Anomaly detection system, anomaly detection method, and anomaly detection program

Abstract

To provide an anomaly detection system capable of detecting anomaly in a target project by comparing how the target project has been progressing to a threshold based on a number of past projects.SOLUTION: An anomaly detection system according to an embodiment is configured to: adapt the number of elapsed months and achievements in performance data of a plurality of past similar projects to a scale of budget data of a target project for anomaly determination; compute a threshold based on the number of elapsed months and achievements in the scale-matched performance data of the plurality of past similar projects; and perform anomaly determination by comparing the performance data of the target project for anomaly determination with the computed threshold.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to an anomaly detection system, an anomaly detection method, and an anomaly detection program. [Background technology]

[0002] For example, in industries that use project-based management, such as construction and system development, where progress is accumulated over a period of time, there is a demand to "determine whether the accumulation is appropriate by comparing it with similar projects from the past."

[0003] In the past, if the construction period and actual results of past projects differed from the construction period and budget of the project for which an abnormality was to be detected, it was not possible to compare how the results accumulated. Also, when an abnormality was detected based on past projects whose construction period and actual results matched, the number of samples was small, resulting in a judgment result with low validity. For example, Patent Document 1 discloses a conventional system for managing budgets and actual results. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-95122 Summary of the Invention [Problem to be solved by the invention]

[0005] However, Patent Document 1 does not describe anything about detecting an abnormality in a case by comparing a threshold based on a large number of past cases with the accumulation of the results of the case in question.

[0006] The present invention has been made in consideration of the above, and aims to provide an anomaly detection system, an anomaly detection method, and an anomaly detection program that can detect anomalies in a case by comparing a threshold based on a large number of past cases with how the actual results of the case in question have accumulated. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the object, the present invention provides an anomaly detection system equipped with a control unit, which is configured to be able to access budget data of a case that is a target for anomaly detection, including case identification information, construction period, and budget; performance data of the case that is a target for anomaly detection, including case identification information, number of months elapsed, and performance data; and performance data of a plurality of similar past cases that are similar to the case that is a target for anomaly detection, including case identification information, number of months elapsed, and performance data; the control unit adjusts the number of months elapsed and performance data of the plurality of similar past cases to the scale of the budget data of the case that is a target for anomaly detection, calculates a threshold based on the number of months elapsed and performance data of the scaled performance data of the plurality of similar past cases, and compares the performance data of the case that is a target for anomaly detection with the calculated threshold to determine an anomaly.

[0008] According to another aspect of the present invention, the control unit includes a scale unifying means for performing a scale unifying process to unify scales by calculating, for each piece of performance data of the plurality of similar past cases, an elapsed time rate obtained by dividing the number of elapsed months by the maximum number of elapsed months and an actual performance rate obtained by dividing the actual performance by the maximum value of the actual performance; an equally-spaced point acquiring means for performing an equally-spaced point acquiring process to calculate, for each piece of performance data of the plurality of similar past cases after the scale unifying process, a hypothetical elapsed time rate obtained by dividing the axis of the elapsed time rate by the construction period of the abnormality determination target case data, and to calculate a hypothetical performance rate corresponding to the hypothetical elapsed time rate for the actual performance; and a scale unifying means for performing an equally-spaced point acquiring process to unify scales by dividing, for each piece of performance data of the plurality of similar past cases after the scale unifying process, The system is characterized by comprising: a scale expansion means for executing a scale expansion process that calculates a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the project to be determined for an abnormality for each piece of actual data, and calculates a virtual actual number of months by multiplying the virtual actual rate by the budget of the budget data of the project to be determined for an abnormality; a threshold calculation means for executing a threshold calculation process that calculates a threshold from the average value and standard deviation of the virtual actual number of elapsed months based on the actual data of a plurality of similar past projects after the scale expansion process; and an abnormality determination means for executing an abnormality determination process that compares the actual data of the project to be determined for an abnormality with the calculated threshold value to determine an abnormality.

[0009] According to another aspect of the present invention, the performance data of the plurality of similar past projects may have a relative error in construction period and / or budget of the budget data of the project to be determined as abnormal that is less than a predetermined percentage.

