Change-point detection device, change-point detection method, and program

Abstract

The purpose of the present disclosure is to detect, as a change point, the occurrence time of any change, including a change of temporal change pattern such as a change of cyclic variation, that occurs in time-series data including data that does not satisfy stationariness constraints and iid constraints, such as data that indicates a cyclic variation.　Thus, the present disclosure provides a change point detection device having: an input unit for receiving input of time-series data that represents the system state at each time of a system configured from one or a plurality of devices, the time-series data being configured from data of equal dimensions to the product of the number of devices constituting the system and the number of items representing the states of the devices; a time window generation unit for converting from the data of equal dimensions to the product of the number of devices constituting the system and the number of items representing the states of the devices at the each time to data of equal dimensions to the product of the number of devices, the number of items, and the length of a time window, thereby generating conversion data; and a detection unit for detecting, as a change point, a change point score of the system state calculated on the basis of the conversion data at the each time in a case where the change point score has exceeded a preset threshold value.

Description

[Technical field]

[0001] The present disclosure relates to a change-point detection device, a change-point detection method, and a program. [Background technology]

[0002] There is a known technique for detecting a change in the state of a system that is composed of one or more devices, using time-series data that represents the state of the system at each point in time. Here, the "system state" refers to the operating state of the system that is represented by quantitative variables such as the "number of accesses" and the "number of users."

[0003] The techniques described in Non-Patent Documents 1 to 4 are known as techniques for detecting change-points in time-series data to which no correct answer label is assigned regarding the position where the change-point occurs.

[0004] Non-Patent Document 1 proposes a method for calculating the degree of change by evaluating the distance between subspaces composed of partial time series using the subspace method. This method generates matrices that bundle partial time series (time windows cut out from a time series) for each of the past and current periods, extracts characteristic patterns by singular value decomposition, and evaluates the distance between these characteristic patterns.

[0005] Non-Patent Document 2 proposes a method of estimating the probability distribution of a new interval based on data observed after the previous change point using a probability model. This is a method of detecting change points by estimating the probability distribution of the run length (the elapsed time until the next change point) from the last change point based on Bayes' theorem. Note that "Bayes' theorem" is a theory that shows that "the possibility of something happening can be roughly estimated using the frequency of occurrence of that event in the past."

[0006] Non-Patent Document 3 proposes a method of classifying time-series data by using clustering, and judging that a change has occurred if a new observation value does not fit any of the existing clusters. This method judges for all existing clusters whether the Euclidean distance between a new observation value and the centroid of an existing cluster exceeds the radius of the cluster, and detects a change point if all of the Euclidean distances exceed the radius.

[0007] The online change detection based on two-stage learning in Non-Patent Document 4 is a type of likelihood ratio test that determines whether there is a significant difference in the probability density of two consecutive intervals based on the likelihood ratio, and proposes a method of calculating a change-point score while removing outliers by learning an autoregressive model in two stages. Specifically, this is a method in which, first, as the first stage of learning, a probability density function based on an autoregressive model is learned from a time series observed up to the immediately previous time point, and a logarithmic loss function under the probability density function for newly observed data is calculated as an outlier score. Furthermore, this is a method in which, after smoothing this outlier score series, next, as the second stage of learning, a probability density function similarly based on an autoregressive model is learned from the smoothed outlier score series calculated up to the immediately previous time point, and a logarithmic loss function under the probability density function is calculated for the outlier score calculated from the newly observed data, and the smoothed result is used as the change-point score.

[0008] A similar technique is known that uses time-series data representing the state of a system composed of one or more devices at each time point to detect non-stationary fluctuations in the system, and this technique is described in Non-Patent Document 5. Specifically, this is a method of classifying the state of time-series data using clustering, tracking the clusters assigned to each time point in the time axis direction, and extracting cluster transitions between different clusters. Furthermore, this is a method of calculating the occurrence frequency of each cluster transition pattern in a certain past period, and detecting a newly observed cluster transition pattern as a non-stationary fluctuation if its occurrence frequency in the past period falls below a preset threshold. [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] T. Ide and K. Tsuda, "Change-Point Detection Using Krylov Subspace Learning," in Procs. of the SIAM International Conference on Data Mining, Apr. 2007. [Non-Patent Document 2] RP Adams and DJC MacKay, "Bayesian Online Changepoint Detection," arXiv:0710.3742, Oct. 2007. [Non-Patent Document 3] DH Tran, "Automated Change Detection and Reactive Clustering in Multivariate Streaming Data," arXiv:1311.0505, Nov. 2013. [Non-Patent Document 4] Yamanishi, "Anomaly Detection: Outlier Detection and Change Detection," REAJ 2015 Vol.37, No. 3, 2015. [Non-Patent Document 5] Takahashi, Ikegami, "Proposal of a technique for detecting non-stationary fluctuations in multidimensional time series data," IEICE Technical Report, CQ2020-32, pp.57-62, July 2020. Summary of the Invention [Problem to be solved by the invention]

