Information processing device, control method for information processing device, and control program for information processing device

Abstract

To provide a technology which detects an abnormality in an apparatus, with high accurately, from data in which noise is included.SOLUTION: An information processing device comprises: an acquisition unit which acquires time-series data measured at predetermined time intervals, from a monitoring object; a generation unit which creates a learning model which detects an abnormality in the monitoring object, on the basis of a feature amount of a plurality of sub-data sets extracted by moving a predetermined width window by a predetermined shift width in a time axis direction, from the acquired past time-series data, and the latest data among the data included in the sub-data set; and a determination unit which determines presence / absence of the abnormality in the monitoring object, by using the learning model, from the feature amount of the sub-data set including the latest data and the latest data, extracted from the time-series data newly acquired from the monitoring object.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, a control method for an information processing device, and a control program for an information processing device. [Background technology]

[0002] BACKGROUND ART Conventionally, a fault monitoring device that monitors the operating state of a device and notifies of a detected fault has been disclosed (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-049551 Summary of the Invention [Problem to be solved by the invention]

[0004] Data acquired from equipment by a fault monitoring device may contain noise that is essentially unrelated to equipment abnormalities, such as noise generated in the equipment itself or in the communication path, etc. There has been a demand for technology that can accurately detect equipment abnormalities based on data that contains this noise. [Means for solving the problem]

[0005] An information processing device according to one embodiment of the present disclosure includes an acquisition unit that acquires time series data measured at predetermined time intervals from a monitoring target; a generation unit that generates a learning model that detects anomalies in the monitoring target based on feature amounts of multiple sub-datasets extracted from the acquired past time series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift amount and the latest data among the data included in the sub-datasets; and a determination unit that uses the learning model to determine whether or not anomalies are present in the monitoring target from the feature amounts of the sub-dataset including the latest data extracted from time series data newly acquired from the monitoring target and the latest data.

[0006] In the information processing device according to an embodiment of the present disclosure, the determination unit may use the mean and standard deviation of the data included in the sub-data set as the feature amount of the sub-data set.

[0007] In an information processing device according to an embodiment of the present disclosure, a generation unit may generate a learning model by supervised machine learning in which data indicating an abnormality in the monitored object is labeled as an abnormality in past time series data acquired from the monitored object.

[0008] In an information processing device according to an embodiment of the present disclosure, the generation unit may generate a learning model by unsupervised machine learning using past time-series data acquired from a monitoring target.

[0009] In an information processing device according to one embodiment of the present disclosure, the generation unit may determine the specified width in generating a learning model based on the time required for the judgment unit to determine whether or not an abnormality exists when the specified width is varied, and the accuracy rate of the judgment of whether or not an abnormality exists.

[0010] In an information processing device according to one embodiment of the present invention, the monitored object is a network device, and the time series data may include at least one of noise generated in the monitored object and noise generated on the communication path from the monitored object to the information processing device.

[0011] In an information processing device according to one embodiment of the present invention, the generation unit may generate a learning model using any of linear discriminant analysis, logistic regression, SVM (Support Vector Machine), neural network, K-nearest neighbor method, decision tree, and deep learning.

[0012] A control method for an information processing device according to an embodiment of the present disclosure includes the steps of: acquiring, by the information processing device, time series data measured at predetermined time intervals from a monitored object; generating a learning model for detecting anomalies in the monitored object based on feature values of multiple sub-datasets extracted from the acquired past time series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-datasets; and determining the presence or absence of anomalies in the monitored object using the learning model based on the feature values of the sub-dataset including the latest data extracted from newly acquired time series data from the monitored object and the latest data.

