Anomaly detection setting device, anomaly detection setting method, and anomaly detection setting program

Abstract

To enable necessary settings concerning abnormality detection to be easily set.SOLUTION: A storage unit stores in advance an association table in which data formats of abnormality detection targets, detection patterns of abnormality detection references, and abnormality detection techniques are associated with each other. A control unit includes: a receiving unit that receives input made by a user; a display control unit that displays a selection screen for a data format and a detection pattern on a display unit; and a registration unit that registers an abnormality detection technique corresponding to a data format and a detection pattern which are input and received via the selection screen, in a setting option table to be used when executing abnormality detection.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an abnormality detection setting device, an abnormality detection setting method, and an abnormality detection setting program. [Background technology]

[0002] In recent years, accounting fraud, such as window dressing and errors, such as "recording fictitious sales" and "inflated orders," has been on the rise. In order to detect these frauds, anomalies that indicate signs of fraud are detected in transaction data such as accounting data and subsidiary ledgers. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6345836 Summary of the Invention [Problem to be solved by the invention]

[0004] There are various anomaly detection methods, and the anomaly detection method to be used or the applicable anomaly detection method differs depending on the transaction data to be detected. For this reason, it is necessary to set an anomaly detection method according to the transaction data to be detected. However, setting an anomaly detection method requires specialized knowledge such as statistical knowledge and machine learning knowledge, and it is difficult for a user without specialized knowledge to set an anomaly detection method. In other words, in the conventional technology, it is difficult for a user to easily perform the necessary settings related to anomaly detection.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to provide an anomaly detection setting device, an anomaly detection setting method, and an anomaly detection setting program that can provide the necessary settings related to anomaly detection in an easily configurable manner. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the abnormality detection setting device according to the present invention is an abnormality detection setting device including a control unit and a storage unit, the storage unit being configured to store an abnormality detection target. Transaction data that is The control unit pre-stores a correspondence table that associates the data format, the detection pattern of the anomaly detection standard, and the anomaly detection method, and the control unit includes a reception unit that receives input from a user, a display control unit that displays a selection screen for the data format and the detection pattern on a display unit, and a registration unit that registers the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table to be used when performing anomaly detection.

[0007] The display control unit of the anomaly detection setting device of the present invention displays on the display unit the selection screen including a selection acceptance field for accepting a selection of whether or not to execute each of a plurality of processes to be executed when an anomaly is detected, and displays on the display unit in stages and sequentially a setting screen for accepting input of values ​​of setting items required when executing the processes depending on whether or not each of the plurality of processes is to be executed, the input of which is accepted via the selection acceptance field, and the registration unit registers the values ​​of the setting items, the input of which is accepted via the setting screen, in an anomaly detection definition table to be used when the anomaly detection is executed.

[0008] The data format in the anomaly detection setting device according to the present invention is either cross-sectional data, which is a data group of different sections corresponding to the same time information, or time-series data, which is a plurality of data groups corresponding to different time information.

[0009] The detection pattern in the anomaly detection setting device of the present invention represents at least one of anomaly detection criteria that considers data above or below a threshold to be abnormal, anomaly detection criteria that considers data outside the average range of other data to be abnormal, and anomaly detection criteria that considers data outside an expected range based on past trends to be abnormal.

[0010] The abnormality detection setting method according to the present invention is an abnormality detection setting method for causing an information processing device having a control unit and a storage unit to execute the abnormality detection setting method, Transaction data that isa correspondence table that associates the data format, the detection pattern of the anomaly detection standard, and the anomaly detection method is stored in advance, and the control unit executes the steps of: accepting input from a user; displaying a selection screen for the data format and the detection pattern on a display unit; and registering the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table to be used when performing anomaly detection.

[0011] The abnormality detection setting program according to the present invention is an abnormality detection setting program to be executed by an information processing device having a control unit and a storage unit, and the storage unit stores an abnormality detection target. Transaction data that is a correspondence table that associates the data format, the detection pattern of the anomaly detection standard, and the anomaly detection method is stored in advance, and the control unit receives input from a user; displays a selection screen for the data format and the detection pattern on a display unit; and registers the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table to be used when performing anomaly detection. Effect of the Invention

[0012] Advantageous Effects of Invention According to the present invention, an effect is achieved in that necessary settings regarding anomaly detection can be provided in an easily configurable manner. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing the configuration of an anomaly detection setting device. [Diagram 2] FIG. 2 is a schematic diagram showing the data structure of the correspondence table. [Diagram 3] FIG. 3 is a schematic diagram showing the data structure of the setting option table. [Figure 4A] FIG. 4A is a schematic diagram showing the data configuration of the abnormal value determination data acquisition definition table. [Figure 4B]FIG. 4B is a schematic diagram showing the data configuration of the stored parameter definition table. [Figure 4C] FIG. 4C is a schematic diagram showing the data configuration of the abnormal value determination data acquisition mapping definition table. [Figure 4D] FIG. 4D is a schematic diagram showing the data configuration of the pre-processing definition table. [Figure 4E] FIG. 4E is a schematic diagram showing a data configuration of the tally condition table. [Figure 4F] FIG. 4F is a schematic diagram showing the data configuration of the change point definition table. [Figure 4G] FIG. 4G is a schematic diagram showing the data configuration of the abnormal value determination definition table. [Figure 4H] FIG. 4H is a schematic diagram showing the data configuration of the extraction condition table. [Figure 4I] FIG. 4I is a schematic diagram showing the data configuration of the abnormality degree rank definition table. [Figure 4J] FIG. 4J is a schematic diagram showing the data structure of the message template table. [Figure 4K] FIG. 4K is a schematic diagram showing the data configuration of the determination result table. [Figure 4L] FIG. 4L is a schematic diagram showing the data configuration of the schedule determination definition table. [Figure 4M] FIG. 4M is a schematic diagram showing the data configuration of the abnormal value determination schedule mapping definition table. [Figure 4N] FIG. 4N is a schematic diagram showing the data configuration of the data condition schedule determination definition table. [Figure 4O] FIG. 4O is a schematic diagram showing the data configuration of the data condition schedule stored parameter definition table. [Figure 4P] FIG. 4P is a schematic diagram showing the data configuration of the data condition schedule mapping definition table. [Diagram 5] FIG. 5 is a flowchart for explaining the overall process flow by the anomaly detection setting device. [Figure 6]FIG. 6 is a schematic diagram of sample data. [Figure 7A] FIG. 7A is a schematic diagram of the selection screen. [Figure 7B] FIG. 7B is a schematic diagram of the data configuration of the setting option table 106b. [Figure 7C] FIG. 7C is a schematic diagram of the data configuration of abnormal value determination definition table 106j. [Figure 8A] FIG. 8A is a schematic diagram showing the corresponding relationships of the setting screens. [Figure 8B] FIG. 8B is a schematic diagram of a progress bar. [Figure 9A] FIG. 9A is a schematic diagram of a setting screen for data acquisition definition. [Figure 9B] FIG. 9B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 9C] FIG. 9C is a diagram showing the data configuration of the abnormal value determination data acquisition definition table. [Figure 9D] FIG. 9D is a diagram showing the data configuration of the data condition schedule mapping definition table. [Figure 9E] FIG. 9E is a diagram showing the data configuration of the abnormal value determination data acquisition mapping definition table. [Figure 10A] FIG. 10A is a schematic diagram of an abnormal value determination definition setting screen. [Figure 10B] FIG. 10B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 11A] FIG. 11A is a schematic diagram of a message template setting screen. [Figure 11B] FIG. 11B is a diagram showing the data configuration of the message template table. [Figure 12A] FIG. 12A is a schematic diagram of a setting screen for determining result table definition. [Figure 12B] FIG. 12B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 12C] FIG. 12C is a diagram showing the data configuration of the determination result table. [Figure 13A]FIG. 13A is a schematic diagram of a setting screen for schedule determination definition. [Figure 13B] FIG. 13B is a diagram showing the data configuration of the abnormal value determination schedule mapping definition table. [Figure 13C] FIG. 13C is a diagram showing the data configuration of the schedule determination definition table. [Figure 13D] FIG. 13D is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 14A] FIG. 14A is a schematic diagram of the selection screen. [Figure 14B] FIG. 14B is a diagram showing the data configuration of the setting option table. [Figure 14C] FIG. 14C is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 15A] FIG. 15A is a schematic diagram of a setting screen for data acquisition definition. [Figure 15B] FIG. 15B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 15C] FIG. 15C is a diagram showing the data configuration of the abnormal value determination data acquisition definition table. [Figure 15D] FIG. 15D is a diagram showing the data configuration of the stored parameter definition table. [Figure 15E] FIG. 15E is a diagram showing the data configuration of the abnormal value determination data acquisition mapping definition table. [Figure 16A] FIG. 16A is a schematic diagram of a setting screen for defining change points. [Figure 16B] FIG. 16B is a diagram showing the data configuration of the change point definition table. [Figure 17A] FIG. 17A is a schematic diagram of an abnormal value determination definition setting screen. [Figure 17B] FIG. 17B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 18A] FIG. 18A is a schematic diagram of a message template setting screen. [Figure 18B]FIG. 18B is a diagram showing the data configuration of the message template table. [Figure 19A] FIG. 19A is a schematic diagram of a setting screen for determining result table definition. [Figure 19B] FIG. 19B is a diagram showing the data configuration of the abnormal value determination definition table. [Figure 19C] FIG. 19C is a diagram showing the data configuration of the determination result table. [Figure 20A] FIG. 20A is a schematic diagram of a setting screen for schedule determination definition. [Figure 20B] FIG. 20B is a diagram showing the data configuration of the abnormal value determination schedule mapping definition table. [Figure 20C] FIG. 20C is a diagram showing the data configuration of the schedule determination definition table. [Figure 20D] FIG. 20D is a diagram showing the data configuration of the abnormal value determination definition table. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of an anomaly detection setting device, an anomaly detection setting method, and an anomaly detection setting program according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment.