[0010] However, the change-point detection technique using the subspace method proposed in Non-Patent Document 1 has the restriction that the time series to be detected must be a stationary process. In other words, it is necessary to satisfy weak stationarity, which means that the expectation and autocovariance of the target time series are constant regardless of time.

[0011] In addition, the change-point detection technology based on Bayes' theorem proposed in Non-Patent Document 2 has the constraint that the time series to be detected must be independently and identically distributed (iid). In other words, the data at each point in time that constitutes the time series must follow the same probability distribution independently of each other. However, time-series data observed in many systems, such as network systems, often shows periodic fluctuations such as time-of-day fluctuations, day-of-week fluctuations, and monthly fluctuations, and furthermore, many of them contain a mixture of multiple types of periodic fluctuations with different periods. Therefore, the change-point detection technology, which is subject to the above-mentioned stationarity constraint and iid constraint, cannot be applied.

[0012] On the other hand, the change-point detection technique by clustering proposed in Non-Patent Document 3 and the online change detection technique based on two-stage learning proposed in Non-Patent Document 4 are considered promising in that the target time series is not subject to constraints such as stationarity constraints and IID constraints. However, the change-point detection technique by clustering proposed in Non-Patent Document 3 classifies the state of snapshot data at each time point extracted from the time series data, and determines whether the classified state is different from the existing state, and does not take the time axis into consideration. In other words, in time series data in which the time change of the state follows a certain pattern, such as time series data showing periodic fluctuations observed in many systems, when this time change pattern changes at a certain moment, this change point cannot be detected.

[0013] Furthermore, the online change detection technology based on two-stage learning proposed in Non-Patent Document 4 is a method based on an autoregressive model, so it can be said to take the time axis into consideration. Therefore, it is considered to be promising for time series data in which the time change pattern changes at a certain moment. However, it is difficult to use an autoregressive model for time series data that contains a mixture of multiple types of periodic fluctuations with different periods, such as time-of-day fluctuations, day-of-week fluctuations, and monthly fluctuations.

[0014] Furthermore, the non-stationary fluctuation detection technology proposed in Non-Patent Document 5 is based on clustering that does not restrict the target time series, and takes the time axis into consideration by tracking cluster transitions in the time axis direction. However, this technology detects cluster transition patterns whose occurrence frequency calculated in a certain past period is below a preset threshold as non-stationary fluctuations, and merely determines whether individual cluster transitions are abnormal (have a low occurrence frequency) compared to past records, and does not detect change points that can be said to be the beginning of a continuous abnormal state.

[0015] The present invention has been made in consideration of the above points, and aims to detect the time point at which any change, including a change in a time-varying pattern such as a change in periodic fluctuation, occurs in time series data, including data that does not satisfy stationarity constraints or iid constraints, such as data that exhibits periodic fluctuations. [Means for solving the problem]