[0013] A control program for an information processing device according to an embodiment of the present disclosure enables the information processing device to perform the following functions: acquire time series data measured at predetermined time intervals from a monitored object; generate a learning model to detect anomalies in the monitored object based on feature values of multiple sub-datasets extracted from the acquired past time series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-datasets; and determine the presence or absence of anomalies in the monitored object using the learning model based on the feature values of the sub-dataset including the latest data extracted from newly acquired time series data from the monitored object and the latest data. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a schematic diagram showing an example of a monitoring system configuration and an information processing device configuration according to an embodiment of the present invention. [Figure 2] FIG. 2 is an example of a flowchart showing processing by an information processing device according to an embodiment of the present invention. [Figure 3] FIG. 3 shows an example of time-series data acquired by an information processing device from a monitored device. [Figure 4] 4(a) and 4(b) are diagrams illustrating generation of a learning model by an information processing device according to one embodiment of the present invention. [Figure 5] FIG. 5 is a diagram illustrating generation of a learning model by an information processing device according to one embodiment of the present invention. [Figure 6] FIG. 6 is a diagram illustrating the determination of the window width according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, an embodiment of the invention according to the present disclosure (also referred to as the present invention) will be described using the drawings. Note that the drawings are merely examples, and the present invention is not limited to those shown in the drawings. For example, the illustrated information processing device (server), the number of monitored devices, the time-series data graph, the data set (table), and the flowchart are merely examples, and the present invention is not limited to these.

[0016] FIG. 1 is a schematic diagram showing the configuration of a monitoring system according to one embodiment. The monitoring system 600 may be an information processing system in which an information processing device (monitoring server) 100 monitors and manages a monitored device 200 via a network 500. The network 500 may include at least one of a radio access network (RAN), a wireless LAN (WLAN), a wide area network (WAN), LTE (long term evolution), LTE-Advanced, fourth generation communication (4G), fifth generation communication (5G), and sixth generation communication (6G) or later mobile communication systems. Note that the network 500 is not limited to these examples and may be, for example, a public switched telephone network (PSTN), a satellite communication network, a dedicated network, or the like. The network 500 may also be a combination of these.

[0017] The information processing device 100 may be any device, such as a server, that is capable of executing various processes related to monitoring the network 500. Although only one information processing device 100 is shown in FIG. 1, the present invention is not limited to this. The functions hereinafter described as being provided by the information processing device 100 may be implemented by multiple servers. Furthermore, the information processing device 100 may be, for example, a distributed server system that cooperates by communicating via a network, or may be a so-called cloud server. The information processing device 100 is not limited to a physical server, but may also include a virtual server implemented by software.

[0018] The monitored device 200 may be a network device such as a router or a switch, and may be a communication device connected to the information processing device 100 so as to be able to communicate with each other via the network 500. In addition, the monitored device may be a server, an IoT (Internet of Things) device, or the like, but is not limited to these.

[0019] The monitored device 200 transmits and receives various time-series data to and from the information processing device 100 using various technologies such as SNMP (Simple Network Management Protocol), Syslog, and IPMI (Intelligent Platform Management Interface). Note that the following description will be given taking an example of a network device that complies with SNMP as the monitored device 200.

[0020] The hardware configuration and functional configuration of an information processing device 100 according to one embodiment of the present invention will be described with reference to FIG.

[0021] 1 is a configuration diagram of an information processing device 100 according to one embodiment of the present invention. The information processing device 100 may include, as hardware components, a control unit 110, a communication unit 120, an input / output unit 130, and a storage unit 170. Although not shown, the information processing device 100 may also include components that are included in a general server.

[0022] The control unit 110 is typically a processor, and may be a central processing unit (CPU), a micro processing unit (MPU), etc. The control unit 110 may execute the functions and methods described in each embodiment by reading a program stored in the storage unit 170 and executing code or instructions included in the read program.

[0023] The storage unit 170 may store (contain) various programs and various data required for the operation of the information processing device 100. For example, the storage unit 170 may store various time-series data transmitted from the monitored device 200, as will be described in detail later. The storage unit 170 may include, for example, a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc. The storage unit 170 may also include a memory that provides a working area for the control unit 110. Note that the various data acquired from the monitored device 200 may be stored in another database server (not shown).

[0024] In order to use the data acquired from the monitored device 200 as time-series data, pre-processing such as adding a timestamp and converting units may be required. Therefore, the information processing device 100 may store a program, software, etc. that performs the pre-processing.