[0015] [1. Configuration] An example of the configuration of an abnormality detection setting device 100 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the configuration of the abnormality detection setting device 100.

[0016] The anomaly detection setting device 100 of this embodiment is a device that performs settings such as the anomaly detection method to be used during the anomaly detection process, the parameters to be used during the anomaly detection process, and settings according to the process to be executed during anomaly detection, prior to the anomaly detection process that detects fraud or signs of fraud contained in transaction data as anomalies.

[0017] Transaction data is data for which anomalies such as fraud or signs of fraud are to be detected. Examples of transaction data include, but are not limited to, corporate accounting data, subsidiary ledgers, etc. Anomalies that indicate fraud or signs of fraud contained in transaction data include, for example, anomalies that indicate accounting fraud such as window dressing or errors, such as the recording of fictitious sales or inflated orders.

[0018] The module that performs the anomaly detection process performs anomaly detection process to detect anomalies contained in transaction data, using the anomaly detection method, parameter settings, and settings corresponding to the processing to be executed upon anomaly detection, which are registered in the setting option table and the anomaly detection table described below and which are set in the anomaly detection setting device 100.

[0019] The module that performs the anomaly detection process may be mounted in the anomaly detection setting device 100, or may be mounted outside the anomaly detection setting device 100. In the following, the anomaly detection process may be simply referred to as anomaly detection. Furthermore, the detection of an anomaly may be simply referred to as an anomaly judgment or simply as judgment. Furthermore, transaction data may be simply referred to as data.

[0020] The abnormality detection setting device 100 is a commercially available desktop personal computer. The abnormality detection setting device 100 is not limited to a stationary information processing device such as a desktop personal computer, but may be a portable information processing device such as a commercially available notebook personal computer, a PDA (Personal Digital Assistant), a smartphone, or a tablet personal computer.

[0021] The abnormality detection setting device 100 includes a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. The units included in the abnormality detection setting device 100 are communicatively connected via any communication path.

[0022] The communication interface unit 104 communicatively connects the anomaly detection setting device 100 to a network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 300 has a function of connecting the anomaly detection setting device 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network). The various data stored in the storage unit 106 may be stored in the server 200, for example.

[0023] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to realize a pointing device function. In the following, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112. The monitor 114 is an example of a display unit.

[0024] Various databases, tables, files, etc. are stored in the storage unit 106. Computer programs for cooperating with an OS (Operating System) to give instructions to a CPU (Central Processing Unit) to perform various processes are recorded in the storage unit 106. For example, memory devices such as RAM (Random Access Memory) and ROM (Read Only Memory), fixed disk devices such as hard disks, flexible disks, and optical disks can be used as the storage unit 106.

[0025] The storage unit 106 stores, for example, a correspondence table 106a, a setting option table 106b, and an anomaly detection definition table 106c. These tables are, for example, databases in which various data are associated and registered. The data format of these tables is not limited to a database. In this embodiment, the structures of these tables are described in a simplified form. The actual structures of these tables are more complicated, but the parts that are not directly related to the present invention are shown in a simplified form.

[0026] The correspondence table 106a is a table that associates the data format of the anomaly detection target with the detection pattern and the anomaly detection method.

[0027] 2 is a schematic diagram showing an example of the data configuration of the correspondence table 106a. The correspondence table 106a is a table in which data formats, detection patterns, anomaly detection methods, and parameters are associated with each other.

[0028] The data format is the data format of the data that is the target of anomaly detection. A plurality of data formats are selected as the target of anomaly detection. In this embodiment, from the viewpoint of detecting abnormal values ​​and outliers as anomalies that indicate fraud or signs of fraud, the data formats are classified into two types: time series data and cross-sectional data.

[0029] Time series data is a set of multiple data corresponding to different pieces of time information. The time information indicates timing expressed in terms of year, month, day, hour, minute, etc., or a specific period of time.

[0030] The cross-sectional data is a group of data of different sections that correspond to the same time information such as the same time or the same period. A section is a group of elements classified according to a predetermined condition, and may be called a segment.

[0031] For example, assume that the transaction data is data representing population and number of households. In this case, the time-series data is data representing the population transition or the number of households transition for each piece of time information, such as a number of years that are consecutive in a chronological order. The cross-sectional data is data representing the population or number of households corresponding to each piece of time information.

[0032] Also, for example, assume that the transaction data is data representing the sales amounts of multiple departments. In this case, the time-series data is data representing the change in the sales amount for each department for each of multiple consecutive periods or time information such as dates. The cross-sectional data is data representing the sales amount for each department corresponding to each of the time information.

[0033] Therefore, when the data format of the target for anomaly detection is set to cross-sectional data, anomaly detection can be performed during anomaly detection processing, for example, by taking into account information of a certain segment (information on department, person in charge, etc.).

[0034] Furthermore, when the data format of the target for anomaly detection is set to time series data, anomaly detection can be performed taking into account not only the cross-sectional data elements but also time series transitions during the anomaly detection process.

[0035] The detection pattern is a pattern that represents an anomaly detection criterion. The anomaly detection criterion is a criterion that represents what constitutes an anomaly. For example, the detection pattern represents at least one of the following anomaly detection criteria: data that is above or below a threshold is considered to be an anomaly; data that is outside the average range of other data is considered to be an anomaly; and data that is outside the expected range based on past trends is considered to be an anomaly.

[0036] In this embodiment, text information and image information representing detection patterns that are detected by setting a threshold value are registered in advance in the correspondence table 106a as detection patterns that represent anomaly detection standards that determine that data that is above or below a threshold value is abnormal.

[0037] In addition, in this embodiment, as detection patterns representing anomaly detection criteria that consider anything outside the average range of other data to be abnormal, character information and image information representing each of the detection patterns of detecting values ​​higher than the normal value, which is the average range, as outliers, detecting values ​​lower than the normal value as outliers, and detecting values ​​higher or lower than the normal value as outliers are registered in advance in correspondence table 106a.

[0038] In addition, in this embodiment, text information and image information that represent a detection pattern that takes into account past trends and is detected as a detection pattern that represents an abnormality detection standard that considers anything outside of an expected range based on past trends to be abnormal is registered in advance in correspondence table 106a.

[0039] By setting one of these detection patterns, it is possible to set, for example, what trends not seen in other data or past trends are to be detected as anomalies during the anomaly detection process.

[0040] The anomaly detection method is a detection method or a calculation method used during an anomaly detection process. The detection method or the calculation method used during an anomaly detection process differs depending on the data format and the detection pattern. The correspondence table 106a registers anomaly detection methods corresponding to the data format and the detection pattern in advance.

[0041] Examples of anomaly detection techniques include, but are not limited to, rule-based, mean standard deviation, outlier range, and the like.

[0042] Depending on the type of anomaly detection method, it may be necessary to set parameters. The correspondence table 106a registers in advance parameters corresponding to the anomaly detection methods.

[0043] Returning to Fig. 1, the explanation will be continued. The setting option table 106b is a table for managing information on Q&A for accepting selection of whether or not to execute each of a data format, a detection pattern, and a plurality of processes to be executed when an abnormality is detected, selected and input by the user. The setting option table 106b is updated by the control unit 102, which will be described later, in response to the input by the user.

[0044] 3 is a schematic diagram showing an example of the data configuration of the setting option table 106b. The setting option table 106b stores the setting values ​​or values ​​input or selected by the user for each of the definition ID, the data format, the detection pattern, and the Q&A information in association with each other.

[0045] The definition ID is identification information that uniquely defines the definition of the anomaly detection judgment. The setting value of the data format in the setting option table 106b is registered with a value corresponding to the data format selected by the user. For example, the setting option table 106b stores a value of "0" when time series data is selected, and stores a value of "1" when cross-sectional data is selected.

[0046] A value corresponding to the detection pattern selected by the user is registered as the setting value of the detection pattern in the setting option table 106b. For example, the setting option table 106b stores the value "0" when "detection by setting a threshold" is selected, the value "1" when "detection of high values ​​as outliers" is selected, the value "2" when "detection of low values ​​as outliers" is selected, the value "3" when "detection of high or low values ​​as outliers" is selected, and the value "4" when "detection taking into account past trends" is selected.

[0047] The Q&A information for accepting the selection of whether or not to execute each of a plurality of processes to be executed when an anomaly is detected includes information representing questions such as, for example, "Do you want to set algorithms and parameters?", "Do you want to create a new data acquisition definition?", "Do you want to create a new schedule determination definition?", "Do you want to perform preprocessing on the data to be determined?", "Do you want to perform aggregation on the data to be determined?", "Do you want to detect change points in the data to be determined?", "Do you want to set extraction conditions?", and "Do you want to set anomaly ranks?". Values ​​selected by the user are set in these fields as answers to the questions.

