Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

To improve the immediacy of an abnormality detection after an event occurs.SOLUTION: An abnormality detecting device includes: a processor that executes a program; and a storage device that stores the program. The processor executes: a correcting process of correcting, by scale conversion, second prediction data at a time point after a certain event occurs in time-series first prediction data on an object subjected to monitoring; and a detecting process of detecting an abnormality in the object subjected to monitoring on the basis of the corrected second prediction data by the correcting process, and of second actual measurement data at a time point after the certain event occurs in time-series first actual measurement data on the object subjected to monitoring.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program for detecting an abnormality. [Background technology]

[0002] Anomaly detection in IT (Information Technology) systems is used to identify the unusual behavior of IT systems so that an appropriate plan of action can be designed and implemented for smooth and efficient operation of the IT system.

[0003] However, anomaly detection will not be possible immediately after events such as configuration changes due to adding or removing disk or RAM capacity, unplanned deletion of large numbers of log files, or transfer of large numbers of log files to backup storage, as these events will cause rapid concept drift. These events are expected to occur more frequently with the adoption of container-based microservices architectures. Therefore, it is important to enable anomaly detection immediately after these events.

[0004] US Patent Publication No. 2009 / 0133993 discloses an apparatus, system, method, and computer program product for drift detection and correction for predictive analytics. In the apparatus, a prediction module applies a model to workload data to generate one or more predicted outcomes. The workload data includes one or more records. The model includes one or more learned functions based on the training data. A drift detection module detects a drift phenomenon associated with the one or more predicted outcomes. A prediction time correction module corrects at least one predicted outcome in response to the drift phenomenon. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] US Patent Application Publication No. 2004 / 0148047 Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the above-mentioned Patent Document 1, when a drift phenomenon is detected, the prediction time correction module corrects at least one prediction result in response to the drift phenomenon, but it is necessary to re-learn the function using the actual measurement data after the detection as training data. Therefore, it takes time from the occurrence of the above-mentioned event to the completion of re-learning, during which abnormality detection cannot be performed or erroneous detection occurs because abnormality detection must be performed in the state before re-learning.

[0007] An object of the present invention is to improve the immediacy of anomaly detection after an event occurs. [Means for solving the problem]

[0008] An abnormality detection device according to one aspect of the invention disclosed in the present application is an abnormality detection device having a processor that executes a program and a storage device that stores the program, wherein the processor executes a correction process that corrects, by scale conversion, second predicted data from first predicted data of a time series of a monitored object after a point in time at which a specific event occurs, and a detection process that detects an abnormality in the monitored object based on the second predicted data corrected by the correction process and second actual measured data from the first actual measured data of the monitored object after a point in time at which the specific event occurs. Effect of the Invention

[0009] According to the representative embodiment of the present invention, it is possible to improve the immediacy of anomaly detection after an event occurs. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiment. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is an explanatory diagram showing an example of an abnormality detection by an abnormality detection device. [Diagram 2] FIG. 2 is an explanatory diagram illustrating an example of a system configuration of the anomaly detection system. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a hardware configuration of the abnormality detection device. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the disk usage rate table. [Diagram 5] FIG. 5 is an explanatory diagram illustrating an example of the prediction result table. [Figure 6] FIG. 6 is an explanatory diagram illustrating an example of the corrected prediction result table. [Figure 7] FIG. 7 is a flowchart illustrating an example of an abnormality detection process procedure performed by the abnormality detection device. [Figure 8] FIG. 8 is a flowchart illustrating a detailed example of the conceptual drift candidate point determination process (step S705) illustrated in FIG. [Figure 9] FIG. 9 is an explanatory diagram showing an example of calculation in step S802. [Figure 10] FIG. 10 is an explanatory diagram showing an example of calculation in step S804. [Figure 11] FIG. 11 is an explanatory diagram showing an example of calculation in step S807. [Figure 12] FIG. 12 is a flowchart showing a detailed example (first half) of the prediction result correction process (step S706) shown in FIG. [Figure 13] FIG. 13 is a flowchart showing a detailed processing procedure example (second half) of the prediction result correction process (step S706) shown in FIG. [Figure 14] FIG. 14 is an explanatory diagram showing a first example of scale and shift calculation for each conceptual drift candidate point. [Figure 15] FIG. 15 is an explanatory diagram showing a second example of the scale and shift calculation for each conceptual drift candidate point. [Figure 16] FIG. 16 is an explanatory diagram showing a third example of scale and shift calculation for each conceptual drift candidate point. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] <Example of abnormality detection> FIG. 1 is an explanatory diagram showing an example of anomaly detection by an anomaly detection device. The object to be monitored is, for example, disk usage of an IT infrastructure. In the graphs shown in (A) to (C) of FIG. 1, the horizontal axis is the time axis, and the vertical axis is disk usage. In this embodiment, disk usage will be taken as an example for explanation, but RAM usage may also be used. The training data is time-series actual measured values ​​up to time t1 used to create a time-series model. The predicted data is time-series predicted values ​​from time t1 to t3 output from the time-series model. The test data is time-series actual measured values ​​(correct answer data) from time t1 to t3 to be compared with the predicted data.

