating a coupling variable and determining its importance. [Figure 11] 13 is a flowchart illustrating an example of a process for calculating an abnormality degree of determination target data. [Figure 12] FIG. 11 is a diagram illustrating an example of an effect achieved by the embodiment of the present invention. [Figure 13] FIG. 2 illustrates an example of a hardware configuration of the anomaly detection device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Fig. 1 shows an example of an anomaly detection device according to an embodiment of the present invention. The anomaly detection device 1 according to the embodiment of the present invention includes a storage unit 10, a categorical variable processing unit 20, and a judgment unit 30, and detects anomalies in data to be judged. Note that the anomaly detection device 1 may further include other functions, devices, or circuits not shown in Fig. 1.

[0012] The determination target data includes a plurality of categorical variables. The determination target data is not particularly limited, but may be, for example, a part of a configuration file installed in a base station of a wireless communication system.

[0013] 2 shows an example of the judgment target data. The judgment target data is a group of parameters set for each base station, and in this embodiment, represents the number of device 1, frequency, area type, base station type, number of device 2, priority, bandwidth, and quality. The judgment target data may further include other parameters. Each parameter is a categorical variable.

[0014] The "number of device 1" identifies one of the multiple devices constituting the base station (for example, CU / DU: Central Unit / Distributed Unit). The "frequency" represents the radio frequency band used by the base station, and in this embodiment, is selected from 1.8 GHz or 700 MHz. The "area type" represents the characteristics of the area in which the base station is installed, and in this embodiment, is selected from urban area or suburban area. The "base station type" represents the characteristics of the base station (such as the expected cell size), and in this embodiment, is selected from macro cell or small cell. The "number of device 2" identifies another device (for example, RU: Radio Unit) of the multiple devices constituting the base station. The "priority" represents the priority of the wireless communication provided by the base station, and in this embodiment, is selected from high priority or medium priority. The "bandwidth" represents the bandwidth of the wireless communication provided by the base station, and in this embodiment, is selected from 5 MHz or 10 MHz. The "quality" represents the quality required for the wireless communication provided by the base station, and in this embodiment, is selected from high quality or low quality.

[0015] For example, the determination target data corresponding to record number 51 represents "Device 1 number: 1001", "Frequency: 1.8 GHz", "Area type: Suburban", "Base station type: Macrocell", "Device 2 number: 70", "Priority: Medium", "Bandwidth: 5 MHz", and "Quality: High". Alternatively, the determination target data corresponding to record number 54 represents "Device 1 number: 1054", "Frequency: 700 MHz", "Area type: Urban", "Base station type: Small cell", "Device 2 number: 38", "Priority: High", "Bandwidth: 5 MHz", and "Quality: Low".

[0016] The storage unit 10 stores normal data as reference data used to detect erroneous settings in the data to be judged. The normal data is data that includes the same categorical variables as the data to be judged, and is confirmed not to include erroneous settings as a configuration file implemented in a base station. In addition, it is preferable that the normal data has the same data structure as the data to be judged.

[0017] FIG. 3(a) shows an example of normal data stored in the storage unit 10. Here, the data structure of the normal data is the same as that of the data to be judged. That is, in this embodiment, the normal data also represents the number of the device 1, the frequency, the area type, the base station type, the number of the device 2, the priority, the bandwidth, and the quality. In addition, the normal data may be generated by, for example, an operation manager of a wireless communication system manually confirming that the set values ​​of each categorical variable are correct for a part of the data to be judged. Alternatively, the normal data may be sample data in which the set values ​​of each categorical variable are confirmed to be correct. In any case, it is assumed that there is no erroneous setting in the normal data. In this embodiment, eight sets of normal data are stored in the storage unit 10.

[0018] 1, the categorical variable processing unit 20 includes a variable importance determining unit 21, an important variable extracting unit 22, a correlation detecting unit 23, a variable combining unit 24, and a combined variable importance determining unit 25. However, the categorical variable processing unit 20 may further include other functions not shown in FIG.

[0019] The variable importance determination unit 21 determines the importance of each categorical variable based on the normal data stored in the storage unit 10. The importance is expressed by a numerical value, with the more important the variable, the larger the value. In this embodiment, the importance of a categorical variable is expressed by the reciprocal of the number of different values ​​(or different patterns) that appear in the normal data.

[0020] For example, in the normal data shown in FIG. 3(a), eight different values ​​appear as the "number of device 1". In this case, the importance of the categorical variable "number of device 1" is "1 / 8". Similarly, the importance of the categorical variable "number of device 2" is also "1 / 8". In contrast, two different values ​​(1.8 GHz and 700 MHz) appear as the "frequency". In this case, the importance of the categorical variable "frequency" is "1 / 2". Similarly, the importance of the categorical variables "area type", "base station type", "priority", "bandwidth", and "quality" are each "1 / 2". As a result, the importance of each categorical variable is obtained as shown in FIG. 3(b). Note that when the importance is determined as described above, a variable with a larger value indicates a higher importance, and a variable with a smaller value indicates a lower importance.