[0016] In order to solve the above problem, the invention according to claim 1 provides an input unit for inputting time series data representing a system state at each time point of a system composed of one or more devices, the time series data being composed of data of a dimension of the number of devices constituting the system x the number of items representing the states of the devices; and a time window generation unit for generating converted data by converting the time series data at each time point from data of a dimension of the number of devices x the number of items to data of a dimension of the number of devices x the number of items x a time window length; a clustering unit that classifies states of dimensional data of the number of devices x the number of items x the time window length at each time point constituting the time series data of a preset past period and a current period by a clustering method; a cluster transition sequence creation unit that tracks clusters assigned to the dimensional data of the number of devices x the number of items x the time window length in the time axis direction, creates a sequence of cluster transitions between different clusters for each of the past period and the current period, and assigns a duration of stay in the cluster to each cluster constituting the sequence of the cluster transitions; and a cluster transition tensor calculation unit that calculates the occurrence probability of each cluster transition pattern in the current period, and calculates, for each of the past period and the current period, a cluster transition tensor having a length of the cluster transition as a dimension, unique values ​​of all clusters that have appeared in the past period and the current period as indices of each dimension, and the occurrence probability of each of the cluster transition patterns as a value; and a change point score calculation unit that calculates a distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as a degree of change from the past period to the current period based on the cluster transition tensors calculated for each of the past period and the current period. and a detection unit that detects a change point when the change point score of the system state calculated based on the converted data at each point in time exceeds a preset threshold. Effect of the Invention

[0017] As described above, according to the present invention, even for time series data that does not satisfy stationarity constraints or iid constraints, such as data that exhibits periodic fluctuations, when any change occurs, including a change in a time-varying pattern such as a change in periodic fluctuation, the time point at which the change occurs can be detected as a change point. [Brief description of the drawings]

[0018] [Figure 1] FIG. 2 is a diagram illustrating an example of a functional configuration of a change-point detection device according to the present embodiment. [Diagram 2] 10 is a flowchart illustrating an example of a change-point detection process according to the embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of a change-point detection device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] An embodiment of the present invention will be described below. In this embodiment, a change point detection device 10 is described that can detect the time point of occurrence of any change in the system state as a change point by using time series data that indicates the system state at each point in time of a system (S) composed of one or more devices. Here, the "system state" refers to the operating state of the system represented by quantitative variables such as "number of accesses" and "number of users."

[0020] [Functional configuration] First, the functional configuration of a change-point detection device 10 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the functional configuration of the change-point detection device according to this embodiment.

[0021] 1, a change-point detection device 10 according to this embodiment includes an input unit 11, a time window generation unit 12, a period setting unit 13, a clustering unit 14, a cluster transition sequence creation unit 15, a cluster transition tensor calculation unit 16, a change-point score calculation unit 17, a detection unit 18, and an output unit 19. Note that the "devices" in the "number of devices" and "device status" shown below refer to devices that constitute a system that is the target of change-point detection by the change-point detection device 10.

[0022] The input unit 11 inputs time series data representing the system state at each point in time of a system (S) consisting of one or more devices, and which is composed of data of dimensions (number of devices x number of items representing the states of the devices) that constitute the system (S).

[0023] The time window generation unit 12 divides the time series data input by the input unit 11 into fixed-length time windows, converts the data at each point in time from (number of devices x number of items) dimensional data to (number of devices x number of items x time window length) dimensional data, generates converted data, and performs intermediate output.

[0024] The period setting unit 13 extracts time series data of a preset past period and a present period from the (number of devices x number of items x time window length) dimensional time series data generated by the time window generating unit 12, and performs intermediate output.

[0025] The clustering unit 14 classifies the state of the (number of devices x number of items x time window length) dimensional data at each point in time that constitutes the time series data for the past period and the current period extracted by the period setting unit 13 using a clustering method, and provides intermediate output.

[0026] The cluster transition sequence creation unit 15 tracks the clusters assigned by the clustering unit 14 to the (number of devices x number of items x time window length) dimensional data at each point in time in the past period and the current period in the time axis direction, and creates a sequence of cluster transitions between different clusters for each of the past period and the current period. At the same time, it assigns the duration of stay in that cluster to each cluster that constitutes this cluster transition sequence, and performs intermediate output.

[0027] The cluster transition tensor calculation unit 16 extracts cluster transitions of a preset fixed length from the cluster transition sequence created by the cluster transition sequence creation unit 15, calculates the occurrence probability of each cluster transition pattern in the past period and the current period, calculates cluster transition tensors for each of the past period and the current period, with the cluster transition length (length of cluster transition) as the rank (i.e., dimension), unique values ​​of all clusters that appeared in the past period and the current period as indices for each dimension, and the occurrence probability of the cluster transition pattern as a value, and performs intermediate output.