[0010] Furthermore, according to one aspect of the present invention, the equally-spaced point acquisition means may, for each of the actual data of a plurality of similar past projects after the scale unification process, use the construction period of the budget data of the project to be determined as the number of divisions, use a width of 1 / the number of divisions as the range of the progress rates of the equally-spaced points, use the equally-spaced points as virtual progress rates, and calculate a virtual achievement rate corresponding to each virtual progress rate from a relational expression between the progress rate and the achievement rate.

[0011] Furthermore, according to one aspect of the present invention, the threshold calculation means may separate the performance data of multiple similar past cases after the scale expansion process into groups of data with matching hypothetical elapsed months, calculate the average value and standard deviation of the hypothetical performance for each group of data, calculate threshold data as follows: upper threshold = hypothetical performance average value + threshold rate × standard deviation, and lower threshold = hypothetical performance average value - threshold rate × standard deviation, and select a threshold to be used for abnormality determination from the calculated threshold data.

[0012] Furthermore, according to one aspect of the present invention, the selection of the threshold value to be used for the abnormality determination may be such that the calculated threshold value data is used as is for the abnormality determination, that the threshold value for the final month has an allowable range (= threshold rate x standard deviation), that only the upper threshold value is used, or that only the lower threshold value is used.

[0013] According to another aspect of the present invention, the abnormality determination means may output an abnormality detection message to a display unit when it determines that an abnormality has occurred.

[0014] According to another aspect of the present invention, the items may include items that are subject to project-based management.

[0015] In order to solve the above-mentioned problems and achieve the object, the present invention provides an anomaly detection method executed by an information processing device having a control unit, wherein the control unit is configured to be able to access budget data of a case that is a target of anomaly detection, including case identification information, a construction period, and a budget, performance data of the case that is a target of anomaly detection, including case identification information, the number of months that have passed, and performance data, and performance data of a plurality of similar past cases that are similar to the case that is a target of anomaly detection, including case identification information, the number of months that have passed, and performance data, The method is characterized in that it includes a process executed by the control unit to adjust the number of elapsed months and actual results of the performance data of the plurality of similar past cases to the scale of the budget data of the case to be determined for an abnormality, calculate a threshold value based on the number of elapsed months and actual results of the scaled performance data of the plurality of similar past cases, and compare the performance data of the case to be determined for an abnormality with the calculated threshold value to determine an abnormality.

[0016] In addition, in order to solve the above-mentioned problems and achieve the object, the present invention provides an anomaly detection program to be executed by an information processing device having a control unit, wherein the control unit is configured to be able to access budget data of a case that is a target for anomaly detection, including case identification information, construction period, and budget; performance data of the case that is a target for anomaly detection, including case identification information, number of months elapsed, and performance data; and performance data of a plurality of similar past cases that are similar to the case that is a target for anomaly detection, including case identification information, number of months elapsed, and performance data; the anomaly detection program causes the control unit to execute a process of adjusting the number of months elapsed and performance data of the performance data of the plurality of similar past cases to the scale of the budget data of the case that is a target for anomaly detection, calculating a threshold based on the number of months elapsed and performance data of the scaled performance data of the plurality of similar past cases, and comparing the performance data of the case that is a target for anomaly detection with the calculated threshold to determine an anomaly. [Effects of the Invention]

[0017] According to the present invention, it is possible to detect abnormalities in a case by comparing a threshold based on a large number of past cases with the way in which the performance of the case in question has accumulated. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram for explaining the background of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the problem to be solved by the present invention. [Figure 3] FIG. 3 is a diagram for explaining the problem to be solved by the present invention. [Figure 4] FIG. 4 is a block diagram showing an example of the configuration of the anomaly detection system according to this embodiment. [Figure 5] FIG. 5 is a diagram showing a processing flow illustrating an example of the overall processing of the control unit of the anomaly detection system according to this embodiment. [Figure 6] FIG. 6 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 7] FIG. 7 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 8] FIG. 8 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 9] FIG. 9 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 10] FIG. 10 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 11] FIG. 11 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 12] FIG. 12 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 13] FIG. 13 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 14] FIG. 14 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 15]FIG. 15 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 16] FIG. 16 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 17] FIG. 17 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 18] FIG. 18 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 19] FIG. 19 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 20] FIG. 20 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 21] FIG. 21 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 22] FIG. 22 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 23] FIG. 23 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 24] FIG. 24 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 25] FIG. 25 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 26] FIG. 26 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 27] FIG. 27 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 28] FIG. 28 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. [Figure 29]FIG. 29 is a diagram for explaining a specific example of the processing of the control unit of the anomaly detection system according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to this embodiment.