[0012] From time t1 to time t2, the difference between the predicted data and the test data is within the allowable range, indicating that the prediction by the time series model is correct.

[0013] (1) Assume that an event is detected at time t2. Here, an event is a behavior that causes an abrupt change in disk usage, such as a configuration change due to the addition or removal of disk or RAM capacity, an unplanned deletion of a large number of log files, or the transfer of a large number of log files to backup storage.

[0014] After such an event, the disk usage rate repeats normal behavior, but because the disk usage rate changes abruptly from time t2 onwards, a difference G occurs between the test data and the predicted data after time t2. Such disk usage rate behavior before and after an event is called conceptual drift. An anomaly detection device may detect an anomaly even though the disk usage rate behavior is normal, or may not detect an anomaly even though the disk usage rate behavior is abnormal.

[0015] (2) For this reason, the anomaly detection device linearly transforms the predicted data from time t2 onwards. In (B), the anomaly detection device shifts the predicted data from time t2 onwards, and in (C), scales (expands) the predicted data from time t2 onwards by a factor of k. The anomaly detection device compares the difference (shift error) between the predicted data and test data after the shift result in (B) with the difference (scale error) between the predicted data and test data after the scale result in (C), and selects the one with the smaller error. In FIG. 1, the shift error is 5% and the scale error is 10%, so shift transformation is adopted. In this way, by using the linear transformation result even immediately after time t2 when an event is detected, anomalies can be detected even after time t2.

[0016] <System configuration example> 2 is an explanatory diagram showing an example of the system configuration of an anomaly detection system 200. The anomaly detection system 200 includes an IT infrastructure 201 and an anomaly detection device 202. The IT infrastructure 201 and the anomaly detection device 202 are communicatively connected via a network 203 such as the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network).

[0017] <Example of hardware configuration of an anomaly detection device> FIG. 3 is a block diagram showing an example of a hardware configuration of the abnormality detection device. The abnormality detection device 202 includes a processor 301, a storage device 302, an input device 303, an output device 304, and a communication interface (communication IF) 305. The processor 301, the storage device 302, the input device 303, the output device 304, and the communication IF 305 are connected by a bus 306. The processor 301 controls the abnormality detection device 202. The storage device 302 serves as a working area for the processor 301. The storage device 302 is a non-transient or temporary recording medium that stores various programs and data. Examples of the storage device 302 include a ROM (Read Only Memory), a RAM (Random Access Memory), a HDD (Hard Disk Drive), and a flash memory. The input device 303 inputs data. Examples of the input device 303 include a keyboard, a mouse, a touch panel, a numeric keypad, a scanner, and a microphone. The output device 304 outputs data. The output device 304 may be, for example, a display, a printer, or a speaker. The communication IF 305 is connected to the network 203 and transmits and receives data.

[0018] Here, the data stored in the storage device 302 will be specifically described. The storage device 302 has a disk usage rate table 321, a prediction result table 322, a corrected prediction result table 323, and an anomaly detection program 324. The disk usage rate table 321 is a table that stores disk usage rates in chronological order, and will be described later in FIG. 4. The prediction result table 322 is a table that stores prediction results in chronological order, and will be described later in FIG. 5. The corrected prediction result table 323 is a table that stores corrected prediction results in chronological order, and will be described later in FIG. 6.

[0019] The anomaly detection program 324 is a program that causes the processor 301 to detect an anomaly that occurs in the IT infrastructure 201, and includes program modules called an anomaly detection module 340, a collection module 341, a concept drift candidate point determination module 342, and a prediction result correction module 343. The anomaly detection module 340 is a program module that detects an anomaly in disk usage by comparing test data with prediction data. The collection module 341 is a program module that collects metrics data from the IT infrastructure 201, and will be described later in FIG. 7. The concept drift candidate point determination module 342 is a program module that determines a concept drift candidate point, and will be described later in FIG. 8 to FIG. 11. A concept drift candidate point is a candidate for the detection time of an event that causes a concept drift. The prediction result correction module 343 is a module that corrects the prediction result stored in the prediction result table 322, and will be described later in FIG. 12 and FIG. 13.

[0020] The disk usage rate table 321, the prediction result table 322, and the corrected prediction result table 323 stored in the storage device 302 will be described with reference to FIGS.