[0021] The important variable extraction unit 22 extracts categorical variables with high importance from among a plurality of categorical variables constituting normal data (or data to be judged). The importance of each categorical variable is determined by the variable importance determination unit 21. Then, the important variable extraction unit 22 extracts categorical variables whose importance value is greater than a predetermined importance threshold. The importance threshold is not particularly limited, but is 1 / 3 in this embodiment. In this case, the important variable extraction unit 22 extracts "frequency", "area type", "base station type", "priority", "bandwidth", and "quality" as categorical variables with high importance.

[0022] The correlation detection unit 23 detects a combination of categorical variables that are correlated with each other among the categorical variables extracted by the important variable extraction unit 22 based on the normal data stored in the storage unit 10. In the example shown in FIG. 3, when the "frequency" is 1.8 GHz, the "area type" is always suburban and the "base station type" is always macrocell. When the "frequency" is 700 MHz, the "area type" is always urban and the "base station type" is always small cell. Therefore, the categorical variables "frequency", "area type" and "base station type" are determined to be correlated with each other. When the "priority" is medium priority, the "bandwidth" is always 5 MHz, and when the "priority" is high priority, the "bandwidth" is always 10 MHz. Therefore, the categorical variables "priority" and "bandwidth" are determined to be correlated with each other. The method by which the correlation detection unit 23 detects a combination of categorical variables that are correlated with each other will be described in detail later.

[0023] The variable combining unit 24 combines a plurality of categorical variables belonging to the combination detected by the correlation detection unit 23 to generate (or define) one new variable. In this embodiment, "frequency", "area type" and "base station type" are detected as combinations of categorical variables that are correlated with each other. Therefore, by combining these variables, a new variable "frequency_area type_base station type" is generated. In addition, "priority" and "bandwidth" are detected as other combinations of categorical variables that are correlated with each other. Therefore, by combining these variables, a new variable "priority_bandwidth" is generated. In the following description, the new variable generated in this way may be called a "combined variable".

[0024] FIG. 4(a) shows an example of normal data corresponding to the combined variable. Here, normal data corresponding to the combined variable is generated based on the normal data shown in FIG. 3(a). For example, a value corresponding to the combined variable "frequency_area type_base station type" is obtained by combining the value of "frequency", the value of "area type", and the value of "base station type". Specifically, for example, in record number 1, by combining "frequency: 1.8GHz", "area type: suburban", and "base station type: macrocell", a combination of values ​​"1.8GHz_suburban_macrocell" corresponding to the combined variable "frequency_area type_base station type" is obtained. Alternatively, in record number 5, by combining "frequency: 700MHz", "area type: urban area", and "base station type: small cell", a combination of values ​​"700MHz_urban_small cell" corresponding to the combined variable "frequency_area type_base station type" is obtained. The same applies to other records. The same applies to the combined variable "priority_bandwidth".

[0025] The combined variable importance determination unit 25 determines the importance of each combined variable based on the normal data corresponding to the combined variables generated by the variable combination unit 24. The method for determining the importance of the combined variables is substantially the same as the method for determining the importance of each individual categorical variable. Therefore, the importance of the combined variable is also expressed by a numerical value having a larger value as the variable becomes more important. However, in this embodiment, the importance of the combined variable is expressed by the reciprocal of the number of different value combinations (or different patterns) that appear in the normal data.

[0026] For example, in the normal data shown in FIG. 4(a), two different values ​​(1.8GHz_suburban_macrocell and 700MHz_urban_smallcell) appear for the combined variable "frequency_area type_base station type". Therefore, the importance of this combined variable is "1 / 2". Similarly, two different values ​​(medium priority_5MHz and high priority_10MHz) appear for the combined variable "priority_bandwidth". Therefore, the importance of this combined variable is also "1 / 2". As a result, the importance of each combined variable is obtained as shown in FIG. 4(b). Note that when the importance is determined as described above, a combined variable with a larger value indicates a higher importance, and a combined variable with a smaller value indicates a lower importance.

[0027] In this way, the categorical variable processing unit 20 determines the importance of each of the multiple categorical variables in the data to be determined based on the normal data stored in the storage unit 10. In addition, the categorical variable processing unit 20 generates a combined variable by combining categorical variables that are correlated with each other from among the multiple categorical variables in the data to be determined. Then, the categorical variable processing unit 20 determines the importance of each combined variable.

[0028] 5 to 6 show an example of the process of the correlation detection unit 23. That is, FIG. 5 to FIG. 6 show an example of a method for detecting a combination of categorical variables that are correlated with each other. In this embodiment, for the sake of simplicity, correlations between four categorical variables are detected. Specifically, correlations are detected between the objective variable "frequency" and the explanatory variables "area type", "base station type", and "quality".

[0029] Each explanatory variable is encoded by one-hot encoding, as shown in FIG. 5. That is, each explanatory variable is replaced by a feature having a value of 0 or 1. For example, when replacing a state in which the value of "area type" is "suburban" with "1", a state in which the value of "area type" is not "suburban" is replaced with "0". Then, the value of "area type: suburban" is replaced with "1" in record numbers 1 to 4, and replaced with "0" in record numbers 5 to 8. Also, when replacing a state in which the value of "area type" is "urban" with "1", a state in which the value of "area type" is not "urban" is replaced with "0". Then, the value of "area type: urban" is replaced with "0" in record numbers 1 to 4, and replaced with "1" in record numbers 5 to 8. Similar encoding is performed for other explanatory variables.