[0020] [1. Overview] The present invention will be outlined in the order of background, problems, and solutions.

[0021] (1-1. Background) The background of the present invention will be explained with reference to Figure 1. In industries such as the construction industry and the system development industry, which use project-based management that accumulates progress over time, there is a demand to "determine whether the accumulation method is appropriate by comparing it with similar past projects."

[0022] The anomaly detection system of the present invention can obtain a graph like the one shown in Figure 1. In Figure 1, the X axis represents the number of months elapsed (months) and the Y axis represents actual results (in 10,000 yen), showing a reference value calculated from similar past cases and the actual results of the case being judged for an anomaly. Values that allow a range for the reference value calculated from similar past cases are set as upper and lower thresholds, and an anomaly is detected when the actual results of the case being judged for an anomaly deviate from the upper or lower threshold.

[0023] In this specification, "construction period" refers to the number of months planned until the project is completed. "Budget" refers to the amount planned to be incurred until the project is completed. "Number of months elapsed" refers to the number of months elapsed since the start of the project. "Actual results" refers to the amount incurred from the start of the project to the elapsed months.

[0024] (1-2. Issues) The problems to be solved by the present invention will be described with reference to Figures 2 and 3. Conventionally, there are the following problems.

[0025] 1. When comparing only past projects with matching construction periods and actual results, there is an issue of the small number of samples to compare, resulting in less valid anomaly determination results.

[0026] 2. There is an issue that if the construction periods and actual results of past projects differ, it is not possible to compare the data.

[0027] More specifically, it is as follows.

[0028] 1. When comparing only past projects whose construction periods and actual results match, the number of samples to compare is small, resulting in low validity of abnormality detection results. Specifically, when collecting data on past projects, if only those whose construction periods and budgets match the project being detected for abnormality are extracted, the number of samples from past projects will be small. In this way, a small number of samples will result in low validity of abnormality detection results.

[0029] 2. The issue of not being able to compare data when the construction period and actual results of past projects differ will be explained in detail with reference to Figures 2 and 3. We will explain the case where you want to determine an abnormality in project A0001 based on how the results of project B0001, which has already been completed in the past, have accumulated. As a premise, we will assume that the actual data and budget data of the project to be determined to be abnormal, and the actual data of the past project to be compared, are stored as the following data.

[0030] Figure 2(A) shows an example of actual data for a project that is subject to abnormality detection, including project code, number of months elapsed, and actual data. Figure 2(B) shows an example of budget data for a project that is subject to abnormality detection, including project code, construction period, and budget data. Figure 2(C) shows actual data for past projects, including project code, number of months elapsed, and actual data.

[0031] Figure 3 shows an image of a graph when comparing the accumulation of a project that has been determined to be abnormal with the accumulation of a comparable project from the past. Figure 3 shows the number of months that have passed and the results for the similar project from the past (B0001) in Figure 2 and the project that has been determined to be abnormal (A0001), with the X axis showing the number of months that have passed (months) and the Y axis showing the results (10,000 yen). Because the construction period and budget for the project that has been determined to be abnormal are different from the construction period and results for the comparable project from the past, it is impossible to determine whether the accumulation of the results for the project that has been determined to be abnormal is abnormal or not.