[0021] 4 is an explanatory diagram showing an example of the disk usage rate table 321. The disk usage rate table 321 has fields of a timestamp 401 and a disk usage rate 402. The timestamp 401 is the date and time when the IT infrastructure 201 measured the disk usage rate 402. The disk usage rate 402 is the ratio of the disk capacity in use to the total disk capacity of the IT infrastructure 201.

[0022] In FIG. 4, timestamps 401 are stored, for example, in 15-minute increments. Disk utilization 402 has an increasing trend up to entry 325X5, increasing by 5% every 15 minutes. At entry 321X6, disk utilization 402 was predicted to be 50%, but disk utilization 402 suddenly drops to 25%. The reason for the sudden drop in disk utilization 402 to half of the prediction (50%) is that the disk capacity of IT infrastructure 201 doubled from 10GB to 20GB after “2021-01-01 01:00:00”, which is the timestamp 401 of entry 321X5.

[0023] Furthermore, at the timestamp 401 of entry 321X7, "2021-01-01 01:30:00", the disk usage 402 suddenly increased. In entry 321X7, the disk usage 402 was predicted to be 27.5%, but the actual measured value was 50%. It can be seen that an abnormality occurred in this entry 321X7. In other words, the disk usage 402 of entry 321X7 is an abnormal value. The abnormality detection device 202 detects that an abnormality has occurred in the timestamp 401 of entry 321X7.

[0024] 5 is an explanatory diagram showing an example of the prediction result table 322. The prediction result table 322 has fields including a time stamp 401, a predicted disk usage rate 502, a lower series 503, and an upper series 504. The predicted disk usage rate 502 is a predicted value of the disk usage rate 402 that is output when the time stamp 401 is input as a response variable to the time series model. In addition to the time stamp 401, parameters such as the day of the week, holidays, and public holidays may be input to the time series model.

[0025] The interval between the lower series 503 and the upper series 504 is called the prediction interval. The prediction interval is, for example, a 95% confidence interval. The values ​​of the lower series 503 and the upper series 504 are calculated, for example, as the values ​​of -3σ and +3σ of the predicted disk usage 502 of the entry, where σ is the standard deviation. Values ​​smaller than the lower series 503 and values ​​larger than the upper series 504 are included in the rejection region.

[0026] The prediction interval may also be defined by percentiles. In this case, the lower series 503 is, for example, the 10th percentile, and the upper series 504 is the 90th percentile. In other words, the 1st to 9th smallest predicted disk usage rates 502 and the 91st and subsequent predicted disk usage rates 502 are included in the rejection region.

[0027] The lower series 503 and the upper series 504 are used for anomaly detection. If the disk usage rate 402 is lower than the lower series 503 or higher than the upper series 504, the disk usage rate 402 is detected as an anomaly. In other words, if the disk usage rate 402 is included in the prediction interval, the disk usage rate 402 is not detected as an anomaly.

[0028] 6 is an explanatory diagram showing an example of the corrected prediction result table 323. The corrected prediction result table 323 has fields including a time stamp 401, a corrected predicted disk usage 602, a corrected lower series 603, and a corrected upper series 604. The corrected predicted disk usage 602 is the predicted disk usage 502 corrected by linear conversion. The corrected lower series 603 is the lower series 503 corresponding to the corrected predicted disk usage 602. The corrected upper series 604 is the upper series 504 corresponding to the corrected predicted disk usage 602.

[0029] <Example of anomaly detection processing procedure> Fig. 7 is a flowchart showing an example of an anomaly detection processing procedure by the anomaly detection device 202. Steps 701 to S704 are executed by the collection module 341, step S705 is executed by the concept drift candidate point determination module 342, and step S706 is executed by the prediction result correction module 343. The anomaly detection device 202 starts the processing shown in Fig. 7, for example, when a certain number of unanalyzed entries are accumulated in the disk usage rate table 321.

[0030] The anomaly detection device 202 collects metrics data from the IT infrastructure 201 and adds an entry to the disk usage table 321 (step S701). For example, one entry in the disk usage table 321 is a statistical value of each disk usage 402 at multiple times. The statistical value is, for example, the average value, median value, maximum value, or minimum value of each disk usage 402 at multiple times.

[0031] Since the timestamp 401 in the disk usage table 321 is recorded at 15-minute intervals, if the IT infrastructure 201 measures the disk usage 402 at one-minute intervals, for example, the IT infrastructure 201 measures the disk usage 402 15 times and calculates statistical values ​​of the 15 disk usages 402. The IT infrastructure 201 transmits the last measurement time of the 15 measurements and the statistical values ​​of the 15 disk usages 402 to the anomaly detection device 202. The anomaly detection device 202 records the received last measurement time in the timestamp 401, and records the statistical values ​​of the 15 disk usages 402 in the disk usage 402.