[0028] Based on the cluster transition tensors for the past period and the current period calculated by the cluster transition tensor calculation unit 16, the change point score calculation unit 17 calculates the distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as the degree of change from the past period to the current period, and provides intermediate output.

[0029] The detection unit 18 detects a change point when the change point score calculated by the change point score calculation unit 17 exceeds a preset threshold. That is, the detection unit 18 detects a change point when the change point score of the system state calculated based on the data (converted data) at each time point exceeds a preset threshold.

[0030] The output unit 19 outputs the change point detected by the detection unit 18 .

[0031] [Change point detection process] Next, a change-point detection process (procedure) according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a flowchart showing an example of the change-point detection process according to this embodiment.

[0032] In what follows, we will assume that the number of devices that make up the system (S) is M, the number of data items that represent the system state at each point in time is K, and the number of observation points in the time series data is N, and that the time series data is composed of N pieces of M × K dimensional data.

[0033] Each element of the M×K dimensional data at each point in time is K observations that represent the state of M devices at that point in time. Specifically, the M×K dimensional data at a certain point in time is expressed as [x 1 ,···,x K ,x K+1 ,···,x 2K ,···,x (M-1)K+1 ,···,x MK ], for example, for m=1, ,M, x (m-1)K+1 ,···,x mK are the K observations of the mth device at that time.

[0034] Step S11: First, the input unit 11 inputs time series data consisting of N pieces of M×K (number of devices×number of items) dimensional data. That is, the M×K dimensional data at time point n is converted into X n Then, the input unit 11 receives the time series data {X 1 ,···,X N}.

[0035] Step S12: Next, the time window generating unit 12 converts the data at each time point from M×K (number of devices×number of items) dimensional data to M×K×W (number of devices×number of items×time window length) dimensional data by dividing the time series data input in step S11 with a time window of fixed length W, generates converted data, and performs intermediate output. Specifically, the M×K dimensional data X n-(W-1) ,X n-(W-2) ,···,X n The M×K×W dimensional vector Y n =(X n-(W-1) ,X n-(W-2) ,···,X n ) is the M×K×W dimensional data at time n. Note that the original M×K dimensional data X n is observed for time points n=1,...,N, the transformed M×K×W dimensional data Y n is obtained for time points n = W, , N.

[0036] Step S13: Next, the period setting unit 13 extracts time series data of the past period and the current period set in advance from the M×K×W (number of devices×number of items×time window length) dimensional time series data generated in step S12. Specifically, when the past period is [s1, e1] and the current period is [s2, e2], the M×K×W dimensional data Y n From past period data {Y s1 ,···,Y e1} and the current period data {Y s2 ,···,Y e2} to extract.

[0037] Step S14: Next, the clustering unit 14 obtains a cluster sequence corresponding to the time series data by classifying (e1-s1+e2-s2+2) pieces of M×K×W (number of devices×number of items×time window length) dimensional data constituting the time series data of the past period of length (e1-s1+1) and the current period of length (e2-s2+1) extracted in step S13 using a clustering method. Specifically, the clustering unit 14 obtains a cluster sequence corresponding to the time series data by classifying (e1-s1+e2-s2+2) pieces of M×K×W dimensional data Y n The cluster to which belongs is C n Then, the time series data for the past period {Y s1 ,···,Y e1} to the cluster series {C s1 ,···,C e1}, time series data for the current period {Y s2 ,···,Y e2} to the cluster series {C s2 ,···,C e2} is obtained. Clustering is a process of classifying (e1-s1+e2-s2+2) pieces of M×K×W dimensional data into the same cluster if the data are close to each other based on the distance between them. A cluster sequence is obtained by arranging the clusters assigned to each M×K×W dimensional data in chronological order. As the clustering method, a hierarchical method (e.g., shortest distance method, longest distance method, group average method, Ward's method, etc.) or a non-hierarchical method (e.g., K-Means method, etc.) may be used.