[0048] Returning to Fig. 1, the explanation will be continued. The anomaly detection definition table 106c is a table for managing the values ​​of setting items that are required when executing each of a plurality of processes executed during anomaly detection processing, selected and input by the user. The setting values ​​and values ​​corresponding to the fields, which are the items included in the anomaly detection definition table 106c, are updated by the control unit 102, which will be described later, in response to input by the user.

[0049] In this embodiment, the anomaly detection definition table 106c includes a plurality of tables corresponding to each of a plurality of processes executed during the anomaly detection process. For example, the anomaly detection definition table 106c includes an abnormal value determination data acquisition definition table 106d, a stored parameter definition table 106e, an abnormal value determination data acquisition mapping definition table 106f, a preprocessing definition table 106g, an aggregation condition table 106h, a change point definition table 106i, an abnormal value determination definition table 106j, an extraction condition table 106k, an anomaly degree rank definition table 106l, a message template table 106m, a determination result table 106n, a schedule determination definition table 106o, an abnormal value determination schedule mapping definition table 106p, a data condition schedule determination definition table 106q, a data condition schedule stored parameter definition table 106r, and a data condition schedule mapping definition table 106s.

[0050] 4A is a schematic diagram showing an example of the data configuration of abnormal value determination data acquisition definition table 106d. Abnormal value determination data acquisition definition table 106d is a table for managing data used to determine anomalies. Setting values ​​and values ​​corresponding to fields, which are items included in abnormal value determination data acquisition definition table 106d, are updated by control unit 102, which will be described later, in response to input by the user.

[0051] The abnormal value determination data acquisition definition table 106d is a table that associates a data acquisition definition ID, a data acquisition definition name, a display order, a stored name, a stored display name, and a description. The data acquisition definition ID is identification information that uniquely defines the transaction data to be used for anomaly detection. The data acquisition definition name is the definition name of the data acquisition. The display order is the display order on the list screen. The stored name is the name of a stored procedure for acquiring data from transaction data. In the following description, the stored procedure may be referred to as "stored." The stored display name is the display name of the stored. The description is a description of the data acquisition definition.

[0052] 4B is a schematic diagram showing an example of the data configuration of the stored parameter definition table 106e. The stored parameter definition table 106e is a table for managing stored parameters. The setting values ​​and values ​​corresponding to the fields, which are the items included in the stored parameter definition table 106e, are updated by the control unit 102, which will be described later, in response to input by the user.

[0053] The stored parameter definition table 106e is a table in which a data acquisition definition ID, a serial number, a parameter name, a parameter type, and a value are associated with each other. The data acquisition definition ID is data acquisition identification information that uniquely determines the data to be used. The serial number is the serial number of the parameter. The parameter name is the name of the parameter. The parameter type is, for example, a fixed value, a current time, a table-valued function, and the like. When the parameter type "fixed value" is selected, a value "0" is registered, when the parameter type "current time" is set, a value "1" is registered, and when the parameter type "table-valued function" is set, a value "2" is registered. The value changes depending on the parameter type. For example, when the parameter type "fixed value" is selected, a fixed value is registered as the value, when the parameter type "current time" is selected, NULL is registered as the value, and when the parameter type "table-valued function" is selected, a table function name is registered as the value.

[0054] 4C is a schematic diagram showing an example of the data configuration of abnormal value determination data acquisition mapping definition table 106f. Abnormal value determination data acquisition mapping definition table 106f is a table for managing item information of data used for abnormality determination. Setting values ​​and values ​​corresponding to fields, which are each item included in abnormal value determination data acquisition mapping definition table 106f, are updated by control unit 102, which will be described later, in response to an input by the user.

[0055] Abnormal value determination data acquisition mapping definition table 106f is a table that associates data acquisition definition IDs, item numbers, item names, item display names, and types.

[0056] 4D is a schematic diagram showing an example of the data configuration of the preprocessing definition table 106g. The preprocessing definition table 106g is a table for managing preprocessing of data. The setting values ​​and values ​​corresponding to the fields, which are the items included in the preprocessing definition table 106g, are updated by the control unit 102, which will be described later, in response to input by the user.

[0057] The preprocessing definition table 106g is a table that associates a definition ID, an execution order, and a definition. The definition ID is identification information that uniquely determines the definition of anomaly determination. The execution order is the order of execution. The definition is JSON of the preprocessing content.

[0058] 4E is a schematic diagram showing an example of the data configuration of the tally condition table 106h. The tally condition table 106h is a table for managing tally information for data. The setting values ​​and values ​​corresponding to the fields, which are the items included in the tally condition table 106h, are updated by the control unit 102, which will be described later, in response to input by the user.

[0059] The tally condition table 106h is a table that associates definition IDs, tally key item 1, tally item 1, tally key item 2, tally item 2, combined key items, and tally methods. The definition IDs are the same as above. Tally key item 1 is a key item for tallying, and is a field for setting a tally key item that corresponds to the denominator when calculating percentages. Tally item 1 is a tally item, and is a field for setting a tally item that corresponds to the denominator when calculating percentages. Tally key item 2 is a field for setting a tally key item that corresponds to the numerator when calculating percentages. Tally item 2 is a field for setting a tally item that corresponds to the numerator when calculating percentages. The combined key item is a field for determining a key item that combines the tally results of the numerator and denominator when calculating percentages. The tally method is a field for setting the tally method.

[0060] 4F is a schematic diagram showing an example of the data configuration of the change point definition table 106i. The change point definition table 106i is a table for managing the setting contents for detecting change points. The setting values ​​and values ​​corresponding to the fields, which are the items included in the change point definition table 106i, are updated by the control unit 102, which will be described later, in response to input by the user.

[0061] The change point definition table 106i is a table that associates a definition ID, a time series item, a key item, a detection item, a comparison target type, a number, a change degree calculation type, a change point detection type, an upper limit, and a lower limit.

[0062] The definition ID is the same as above. The time series item is the time series item name. The key item is the key item that separates the series when there are multiple series. The detection item is the item to be detected. In the comparison type field, "0" is registered if the comparison type is past results, and "1" is registered if the comparison type is moving average. The setting in the quantity field changes depending on the comparison type. If the comparison type is past results, the quantity field registers the number of results from how far back in time to compare with. If the comparison type is moving average, the quantity field registers the number of results from how far back to take the moving average.

[0063] In the change rate calculation type field, how the change rate between the actual result and the comparison target is calculated is set. When using the difference between the actual result and the comparison target, "Difference" is registered, when using the ratio of the actual result and the comparison target, "Ratio" is registered, and when using the rate of change of the actual result and the comparison target, "Rate of change" is registered.

[0064] The change point detection type field sets how to detect the change degree. If a threshold is set and detection is performed, "threshold" is registered, if detection is performed based on the average standard deviation, "average standard deviation" is registered, and if detection is performed based on the interquartile range, "interquartile range" is registered.

[0065] In the upper limit field, an upper limit of the degree of change is registered if the change-point detection type is a threshold value, and in the lower limit field, a lower limit of the degree of change is registered if the change-point detection type is a threshold value.

[0066] 4G is a schematic diagram showing an example of the data configuration of abnormal value determination definition table 106j. Abnormal value determination definition table 106j is a table for managing settings of anomaly determination methods and update contents. Settings and values ​​corresponding to fields, which are items included in abnormal value determination definition table 106j, are updated by control unit 102, which will be described later, in response to user input.

[0067] The abnormal value determination definition table 106j is a table that associates a definition ID, a definition name, a display order, a comment, an algorithm, a definition, a data acquisition definition ID, a determination result update table name, a sorting column at the time of update, a sorting order, an update start number, a number of updates, a layout CD, and a status.

[0068] The definition ID, display order, and data acquisition definition ID are the same as above. The definition name is the name of the definition. The comment is a comment that describes the definition details. The definition is the JSON of the definition required for the algorithm. The judgment result update table name is the name of the table that updates the abnormal judgment results. The sort column at update indicates which column is used for sorting at update. For the sort order, "Asc" is set for ascending order, and "Desc" is set for descending order. The update start number indicates which element is updated at update. The update count indicates how many elements are updated at update. The layout CD is a CD that uniquely represents the layout of the message area. The status indicates the creation status of the definition, and "0" is registered if there is no definition, "1" is registered if it is being created, and "2" is registered if creation is complete.

[0069] 4H is a schematic diagram showing an example of the data configuration of the extraction condition table 106k. The extraction condition table 106k is a table for managing information when a threshold is set for determining an abnormality, or when a result is to be extracted after determining an abnormality. The setting values ​​and values ​​corresponding to the fields, which are the items included in the extraction condition table 106k, are updated by the control unit 102, which will be described later, in response to an input by the user.

[0070] The extraction condition table 106k is a table that associates definition IDs, position numbers, conjunctions, leading parentheses, extracted column names, operators, thresholds, type names, comparison example names, and trailing parentheses. The definition IDs are the same as above. The position number specifies the number of the extraction condition in the same definition ID, and is expressed as a consecutive number with an initial value of 0. The conjunctions are a field for specifying AND or OR when there are multiple extraction conditions. The extracted column name is a field for specifying the extracted column name. The operator is a field for setting equality or inequality. The threshold is a field for setting the threshold for the extracted column. The type name is a field for setting the data type, and the comparison column name is a field that is set when comparing the extracted column with an item.