[0032] Next, the abnormality detection device 202 detects the analysis start time T start (Step S702). The analysis start time T start is the time stamp 401 of the entry in the disk usage rate table 321 at which the error detection device 202 starts the analysis in step S703. startis the time stamp 401 of the oldest unanalyzed entry in the disk usage table 321. For example, if the anomaly detection process has been completed up to the entry 321X4 in the disk usage table 321, the value of the time stamp 401 of the next entry 321X5, “2021-01-01 01:00:00”, is the analysis start time T start It becomes.

[0033] Next, the anomaly detection device 202 detects the analysis start time T start The entries up to are extracted as time series data from the disk usage rate table 321, and the time series model is re-learned (step S703). y = f(t) (1) The left side of the formula is a function expressed as follows: y on the left side is the disk usage rate 402, and t on the right side is time data, for example, the time stamp 401. In addition to the time stamp 401, the type of day of the week (weekday, holiday, or public holiday) may also be input as the time data t.

[0034] For example, the entries up to one before the entry 321X1 have been trained, and the entries 321X1 to 321X4 have not been used in training the time series model. start If the entry group is up to the analysis start time T, the anomaly detection device 202 inputs the time stamps 401 of the entries 321X1 to 321X4 into the time data t of the time series model, and re-learns the time series model so that the difference between the output result y and the disk usage rate 402 of the entries 321X1 to 321X4 is minimized. Note that if the time series model has not yet been generated, the anomaly detection device 202 start The entries up to are extracted as time series data from the disk usage rate table 321, and a time series model is trained.

[0035] The time series model may be a random forest, an ARIMA (AutoRegressive Integrated Moving Average) model, or a SARIMA (Seasonal ARIMA) model.

[0036] Next, the abnormality detection device 202 detects the analysis start time T start , and adds an entry to the prediction result table 322 (step S704). Specifically, for example, the anomaly detection device 202 adds the analysis start time T start The abnormality detection device 202 sequentially inputs timestamps 401 from the latest time, outputs predicted data p of disk usage 402 for each timestamp 401 as y in the above formula (1), and records this together with the timestamp 401 as predicted disk usage 502 in the prediction result table 322. The abnormality detection device 202 also calculates the values ​​of lower series 503 and upper series 504 for each of the sequentially input timestamps 401, and records these in the prediction result table 322.

[0037] Here, we will explain entries that are not detected as abnormal by the anomaly detection module 340. For example, the disk usage rate 402 (50%) of the entry 321X7 is an abnormal value. However, in the entry 322P3 of the prediction result table 322 with the same timestamp 401 as the entry 321X7, the value of the lower series 503 is "45%" and the value of the upper series 504 is "65%".

[0038] Therefore, the disk usage rate 402 (50%) of the entry 321X7, which is an abnormal value, is included in the prediction interval [45, 65] between the value "45%" of the lower series 503 and the value "65%" of the upper series 504. Therefore, the disk usage rate 402 (50%) of the entry 321X7 is not detected as an abnormal value. This is because the time series model f after re-learning misses the effect of the doubling of the disk capacity of the IT infrastructure 201.

[0039] The anomaly detection device 202 performs a concept drift candidate point determination process (step S705) and a prediction result correction process (step S706) to correct the predicted disk usage 502. As a result, the anomaly detection device 202 detects the disk usage 402 (50%) of the entry 321X7, which was overlooked and treated as a normal value by the anomaly detection module 340, as an abnormal value (step S707).

[0040] <Concept drift candidate point determination process (step S705)> Fig. 8 is a flowchart showing a detailed example of the process procedure of the concept drift candidate point determination process (step S705) shown in Fig. 7. After step S704, the anomaly detection device 202 judges whether an operation log or a configuration management database (CMDB) is available (step S801). If either the operation log or the CMDB in the IT infrastructure 201 is available (step S801: Yes), the anomaly detection device 202 acquires the concept drift candidate points from the operation log or the CMDB (step S810) and proceeds to the prediction result correction process (step S706).

[0041] On the other hand, if neither the operation log nor the CMDB is available (step S801: No), the anomaly detection device 202 calculates the average error between the predicted data and the test data (step S802). The predicted data is the predicted disk usage 502, and the test data is the disk usage 402 of the same timestamp 401 as the predicted data, and is also called the correct answer data. The average error is the average value of the error based on the difference between the predicted data and the test data for each timestamp 401. For example, the error is the difference G in FIG. 1(A) and is expressed by the following formula (2). The average error is expressed by the following formula (3).