[0025] Here, the data acquired from the monitored device 200 may be an accumulated value. Specifically, for example, when the number of packets transmitted and received by the monitored device 200 is acquired using SNMP, the accumulated value of the number of packets transmitted and received by the monitored device 200 up to that point is acquired. Such data may be referred to as a "counter value." When the information processing device 100 acquires a counter value from the monitored device 200, pre-processing such as adding a timestamp and calculating the difference from the previously acquired counter value is required. Such processing may be realized by known software such as Zabbix (registered trademark) or Cacti. When the data acquired by the information processing device 100 from the monitored device 200 is a counter value, the data after pre-processing may be treated as time-series data. In the following description, when the term "time-series data" is used, it is assumed that the necessary pre-processing has been performed appropriately.

[0026] The communication unit 120 may be implemented as hardware such as a network interface card (NIC), communication software, or a combination of these. The communication unit 120 may transmit and receive information between the information processing device 100 and other devices, and may, for example, receive data necessary for monitoring the monitoring target device 200 from other servers or storage devices (database servers) not shown, or transmit data related to monitoring the monitoring target device 200 to a terminal of an administrator not shown.

[0027] The input / output unit 130 may include an input device for inputting various operations to the information processing device 100, and an output device for outputting processing results processed by the information processing device 100. The input device may include, for example, a touch panel, a touch display, hardware keys such as a keyboard, a pointing device such as a mouse, a camera (for inputting operations via images), and a microphone (for inputting operations via voice). The output device outputs processing results processed by the control unit 110, and may include, for example, a touch panel, a speaker, etc.

[0028] Next, the functional configuration of the information processing device 100 will be described. The information processing device 100 may include an acquisition unit 111, a generation unit 112, a determination unit 113, a notification unit 114, and a calculation unit 115 as functions realized by a control unit 110. Note that in FIG. 1, functional units that are not essential for the embodiments described hereinafter may be omitted. Furthermore, the functions or processes of each functional unit may be realized by machine learning or AI to the extent feasible.

[0029] Details will be described later, but the processing of each functional unit will be briefly described. The acquisition unit 111 may acquire time-series data measured at predetermined time intervals from the monitored device 200. The generation unit 112 may generate a learning model for detecting anomalies in the monitored device 200 based on the acquired past time-series data. The determination unit 113 may determine the presence or absence of anomalies in the monitored device 200 using the generated learning model from the latest data newly acquired from the monitored device 200. The notification unit 114 may output various notifications to a monitor or the like. The calculation unit 115 may perform various arithmetic processing.

[0030] Hereinafter, one embodiment of the present invention will be described with reference to FIGS. 2 to 6 along with the processing of each functional unit of the information processing device 100.

[0031] 2 is an example of a flowchart showing processing by the information processing device 100 according to an embodiment. First, the acquisition unit 111 may acquire time-series data measured at predetermined time intervals from the monitored device 200 (step S11). Here, the time-series data acquired from the monitored device 200 may be data that can detect the occurrence of an abnormality in the monitored device 200. Examples of the time-series data may include, but are not limited to, CPU usage, memory usage, device temperature, traffic volume, and the number of error packets. Furthermore, the predetermined time interval may be, for example, every 3 minutes, every 5 minutes, or every 10 minutes, but is not limited to these.

[0032] An example of a graph showing changes in time-series data is shown in Fig. 3. In Fig. 3, the graph DT10 may be an example showing changes in time series of a value (hereinafter referred to as "difference rate") obtained by dividing the difference between the number of packets flowing into the router and the number of packets flowing out of the router when the monitored device 200 is a router, by the number of packets flowing into the router.

[0033] Here, it is known that, depending on the timing of acquisition, such as when the acquisition unit 111 acquires time-series data from the monitored device 200 while the monitored device 200 is performing a switching process, incomplete time-series data may be acquired, and data at a certain point in time in the time series may be missing (hereinafter referred to as "missing data"). If the time-series data used to calculate the difference rate includes missing data, the calculation of the difference rate will not be performed correctly, which will have an adverse effect on monitoring of the monitored device 200.