[0030] After that, the correlation detection unit 23 detects the correlation between the objective variable and each explanatory variable by using a decision tree analysis, etc. Specifically, as shown in Fig. 6, the correlation detection unit 23 finds the correlation between "frequency" and other explanatory variables by grasping the characteristics of the values ​​of each explanatory variable when "frequency" is 700 MHz and the characteristics of the values ​​of each explanatory variable when "frequency" is 1.8 GHz.

[0031] For example, when the value of "area type: suburban" is 0.5 or less, the probability that the "frequency" will be 700MHz is 100 percent, and when the value of "area type: suburban" is greater than 0.5, the probability that the "frequency" will be 1.8GHz is 100 percent. Also, when the value of "area type: urban" is 0.5 or less, the probability that the "frequency" will be 1.8GHz is 100 percent, and when the value of "area type: urban" is greater than 0.5, the probability that the "frequency" will be 700MHz is 100 percent. That is, in this case, when the value of "area type" is determined, the value of "frequency" is also determined to be the first place. Therefore, it is determined that there is a correlation between "frequency" and "area type". Similarly, it is determined that there is a correlation between "frequency" and "area type".

[0032] In contrast, when the value of "Quality: High" is 0.5 or less, there is a 50 percent probability that the "Frequency" will be 700 MHz, and when the value of "Quality: High" is greater than 0.5, there is a 50 percent probability that the "Frequency" will be 1.8 GHz. Also, when the value of "Quality: Low" is 0.5 or less, there is a 50 percent probability that the "Frequency" will be 1.8 GHz, and when the value of "Quality: Low" is greater than 0.5, there is a 50 percent probability that the "Frequency" will be 700 MHz. In other words, in this case, even if the value of "Quality" is determined, the value of "Frequency" is not determined. Therefore, it is determined that there is no correlation between "Frequency" and "Quality".

[0033] The method of detecting a combination of categorical variables that are correlated with each other is not particularly limited, and may be realized by existing technology. Also, AI (Artificial Intelligence) technology may be used to calculate the correlation between variables.

[0034] 1, the determination unit 30 includes an abnormality degree calculation unit 31, a normal / abnormal determination unit 32, and an erroneous variable identification unit 33. The determination unit 30 determines whether the data to be determined is normal or abnormal based on the normal data stored in the storage unit 10. The determination unit 30 may further include other functions not shown in FIG.

[0035] The anomaly degree calculation unit 31 calculates the degree of anomaly of the data to be judged based on the normal data stored in the storage unit 10. At this time, the anomaly degree calculation unit 31 first judges whether or not the set value of each variable of the data to be judged matches any value of the corresponding variable in the normal data. The variables to be processed include individual categorical variables and combined variables.

[0036] In this embodiment, the normal data shown in FIG. 3(a) is stored in the storage unit 10. Furthermore, the correlation detection unit 23 and the variable combination unit 24 generate normal data corresponding to the combination variables shown in FIG. 4(a). Furthermore, the importance of each variable is determined as shown in FIG. 3(b) and FIG. 4(b). Then, the judgment target data of each record shown in FIG. 2 is compared with the normal data. In the following description, the judgment target data of record number x may be referred to as "judgment target data Rx."

[0037] The following determination is made for the determination target data R51 (that is, the determination target data of record number 51). (1) "Device 1 number: 1001" matches the corresponding value of record number 1 of the normal data. (2) “Frequency: 1.8 GHz” matches the corresponding values ​​in record numbers 1 to 4 of the normal data. (3) “Area Type: Suburban” matches the corresponding values ​​in records 1 to 4 of the normal data. (4) “Base station type: macro cell” matches the corresponding values ​​in records 1 to 4 of the normal data. (5) “Device 2 Number: 70” matches the corresponding value in record 1 of the normal data. (6) “Priority: Medium” matches the corresponding values ​​in records 1 and 8 of the normal data. (7) “Bandwidth: 5 MHz” matches the corresponding values ​​in records 1 and 8 of the normal data. (8) “Quality: High” matches the corresponding values ​​in records 1, 2, 5, and 6 of the normal data. (9) “Frequency_area type_base station type: 1.8 GHz_suburban_macrocell” matches the combination of corresponding values ​​in records 1 to 4 of the normal data. (10) “Priority_Bandwidth: Medium_5MHz” matches the combination of corresponding values ​​of records 1 and 8 of the normal data.