[0042]

number

[0043] x in equations (2) and (3) t is the test data, and pt is the predicted disk usage rate 502, and t is the time stamp 401. e(t) is the error when the time stamp 401 is t, and E is the analysis start time T start From T end It is the average of the n errors e(t) up to T end is the analysis start time T start This is the analysis end time indicated by the time stamp 401 of the n-th entry from the entry .

[0044] Next, the abnormality detection device 202 checks whether the average error E calculated in step S802 is equal to or smaller than the error threshold E threshold It is determined whether the average error E is greater than the error threshold E (step S803). threshold If the average error E is not greater than the error threshold E (step S803: No), the process proceeds to the prediction result correction process (step S706). threshold If it is greater than the error threshold E (step S803: Yes), the process proceeds to step S804. threshold For example, E threshold = 0.2. The average error E is the error threshold E threshold If the average error E is greater than the error threshold E, then rapid concept drift is expected. threshold A concept drift larger than is called an abrupt concept drift.

[0045] The average error E is the error threshold E threshold If it is greater than the change rate r t is calculated for each time stamp 401 (step S804). t is calculated, for example, by the following (4).

[0046]

number

[0047] Rate of change r t is the test data x at time tt and the test data x at time t+1 t+1 The anomaly detection device 202 calculates the change rate threshold value R threshold A specific rate of change greater than r t It is determined whether or not there is a specific rate of change r t If there is no specific change rate r t If there is one or more (step S805: Yes), the process proceeds to step S806. threshold can be arbitrarily set by the user.

[0048] The anomaly detection device 202 detects a specific rate of change r t and the time t indicated by the time stamp 401 (step S806). Then, the anomaly detection device 202 selects a specific rate of change r t For each of the selected items, the number of times the item is selected in step S806 is counted in a predetermined period (for example, one day) (step S807). t Number of occurrences of f r Note that the specific rate of change r t may be counted only if it is a perfect match, or if it is within a tolerance. For example, the rate of change r t If r is 1.804 or 1.863, the specific rate of change r t Number of occurrences of f = 1.8 r is counted as

[0049] After this, the anomaly detection device 202 detects whether the occurrence count fr is equal to or smaller than the occurrence count threshold F threshold It is determined whether there is a specific time stamp 401 smaller than the occurrence count f (step S808). r is the occurrence count threshold F threshold If there is no smaller specific time stamp 401 (step S808: No), the process proceeds to the prediction result correction process (step S706).

[0050] On the other hand, the number of occurrences f t is the occurrence count threshold F threshold If there is one or more specific time stamps 401 smaller than the specific rate of change r (step S808: Yes), the anomaly detection device 202 determines the specific time stamps 401 as concept drift candidate points (step S809), and proceeds to the prediction result correction process (step S706). t is the occurrence count threshold F threshold The fact that more than one occurrence of the phenomenon occurs indicates that a specific rate of change r t The time stamp 401 does not indicate a change in the disk usage rate 402 due to concept drift, but indicates that a change that is different from normal behavior has occurred in the disk usage rate 402 itself. Therefore, the anomaly detection device 202 r is the occurrence count threshold F threshold It is predicted that a rapid concept drift is likely to have occurred at the time indicated by the smaller specific timestamp 401 .

[0051] Next, an example of the execution of the conceptual drift candidate point determination process (step S705) will be described with reference to FIGS.

[0052] FIG. 9 is an explanatory diagram showing an example of calculation in step S802. In FIG. 9, the time stamp 401 that is the analysis start time is set to "2021-01-01 01:00:00", and the time stamp 401 that is the analysis end time is set to "2021-01-01 01:45:00". In the case of FIG. 9, the average error E is calculated based on the error threshold E threshold Since it is greater than (step S802: Yes), the process proceeds to step S804.

[0053] FIG. 10 is an explanatory diagram showing an example of calculation in step S804. Entry 1000 is the analysis start time T start The timestamp 401 just before (i.e., the end time of the previous analysis T end 10 shows the calculation results of the change rates r t is the rate of change threshold Rthreshold It can be seen that the specific rate of change is greater than

[0054] 11 is an explanatory diagram showing an example of calculation in step S807. In the entries 1101 to 1103, the occurrence count fr of each of the specific change rates rt is "1", so the occurrence count threshold F threshold Therefore, the time stamps 401 of the entries 1001 to 1003 selected in step S806 are determined to be the specific time stamps 401 (step S809).

[0055] <Prediction result correction process (step S706)> 12 is a flowchart showing a detailed example of the processing procedure (first half) of the prediction result correction process (step S706) shown in FIG. 7. The anomaly detection device 202 acquires test data, prediction data, and concept drift candidate points (step S1201). Next, the anomaly detection device 202 judges whether or not there are unselected concept drift candidate points (step S1202). If there are unselected concept drift candidate points (step S1202: Yes), the anomaly detection device 202 selects one of the unselected concept drift candidate points and sets it as T, and calculates the rate of change r of the selected concept drift candidate point T. T is calculated using the following formula (5) (step S1203).