[0034] For example, as shown in Fig. 3, noises n11 to n16 occur in the graph DT10. This may be caused by, for example, data relating to packets being acquired during the switching process in the router, resulting in missing data, and does not indicate an abnormality in the router if the switching process is performed normally.

[0035] If no abnormality occurs in the router, the packets that flow out are user traffic packets (hereinafter referred to as "user packets"), excluding a small number of packets (hereinafter referred to as "control packets") such as management packets and multicast packets. When a sufficient number of user packets are flowing, the influence of control packets is minimal and can be ignored. The difference between the number of inflow packets and the number of outflow packets is close to "0." Therefore, the difference rate in graph DT10, which shows the difference rate, is close to "0." For the above reasons, when the monitored device 200 is operating normally, the deviation of the difference rate from "0" due to the influence of missing data is not due to a router abnormality and should not contribute to abnormality detection. In other words, in graph DT10, although noise n11 to n14 is included up to time "t1," it is necessary to consider that no abnormality has occurred in the router. Depending on the model of the monitored device 200, a difference may occur between the number of incoming packets and the number of outgoing packets due to factors other than control packets. However, even in this case, in a situation where user packets account for the majority of the packets processed by the monitored device 200, the difference is small and can be ignored.

[0036] In contrast, when an abnormality occurs in the monitored device 200, the difference rate deviates from "0" even after subtracting the effect of missing data. Specifically, for example, in graph DT10, the value of the difference rate deviates from "0" after time "t1," indicating the occurrence of an abnormality. Note that even when an abnormality occurs, noises n15 and n16 affected by missing data are included. As described above, such noise occurs when acquiring data in the device or in the communication path, and can reduce the accuracy of detecting the occurrence of an abnormality. The present invention provides a technology that reduces the effect of such noise and accurately detects the occurrence of an abnormality in the monitored device.

[0037] 2, the generation unit 112 may generate a learning model for detecting anomalies in the monitored object based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-data sets (step S12). That is, the generation unit 112 may generate a classification model by machine learning for determining whether data newly acquired from the monitored device 200 is classified as "anomalous" or "normal."

[0038] Here, the generation of a learning model according to one embodiment will be described with reference to FIG. 4. FIG. 4 shows a portion of time-series data DT10 used to generate the learning model. FIG. 4(a) may represent normal data, and FIG. 4(b) may represent abnormal data. The labeling of "abnormal" or "normal" will be described later. Here, the time-series data DT10 is a collection of time-series data acquired over a certain period of time in the monitored device 200 in the past. For generating the learning model, it is desirable to include data when an abnormality occurs. That is, although FIGS. 4(a) and 4(b) are shown separately, they may each represent a portion of continuous data. The certain period of time in the past may be, for example, one year, six months, three months, etc., but is not limited thereto.

[0039] The generation unit 112 may learn past time series data using the sliding window concept, which is known in detecting anomalies in time series data. A window may be a concept of extracting data from time series data such as that shown in FIG. 4 at a time width equal to the window width. For example, the generation unit 112 may generate multiple sub-datasets f11, f12, f13, etc. by shifting a window with a predetermined width of "9" in the time axis direction by a predetermined shift width of "1". Note that the sub-datasets may be a collection of multiple consecutive time series data. In the example of FIG. 4(a), the sub-datasets f11, f12, and f13 may include nine pieces of data d1 to d9, d2 to d10, and d3 to d11, respectively. Note that, in this example, one window is five minutes long, and the window width of "9" may mean extracting 45 minutes of time series data. Note that the window width is not limited to "9", and the shift width is not limited to "1".

[0040] Here, the "features of the sub-datasets" refer to the mean and standard deviation of the data included in the sub-datasets. According to one embodiment of the present invention, supervised learning may be performed for each sub-dataset, with the mean, standard deviation, and the most recent data included in the sub-dataset as input variables, and a binary value, for example, 1 or 0, used to label whether the sub-dataset is "normal" or "abnormal" as an output variable. In the example of FIG. 4(a), the mean, standard deviation, and data d9 of data d1 to d9 included in sub-dataset f11 may be used as input variables. Also, the mean, standard deviation, and data d10 of data d2 to d10 included in sub-dataset f12 may be used as input variables.