[0038] The following determination is made for the determination target data R52. (1) "Device 1 Number: 1052" does not match the corresponding value of any record in the normal data. (2) “Frequency: 1.8 GHz” matches the corresponding values ​​in record numbers 1 to 4 of the normal data. (3) “Area Type: Suburban” matches the corresponding values ​​in records 1 to 4 of the normal data. (4) “Base station type: macro cell” matches the corresponding values ​​in records 1 to 4 of the normal data. (5) “Device 2 Number: 41” does not match the corresponding value of any record in the normal data. (6) “Priority: Medium” matches the corresponding values ​​in records 1 and 8 of the normal data. (7) “Bandwidth: 5 MHz” matches the corresponding values ​​in records 1 and 8 of the normal data. (8) “Quality: High” matches the corresponding values ​​in records 1, 2, 5, and 6 of the normal data. (9) “Frequency_area type_base station type: 1.8 GHz_suburban_macrocell” matches the combination of corresponding values ​​in records 1 to 4 of the normal data. (10) “Priority_Bandwidth: Medium_5MHz” matches the combination of corresponding values ​​of records 1 and 8 of the normal data.

[0039] The following determination is made for the determination target data R53. (1) "Device 1 number: 1053" does not match the corresponding value of any record in the normal data. (2) “Frequency: 1.8 GHz” matches the corresponding values ​​in record numbers 1 to 4 of the normal data. (3) “Area Type: Suburban” matches the corresponding values ​​in records 1 to 4 of the normal data. (4) “Base station type: macro cell” matches the corresponding values ​​in records 1 to 4 of the normal data. (5) “Device 2 Number: 69” does not match the corresponding value of any record in the normal data. (6) “Priority: Medium” matches the corresponding values ​​in records 1 and 8 of the normal data. (7) “Bandwidth: 5 MHz” matches the corresponding values ​​in records 1 and 8 of the normal data. (8) “Quality: Medium” does not match the corresponding value of any record in the normal data. (9) “Frequency_area type_base station type: 1.8 GHz_suburban_macrocell” matches the combination of corresponding values ​​in records 1 to 4 of the normal data. (10) “Priority_Bandwidth: Medium_5MHz” matches the combination of corresponding values ​​of records 1 and 8 of the normal data.

[0040] The following determination is made for the determination target data R54. (1) "Device 1 number: 1054" does not match the corresponding value of any record in the normal data. (2) “Frequency: 700 MHz” matches the corresponding values ​​in record numbers 5 to 8 of the normal data. (3) “Area Type: Urban” matches the corresponding values ​​in records 5 to 8 of the normal data. (4) “Base station type: small cell” matches the corresponding values ​​in records 5 to 8 of the normal data. (5) “Device 2 Number: 38” does not match the corresponding value of any record in the normal data. (6) “Priority: High” matches the corresponding values ​​in records 2 to 7 of the normal data. (7) “Bandwidth: 5 MHz” matches the corresponding values ​​in records 1 and 8 of the normal data. (8) “Quality: Low” matches the corresponding values ​​in records 3, 4, 7, and 8 of the normal data. (9) “Frequency_area type_base station type: 700 MHz_urban area_small cell” matches the combination of corresponding values ​​in records 5 to 8 of the normal data. (10) “Priority_Bandwidth:High_5MHz” does not match any of the corresponding value combinations of any records in the normal data.

[0041] The following determination is made for the determination target data R55. (1) "Device 1 number: 1055" does not match the corresponding value of any record in the normal data. (2) “Frequency: 700 MHz” matches the corresponding values ​​in record numbers 5 to 8 of the normal data. (3) “Area Type: Suburban” matches the corresponding values ​​in records 1 to 4 of the normal data. (4) “Base station type: macro cell” matches the corresponding values ​​in records 1 to 4 of the normal data. (5) “Device 2 Number: 62” does not match the corresponding value of any record in the normal data. (6) “Priority: High” matches the corresponding values ​​in records 2 to 7 of the normal data. (7) “Bandwidth: 10 MHz” matches the corresponding values ​​in records 2 to 7 of the normal data. (8) “Quality: Medium” does not match the corresponding value of any record in the normal data. (9) “Frequency_area type_base station type: 700 MHz_suburban_macrocell” does not match any of the corresponding value combinations of any records in the normal data. (10) “Priority_Bandwidth:High_10MHz” matches the corresponding values ​​in records 2 to 7 of the normal data.

[0042] Fig. 7 shows the above-mentioned judgment result. In Fig. 7, a circle mark indicates that the setting value of the judgment target data matches at least one of the values ​​of the corresponding variable in the normal data. A cross mark indicates that the setting value of the judgment target data does not match any of the values ​​of the corresponding variable in the normal data. Note that the numerical value (1 / 2 or 1 / 8) given to each variable in Fig. 7 indicates the importance of the variable determined by the variable importance determination unit 21 or the combined variable importance determination unit 25.

[0043] Next, the anomaly degree calculation unit 31 calculates the anomaly degree of each judgment target data based on the judgment result shown in Fig. 7. In this embodiment, the anomaly degree is represented by the sum of weights determined for variables whose set values ​​or combinations of set values ​​do not match the normal data. Specifically, it is as follows.

[0044] In the judgment target data R51, all variables are judged to be “matched.” In this case, the degree of abnormality of this judgment target data is zero.