[0071] 4I is a schematic diagram showing an example of the data configuration of the abnormality degree rank definition table 106l. The abnormality degree rank definition table 106l is a table for managing the number of ranks of data determined to be abnormal. The setting values ​​and values ​​corresponding to the fields, which are the items, included in the abnormality degree rank definition table 106l are updated by the control unit 102, which will be described later, in response to an input by the user.

[0072] The abnormality rank definition table 106l is a table in which definition IDs are associated with the number of abnormality ranks. The definition IDs are the same as above. The number of abnormality ranks is the number of divisions into which abnormal data is divided.

[0073] 4J is a schematic diagram showing an example of the data configuration of the message template table 106m. The message template table 106m is a table for managing templates of reason messages for abnormality determination results. The setting values ​​and values ​​corresponding to the fields, which are the items included in the message template table 106m, are updated by the control unit 102, which will be described later, in response to input by the user.

[0074] The message template table 106m is a table that associates definition IDs, message categories, areas CDs, and template values. The definition IDs are the same as above. The message category indicates the category of the message. In the message category field, "1" is set if the message exceeds the upper limit, and "2" is set if the message falls below the lower limit. The area CD is the CD of the area in which the message is displayed. The template value is the template of the message.

[0075] 4K is a schematic diagram showing an example of the data configuration of the judgment result table 106n. The judgment result table 106n is a table for managing item information of a table that stores judgment results. The setting values ​​and values ​​corresponding to the fields, which are the items included in the judgment result table 106n, are updated by the control unit 102, which will be described later, in response to input by the user.

[0076] The judgment result table 106n is a table that associates a definition ID, an item number, an item name, an item display name, a type, and a mandatory flag. The definition ID is the same as above. The item number is the item number of the table that stores the judgment result. The item name is the item name of the item number, and the item display name is the display name of the item name. The type is the type of the corresponding item, and the mandatory flag is a flag that indicates whether the corresponding item is mandatory or not.

[0077] 4L is a schematic diagram showing an example of the data configuration of the schedule determination definition table 106o. The schedule determination definition table 106o is a table for managing schedules for determining anomalies. The setting values ​​and values ​​corresponding to the fields, which are the items included in the anomaly detection definition table 106c, are updated by the control unit 102, which will be described later, in response to input by the user.

[0078] The schedule determination definition table 106o is a table that associates a schedule definition ID, a schedule definition name, a start date of use, an end date of use, an execution condition type, a display order, and a deletion flag. The schedule definition ID is identification information that uniquely defines a schedule definition. The schedule definition name is the schedule definition name. The start date of use indicates the start date of use of the schedule definition, and the end date of use indicates the end date of use of the schedule definition. For the execution condition type, "0" is registered if the standard settings are followed, and "1" is registered if the data condition specifications are followed. The display order indicates the display order on the list screen. The deletion flag indicates whether the schedule determination definition has been deleted or not.

[0079] 4M is a schematic diagram showing an example of the data configuration of abnormal value determination schedule mapping definition table 106p. Abnormal value determination schedule mapping definition table 106p is a table for linking anomaly determination schedules with abnormal value determination definitions. Setting values ​​and values ​​corresponding to fields, which are items included in abnormal value determination schedule mapping definition table 106p, are updated by control unit 102, which will be described later, in response to user input.

[0080] The abnormal value determination schedule mapping definition table 106p is a table that associates a schedule definition ID with a definition ID. The schedule definition ID is the same as above. The definition ID is also the same as above, and is identification information that uniquely determines the definition of the determination.

[0081] 4N is a schematic diagram showing an example of the data configuration of the data condition schedule determination definition table 106q. The data condition schedule determination definition table 106q is a table for managing schedules based on data conditions. The setting values ​​and values ​​corresponding to the fields, which are the items included in the data condition schedule determination definition table 106q, are updated by the control unit 102, which will be described later, in response to input by the user.

[0082] The data condition schedule determination definition table 106q is a table that associates a data condition definition ID, a data condition definition name, a stored name, an expected number of rows, and an operator type. The data condition definition ID is identification information that uniquely defines a data condition definition. The data condition definition name is the name of a data condition definition. The stored name is the name of a stored procedure for acquiring data from transaction data. The expected number of rows is the expected number of rows in a table acquired by a stored procedure identified by the corresponding stored name. The operator type is a field for specifying a comparison operator with a record number. The operator type is set to "0" if the value is invalid, "1" if the value is "=", "2" if the value is "!=", "3" if the value is "<", "4" if the value is "≦", "5" if the value is ">", and "6" if the value is "≧".

[0083] 4O is a schematic diagram showing an example of the data configuration of the data condition schedule stored parameter definition table 106r. The data condition schedule stored parameter definition table 106r is a table for managing stored parameters used for data conditions. The setting values ​​and values ​​corresponding to the fields, which are the items included in the data condition schedule stored parameter definition table 106r, are updated by the control unit 102, which will be described later, in response to input by the user.

[0084] The data condition schedule stored parameter definition table 106r is a table that associates a data condition definition ID, a sequence number, a parameter type, a parameter type, and a value. The data condition definition ID is the same as above. The sequence number is the sequence number of the parameter. The parameter type is the type of the parameter. In the parameter type, "0" is registered if the parameter type is a fixed value, "1" is registered if the parameter type is the current time, and "2" is registered if the parameter type is a table-valued function. The setting content of the value changes depending on the corresponding parameter type. In the parameter type, a fixed value is registered if the parameter type is a fixed value, NULL is registered if the parameter type is the current time, and the table-valued function name is registered if the parameter type is a table-valued function.

[0085] 4P is a schematic diagram showing an example of the data configuration of the data condition schedule mapping definition table 106s. The data condition schedule mapping definition table 106s is a table for linking a schedule for determining anomalies with a data condition. The setting values ​​and values ​​corresponding to the fields, which are the items included in the data condition schedule mapping definition table 106s, are updated by the control unit 102, which will be described later, in response to an input by the user.

[0086] The data condition schedule mapping definition table 106s is a table in which the schedule definition ID and the data condition definition ID are associated with each other. The schedule definition ID and the data condition definition ID are the same as those described above.

[0087] Returning to Figure 1, we will continue with the explanation.

[0088] The control unit 102 is a CPU or the like that performs overall control of the abnormality detection setting device 100. The control unit 102 has an internal memory for storing control programs such as an OS (operating system), programs that define various processing procedures, and required data, and executes various information processing based on these stored programs.

[0089] In this embodiment, the control unit 102 includes a reception unit 102a, a display control unit 102b, and a registration unit 102c.

[0090] The receiving unit 102a receives an input from a user. In detail, the receiving unit 102a receives a selection or input operation performed by the user operating the input device 112.

[0091] The display control unit 102b displays on the output device 114 a selection screen for selecting a data format and a detection pattern.

[0092] The registration unit 102c registers the anomaly detection method corresponding to the data format and detection pattern input via the selection screen in the setting option table 106b used when performing anomaly detection.

[0093] Furthermore, the display control unit 102b displays a selection screen including a selection receiving field for receiving a selection of whether or not to execute each of a plurality of processes to be executed when an abnormality is detected on the output device 114. Then, depending on whether or not to execute each of a plurality of processes for which input is received via the selection receiving field, the display control unit 102b sequentially displays setting screens for receiving input of values ​​of setting items required for executing the processes in a step-by-step manner on the output device 114. That is, the display control unit 102b sequentially displays the setting screens on the output device 114 in a wizard format.

[0094] The registration unit 102c registers the values ​​of the setting items input via the setting screen in the anomaly detection definition table 106c used when performing anomaly detection.

[0095] Therefore, the user can easily set the anomaly detection method required for anomaly detection processing and the setting values ​​required for various processing by selecting and inputting the data format, detection pattern, and setting item values ​​via the selection screen and the setting screen. In other words, even a user who does not have specialized knowledge about anomaly detection can easily set the anomaly detection method required for anomaly detection processing and the setting values ​​required for various processing. Therefore, the anomaly detection setting device 100 of the present embodiment can provide the necessary settings for anomaly detection in a manner that allows them to be easily set.

[0096] [3. Specific Examples] A specific example of the processing performed by the abnormality detection setting device 100 in this embodiment will be described with reference to FIGS. 5 to 20D.

[0097] FIG. 5 is a flowchart illustrating an example of the overall process flow by the anomaly detection setting device 100 according to the present embodiment.

[0098] Fig. 6 is a schematic diagram showing an example of sample data. For example, the sample data in which the sales discount amount is registered for each accounting year / month, department CD, person in charge CD, and person in charge name is assumed to be used as transaction data for anomaly detection.

[0099] The following description will be given assuming a situation in which the user desires to detect a person in charge who has a high sales discount amount as an anomaly detection process.

[0100] In addition, in this specific example, the anomaly detection setting device 100 will be described assuming a situation in which a user with no specialist knowledge of anomaly detection such as statistics and an expert each operate the device. The user with no specialist knowledge is assumed to, for example, desire anomaly determination for the time being. The expert has specialist knowledge such as statistics and desires to change the parameter settings or set additional settings to perform anomaly determination.

[0101] [Specific examples of operations by users without specialized knowledge] First, a description will be given assuming a situation in which the anomaly detection setting device 100 is operated by a user who does not have specialized knowledge about anomaly detection, such as statistics.