[0056]

number

[0057] Next, the anomaly detection device 202 calculates the scale error e of the concept drift candidate point T using the following equation (6): T scale (Step S1203).

[0058]

number

[0059] In the above formula (6), m is the time from time T+1 indicated by the time stamp 401 to the analysis end time T end The scale error e T scale is the predicted data p t The rate of change of the conceptual drift candidate point T is r T This shows the average error with the test data when scaled by .

[0060] Next, the abnormality detection device 202 calculates the change difference d T (step S1205).

[0061]

number

[0062] Then, the abnormality detection device 202 calculates the shift error e T shift (step S1206), and the process returns to step S1202.

[0063]

number

[0064] Shift error e T shift is the predicted data p t The difference in change d T 13. In step S1202, if there is no unselected concept drift candidate point (step S1202: No), the anomaly detection device 202 selects the minimum error and its time stamp 401 (step S1207), and proceeds to step S1301 in FIG. 13. Specifically, for example, the anomaly detection device 202 calculates the scale error e T scale and the shift error e T shiftThe time indicated by the time stamp 401 of the smallest error is set as τ.

[0065] For example, suppose there are three concept drift candidate points T (T1, T2, and T3). The scale error e T1 scale ,e T2 scale ,e T3 scale and the shift error e T1 shift ,e T2 shift ,e T3 shift In step S1207, the abnormality detection device 202 calculates the scale error e T1 scale ,e T2 scale ,e T3 scale and the shift error e T1 shift ,e T2 shift ,e T3 shift Select the minimum error from among these. If this minimum error is, for example, the scale error e T3 scale Then, the anomaly detection device 202 detects the scale error e T3 scale The conceptual drift candidate point T3 where this occurs is selected and set as τ. Then, the process proceeds to step S1301 in FIG.

[0066] In addition, if no concept drift candidate point T is determined or acquired in the concept drift candidate point determination process (step S705), step S1207 and the process of FIG. 13 are not executed.

[0067] 13 is a flowchart showing a detailed processing procedure example (second half) of the prediction result correction process (step S706) shown in FIG. 7. τ scale or the shift error e τ shiftIt is determined whether the selected minimum error is equal to or smaller than the scale error e τ scale If (step S1301: scaled error), the anomaly detection device 202 selects the scaled error e τ scale is the error tolerance E tolerance It is determined whether the scale error e τ scale is the error tolerance E tolerance If not (step S1302: No), the prediction result correction process (step S706) ends.

[0068] On the other hand, the scale error e τ scale is the error tolerance E tolerance If the result is equal to or smaller than the predetermined value (step S1302: Yes), the abnormality detection device 202 calculates the predicted data p after the time τ indicated by the time stamp 401 at a rate of change r τ (step S1303). At this time, the anomaly detection device 202 also corrects the lower series 503 and the upper series 504 based on the scaled predicted data p. Then, the anomaly detection device 202 adds an entry for the scaled predicted data p to the corrected prediction result table 323 (step S1304), and the prediction result correction process (step S706) ends.

[0069] Also, in step S1301, the selected minimum error is the shift error e τ shift If so (step S1301: shift error), the abnormality detection device 202 selects the shift error e τ shift is the error tolerance E tolerance It is determined whether the shift error e τ shift is the error tolerance E tolerance If not (step S1305: No), the prediction result correction process (step S706) ends.

[0070] On the other hand, the shift error e τshift is the error tolerance E tolerance If it is equal to or smaller than this (step S1305: Yes), the abnormality detection device 202 calculates the predicted data p after the time τ indicated by the time stamp 401 by the change difference d τ (step S1306). At this time, the anomaly detection device 202 also corrects the lower series 503 and the upper series 504 based on the shifted predicted data p. Then, the anomaly detection device 202 adds an entry to the corrected prediction result table 323 for the shifted predicted data p (step S1307), and the prediction result correction process (step S706) ends.

[0071] 14 to 16 are explanatory diagrams showing examples of scale and shift calculation for each conceptual drift candidate point T. The conceptual drift candidate point in FIG. 14 is "2021-01-01 01:00:00", the conceptual drift candidate point in FIG. 15 is "2021-01-01 01:15:00", and the conceptual drift candidate point in FIG. 16 is "2021-01-01 01:30:00".

[0072] The three scale errors e at these three concept drift candidate points T T scale and three shift errors e T shift The smallest error is the scale error e at the conceptual drift candidate point T = "2021-01-01 01:00:00" in Figure 14. T scale = 0.159. Therefore, this scale error e T scale is selected as the minimum error, and the conceptual drift candidate point T="2021-01-01 01:00:00" which is the timestamp 401 is selected as τ (step S1207). Then, the timestamps 401 and the scaled prediction data of the entries 1401 to 1403 are registered in the corrected prediction table.