[0038] Step S15: Next, the cluster transition sequence creation unit 15 tracks the clusters assigned in step S14 in the time axis direction for the M×K×W (number of devices×number of items×time window length) dimensional data at each point in time of the past period [s1, e1] and the current period [s2, e2], creates a sequence of cluster transitions between different clusters for each of the past period and the current period, and assigns the duration of stay in the cluster to each cluster that constitutes this cluster transition sequence. Specifically, the time series data {Y s1 ,···,Y e1 The cluster sequence {C s1 ,···,C e1} as an example, the time when a cluster transition occurs between different clusters in the interval [s1, e1] is called τ i (i=1,2,...,I) (where τ 1 =s1), at time τ i The cluster of the post-transition cluster in c(τ i ), then by arranging them in chronological order, we obtain a cluster transition sequence c(τ 1 ) →c(τ 2 ) →···→c(τ I ) is obtained. In addition, each cluster c(τ i ) for the cluster c(τ i ) duration of stay d(τ i )=τ i+1 -τ i (However, τ I+1 = e1), we obtain the cluster transition sequence c(τ 1 )|d(τ 1 ) →c(τ 2 )|d(τ 2 ) →···→c(τ I )|d(τ I ) is obtained.

[0039] Step S16: Next, the cluster transition tensor calculation unit 16 extracts a cluster transition of a preset fixed length L from the cluster transition sequence created in step S15, calculates the occurrence probability of each cluster transition pattern in the past period and the current period, and calculates a cluster transition tensor for each of the past period and the current period, with the cluster transition length L as the rank (dimension), unique values ​​of all clusters that appeared in the past period and the current period as indices for each dimension, and the occurrence probability of the cluster transition pattern as a value. Specifically, the time series data {Y s1 ,···,Y e1}, the cluster transition sequence c(τ 1 ) →c(τ 2 ) →···→c(τ I ) as an example, we can extract (I-(L-1)) cluster transitions of length L (where L≦I) from this cluster transition sequence, and c(τ i-(L-1) ) →c(τ i-(L-2) ) →···→c(τ i ) (i=L, . . . , I). The cluster transition tensor calculation unit 16 calculates the occurrence probability for each pattern of the (I-(L-1)) cluster transitions, and calculates an L-dimensional cluster transition tensor based on the probability. Here, the occurrence probability of a cluster transition pattern is the value obtained by dividing the occurrence frequency of the cluster transition pattern by the total occurrence frequency of all cluster transition patterns.

[0040] The frequency of occurrence of a cluster transition pattern may be a value weighted by the duration of stay of the cluster transition pattern. Below, for simplicity, a method for storing the occurrence probability of a cluster transition pattern in a tensor will be explained using an example in which L=2 and the unique values ​​of all clusters that have appeared throughout the past and current periods are α, β, and γ. In this case, the cluster transition tensor is two-dimensional, and the index of each dimension takes three values ​​α, β, and γ. The cluster transition tensor can be represented by a 3×3 array, and if the occurrence probability of the cluster transition pattern α→β is 0.1, the occurrence probability of 0.1 is stored in the array element whose first axis index (first element of the cluster transition pattern) takes the value α and whose second axis index (second element of the cluster transition pattern) takes the value β.

[0041] Step S17: Next, the change point score calculation unit 17 calculates the distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as the degree of change from the past period to the current period based on the cluster transition tensors for the past period and the current period calculated in step S16. 1 The elements of d 1 i1,···,iL , the cluster transition tensor D for the current period 2 The elements of d 2 i1,···,iL Then, the distance between the two can be expressed, for example, by the mean square error as follows: (Σ l=1 L Σ m=1 M (d 2 i1,···,iL -d 1 i1,···,iL ) 2 / M L ) 1 / 2 In the inter-tensor distance below, M is the number of unique values ​​in all clusters that appeared throughout the past and current periods.

[0042] Step S18: Next, the detection unit 18 detects a change point when the change point score calculated in step S17 exceeds a preset threshold. That is, the detection unit 18 detects a change point when the change point score of the system state calculated based on the data (converted data) at each time point exceeds a preset threshold.

[0043] Step S19: Finally, the output unit 19 outputs the change point detected in step S18.

[0044] [Hardware configuration] Next, the hardware configuration of the change-point detection device 10 will be described with reference to Fig. 3. Fig. 3 is a diagram showing the hardware configuration of the change-point detection device.

[0045] 3, the change-point detection device 10 includes a processor 101, a memory 102, an auxiliary storage device 103, a connection device 104, a communication device 105, and a drive device 106. The hardware components constituting the change-point detection device 10 are connected to each other via a bus 107.