[0041] Here, the sub-datasets f11, f12, and f13 may be labeled as "normal" during machine learning. Furthermore, the sub-dataset f20 in FIG. 4(b) may be labeled as "abnormal" during machine learning. The "abnormal" label may be assigned when the data d25 at the center C of the window indicates "abnormal" as shown in FIG. 4(b), but is not limited thereto. The label may also be assigned when the latest data in the sub-dataset indicates "abnormal."

[0042] The determination unit 113 may determine whether or not there is an abnormality in the monitored device 200 using the learning model generated by the generation unit 112 from the features of the sub-dataset including the latest data newly acquired from the monitored device 200 and the latest data (step S13).

[0043] The process of determining whether or not an abnormality exists will be described with reference to FIG. 5. FIG. 5 may show the transition of data currently being acquired from the monitored device 200. The calculation unit 115 may calculate the mean and standard deviation as feature quantities of the sub-dataset f31 including the latest data d39. The calculation unit 115 may also input the feature quantities of the sub-dataset f31 and the value of the latest data d39 into the learning model generated by the generation unit 112. The determination unit 113 may determine whether or not an abnormality exists in the monitored device 200 depending on whether the output of the learning model is "abnormal" or "normal."

[0044] As described above, according to one embodiment of the present invention, the latest data in the sub-data set may be used as input variables when generating a learning model, thereby enabling the generated learning model to quickly detect the presence or absence of anomalies in newly acquired data.

[0045] According to one embodiment of the present invention, the mean and standard deviation may be calculated within the sub-dataset, and these values may be used to generate a learning model. In this way, by learning the trends in the mean values for abnormal and normal conditions as well as the trends in the standard deviation when noise is present, the influence of noise can be reduced. Furthermore, by using the three-dimensional data of the latest data within the sub-dataset as input variables in addition to the mean and standard deviation, it becomes easier to distinguish between abnormal and normal data during learning, thereby improving the accuracy of the learning model.

[0046] As described above, noise may occur in the monitored device 200 or in the communication path from the monitored device 200 to the information processing device 100. According to one embodiment of the present invention, it may be possible to suppress the influence of noise that is essentially unrelated to these abnormalities.

[0047] In addition, if it is determined that an abnormality has occurred, the notification unit 114 may output the fact that an abnormality has occurred via the input / output unit 130, or may notify a monitor's terminal (not shown) via the communication unit 120.

[0048] Furthermore, in one embodiment of the present invention, the generation unit 112 may determine the predetermined range in generating a learning model depending on the time required for the determination unit 113 to determine whether or not an abnormality exists and the accuracy rate of the determination of whether or not an abnormality exists when the predetermined range is varied.

[0049] Generally, the wider the window width, the more the influence of noise can be reduced, enabling more accurate classification of abnormal and normal data. However, the wider the window width, the longer it takes to make a determination, especially at the beginning of an abnormality. If the window width is widened, at the beginning of an abnormality, more normal data than abnormal data is included within the window. Therefore, the window must be slid until enough abnormal data is included within the window to be determined as an abnormality, which increases the time required for determination. Figure 6 shows an example of table TB10 showing the changes in the accuracy of the learning model and the time required for determination when the window width is changed. Note that accuracy may refer to the accuracy rate of determination using the generated learning model. As shown in Figure 6, the larger the window width, the higher the accuracy, but the longer the time required for determination. The generation unit 112 may use a window width that requires a higher accuracy rate to determine whether an abnormality exists, for example, within one hour, when generating the learning model. Note that the numerical values are not limited to these.

[0050] As described above, according to one embodiment of the present invention, a learning model is generated that takes into account the time and accuracy required for anomaly detection, thereby enabling accurate anomaly detection while reducing the processing load on the information processing device.

[0051] The above describes a mode in which a learning model is generated by supervised machine learning with labels of abnormal and normal. This makes it possible to generate a highly accurate learning model for monitored devices for which past time-series data has been acquired.

[0052] However, according to one embodiment of the present invention, the generation unit 112 may generate a learning model by unsupervised machine learning using past time-series data acquired from the monitored device 200. This makes it possible to generate a more versatile learning model.