[0045] In the judgment target data R52, "Device 1 number" and "Device 2 number" are each judged to be "mismatched." Here, the importance of these variables is 1 / 8, respectively. And the sum of the importance of these two variables is 0.25. Therefore, the degree of anomaly of the judgment target data R52 is 0.25.

[0046] In the judgment target data R53, "Device 1 Number", "Device 2 Number", and "Quality" are each judged to be "Mismatched". Here, the importance of "Quality" is 1 / 2. And the sum of the importance of these three variables is 0.75. Therefore, the degree of anomaly of the judgment target data R53 is 0.75.

[0047] In the judgment target data R54, "Device 1 Number", "Device 2 Number", and "Priority_Bandwidth" are each judged to be "Mismatched". Here, the importance of "Priority_Bandwidth" is 1 / 2. And the sum of the importance of these three variables is 0.75. Therefore, the degree of anomaly of the judgment target data R54 is also 0.75.

[0048] In the judgment target data R55, "Device 1 Number", "Device 2 Number", "Quality", and "Frequency_Area Type_Base Station Type" are each judged to be "Mismatched". Here, the importance of "Frequency_Area Type_Base Station Type" is 1 / 2. And the sum of the importance of these four variables is 1.25. Therefore, the abnormality degree of the judgment target data R55 is 1.25.

[0049] The normality / abnormality determination unit 32 compares the degree of abnormality calculated by the abnormality degree calculation unit 31 with a predetermined abnormality degree threshold to determine whether the data to be determined is normal or abnormal. Specifically, data to be determined whose degree of abnormality is greater than the abnormality degree threshold is determined to be abnormal (including, for example, incorrect settings). In contrast, data to be determined whose degree of abnormality is equal to or less than the abnormality degree threshold is determined to be normal. Here, in this embodiment, the abnormality degree threshold is 0.5. In this case, the data to be determined R51 to R52 are determined to be normal data, and the data to be determined R53 to R55 are determined to be abnormal data. The abnormality degree threshold is determined taking into consideration the number of variables used by the data to be determined, etc.

[0050] The erroneous variable identifying unit 33 identifies erroneous variables in the data to be judged as abnormal data by the normal / abnormal judging unit 32. At this time, a variable that does not match the value of the normal data and has an importance value greater than a predetermined importance threshold is identified as an erroneous variable.

[0051] For example, as shown in Fig. 7, in the judgment target data R53, "Device 1 Number", "Device 2 Number", and "Quality" do not match the normal data. Here, if the importance threshold used by the erroneous variable identification unit 33 is 1 / 3, among these three variables, only "Quality" has an importance value greater than the importance threshold. In this case, the erroneous variable identification unit 33 judges that there is a possibility that an erroneous setting has been made for "Quality".

[0052] In contrast, for example, in the judgment target data R55, "number of device 1", "number of device 2", "quality", and "frequency_area type_base station type" do not match the normal data. Here, among these four variables, the variables with importance values ​​greater than the importance threshold are "quality" and "frequency_area type_base station type". And, the state in which "frequency_area type_base station type" does not match the combination of values ​​of the normal data may occur when an erroneous setting is made for one or more variables of "frequency", "area type" or "base station type". Also, the importance of "frequency", "area type", and "base station type" are all greater than the importance threshold. Therefore, in this case, the erroneous setting variable identification unit 33 judges that there is a possibility that an erroneous setting has been made for "quality", "frequency", "area type", and "base station type".

[0053] Thereafter, the user (in this embodiment, the administrator of the wireless communication system) checks the setting values ​​of the variables identified by the erroneous setting variable identifying unit 33 in the data to be judged as abnormal by the normal / abnormal judging unit 32. This makes it possible to efficiently correct the erroneous settings in the data to be judged.

[0054] <Flowchart> 8 is a flowchart showing an example of the process of the anomaly detection device 1. It is assumed that normal data is stored in the storage unit 10 before the anomaly detection device 1 determines whether or not there is an anomaly in the determination target data.

[0055] In S1, the anomaly detection device 1 determines the importance of each variable. The variables for which the importance is to be determined include each categorical variable in the data to be determined and a combined variable obtained by combining two or more categorical variables. That is, the anomaly detection device 1 determines the importance of each categorical variable and each combined variable. The method of determining the importance of each variable will be described in detail later.

[0056] In S2, the anomaly detection device 1 acquires judgment target data. After that, the anomaly detection device 1 executes the processes of S3 to S5 on the judgment target data i (i=1 to n).

[0057] In S3, the anomaly detection device 1 calculates the degree of anomaly of the judgment target data i. A method for calculating the degree of anomaly of the judgment target data will be described in detail later. In S4, the anomaly detection device 1 compares the degree of anomaly calculated for the judgment target data i with a predetermined anomaly threshold. As a result, if the degree of anomaly of the judgment target data i is greater than the anomaly threshold, the anomaly detection device 1 determines in S5 that the judgment target data i is abnormal data. On the other hand, if the degree of anomaly of the judgment target data i is equal to or less than the anomaly threshold, the anomaly detection device 1 determines that the judgment target data i is not abnormal data. In this way, the anomaly detection device 1 determines whether each of the judgment target data 1 to n is normal or abnormal.