[0102] As shown in Fig. 5, the display control unit 102b displays a selection screen on the output device 114 (step S100). When the reception unit 102a receives an input of a data format (step S102), it displays a detection pattern corresponding to the received data format on the selection screen (step S104). Then, when the reception unit 102a receives an input of a detection pattern (step S106), it receives a selection of whether or not to execute a process (step S108). Then, the registration unit 102c registers the setting values ​​and the like selected by the user in the setting option table 106b (step S110).

[0103] 7A is a schematic diagram showing an example of a selection screen 50. The display control unit 102b displays on the output device 114 the selection screen 50 including a definition information receiving field 50A and a data format input receiving field 50B.

[0104] The user inputs the definition ID, definition name, and display order in the definition information reception field 50A. For example, assume that the definition ID "UriageNebikiKingaku01", the display name "Sales discount amount detection 01", and the display order "1" are input. The user also inputs the data format of the target for anomaly detection by selecting "Time series data" or "Cross-sectional data" in the data format input reception field 50B.

[0105] The display control unit 102b reads the detection pattern corresponding to the accepted data format from the correspondence table 106a (see also FIG. 2). Here, the explanation will be continued assuming a situation where time-series data is selected. In this case, the character information and image representing the detection pattern corresponding to the time-series data in the correspondence table 106a are read and displayed in the detection pattern selection acceptance field 50C of the selection screen 50.

[0106] For this reason, as shown in Fig. 7A, a list of detection patterns corresponding to the data format selected and accepted in the data format input acceptance field 50B is displayed in a selectable manner in the detection pattern selection acceptance field 50C of the selection screen 50. In detail, a list of text information and images representing the detection patterns is displayed in a selectable manner. Since an image representing the detection pattern is displayed in addition to the text information representing the detection pattern, the user can visually understand the detection pattern.

[0107] The user selects a desired detection pattern from among the detection patterns displayed in the detection pattern selection receiving field 50 C. Here, the explanation will be continued assuming a situation in which a detection pattern that detects high values ​​as outliers has been selected.

[0108] Registration unit 102c registers the definition ID, definition name, and display order input via definition information reception field 50A, the data format input via data format input reception field 50B, and the detection pattern input via detection pattern selection reception field 50C in setting option table 106b. Registration unit 102c also registers the definition ID, definition name, and display order input via definition information reception field 50A in abnormal value determination definition table 106j.

[0109] Therefore, as shown in Fig. 7B, the definition ID, data format, and detection pattern setting values ​​input by the user are registered in setting option table 106b, and as shown in Fig. 7C, the definition ID, definition name, and display order are registered in abnormal value determination definition table 106j.

[0110] Returning to Fig. 7A, the description will be continued. The display control unit 102b further displays a process selection receiving field 50D on the selection screen 50. The process selection receiving field 50D is a receiving field for receiving a selection of whether or not to execute each of a plurality of processes to be executed when an abnormality is detected.

[0111] In this embodiment, the display control unit 102b displays, in the processing selection reception column 50D, display items registered in each field of the Q&A information in the setting option table 106b for accepting selection of whether or not to execute each of a plurality of processes to be executed when an abnormality is detected.

[0112] The user selects answers to the questions displayed in the process selection receiving field 50 D. Here, the explanation will be continued assuming a situation in which “No” is selected to all questions.

[0113] The registration unit 102c registers the selection of whether or not to execute each of the multiple processes to be executed when an abnormality is detected, which is received via the process selection receiving field 50D, in the setting option table 106b. Therefore, as shown in Fig. 7B, the setting option table 106b is in a state where the setting value "0" representing "No" is registered for each piece of Q&A information.

[0114] Returning to Fig. 5, the description will continue. The display control unit 102b identifies a setting screen based on the setting option table 106b registered in step S110 (step S112).

[0115] The setting screen is a screen for receiving input of values ​​of setting items required for executing processing to be executed when an abnormality is detected. In this embodiment, a case will be described as an example in which the display control unit 102b can prepare a total of 10 setting screens, including a data acquisition definition, a preprocessing definition, a counting condition, a change point definition, an abnormal value determination definition, an extraction condition, an abnormality rank definition, a message template, a determination result table definition, and a schedule determination definition.

[0116] Among these setting screens, the setting screens for data acquisition definition, abnormal value judgment definition, message template, judgment result table definition, and schedule judgment definition are required screens for setting. On the other hand, the setting screens for preprocessing definition, aggregation conditions, change point definition, extraction conditions, and anomaly rank definition are setting screens that are set by selecting whether or not to execute each of the multiple processes to be executed when an anomaly is detected, i.e., by the selection results of the above Q&A.

[0117] The data acquisition definition is a settings screen for the process of acquiring data to be used for judgment. On the data acquisition definition settings screen, it is necessary to set the acquisition stored and item name. The preprocessing definition is a settings screen for preprocessing the acquired data, such as NULL interpolation and scale conversion. On the preprocessing definition settings screen, it is necessary to set data interpolation if the data to be used contains NULL. The aggregation conditions is a settings screen for tabulating the acquired data, such as taking the sum or average. On the aggregation conditions settings screen, it is necessary to set the aggregation method if judgment is to be made using the data after aggregation.

[0118] The change point definition is a settings screen for processing that analyzes trends in time-series data and detects points of major change. On the change point definition settings screen, if you want to know the degree of change from past data in addition to anomaly detection, you will need to set the period to compare. The outlier determination definition is a settings screen for processing that performs calculations based on a specified anomaly detection method and detects anomalies. On the outlier determination definition settings screen, you will need to set parameters such as the items to be used to determine anomalies and the strictness of detection.

[0119] The extraction conditions are a setting screen for processing that detects abnormal values ​​according to specified rules. On the extraction conditions setting screen, rules must be set when detecting using a threshold or when specifying additional conditions for automatic calculation. The anomaly rank definition is a setting screen for processing that ranks data determined to be anomalous according to the degree of anomaly. On the anomaly rank definition setting screen, the number of ranks can be set, and if not set, the default value will be used.

[0120] The message template is a setting screen for storing messages accompanying abnormality determination results in a database. On the message template setting screen, it is necessary to set a message template according to the anomaly detection method, which is the method for determining anomalies.

[0121] The judgment result table definition is a setting screen for the process of saving the anomaly judgment results in a database. The setting screen for the judgment result table definition requires the setting of the items to be saved and the update period according to the anomaly detection method, which is the method for judging anomalies. The schedule judgment definition is a setting screen for the process of executing anomaly judgment and setting the timing of updates. The setting screen for the schedule judgment definition makes it possible to set the schedule to be executed according to the data conditions.

[0122] The display control unit 102b determines whether to display or hide these setting screens, and the display content to be displayed on these setting screens, depending on the selection of whether or not to execute each of the multiple processes to be executed when an abnormality is detected, i.e., the selection of the answer to the above Q&A information.

[0123] 8A is a schematic diagram showing an example of a correspondence relationship between setting screens corresponding to each Q&A. The display control unit 102b specifies each of the setting screens, "abnormal value determination definition," "data acquisition definition," and "schedule determination definition," as the corresponding setting screen in response to the user's selection for each of "Do you want to set algorithms and parameters?", "Do you want to create a new data acquisition definition?", and "Do you want to create a new schedule determination definition?".

[0124] As described above, the setting screens "Do you want to set algorithms and parameters?", "Do you want to create a new data acquisition definition?", and "Do you want to create a new schedule determination definition?" are indispensable screens. In this case, the display control unit 102b changes the display items included in these setting screens in response to the user's selection.

[0125] 8A, "Do you want to perform preprocessing on the data to be judged?", "Do you want to perform aggregation on the data to be judged?", "Do you want to detect change points in the data to be judged?", "Do you want to set extraction conditions?", and "Do you want to set anomaly ranks?" correspond to the setting screens for "preprocessing definition", "aggregation conditions", "change point definition", "extraction conditions", and "anomaly rank definition", respectively. These setting screens are displayed when execution of the process represented by the corresponding Q&A information is selected.

[0126] Returning to Fig. 5, the description will be continued. The display control unit 102b specifies whether to display or hide these setting screens and the display contents to be displayed on these setting screens according to the selection of the answer to the Q&A information (step S112). The display control unit 102b specifies the display items of the setting screens that are required to be set and the setting screens corresponding to the processing selected by the Q&A information.

[0127] Then, the display control unit 102b creates a progress bar for the specified setting screen (step S114). That is, the display control unit 102b creates a progress bar indicating the progress of the settings on the multiple setting screens that the user needs to set and that were specified in step S112.

[0128] 8B is a schematic diagram of an example of the progress bar 62. The progress bar 62 is a bar-shaped image in which tasks 62A to 62J, such as a data acquisition definition, a preprocessing definition, a counting condition, a change point definition, an abnormal value determination definition, an extraction condition, an anomaly degree rank definition, a message template, a determination result table definition, and a schedule determination definition, are arranged in order.

[0129] As described above, assume that "No" is selected to all questions displayed in the process selection acceptance field 50D. In this case, the display control unit 102b creates a progress bar 62 including the setting tasks of each of the required setting screens, "Data Acquisition Definition," "Abnormal Value Determination Definition," "Message Template," "Determination Result Table Definition," and "Schedule Determination Definition." The display control unit 102b is in a state of identifying these five setting screens.