[0032] (1-3.Solution) Therefore, as a solution to this problem, the present invention processes data so that the scale of the construction period and actual results of past projects matches the construction period and budget of the project being judged for anomalies. Specifically, the values of the number of months elapsed and actual results of past projects are compressed, and then the number of months elapsed and actual results are expanded to the construction period and budget of the project being judged for anomalies. This solution solves the following problems.

[0033] 1. When comparing only past projects with matching construction periods and results, the number of samples to be compared is small, resulting in anomaly detection results with low validity. However, since it is possible to compare with the project being detected as anomaly regardless of the construction periods and results of past projects, it becomes possible to collect data regardless of construction periods and results.

[0034] 2. In response to the issue of being unable to compare data when the construction periods and actual results of past projects differ, by matching the construction periods and actual results of past projects to the construction period and budget of the project being judged as abnormal, it becomes possible to compare past projects with the project being judged as abnormal.

[0035] Specifically, (1) it can detect delays in project progress and revise plans, and (2) it can detect overstated or fraudulent reporting of progress rates intended to achieve targets, preventing fraudulent reporting of actual results that do not correspond to reality.

[0036] The anomaly detection system of the present invention can be applied to all business types and industries, and can be suitably applied to projects that involve project-based management, such as the construction industry and the IT media industry, for example.

[0037] [2. Configuration] An example of the configuration of the anomaly detection system 100 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a block diagram showing an example of the configuration of the anomaly detection system 100.

[0038] The anomaly detection system 100 is a commercially available desktop personal computer. Note that the anomaly detection system 100 is not limited to a stationary information processing device such as a desktop personal computer, and may be a portable information processing device such as a commercially available notebook personal computer, PDA (Personal Digital Assistant), smartphone, or tablet personal computer.

[0039] The anomaly detection system 100 includes a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. The units included in the anomaly detection system 100 are connected to each other so as to be able to communicate with each other via any communication path.

[0040] The communication interface unit 104 communicatively connects the anomaly detection system 100 to a network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 300 has a function of connecting the anomaly detection system 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

[0041] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to achieve a pointing device function. Note that, hereinafter, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112. Displaying information on the monitor 114 and the user operating the input device 112 may be referred to as a "user operation via a UI."

[0042] The storage unit 106 stores various databases, tables, files, etc. The storage unit 106 stores computer programs that work in conjunction with an OS (Operating System) to issue commands to a CPU (Central Processing Unit) to perform various processes. The storage unit 106 may be, for example, a memory device such as a RAM (Random Access Memory) or a ROM (Read Only Memory), a fixed disk device such as a hard disk, a flexible disk, or an optical disk. The storage unit 106 includes a data table 106a, etc.

[0043] The data table 106a is a table for storing various data such as budget data and performance data of the case to be judged as abnormal, and performance data of a plurality of similar cases in the past.

[0044] The budget data for the case that is the target of anomaly detection may include the case code (case identification information), construction period, and budget. The performance data for the case that is the target of anomaly detection may include the case code (case identification information), number of months elapsed, and performance.

[0045] The performance data of a plurality of similar past cases is performance data of a plurality of past cases similar to the case to be determined as abnormal, and may include the case code (case identification information), the number of months elapsed, and performance.

[0046] The control unit 102 is a CPU or the like that performs overall control of the anomaly detection system 100. The control unit 102 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, etc., and executes various information processing operations based on these stored programs.

[0047] The control unit 102 is configured to be able to access the data table 106a and the like stored in the storage unit 106. The data table 106a may be provided in another location (for example, the server 200) as long as it is accessible by the control unit 102.

[0048] The control unit 102 conceptually includes a data acquisition unit 102a, a scale unification unit 102b, an equally spaced point acquisition unit 102c, a scale enlargement unit 102d, a threshold calculation unit 102e, and an abnormality determination unit 102f.

[0049] The control unit 102 uses the performance data of a plurality of similar past cases stored in the data table 106a to determine whether the performance data of the case to be determined for an abnormality stored in the data table 106a is abnormal. Specifically, the control unit 102 adjusts the number of elapsed months and the results of the performance data of the plurality of similar past cases to the scale of the budget data of the case to be determined for an abnormality, calculates a threshold based on the number of elapsed months and the results of the scaled performance data of the plurality of similar past cases, and automatically executes a series of processes to compare the performance data of the case to be determined for an abnormality with the calculated threshold.