[0073] In this way, according to the above-described anomaly detection device 202, for example, in the IT infrastructure 201, when the disk capacity increases by k times, the disk usage rate 402 is scaled to 1 / k times. Also, when the disk capacity decreases by k times, the disk usage rate 402 is scaled to k times. Also, when a large number of log files are unscheduled deleted, the disk usage rate 402 is shifted to decrease by that amount. Also, when a large number of files are copied to the backup storage, the disk usage rate 402 is shifted to increase by that amount.

[0074] Therefore, even after the occurrence of a specific event that may cause concept drift, the immediacy of anomaly detection is improved, and periodic anomaly reports for IT systems, such as daily or hourly, can be output immediately. Therefore, anomaly detection does not stop after the occurrence of a specific event, and false positives such as anomalies being deemed normal when they are actually abnormal or normal when they are deemed abnormal can also be suppressed.

[0075] In addition, in the above-described anomaly detection device 202, either one of the scale transformation and the shift transformation is selected to correct the predicted data, but only one of the scale transformation and the shift transformation may be implemented.

[0076] Furthermore, the above-mentioned abnormality detection device 202 can also be configured as follows (1) to (9).

[0077] (1) The abnormality detection device 202 includes a processor 301 that executes a program and a storage device 302 that stores the program. The processor 301 executes a correction process (step S706) for correcting, by scale conversion, second predicted data after a time point T at which a specific event occurs (for example, time t2 in FIG. 1 ) from among time-series first predicted data (for example, predicted data from time t1 to t3 shown in FIG. 1 ) of a monitoring target (for example, disk usage rate 402), and a detection process (step S707) for detecting an abnormality in the monitoring target based on the second predicted data (for example, predicted data from time t2 to t3 shown in FIG. 1 ) corrected by the correction process and second actual measurement data after a time point T at which the specific event occurs (for example, test data from time t2 to t3 shown in FIG. 1 ) from among time-series first actual measurement data (for example, test data from time t1 to t3 shown in FIG. 1 ) of the monitoring target.

[0078] (2) In the abnormality detection device 202 described in (1) above, in the correction process (step S706), the processor 301 calculates the second predicted data based on a change rate r τ The correction is performed by the scale conversion using

[0079] (3) In the anomaly detection device 202 of (1) above, in the correction process (step S706), the processor 301 corrects the second predicted data by linear transformation, which is either the scale transformation or the shift transformation.

[0080] (4) In the abnormality detection device 202 of the above (1), in the correction process, when the scale conversion is selected, the processor 301 converts the second predicted data into the second actual data change rate r τ When the shift transformation is selected, the second predicted data is corrected by the difference r τ The shift transformation is performed using the above formula.

[0081] (5) In the abnormality detection device 202 of the above (4), in the correction process (step S706), the processor 301 τ The scale error e between the second predicted data and the data scaled by τ scale Calculate the difference r between the second measured data and the change τ The shift error e between the second predicted data shifted by τ shift Calculate the scale error e τ scale and the shift error e τ shift Based on the above, one of the scale transformation and the shift transformation is selected.

[0082] (6) In the abnormality detection device 202 of (5) above, in the correction process (step S706), the processor 301 τ scale and the shift error e τ shift The linear transformation with the smaller error is selected.

[0083] (7) In the anomaly detection device 202 of (1) above, the processor 301 calculates a rate of change r t For each of these, the change rate threshold R threshold (step S805: Yes) as the candidate occurrence time T of the specific event, and in the correction process (step S706), the processor 301 corrects the second prediction data after any of the candidate occurrence time τ of the specific event determined by the determination process (step S705) by the scale transformation.

[0084] (8) In the abnormality detection device 202 of (7) above, in the determination process (step S705), the processor 301 determines whether the error E between the first predicted data and the first measured data is equal to or smaller than an error threshold E thresholdIf it is greater (step S803: Yes), the specific observation time t is determined as the candidate occurrence time T of the specific event.

[0085] (9) In the anomaly detection device 202 of (7) above, in the determination process (step S705), the processor 301 determines the rate of change r of the actual measurement value at the specific observation time t. t The number of occurrences of f within a given period r Count the number of occurrences f r is the occurrence count threshold F threshold The rate of change of the measured value r is smaller than t The specific observation time t corresponding to is determined as a candidate occurrence time T of the specific event.