[0058] In S6, the anomaly detection device 1 identifies variables in each of the determination target data determined to be abnormal that do not match the corresponding values ​​in the normal data and have importance greater than the importance threshold value. Then, the anomaly detection device 1 outputs information indicating the identified variables for each of the determination target data determined to be abnormal.

[0059] Fig. 9 is a flowchart showing an example of a process for determining the importance of each categorical variable. The process of this flowchart corresponds to a part of S1 shown in Fig. 8, and is executed by the variable importance determination unit 21 and the important variable extraction unit 22. The important variable extraction unit 22 has an important variable list for registering categorical variables with high importance. In the initial state, the important variable list is empty. Then, the variable importance determination unit 21 and the important variable extraction unit 22 execute the processes of S11 to S13 for each categorical variable c (c = 1 to m) constituting the judgment target data.

[0060] In S11, the variable importance determination unit 21 determines the importance of the categorical variable c based on the normal data. In this embodiment, the importance of the categorical variable is represented by the reciprocal of the number of different values ​​(or different patterns) that appear in the normal data. In this case, a categorical variable with a larger importance value indicates a higher importance, and a categorical variable with a smaller importance value indicates a lower importance.

[0061] In S12 to S13, the important variable extraction unit 22 compares the importance of the categorical variable c with a predetermined importance threshold. If the importance value is greater than the importance threshold, the important variable extraction unit 22 adds the categorical variable c to the important variable list as a categorical variable with high importance. Thus, by executing S11 to S13 for all categorical variables, categorical variables with high importance are extracted.

[0062] Fig. 10 is a flowchart showing an example of a process for generating a coupling variable and determining its importance. The process of this flowchart corresponds to a part of S1 shown in Fig. 8, and is executed by the correlation detection unit 23, the variable coupling unit 24, and the coupling variable importance determination unit 25.

[0063] In S21, the correlation detection unit 23 calculates the correlation between the categorical variables registered in the important variable list. The correlation between the categorical variables is calculated, for example, by the method shown in FIG. 5 to FIG. 6. In S22, the variable combination unit 24 generates a combined variable by combining categorical variables that are correlated with each other. The combined variable may be generated from two categorical variables, or may be generated from three or more categorical variables. The combined variable importance determination unit 25 executes the process of S23 for each combined variable d (d=1 to k) generated by the variable combination unit 24. That is, the combined variable importance determination unit 25 determines the importance of the combined variable d based on the normal data. The method of determining the importance of the combined variable d is substantially the same as the method of determining the importance of the categorical variable c, and is represented by the reciprocal of the number of different value combinations (or different patterns) that appear in the normal data.

[0064] 11 is a flowchart showing an example of a process for calculating the degree of abnormality of each judgment target data. The process of this flowchart corresponds to S3 shown in FIG.

[0065] In S31, the anomaly degree calculation unit 31 initializes the anomaly degree i to "0". The anomaly degree i represents the degree of anomaly of the judgment target data i. In S32, the anomaly degree calculation unit 31 initializes a variable c that identifies a categorical variable that constitutes the judgment target data to "1". Thereafter, the processes of S33 to S34 are executed for each of the n categorical variables that constitute the judgment target data in order.

[0066] In S33, the anomaly degree calculation unit 31 judges whether the set value of the categorical variable c in the judgment target data i matches any of the corresponding values ​​in the normal data. For example, in the judgment target data shown in FIG. 2, when i identifies the record number 51 and c identifies the "frequency", the set value of the categorical variable c in the judgment target data i is 1.8 GHz. In this case, the anomaly degree calculation unit 31 judges whether or not there is normal data in which the "frequency" is 1.8 GHz in FIG. 3. As a result, when the set value of the categorical variable c in the judgment target data i does not match any of the corresponding values ​​in the normal data, in S34, the anomaly degree calculation unit 31 adds the importance of the categorical variable c to the anomaly degree i. Note that when the set value of the categorical variable c in the judgment target data i matches any of the corresponding values ​​in the normal data, the process of S34 is skipped.

[0067] After that, if any categorical variables remain for which the processes of S33 to S34 have not been executed (S35: No), the next categorical variable is selected in S36, and the process of the anomaly degree calculation unit 31 returns to S33. That is, the processes of S33 to S34 are executed for all categorical variables. As a result, the sum of the importance of the categorical variables that do not match the normal data is calculated as the anomaly degree i.

[0068] The processes of S37 to S41 are substantially the same as those of S32 to S36. However, the processes of S37 to S41 are executed for each of the m combined variables. That is, when the combination of the set values ​​of the combined variables d in the judgment target data i does not match any of the corresponding value combinations in the normal data, the anomaly degree calculation unit 31 adds the importance of the combined variables d to the anomaly degree i. As a result, the sum of the importance of the categorical variables whose set values ​​do not match the normal data and the importance of the combined variables whose set value combinations do not match the normal data is calculated as the anomaly degree i.