[0050] The data acquisition unit 102a acquires the budget data and performance data of the case to be detected as an anomaly, and performance data of a plurality of similar past cases, and stores them in the data table 106a. The performance data of the plurality of similar past cases may have a relative error in construction period and / or budget of the budget data of the case to be detected as an anomaly, which is equal to or less than a predetermined percentage.

[0051] The scale unification unit 102b calculates an elapsed rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an achievement rate by dividing the achievement by the maximum value of the achievement for each piece of achievement data for a plurality of similar past cases, and executes a scale unification process to unify the scales.

[0052] The equally-spaced point acquisition unit 102c calculates a hypothetical progress rate by dividing the progress rate axis by the construction period of the data on the project to be judged as abnormal for each of the performance data of multiple past similar projects after the scale unification process, and executes an equally-spaced point acquisition process to calculate a hypothetical performance rate corresponding to the hypothetical progress rate for the actual performance.

[0053] In this case, the equally-spaced point acquisition unit 102c may, for each of the actual data of multiple past similar projects after the scale unification process, use the construction period of the budget data of the project to be determined as the number of divisions, use the range of 1 / the number of divisions as the range of the progress rates of the equally-spaced points, and use the equally-spaced points as virtual progress rates, and calculate (acquire) a virtual progress rate corresponding to each virtual progress rate from the relational expression between the progress rate and the actual rate.

[0054] The scale expansion unit 102d executes a scale expansion process to calculate a hypothetical number of elapsed months by multiplying the hypothetical elapsed rate by the construction period of the budget data of the project to be determined for abnormality, for each of the performance data of multiple past similar projects after the equally spaced point acquisition process, and calculates a hypothetical performance by multiplying the hypothetical performance rate by the budget of the budget data of the project to be determined for abnormality.

[0055] The threshold calculation unit 102e executes a threshold calculation process to calculate a threshold from the average value and standard deviation of the hypothetical results for each hypothetical number of elapsed months, based on the performance data of a plurality of similar past cases after the scale expansion process.

[0056] In this case, the threshold calculation unit 102e may separate the performance data of multiple similar past cases after the scale expansion process into data that match the virtual number of elapsed months, calculate the average value and standard deviation of the virtual performance for each separated data, calculate threshold data as follows: upper threshold = virtual performance average value + threshold rate × standard deviation, lower threshold = virtual performance average value - threshold rate × standard deviation, and select a threshold to be used for abnormality determination from the calculated threshold data.

[0057] The threshold value to be used for abnormality determination may be selected by using the calculated threshold data as is for abnormality determination, by giving the threshold value for the final month an allowable range (= threshold rate x standard deviation), by using only the upper threshold value, or by using only the lower threshold value.

[0058] The abnormality determination unit 102f executes an abnormality determination process in which the performance data of the case to be determined to be abnormal is compared with the calculated threshold value to determine whether the case is abnormal. In this case, the abnormality determination unit 102f may output and display an abnormality detection message on the monitor 114 when determining that an abnormality has occurred.

[0059] [3. Specific Examples] Specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment will be described with reference to Fig. 4 to Fig. 29. Fig. 5 is a diagram showing a processing flow for outlining the overall processing by the control unit 102 of the anomaly detection system 100 according to this embodiment. Figs. 6 to 29 are diagrams for explaining specific examples of processing by the control unit 102 of the anomaly detection system 100 according to this embodiment.

[0060] (3-1. Overview of processing flow) An overview of the processing flow will be explained with reference to Fig. 5. The scale unification unit 102b executes scale unification processing (step S1). In the scale unification processing, the performance data of a plurality of similar past cases is normalized along two axes: the number of months elapsed (X axis) and the performance (Y axis). Specifically, for each piece of performance data of a plurality of similar past cases, the number of months elapsed is divided by the maximum number of months elapsed for each case, and for each similar past case, the performance is divided by the maximum performance value for each case.