[0053] The machine learning in one embodiment of the present invention may use any of linear discriminant analysis, logistic regression, SVM (Support Vector Machine), neural network, K-nearest neighbor method, decision tree, and deep learning.

[0054] While the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art would readily be able to make various modifications and alterations based on the present disclosure. Therefore, it should be noted that these modifications and alterations are within the scope of the present invention. For example, the functions included in each component, step, etc. may be rearranged so as not to cause logical inconsistencies, and multiple components, steps, etc. may be combined or separated into one. Furthermore, the configurations described in the above embodiments may be appropriately combined. For example, each component described as being included in the information processing device 100 may be realized in a distributed manner across multiple servers.

[0055] For example, in the above description, a router is used as the monitored device and the difference rate is used as the time-series data, but abnormalities may be determined based on other types of data.

[0056] In addition, the above describes an example of a learning model that classifies data newly acquired from a monitored device as either "abnormal" or "normal." However, a learning model that predicts whether an abnormality has occurred may be generated based on the tendency of data newly acquired from the monitored device 200.

[0057] The programs of the embodiments of the present disclosure may be provided in a state stored in a storage medium readable by an information processing device. The storage medium may store the programs in a "non-transitory tangible medium." The programs include, for example, software programs and information processing device programs. When the functional units of the information processing device 100 as an information processing device are realized by software, the information processing device 100 functions as an acquisition unit 111, a generation unit 112, a determination unit 113, and a notification unit 114 by the processor executing the programs loaded on the memory.

[0058] The storage medium may, where appropriate, include one or more semiconductor-based or other integrated circuits (ICs) (e.g., field programmable gate arrays (FPGAs), application specific ICs (ASICs), etc.), hard disk drives (HDDs), hybrid hard drives (HHDs), optical disks, optical disk drives (ODDs), magneto-optical disks, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid state drives (SSDs), RAM drives, secure digital cards or drives, any other suitable storage media, or any suitable combination of two or more of these. The storage medium may, where appropriate, be volatile, non-volatile, or a combination of volatile and non-volatile.

[0059] Furthermore, the program of the present disclosure may be provided to the information processing device 100 via any transmission medium (such as a communication network or broadcast waves) capable of transmitting the program.

[0060] Furthermore, each embodiment of the present disclosure may be realized in the form of a data signal embedded in a carrier wave, in which the program is embodied by electronic transmission. Note that the program of the present disclosure may be implemented using, for example, a scripting language such as JavaScript (registered trademark) or Python, or C, Go, Swift, Koltin, Java (registered trademark), or the like.

[0061] According to each aspect of the present disclosure described above, in a world where all devices will be connected via networks after 5G, by providing technology that monitors devices and enables early detection of abnormalities, it is possible to contribute to achieving Goal 9 of the Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote inclusive and sustainable industrialization, and promote innovation and resilience." [Explanation of symbols]

[0062] 100 Information processing device (monitoring server) 110 control section 111 Acquisition Department 112 Generation part 113 Judgment section 114 Notification Department 115 Calculation Unit 120 Communications Department 130 Input / output section 170 Storage section 200 monitored devices 500 Network 600 Information Processing Systems (Monitoring Systems)

Claims

1. an acquisition unit that acquires time-series data measured at predetermined time intervals from a monitoring target; a generation unit that generates a learning model for detecting anomalies in the monitoring target by learning, for each sub-dataset, using the feature amounts of the sub-dataset and the latest data of the data included in the sub-dataset as input variables, based on feature amounts of a plurality of sub-datasets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift amount and the latest data in time series among the data included in the sub-dataset; an information processing device comprising: a determination unit that inputs features of a sub-dataset including the latest data that has been newly acquired from the monitored object and has not been used to generate the learning model, and the newly acquired latest data, into the learning model, and determines whether or not there is an abnormality in the monitored object.

2. the generation unit performs the learning using the presence or absence of an abnormality in the sub-data set as an output variable. The information processing device according to claim 1 .