[0086] The present invention is not limited to the above-described embodiments, and includes various modified examples and equivalent configurations within the spirit of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those having all of the configurations described. Also, a part of the configuration of one embodiment may be replaced with a configuration of another embodiment. Also, a configuration of another embodiment may be added to a configuration of one embodiment. Also, a part of the configuration of each embodiment may be added, deleted, or replaced with another configuration.

[0087] In addition, each of the configurations, functions, processing units, processing means, etc. described above may be realized in hardware, for example by designing some or all of them as an integrated circuit, or may be realized in software by processor 301 interpreting and executing a program that realizes each function.

[0088] Information such as programs, tables, files, etc. that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or in a recording medium such as an IC (Integrated Circuit) card, an SD card, or a DVD (Digital Versatile Disc).

[0089] In addition, the control lines and information lines shown are those considered necessary for the explanation, and do not necessarily show all the control lines and information lines necessary for implementation. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0090] 200 Anomaly Detection System 201 IT Infrastructure 202 Anomaly Detection Device 301 Processor 302 Storage Devices 321 Disk Utilization Table 322 Prediction Results Table 323 Corrected prediction result table 324 Anomaly Detection Program 340 Anomaly Detection Module 341 Collection Module 342 Concept Drift Candidate Point Decision Module 343 Prediction Result Correction Module

Claims

1. An anomaly detection device having a processor that executes a program and a storage device that stores the program, The processor, a correction process for correcting second predicted data after a specific event occurs from the first predicted data of the time series of the monitoring target by scale conversion; a detection process for detecting an abnormality in the monitoring target based on second predicted data corrected by the correction process and second actual measurement data after a point in time when the specific event occurs among first time-series actual measurement data of the monitoring target; An anomaly detection device comprising:

2. The abnormality detection device according to claim 1 , In the correction process, the processor corrects the second predicted data by the scale conversion using a rate of change of the second actual measurement data.

2. An abnormality detection device comprising:

3. The abnormality detection device according to claim 1 , In the correction process, the processor corrects the second predicted data by linear transformation, which is either the scale transformation or the shift transformation.

2. An abnormality detection device comprising:

4. The abnormality detection device according to claim 3, In the correction process, when the scale conversion is selected, the processor corrects the second predicted data by the scale conversion using a rate of change of the second actual measured data, and when the shift conversion is selected, the processor corrects the second predicted data by the shift conversion using a difference in change of the second actual measured data.

2. An abnormality detection device comprising:

5. The abnormality detection device according to claim 4, In the correction process, the processor calculates a scale error between the second actual data and the second predicted data scaled by the change rate, calculates a shift error between the second actual data and the second predicted data shifted by the change difference, and selects one of the linear transformations, the scale transformation or the shift transformation, based on the scale error and the shift error.

2. An abnormality detection device comprising:

6. The abnormality detection device according to claim 5, In the correction process, the processor selects a linear transformation that has a smaller error between the scale error and the shift error.

2. An abnormality detection device comprising:

7. The abnormality detection device according to claim 1 , The processor, performing a determination process for determining a specific observation time point at which a change rate of the actual measurement value at an observation time point of the first actual measurement data is greater than a change rate threshold value as a candidate occurrence time point of the specific event; In the correction process, the processor corrects the second predicted data after any one of the occurrence time candidate candidates of the specific event determined in the determination process, by the scale conversion.

2. An abnormality detection device comprising:

8. The abnormality detection device according to claim 7, In the determination process, when an error between the first predicted data and the first actual measured data is greater than an error threshold, the processor determines the specific observation time point as a candidate occurrence time point of the specific event.

2. An abnormality detection device comprising:

9. The abnormality detection device according to claim 7, In the determination process, the processor counts the number of occurrences within a predetermined period of time of the rate of change of the actual measurement value at the specific observation time point, and determines the specific observation time point corresponding to the rate of change of the actual measurement value where the number of occurrences is smaller than an occurrence number threshold value as a candidate occurrence time point of the specific event.

2. An abnormality detection device comprising:

10. An anomaly detection method executed by an anomaly detection device having a processor that executes a program and a storage device that stores the program, comprising: The processor, a correction process for correcting second predicted data after a specific event occurs from the first predicted data of the time series of the monitoring target by scale conversion; a detection process for detecting an abnormality in the monitoring target based on predicted data corrected by the correction process and second actual measurement data after a point in time when the specific event occurs among first actual measurement data in a time series of the monitoring target; 2. An anomaly detection method comprising:

11. The processor: a correction process for correcting second predicted data after a specific event occurs from the first predicted data of the time series of the monitoring target by scale conversion; a detection process for detecting an abnormality in the monitoring target based on predicted data corrected by the correction process and second actual measurement data after a point in time when the specific event occurs among first actual measurement data in a time series of the monitoring target; An anomaly detection program characterized by executing the above.

Images