[0046] The processor 101 serves as a control unit that controls the entire change-point detection device 10, and includes various arithmetic devices such as a CPU (Central Processing Unit). The processor 101 reads various programs onto the memory 102 and executes them. The processor 101 may include a GPGPU (General-purpose computing on graphics processing units).

[0047] The memory 102 has a main storage device such as a Read Only Memory (ROM) and a Random Access Memory (RAM). The processor 101 and the memory 102 form a so-called computer, and the processor 101 executes various programs read onto the memory 102, causing the computer to realize various functions.

[0048] The auxiliary storage device 103 stores various programs and various information used when the processor 101 executes the various programs.

[0049] The connection device 104 is a connection device that connects an external device (for example, a display device 110, an operation device 111) and the change-point detection device 10.

[0050] The communication unit 105 is a communication device for transmitting and receiving various types of information to and from other units.

[0051] The drive device 106 is a device for setting the recording medium 130. The recording medium 130 here includes media that record information optically, electrically, or magnetically, such as a CD-ROM (Compact Disc Read-Only Memory), a flexible disk, a magneto-optical disk, etc. The recording medium 130 may also include semiconductor memories that record information electrically, such as a ROM (Read Only Memory), a flash memory, etc.

[0052] The various programs to be installed in the auxiliary storage device 103 are installed, for example, by setting the distributed recording medium 130 in the drive device 106 and reading out the various programs recorded on the recording medium 130 by the drive device 106. Alternatively, the various programs to be installed in the auxiliary storage device 103 may be installed by being downloaded from a network via the communication device 105.

[0053] [Main Effects of the Embodiments] As described above, the change-point detection device 10 of this embodiment can detect the time point at which any change occurs in the system state as a change point by using time series data representing the system state at each point in time of a system (S) composed of one or more devices.

[0054] Moreover, the change-point detection device 10 according to the present embodiment is premised on a method of classifying the system state at each time point by a clustering method, and is therefore capable of targeting time-series data including data that does not satisfy stationarity constraints or iid constraints, such as data that exhibits periodic fluctuations. Furthermore, the change-point detection device 10 according to the present embodiment models periodic fluctuations of the system (S) by considering state transitions of the system (S) over time (i.e., transitions between clusters to which the system state belongs at each time point and the duration of such transitions), and is capable of detecting changes including changes in time-varying patterns, such as changes in periodic fluctuations.

[0055] 〔supplement〕 The present invention is not limited to the above-described embodiment, and may have the following configurations or processes (operations).

[0056] The change-point detection device 10 can be realized by a computer and a program, and this program can be recorded on a (non-transitory) recording medium or provided via a network such as the Internet.

[0057] [Additional notes] This embodiment can be expressed as follows.

[0058] [Additional Note 1] A change point detection device having a processor, The processor, an input step of inputting time series data representing a system state at each point in time of a system composed of one or more devices, the time series data being composed of data of dimensions of the number of devices constituting the system x the number of items representing the states of the devices; a time window generation step of generating converted data by converting the time series data at each time point from data of dimensions of number of devices x number of items to data of dimensions of number of devices x number of items x time window length; a detection step of detecting a change point when the change point score of the system state calculated based on the converted data at each time point exceeds a preset threshold; A change point detection device that performs the above.

[0059] [Additional note 2] The change point detection device according to claim 1, The processor, A clustering step of classifying, by a clustering method, the dimensional data of the number of devices x the number of items x the time window length at each time point constituting the time series data of the preset past period and the current period; a cluster transition sequence creation step of tracking clusters assigned to the dimensional data of the number of devices x the number of items x the time window length in a time axis direction, creating a sequence of cluster transitions between different clusters for each of the past period and the current period, and assigning a duration of stay in the cluster to each cluster constituting the sequence of cluster transitions; a cluster transition tensor calculation step of extracting a cluster transition of a preset fixed length from the sequence of cluster transitions, calculating the occurrence probability of each cluster transition pattern in a past period and a current period, and calculating, for each of the past period and the current period, a cluster transition tensor having the length of the cluster transition as a dimension, unique values ​​of all clusters that have appeared in the past period and the current period as indexes for each dimension, and the occurrence probability of each cluster transition pattern as a value; a change point score calculation step of calculating a distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as a degree of change from the past period to the current period based on the cluster transition tensor calculated for each of the past period and the current period; A change point detection device that performs the above.