[0069] <Effects of the embodiment of the present invention> FIG. 12 shows an example of the effect of an embodiment of the present invention. Below, the effect of taking into account the combined variables will be described based on the determination results shown in FIG. 7. Note that the "degree of abnormality based only on categorical variables" represents the sum of the importance of categorical variables whose set values ​​do not match normal data. The "degree of abnormality based on combined variables" represents the sum of the importance of combined variables whose combinations of set values ​​do not match normal data. The "degree of abnormality based on an embodiment of the present invention" represents the sum of the "degree of abnormality based only on categorical variables" and the "degree of abnormality based on combined variables."

[0070] When comparing the "degree of abnormality based on categorical variables only" and the "degree of abnormality based on an embodiment of the present invention," the judgment results are different for the judgment target data R54. That is, the judgment result based on categorical variables only is "normal," whereas the judgment result based on the embodiment of the present invention is "abnormal."

[0071] 2 and 3, of the eight categorical variables in the data to be determined R54, the only categorical variables that do not have matching values ​​in the normal data are "Device 1 Number" and "Device 2 Number." The importance of each of these categorical variables is 1 / 8. Therefore, when only the categorical variables are taken into consideration, the degree of anomaly of the data to be determined R54 is 0.25, which is smaller than the anomaly threshold, and the determination result is "normal."

[0072] On the other hand, in the data to be judged R54, the combination variable "priority_bandwidth" is set to "high_5MHz", and this combination does not appear in the normal data. Therefore, the combination variable "priority_bandwidth" and the two categorical variables "priority" and "bandwidth" that make up this combination variable are examined.

[0073] In the judgment target data R54, the setting value of "priority" is "high" as shown in FIG. 2. Here, as shown in FIG. 3, the "priority" of the normal data R2 to R7 is "high". That is, the setting value of "priority" of the judgment target data R54 matches that of normal data of 1 or more. Therefore, when only categorical variables are taken into consideration, the importance of the categorical variable "priority" is not added when calculating the degree of abnormality of the judgment target data R54.

[0074] In addition, in the judgment target data R54, the set value of "bandwidth" is "5 MHz" as shown in FIG. 2. Here, as shown in FIG. 3, the "bandwidth" of the normal data R1 and R8 is "5 MHz". That is, the set value of "bandwidth" of the judgment target data R54 matches normal data of 1 or more. Therefore, when only categorical variables are taken into consideration, the importance of the categorical variable "bandwidth" is not added when calculating the degree of abnormality of the judgment target data R54.

[0075] However, the correlation detection unit 23 has detected that "priority" and "bandwidth" are correlated with each other. Specifically, according to the normal data shown in Fig. 3, when "priority: high", the "bandwidth: 10 MHz" must be set, and when "priority: medium", the "bandwidth: 5 MHz" must be set.

[0076] In contrast, in the data to be judged R54, "Bandwidth: 5 MHz" is set for "Priority: High". In this case, at least one of "Priority: High" and "Bandwidth: 5 MHz" is considered to be an incorrect setting. Therefore, in the embodiment of the present invention, the normal data and the data to be judged are compared with respect to a combination variable, which is a combination of categorical variables having correlation with each other. Then, when the combination of the set values ​​of the combination variables does not match the normal data, a value representing the importance of the combination variable is added to the degree of abnormality calculated considering only the categorical variables. In this embodiment, the importance of the combination variable "priority_bandwidth" is 1 / 2, so the degree of abnormality of the data to be judged R54 is 0.75. As a result, the judgment result of the data to be judged R54 is "abnormal".

[0077] In this way, cases where the combination of the set values ​​of the categorical variables is inappropriate may not be detected by simply checking the set values ​​of each categorical variable individually. In contrast, according to an embodiment of the present invention, the correlation between the categorical variables is utilized to compare normal data with the data to be judged, so that cases where the combination of the set values ​​of the categorical variables is inappropriate can be detected. This makes it possible to accurately detect erroneous settings of the categorical variables and accurately judge whether the data to be judged is normal or abnormal.

[0078] <Variations> In the above-mentioned embodiment, both the categorical variables constituting the data to be judged and the combined variables representing the combination of the categorical variables are used to detect erroneous settings in the data to be judged, but the embodiment of the present invention is not limited to this configuration. For example, only the combined variables may be used to detect erroneous settings in the data to be judged. However, in this case, the judgment accuracy may decrease. For example, in the embodiment shown in FIG. 12, there is a risk that an abnormality in the data to be judged R53 cannot be detected. Therefore, in order to increase the accuracy of detecting erroneous settings (or the accuracy of judging whether the data to be judged is normal or abnormal), it is preferable to use both the categorical variables and the combined variables.

[0079] In the above embodiment, normal data is used as reference data used to detect misconfigurations in the data to be judged, but the embodiment of the present invention is not limited to this configuration. For example, a predicted misconfiguration pattern may be created and used as the reference data. In this case, it may be determined whether one or more variables (categorical variables and combined variables) in the data to be judged match the misconfiguration pattern.

[0080] <Hardware configuration> 13 shows an example of a hardware configuration of the anomaly detection device 1. The anomaly detection device 1 is realized by a computer 100 including a processor 101, a memory 102, a storage device 103, an input / output device 104, a recording medium reader 105, and a communication interface 106.