3. The information processing device according to claim 1 , wherein the determining unit uses a mean and a standard deviation of data included in the sub-data set as the feature quantities of the sub-data set.

4. The information processing device according to claim 1 or 2, wherein the generation unit generates the learning model by supervised machine learning in which data indicating an abnormality in the monitoring target is labeled as an abnormality in the past time-series data acquired from the monitoring target.

5. The information processing device according to claim 3 , wherein the generation unit generates the learning model by unsupervised machine learning using the past time-series data acquired from the monitoring target.

6. 3. The information processing device according to claim 1, wherein the monitoring target is a network device, and the time series data includes at least one of noise occurring in the monitoring target and noise occurring in a communication path from the monitoring target to the information processing device.

7. 3. The information processing device according to claim 1, wherein the generation unit generates the learning model using any one of linear discriminant analysis, logistic regression, SVM (Support Vector Machine), neural network, K-nearest neighbor method, decision tree, and deep learning.

8. The information processing device acquiring time-series data measured at predetermined time intervals from a monitoring target; generating a learning model for detecting anomalies in the monitored object by learning for each sub-dataset using the feature amounts of the sub-dataset and the latest data in time series among the data included in the sub-dataset as input variables, based on feature amounts of a plurality of sub-datasets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift amount and the latest data in time series among the data included in the sub-dataset; a step of inputting features of a sub-dataset including the latest data newly acquired from the monitored object and not used in generating the learning model, and the newly acquired latest data, into the learning model, and determining whether or not there is an abnormality in the monitored object.

9. In the information processing device, A function to acquire time series data measured at predetermined time intervals from the monitored object, a function of generating a learning model for detecting anomalies in the monitored object by learning, for each sub-dataset, using as input variables the feature amounts of the sub-dataset and the latest data among the data included in the sub-dataset, based on feature amounts of a plurality of sub-datasets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift amount and the latest data in time series among the data included in the sub-dataset; a control program for an information processing device that realizes a function of inputting features of a sub-dataset including the latest data newly acquired from the monitored object and not used in generating the learning model, and the newly acquired latest data, into the learning model, and determining whether or not there is an abnormality in the monitored object.

10. an acquisition unit that acquires time-series data measured at predetermined time intervals from a monitoring target; a generation unit that generates a learning model for detecting anomalies in the monitoring target based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-data sets; a determination unit that determines the presence or absence of an abnormality in the monitoring target using the learning model from features of a sub-dataset including latest data extracted from newly acquired time-series data from the monitoring target and the latest data, The information processing device wherein the generation unit determines the predetermined range in generating the learning model based on the time required for the determination unit to determine whether or not an abnormality exists when the predetermined range is varied and the accuracy rate of the determination of whether or not an abnormality exists.

11. The information processing device acquiring time-series data measured at predetermined time intervals from a monitoring target; generating a learning model for detecting anomalies in the monitored object based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width and the latest data included in the sub-data sets; determining whether or not there is an abnormality in the monitored object using the learning model from the latest data and feature amounts of a sub-dataset including the latest data extracted from the newly acquired time-series data from the monitored object; Run A control method for an information processing device, wherein the generating step determines the predetermined range in accordance with the time required to determine the presence or absence of the abnormality in the judging step when the predetermined range is varied in generating the learning model, and the accuracy rate of the determination of the presence or absence of the abnormality.

12. In the information processing device, A function to acquire time series data measured at predetermined time intervals from the monitored object, a function of generating a learning model for detecting anomalies in the monitored object based on feature amounts of a plurality of sub-data sets extracted from the acquired past time-series data by shifting a window of a predetermined width in the time axis direction by a predetermined shift width, and the latest data included in the sub-data sets; a function of determining the presence or absence of an abnormality in the monitoring target using the learning model from the latest data and feature amounts of a sub-dataset including the latest data extracted from newly acquired time-series data from the monitoring target; To achieve this, A control program for an information processing device, in which the generating function determines the predetermined range in accordance with the time required for the judging function to determine the presence or absence of the abnormality when the predetermined range is varied in generating the learning model, and the accuracy rate of the determination of the presence or absence of the abnormality.

Images