[0130] Returning to Fig. 5, the description will continue. The display control unit 102b repeats the processes of steps S116 to S120 for each setting screen set in step S112, and then ends this routine.

[0131] That is, assume that "No" is selected to all questions shown in the process selection acceptance field 50D, and the setting screens that are required to be set, "Data Acquisition Definition," "Abnormal Value Determination Definition," "Message Template," "Determination Result Table Definition," and "Schedule Determination Definition," are specified. In this case, the display control unit 102b sequentially displays these setting screens on the output device 114, and each time a setting screen is displayed on the output device 114, it accepts the input of a selection by the user and sequentially registers it in the corresponding anomaly detection definition table 106c.

[0132] That is, the user can sequentially input the values ​​of the setting items required for each of the multiple processes to be executed when an abnormality is detected by inputting the setting values ​​and selecting the selection items according to the guidance of the setting screens displayed in sequence in the wizard format. The input values ​​are then sequentially registered in the abnormality detection definition table 106c.

[0133] For example, as shown in Fig. 9A, the display control unit 102b displays a data acquisition definition setting screen 60A on the output device 114 as a setting screen 60 including the created progress bar 62. As shown in Fig. 9A, in this case, the data acquisition definition task 62A of the progress bar 62 is displayed in an emphasized manner, and the user is informed that the current task is setting the data acquisition definition.

[0134] The user inputs a data acquisition definition ID and a data acquisition definition name via data acquisition definition setting screen 60A. Note that, since "No" is selected in response to the question "Do you want to create a new data acquisition definition?" on selection screen 50, search button 60A1 for selecting an existing data acquisition definition is displayed. When the user operates search button 60A1, any of the data acquisition definition IDs registered in abnormal value determination data acquisition definition table 106d registered in storage unit 106 is displayed in a selectable manner.

[0135] For example, assume that "UriageNebikiKingakuSelect" is selected as the data acquisition definition ID. In this case, display control unit 102b registers "UriageNebikiKingakuSelect" as the setting value of the data acquisition definition ID in abnormal value determination definition table 106j, as shown in Fig. 9B. Furthermore, with this setting, as shown in Figs. 9C to 9E, information corresponding to the existing data acquisition definition ID "UriageNebikiKingakuSelect" registered in abnormal value determination data acquisition definition table 106d, stored parameter definition table 106e, and abnormal value determination data acquisition mapping definition table 106f is defined as data acquisition definition information for definition ID "UriageNebikiKingaku01".

[0136] Next, as shown in FIG. 10A, display control unit 102b displays on output device 114 abnormal value determination definition setting screen 60E including progress bar 62 highlighting abnormal value determination definition task 62E, which is the next task.

[0137] The user inputs a comment, an algorithm, a judgment item, and a key item via abnormal value judgment definition setting screen 60E. Note that "No" is selected in response to the question "Do you want to set an algorithm and parameters?" on selection screen 50. Therefore, display control unit 102b automatically determines an algorithm and displays it on abnormal value judgment definition setting screen 60E. Furthermore, registration unit 102c sets default values ​​as parameters. Furthermore, display control unit 102b displays judgment items selectable from the items of abnormal value judgment data acquisition mapping definition table 106f. The user selects a judgment item.

[0138] Then, registration unit 102c registers each setting value input via abnormal value determination definition setting screen 60E in the corresponding field of abnormal value determination definition table 106j. Therefore, the setting values ​​of the comment, algorithm, and definition in abnormal value determination definition table 106j are updated as shown in FIG. 10B.

[0139] Next, as shown in FIG. 11A, the display control unit 102b displays on the output device 114 a message template setting screen 60H including a progress bar 62 that highlights a message template task 62H, which is the next task.

[0140] The user selects whether to use a standard template, the detection target item name, the judgment item name, the label item, and the unit via message template setting screen 60H, that is, from the items in abnormal value judgment data acquisition mapping definition table 106f.

[0141] The registration unit 102c then registers each setting value input via the message template setting screen 60H in the corresponding field of the message template table 106m. Therefore, as shown in Fig. 11B, the message template table 106m registers the setting values ​​selected by the user, that is, the message category, the area CD, and the template value.

[0142] Next, as shown in FIG. 12A, the display control unit 102b displays on the output device 114 a setting screen 60I for determining result table definition including a progress bar 62 highlighting the next task, that is, a determining result table definition task 62I.

[0143] The user inputs the update table name, the acquired data column name, the abnormal value determination result column name, the storage range setting, and the like via a determination result table definition setting screen 60I.

[0144] Then, the registration unit 102c registers each setting value input via the setting screen 60I of the judgment result table definition in the corresponding fields of the abnormal value judgment definition table 106j and the judgment result table 106n. Therefore, as shown in Fig. 12B, the judgment result update table name, the sorting order at update, the update start number, and the update number, which are the setting values ​​selected by the user, are registered in the abnormal value judgment definition table 106j. Also, as shown in Fig. 12C, the item number, item name, type, and required flag corresponding to the definition ID are registered in the judgment result table 106n.

[0145] Next, as shown in FIG. 13A, the display control unit 102b displays on the output device 114 a setting screen 60J for schedule determination definition including a progress bar 62 highlighting the next task, that is, a schedule determination definition task 62J.

[0146] The user inputs a schedule definition ID, a schedule definition name, a start date, an end date, an execution condition type, and the like via a schedule judgment definition setting screen 60J. Note that, since "No" is selected in response to the question "Do you want to create a new schedule judgment definition?" on the selection screen 50, a search button 60J1 for selecting an existing schedule judgment definition is displayed. When the user operates the search button 60J1, any of the schedule definition IDs registered in the schedule judgment definition table 106o registered in the storage unit 106 is displayed so as to be selectable.

[0147] For example, assume that "UriageNebikiKingakuSelect" is selected as the schedule definition ID. In this case, the display control unit 102b registers the definition ID "UriageNebikiKingaku01" set on the initial data acquisition definition setting screen 60A and the currently selected schedule definition ID "UriageNebikiKingakuSchedule" in the abnormal value determination schedule mapping definition table 106p in association with each other, as shown in FIG. 13B.

[0148] Furthermore, with this setting, the existing schedule determination definition information registered in the schedule determination definition table 106o shown in FIG. 13C is selected as the schedule determination definition information corresponding to the definition ID "UriageNebikiKingaku01".

[0149] Furthermore, since the settings on all of the setting screens have been completed, registration unit 102c updates the status in abnormal value determination definition table 106j to "2," which indicates completion of creation, as shown in FIG. 13D.

[0150] In this way, even when a user who does not have specialized knowledge about anomaly detection such as statistics operates the anomaly detection setting device 100, the user can easily set the anomaly detection method required for anomaly detection processing and the setting values ​​required for various processing by selecting and inputting the data format, detection pattern, and values ​​of the setting items via the selection screen and setting screen.

[0151] [Specific examples of manipulation by experts] Next, a description will be given assuming a situation in which an expert with specialized knowledge about anomaly detection operates the anomaly detection setting device 100.

[0152] As shown in Fig. 5, the display control unit 102b displays a selection screen on the output device 114 (step S100). When the reception unit 102a receives an input of a data format (step S102), it displays a detection pattern corresponding to the received data format on the selection screen (step S104). Then, when the reception unit 102a receives an input of a detection pattern (step S106), it receives a selection of whether or not to execute a process (step S108). Then, the registration unit 102c registers the setting values ​​and the like selected by the user in the setting option table 106b (step S110).

[0153] 14A is a schematic diagram showing an example of a selection screen 50. The display control unit 102b displays on the output device 114 the selection screen 50 including a definition information receiving field 50A and a data format input receiving field 50B.

[0154] A knowledgeable user inputs a definition ID, definition name, and display order in the definition information reception field 50A. For example, assume that the definition ID "UriageNebikiKingaku02", the display name "Sales discount amount detection 02", and the display order "2" are input. The user also inputs the data format of the target for anomaly detection by selecting "Time series data" or "Cross-sectional data" in the data format input reception field 50B.

[0155] The display control unit 102b reads the detection pattern corresponding to the accepted data format from the correspondence table 106a (see also FIG. 2). Here, the explanation will be continued assuming a situation where time-series data is selected. In this case, the character information and image representing the detection pattern corresponding to the time-series data in the correspondence table 106a are read and displayed in the detection pattern selection acceptance field 50C of the selection screen 50.

[0156] 14A, a list of detection patterns corresponding to the data format selected in the data format input receiving field 50B is displayed in a selectable manner in the detection pattern selection receiving field 50C of the selection screen 50. The user selects a desired detection pattern from among the detection patterns displayed in the detection pattern selection receiving field 50C. Here, the explanation will be continued assuming a situation in which a detection pattern that detects high values ​​as outliers has been selected.

[0157] Registration unit 102c registers the definition ID, definition name, and display order input via definition information reception field 50A, the data format input via data format input reception field 50B, and the detection pattern input via detection pattern selection reception field 50C in setting option table 106b. Registration unit 102c also registers the definition ID, definition name, and display order input via definition information reception field 50A in abnormal value determination definition table 106j.

[0158] Therefore, as shown in Fig. 14B, the definition ID, data format, and detection pattern setting values ​​input by the user are registered in setting option table 106b, and as shown in Fig. 14C, the definition ID, definition name, and display order are registered in abnormal value determination definition table 106j.