[0060] [Additional note 3] an input step of inputting time series data representing a system state at each point in time of a system composed of one or more devices, the time series data being composed of data of dimensions of the number of devices constituting the system x the number of items representing the states of the devices; a time window generation step of generating converted data by converting the time series data at each time point from data of dimensions of number of devices x number of items to data of dimensions of number of devices x number of items x time window length; a detection step of detecting a change point when the change point score of the system state calculated based on the converted data at each time point exceeds a preset threshold; A change point detection method implemented by a computer.

[0061] [Additional Note 4] A non-transitory recording medium having a program recorded thereon for causing a computer to execute the method described in appended claim 3. [Explanation of symbols]

[0062] 10. Change point detection device 11 Input section 12 Time window generation unit 13 Period Setting Section 14 Clustering Department 15 Cluster transition sequence creation section 16 Cluster transition tensor calculation part 17 Change point score calculation section 18 Detection unit 19 Output section

Claims

1. an input unit for inputting time-series data representing a system state at each point in time of a system composed of one or more devices, the time-series data being composed of data of dimensions of the number of devices constituting the system x the number of items representing the states of the devices; a time window generating unit that generates converted data by converting the time series data at each time point from data of dimensions of number of devices x number of items to data of dimensions of number of devices x number of items x time window length; A clustering unit that classifies states of dimensional data of the number of devices x the number of items x the time window length at each time point constituting the time series data of a preset past period and a preset current period by a clustering method; a cluster transition sequence creation unit that tracks clusters assigned to the dimensional data of the number of devices x the number of items x the time window length in a time axis direction, creates a sequence of cluster transitions between different clusters for each of the past period and the current period, and assigns a duration of stay in the cluster to each cluster that constitutes the sequence of cluster transitions; a cluster transition tensor calculation unit that extracts a cluster transition of a preset fixed length from the sequence of cluster transitions, calculates the occurrence probability of each cluster transition pattern in a past period and a current period, and calculates a cluster transition tensor for each of the past period and the current period, the cluster transition tensor having the length of the cluster transition as a dimension, unique values ​​of all clusters that have appeared in the past period and the current period as indexes for each dimension, and the occurrence probability of each cluster transition pattern as a value; a change point score calculation unit that calculates a distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as a degree of change from the past period to the current period based on the cluster transition tensor calculated for each of the past period and the current period; a detection unit that detects a change point when the change point score of the system state calculated based on the converted data at each time point exceeds a preset threshold; A change point detection device having the following.

2. an input step of inputting time series data representing a system state at each point in time of a system composed of one or more devices, the time series data being composed of data of dimensions of the number of devices constituting the system x the number of items representing the states of the devices; a time window generation step of generating converted data by converting the time series data at each time point from data of dimensions of number of devices x number of items to data of dimensions of number of devices x number of items x time window length; A clustering procedure for classifying states of data of dimensions (number of devices x number of items x time window length) at each time point constituting the time series data of a preset past period and a preset current period, using a clustering method; a cluster transition sequence creation step of tracking clusters assigned to the dimensional data of the number of devices x the number of items x the time window length in a time axis direction, creating a sequence of cluster transitions between different clusters for each of the past period and the current period, and assigning a duration of stay in the cluster to each cluster constituting the sequence of cluster transitions; a cluster transition tensor calculation step of extracting a cluster transition of a preset fixed length from the sequence of cluster transitions, calculating the occurrence probability of each cluster transition pattern in a past period and a current period, and calculating a cluster transition tensor for each of the past period and the current period, the cluster transition tensor having the length of the cluster transition as a dimension, unique values ​​of all clusters that have appeared in the past period and the current period as an index for each dimension, and the occurrence probability of each cluster transition pattern as a value; a change point score calculation step of calculating a distance between the cluster transition tensor in the past period and the cluster transition tensor in the current period as a degree of change from the past period to the current period based on the cluster transition tensor calculated for each of the past period and the current period; a detection step of detecting a change point when the change point score of the system state calculated based on the converted data at each time point exceeds a preset threshold; A change point detection method implemented by a computer.

3. A program for causing a computer to execute the method according to claim 2.

Images