[0081] The processor 101 controls the operation of the anomaly detection device 1 by executing an anomaly detection program stored in the storage device 103. Here, the anomaly detection program includes a program code describing the procedures of the flowcharts shown in Figs. 8 to 11. Therefore, by the processor 101 executing this anomaly detection program, the functions of the categorical variable processing unit 20 (variable importance determination unit 21, important variable extraction unit 22, correlation detection unit 23, variable combination unit 24, and combination variable importance determination unit 25) and the judgment unit 30 (anomaly degree calculation unit 31, normal / abnormal judgment unit 32, and erroneous variable identification unit 33) shown in Fig. 1 are provided. The memory 102 is used as a working area for the processor 101. The storage device 103 stores the anomaly detection program and other programs described above. The storage device 103 is also used as the storage unit 10 shown in Fig. 1.

[0082] The input / output device 104 includes input devices such as a keyboard, a mouse, a touch panel, and a microphone. The input / output device 104 also includes output devices such as a display device and a speaker. The recording medium reader 105 can acquire data and information recorded in the recording medium 110. The recording medium 110 is a removable recording medium that can be attached to and detached from the computer 100. The recording medium 110 is realized by, for example, a semiconductor memory, a medium that records signals by optical action, or a medium that records signals by magnetic action. The anomaly detection program may be provided to the computer 100 from the recording medium 110. The communication interface 106 provides a function of connecting to a network. When the anomaly detection program is stored in the program server 120, the computer 100 may acquire the server program from the program server 120. [Explanation of symbols]

[0083] 1. Anomaly detection device 10 Storage section 20 Categorical variable processing section 21 Variable Importance Determination Unit 22 Important variable extraction section 23 Correlation detection unit 24 Variable bindings 25. Joint variable importance determination unit 30 Judgment section 31 Abnormality calculation part 32 Normal / abnormal judgment section 33 Misconfigured variable identification section

Claims

1. A storage unit for storing reference data including the same categorical variables as the data to be determined, the categorical variables being included in the reference data; a correlation detection unit that detects a combination of categorical variables that are correlated with each other from among the plurality of categorical variables by using the reference data; a variable combination unit that generates one or more combined variables by combining categorical variables that are correlated with each other and detected by the correlation detection unit; a determination unit that determines whether the target data is normal or abnormal by comparing the reference data with the target data for each of the one or more combined variables; An anomaly detection device comprising:

2. A coupling variable importance determination unit that determines the importance of each of the one or more coupling variables, The determination unit is Identifying a combination variable among the one or more combination variables, in which a combination of set values ​​of the data to be determined does not match a corresponding combination of values ​​of the reference data; Calculating the degree of anomaly of the target data based on the importance of the identified combined variable; A determination is made as to whether the determination target data is normal or abnormal based on the degree of abnormality of the determination target data. The anomaly detection device according to claim 1 .

3. A variable importance determination unit that determines the importance of each of the plurality of categorical variables, The determination unit is identifying a categorical variable among the plurality of categorical variables, the set value of the determination target data not matching the corresponding value of the reference data; Calculating a degree of anomaly of the data to be determined based on the importance of the identified combined variable and the importance of the identified categorical variable; A determination is made as to whether the determination target data is normal or abnormal based on the degree of abnormality of the determination target data. The anomaly detection device according to claim 2 .

4. The reference data is a plurality of normal data that has been confirmed to be free of erroneous settings, The determination unit is Identifying a categorical variable among the plurality of categorical variables, the set value of the judgment target data not matching any of the corresponding values ​​of the normal data; Identifying a combination variable, among the one or more combination variables, in which a combination of set values ​​of the target data does not match any of the corresponding combinations of values ​​of the normal data; Calculating a degree of anomaly of the data to be determined based on the importance of the identified combined variable and the importance of the identified categorical variable; A determination is made as to whether the determination target data is normal or abnormal based on the degree of abnormality of the determination target data.

4. The anomaly detection device according to claim 3.

5. The importance of the categorical variable and the importance of the combined variable are numerical values ​​each having a larger value as the importance increases, The determination unit is Calculating the degree of anomaly of the target data by adding up the importance of the identified combined variable and the importance of the identified categorical variable; When the degree of abnormality of the judgment target data is greater than a predetermined abnormality degree threshold, the judgment target data is judged to be abnormal.

5. The anomaly detection device according to claim 4.

6. A variable importance determination unit that determines the importance of each of the plurality of categorical variables, The correlation detection unit detects a combination of categorical variables that are correlated with each other from among categorical variables whose importance is higher than a predetermined importance threshold. The anomaly detection device according to claim 1 .

7. Detecting a combination of categorical variables that are correlated with each other from among the plurality of categorical variables by using reference data including categorical variables identical to the data to be determined that includes the plurality of categorical variables; generating one or more combined variables by combining categorical variables that are correlated with each other and are detected from among the plurality of categorical variables; determining whether the data to be determined is normal or abnormal by comparing the reference data with the data to be determined for each of the one or more combined variables; The anomaly detection method according to the present invention is characterized in that

Images