[0159] Returning to FIG. 14A, the description will be continued. The display control unit 102b further displays a process selection acceptance field 50D on the selection screen 50. The user selects an answer to the question displayed in the process selection acceptance field 50D. Here, the description will be continued assuming a situation in which "Yes" is selected to "Do you want to set algorithms and parameters?" and "Do you want to detect change points in the data to be evaluated?" and "No" is selected to the other questions.

[0160] The registration unit 102c registers the selection of whether or not to execute each of the multiple processes to be executed when an abnormality is detected, which is received as an input via the process selection receiving field 50D, in the setting option table 106b, that is, information representing the answer to the question. Therefore, as shown in Fig. 14B, the setting option table 106b is in a state in which the setting value "1" representing "yes" is registered for "Do you want to set algorithms and parameters?" and "Do you want to create a change point definition?", and the setting value "0" representing "no" is registered for each of the other Q&A information.

[0161] Returning to Fig. 5, the description will continue. The display control unit 102b identifies a setting screen based on the setting option table 106b registered in step S110 (step S112).

[0162] The display control unit 102b determines whether to display or hide these setting screens, and the display content to be displayed on these setting screens, depending on the selection of whether or not to execute each of the multiple processes to be executed when an abnormality is detected, i.e., the selection of the answer to the above Q&A information.

[0163] As described above, the setting screens corresponding to "Do you want to set algorithms and parameters?", "Do you want to create a new data acquisition definition?", and "Do you want to create a new schedule determination definition?" are indispensable screens. The display control unit 102b changes the display items included in these setting screens in response to the user's selection.

[0164] As described above, "Do you want to perform preprocessing on the data to be judged?", "Do you want to perform aggregation on the data to be judged?", "Do you want to detect change points in the data to be judged?", "Do you want to set extraction conditions?", and "Do you want to set anomaly ranks?" correspond to the setting screens for "preprocessing definition", "aggregation conditions", "change point definition", "extraction conditions", and "anomaly rank definition", respectively. These setting screens are displayed when execution of the process represented by the corresponding Q&A information is selected.

[0165] The display control unit 102b specifies whether to display or hide these setting screens and the display contents to be displayed on these setting screens according to the selection of the answer to the Q&A information (step S112). The display control unit 102b specifies the display items of the setting screens that are required to be set and the setting screens corresponding to the processing selected by the Q&A information.

[0166] It is assumed that "Yes" is selected for "Do you want to set algorithms and parameters?" and "Do you want to detect change points in the data to be judged?" In this case, the display control unit 102b specifies the setting screens for each of "Data acquisition definition", "Change point definition", "Abnormal value judgment definition", "Message template", "Judgment result table definition", and "Schedule judgment definition".

[0167] Then, the display control unit 102b creates a progress bar for the identified setting screen (step S114). That is, the display control unit 102b creates a progress bar indicating the progress of the setting of the multiple setting screens that the user needs to set, identified in step S112. Then, the display control unit 102b repeats the processes of steps S116 to S120 for each setting screen set in step S112. Then, this routine ends.

[0168] That is, a scene is assumed in which the setting screens for "data acquisition definition," "change point definition," "abnormal value judgment definition," "message template," "judgment result table definition," and "schedule judgment definition" are specified. In this case, the display control unit 102b sequentially displays these setting screens on the output device 114, and each time a setting screen is displayed on the output device 114, it accepts a selection input by the user and sequentially registers it in the corresponding anomaly detection definition table 106c.

[0169] That is, the user can sequentially input the values ​​of the setting items required for each of the multiple processes to be executed when an abnormality is detected by inputting the setting values ​​and selecting the selection items according to the guidance of the setting screens displayed in sequence in the wizard format. The input values ​​are then sequentially registered in the abnormality detection definition table 106c.

[0170] For example, as shown in Fig. 15A, the display control unit 102b displays a data acquisition definition setting screen 60A on the output device 114 as a setting screen 60 including the created progress bar 62. As shown in Fig. 15A, in this case, the data acquisition definition task 62A of the progress bar 62 is displayed in an emphasized manner, and it is presented to the user that the current task is setting the data acquisition definition.

[0171] The user inputs a data acquisition definition ID and a data acquisition definition name via data acquisition definition setting screen 60A. Note that, since "No" is selected in response to the question "Do you want to create a new data acquisition definition?" on selection screen 50, search button 60A1 for selecting an existing data acquisition definition is displayed. When the user operates search button 60A1, any of the data acquisition definition IDs registered in abnormal value determination data acquisition definition table 106d registered in storage unit 106 is displayed in a selectable manner.

[0172] For example, assume that "UriageNebikiKingakuSelect" is selected as the data acquisition definition ID. In this case, display control unit 102b registers "UriageNebikiKingakuSelect" as the setting value of the data acquisition definition ID in abnormal value determination definition table 106j, as shown in Fig. 15B. Furthermore, with this setting, as shown in Figs. 15C to 15E, information corresponding to the existing data acquisition definition ID "UriageNebikiKingakuSelect" registered in abnormal value determination data acquisition definition table 106d, stored parameter definition table 106e, and abnormal value determination data acquisition mapping definition table 106f is defined as data acquisition definition information for definition ID "UriageNebikiKingaku02".

[0173] Next, as shown in FIG. 16A, the display control unit 102b displays on the output device 114 a setting screen 60D for change point definition including a progress bar 62 highlighting the next task, that is, a change point definition task 62D.

[0174] The user sets the item, the comparison target, and the detection method via change point definition setting screen 60D. The item setting may be displayed so that it can be selected from the items in abnormal value determination data acquisition mapping definition table 106f.

[0175] The registration unit 102c then registers each setting value input via the change point definition setting screen 60D in the corresponding field of the change point definition table 106i. Therefore, as shown in FIG. 16B, the setting value of the corresponding field in the change point definition table 106i is updated.

[0176] Next, as shown in FIG. 17A, display control unit 102b displays on output device 114 abnormal value determination definition setting screen 60E including progress bar 62 highlighting abnormal value determination definition task 62E, which is the next task.

[0177] The user inputs a comment, an algorithm, a judgment item, and a key item via abnormal value determination definition setting screen 60E. Note that "Yes" is selected in response to the question "Do you want to set the algorithm and parameters?" on selection screen 50. Therefore, display control unit 102b displays abnormal value determination definition setting screen 60E, which allows the algorithm and parameters to be changed. The user inputs each setting value via abnormal value determination definition setting screen 60E.

[0178] Then, registration unit 102c registers each setting value input via abnormal value determination definition setting screen 60E in the corresponding field of abnormal value determination definition table 106j. Therefore, the setting values ​​of the comment, algorithm, and definition in abnormal value determination definition table 106j are updated, as shown in FIG.

[0179] Next, as shown in FIG. 18A, the display control unit 102b displays on the output device 114 a message template setting screen 60H including a progress bar 62 that highlights a message template task 62H, which is the next task.

[0180] The user selects the use of standard template, the detection target item name, the judgment item name, the label item, and the unit via message template setting screen 60H. That is, the user selects from the items of abnormal value judgment data acquisition mapping definition table 106f.

[0181] The registration unit 102c then registers each setting value input via the message template setting screen 60H in the corresponding field of the message template table 106m. Therefore, as shown in Fig. 18B, the message template table 106m registers the setting values ​​selected by the user, that is, the message category, the area CD, and the template value.

[0182] 19A, the display control unit 102b displays a determination result table definition setting screen 60I including a progress bar 62 highlighting the next task, a determination result table definition task 62I, on the output device 114. In this case, since a change point definition has been created, items related to the change points can be included in the items of the determination result table 106n.

[0183] The user inputs the update table name, the acquired data column name, the abnormal value determination result column name, the storage range setting, and the like via a determination result table definition setting screen 60I.

[0184] Then, the registration unit 102c registers each setting value input via the setting screen 60I of the judgment result table definition in the corresponding fields of the abnormal value judgment definition table 106j and the judgment result table 106n. Therefore, as shown in Fig. 19B, the judgment result update table name, the sorting order at update, the update start number, and the update number, which are the setting values ​​selected by the user, are registered in the abnormal value judgment definition table 106j. Also, as shown in Fig. 19C, the item number, item name, type, and required flag corresponding to the definition ID are registered in the judgment result table 106n.

[0185] Next, as shown in FIG. 20A, the display control unit 102b displays on the output device 114 a setting screen 60J for schedule determination definition including a progress bar 62 highlighting the next task, that is, a schedule determination definition task 62J.

[0186] The user inputs a schedule definition ID, a schedule definition name, a start date, an end date, an execution condition type, and the like via a schedule judgment definition setting screen 60J. Note that, since "No" is selected in response to the question "Do you want to create a new schedule judgment definition?" on the selection screen 50, a search button 60J1 for selecting an existing schedule judgment definition is displayed. When the user operates the search button 60J1, any of the schedule definition IDs registered in the schedule judgment definition table 106o registered in the storage unit 106 is displayed so as to be selectable.

[0187] For example, assume that "UriageNebikiKingakuSelect" is selected as the schedule definition ID. In this case, the display control unit 102b registers the definition ID "UriageNebikiKingaku02" set on the initial data acquisition definition setting screen 60A and the currently selected schedule definition ID "UriageNebikiKingakuSchedule" in the abnormal value determination schedule mapping definition table 106p in association with each other, as shown in FIG. 20B.

[0188] Furthermore, with this setting, the existing schedule determination definition information registered in the schedule determination definition table 106o shown in FIG. 20C is selected as the schedule determination definition information corresponding to the definition ID "UriageNebikiKingaku02".

[0189] Furthermore, as shown in FIG. 20D, because the settings on all of the setting screens have been completed, registration unit 102c updates the status in abnormal value determination definition table 106j to "2," which indicates completion of creation.

[0190] In this way, even when an expert user with specialized knowledge of anomaly detection such as statistics operates the anomaly detection setting device 100, the user can easily set the anomaly detection method required for anomaly detection processing and the setting values ​​required for various processing by selecting and inputting the data format, detection pattern, and setting item values ​​via the selection screen and setting screen. Also, an expert may wish to set detailed parameters, etc., and settings can be made according to the expert's wishes.

[0191] As described above, the storage unit 106 of the anomaly detection setting device 100 of this embodiment stores the correspondence table 106a in advance. The correspondence table 106a is a table that associates the data format of the anomaly detection target with the detection pattern of the anomaly detection criterion and the anomaly detection method. The reception unit 102a receives input from the user. The display control unit 102b displays a selection screen 50 for the data format and the detection pattern on the output device 114, which is a display unit. The registration unit 102c registers the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen 50 in the setting option table 106b used when performing anomaly detection.

[0192] There are various anomaly detection methods, and the anomaly detection method to be used or the applicable anomaly detection method differs depending on the transaction data to be detected. For this reason, it is necessary to set an anomaly detection method according to the transaction data to be detected. However, setting an anomaly detection method requires specialized knowledge such as statistical knowledge and machine learning knowledge, and it is difficult for a user without specialized knowledge to set an anomaly detection method. In other words, in the conventional technology, it is difficult for a user to easily perform the necessary settings related to anomaly detection.

[0193] On the other hand, in the anomaly detection setting device 100 of this embodiment, the display control unit 102b displays a selection screen 50 for a data format and a detection pattern on the display unit, that is, the output device 114. The registration unit 102c registers the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen 50 in the setting option table 106b used when performing anomaly detection.

[0194] Therefore, even if a user is not familiar with anomaly detection methods, the user can easily set the anomaly detection method by selecting the data format and detection pattern of the data for which anomalies are to be detected via the displayed selection screen 50. In other words, the user does not directly set the anomaly detection method, but rather selects the data format and detection pattern, and the corresponding anomaly detection method is automatically set.

[0195] Therefore, the abnormality detection setting device 100 of the present embodiment can provide necessary settings related to abnormality detection in an easily configurable manner.

[0196] Furthermore, the display control unit 102b of the anomaly detection setting device 100 of this embodiment displays on the output device 114 a selection screen 50 including a selection receiving field 50D for receiving a selection of whether or not to execute each of a plurality of processes to be executed upon anomaly detection. Then, the display control unit 102b sequentially displays a setting screen 60 for receiving input of values ​​of setting items required for the execution of the processes in stages on the output device 114, depending on whether or not to execute each of the plurality of processes for which input is received via the selection receiving field 50D. The registration unit 102c registers the values ​​of the setting items for which input is received via the setting screen 60 in the anomaly detection definition table 106c used when performing anomaly detection.

[0197] Depending on the data used, pre-processing, aggregation, and other processes may be performed before anomaly detection. Also, depending on the anomaly detection method used, parameter settings may be required. However, users often do not know what settings need to be made depending on the process they want to perform when detecting an anomaly or the anomaly detection method they use when detecting an anomaly.

[0198] On the other hand, in the anomaly detection setting device 100 of this embodiment, a process selection acceptance field 50D is prepared, and by the user selecting the process he or she wishes to perform, only the necessary setting screen 60 can be displayed in a wizard format. Therefore, the user can sequentially input setting items according to the setting screen displayed for the process he or she wishes to perform, thereby sequentially inputting setting values ​​required for each process when an anomaly is detected.

[0199] Therefore, in addition to the above-mentioned effects, the anomaly detection setting device 100 of the present embodiment can provide settings that correspond to the processing desired by the user in an easily configurable manner.

[0200] Furthermore, the anomaly detection setting device 100 of this embodiment allows the user to perform necessary settings as necessary.

[0201] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to goals 8 and 9 of the SDGs.

[0202] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0203] Furthermore, this embodiment can contribute to strengthening control and governance, making it possible to contribute to Goal 16 of the SDGs.

[0204] 5. Other embodiments The present invention may be embodied in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0205] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0206] In addition, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings may be changed as desired unless otherwise specified.

[0207] Furthermore, with regard to the abnormality detection setting device 100, each of the components shown in the figures is a functional concept, and does not necessarily have to be physically configured as shown in the figures.

[0208] For example, the processing functions of the anomaly detection setting device 100, particularly the processing functions performed by the control unit 102, may be realized in whole or in part by a CPU and a program interpreted and executed by the CPU, or may be realized as hardware using wired logic. The program is recorded in a non-transient computer-readable recording medium including programmed instructions for causing the information processing device to execute the processes described in this embodiment, and is mechanically read by the anomaly detection setting device 100 as necessary. That is, a computer program for giving instructions to the CPU in cooperation with the OS and performing various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). This computer program is executed by being loaded into a RAM, and constitutes a control unit in cooperation with the CPU.

[0209] In addition, this computer program may be stored in an application program server connected to the anomaly detection setting device 100 via any network, and it is also possible to download all or part of it as necessary.

[0210] In addition, the program for executing the process described in this embodiment may be stored in a non-transient computer-readable recording medium, or may be configured as a program product. Here, the "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) Disc.

[0211] Moreover, a "program" is a data processing method written in any language or description method, and may be in any form, such as source code or binary code. Note that a "program" is not necessarily limited to a single configuration, but also includes a configuration that is distributed as a plurality of modules or libraries, and a program that achieves its function by cooperating with a separate program, such as an OS. Note that the specific configuration and reading procedure for reading a recording medium in each device shown in this embodiment, as well as the installation procedure after reading, may use well-known configurations and procedures.

[0212] The various databases etc. stored in the memory unit 106 are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files etc. used for various processes and providing websites.

[0213] The anomaly detection setting device 100 may be configured as an information processing device such as a known personal computer or workstation, or may be configured as the information processing device to which any peripheral device is connected. The anomaly detection setting device 100 may be realized by installing software (including programs or data, etc.) that causes the device to realize the processing described in this embodiment.

[0214] Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the drawings, and all or part of them can be functionally or physically distributed and integrated in any unit according to various additions or functional loads. In other words, the above-mentioned embodiments can be implemented in any combination, or the embodiments can be implemented selectively. [Explanation of symbols]

[0215] 100 Anomaly detection setting device 102 Control section 106 Storage section 102a Reception 102b Display control unit 102c Registration Department

Claims

1. An abnormality detection setting device including a control unit and a storage unit, The storage unit is A correspondence table is stored in advance in which a data format of transaction data to be subjected to anomaly detection is associated with a detection pattern of the anomaly detection standard and an anomaly detection method; The control unit is A reception unit that receives an input from a user; a display control unit that displays a selection screen for the data format and the detection pattern on a display unit; a registration unit that registers the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table used when performing anomaly detection; An abnormality detection setting device comprising:

2. The display control unit is displaying, on the display unit, the selection screen including a selection acceptance field for accepting a selection of whether or not to execute each of a plurality of processes to be executed when an abnormality is detected; displaying, in a step-by-step order, on the display unit, setting screens for receiving input of values ​​of setting items required for executing the processes, depending on whether or not each of the processes, whose input has been received via the selection receiving field, is executed; The registration unit is registering the value of the setting item inputted via the setting screen in an anomaly detection definition table used when performing the anomaly detection; The anomaly detection setting device according to claim 1 .

3. The data format is: Cross-sectional data is a group of data of different sections corresponding to the same time information, or time-series data is a group of data corresponding to different time information.

3. The abnormality detection setting device according to claim 1 or 2.

4. The detection pattern is Represents at least one of anomaly detection criteria that consider data above or below a threshold to be abnormal, anomaly detection criteria that consider data outside the average range of other data to be abnormal, and anomaly detection criteria that consider data outside an expected range based on past trends to be abnormal. The abnormality detection setting device according to any one of claims 1 to 3.

5. An anomaly detection setting method for causing an information processing device having a control unit and a storage unit to execute the anomaly detection setting method, The storage unit includes: A correspondence table is stored in advance, in which a data format of transaction data that is an anomaly detection target is associated with a detection pattern of an anomaly detection standard and an anomaly detection method; Executed by the control unit, accepting input from a user; displaying a selection screen for the data format and the detection pattern on a display unit; registering the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table used when performing anomaly detection; An anomaly detection setting method comprising:

6. An abnormality detection setting program to be executed by an information processing device having a control unit and a storage unit, The storage unit includes: A correspondence table is stored in advance, in which a data format of transaction data that is an anomaly detection target is associated with a detection pattern of an anomaly detection standard and an anomaly detection method; In the control unit, accepting input from a user; displaying a selection screen for the data format and the detection pattern on a display unit; registering the anomaly detection method corresponding to the data format and the detection pattern inputted via the selection screen in a setting option table used when performing anomaly detection; An anomaly detection setting program for executing the above.

Images