[0061] The equally-spaced point acquisition unit 102c executes an equally-spaced point acquisition process (step S2). In the equally-spaced point acquisition process, a virtual actual result corresponding to the construction period of the budget data of the case to be detected as an anomaly is obtained. Specifically, a relational expression between the number of elapsed months and the actual result is obtained, and the actual result corresponding to each number of elapsed months when the number of elapsed months is divided by the construction period of the case to be detected as an anomaly is calculated.

[0062] The scale expansion unit 102d executes a scale expansion process (step S3). In the scale expansion process, inverse normalization is performed on each of the two axes, the virtual elapsed time rate (X-axis) and the virtual actual production rate (Y-axis), to match the scale with that of the case to be judged for anomaly. Specifically, the virtual elapsed time rate obtained by obtaining equally spaced points is multiplied by the construction period of the case to be judged for anomaly. In addition, the virtual actual production rate obtained by obtaining equally spaced points is multiplied by the budget of the case to be judged for anomaly.

[0063] The threshold calculation unit 102e executes a threshold calculation process (step S4). In the threshold calculation process, the threshold is calculated from the average value and standard deviation of the hypothetical actual results for each number of elapsed months. Specifically, the average value and standard deviation are calculated for each data set with the same number of elapsed months, and the threshold is calculated.

[0064] The abnormality determination unit 102f executes an abnormality determination process (step S5). In the abnormality determination process, a threshold calculated from performance data of multiple similar past cases is compared with performance data of the case to be abnormally determined to determine whether an abnormality has occurred. Specifically, the abnormality determination is performed based on whether the performance data of the case to be abnormally determined exceeds the threshold for each number of elapsed months.

[0065] (3-2. Processing flow details) The details of the processing flow will be described with reference to FIGS.

[0066] (Actual data and budget data for the project subject to abnormality detection, as well as actual data for similar projects in the past) The performance data and budget data of the case to be judged as abnormal, as well as performance data of similar cases in the past, will be described with reference to FIGS. 6 and 7. FIG.

[0067] It is assumed that the data table 106a has registered therein the performance data and budget data of the case subject to abnormality detection by the data acquisition unit 102a. In the following example, the case code of the case subject to abnormality detection is "A0001".

[0068] Figure 6(A) shows an example of actual data for a project that is subject to abnormality detection, and includes the fields for project code, number of months elapsed, and actual data. Figure 6(B) shows budget data for a project that is subject to abnormality detection, and includes the fields for project code, construction period, and budget. In Figure 6, the number of months elapsed for which actual results exist in the actual data (3 months) is less than the construction period in the budget data (6 months) because project "A0001" is currently in progress.

[0069] It is assumed that performance data of similar past cases is stored in the data table 106a. The data acquisition unit 102a acquires similar case data by extracting it from the performance data of similar past cases according to predetermined conditions, and stores the acquired data in the data table 106a.

[0070] Examples of criteria for extracting similar projects are, for example, (1) the relative error between the "construction period of the project to be judged as abnormal" and the "construction period of past projects" is 10% or less, and (2) the relative error between the "budget of the project to be judged as abnormal" and the "final results of past projects" is 10% or less.

[0071] When extracting projects with a relative error of 10% or less for the budget "10 million yen" of project "A0001," past projects with final results of "9 million to 11 million yen" will be extracted.

[0072] In this example, the case codes of the past similar case data are "B0001" and "B0002." For simplicity, this explanation will use two cases as an example, but in reality, it is assumed that there will be many similar cases in the past to ensure the validity of the anomaly detection results.

[0073] Figure 7(A) shows an example of performance data for a similar past project. Figure 7(B) shows a graph of the performance data for a similar past project, with the horizontal axis representing the number of months elapsed and the vertical axis representing the actual results. Figure 7(B) also plots an example of the budget and construction period for a project that is subject to anomaly detection.

[0074] In the present invention, a set of scale unification processing, equally spaced point acquisition processing, and scale enlargement processing is performed, thereby making it possible to compare data of different scales.

[0075] (Scale unification processing) The scale unification process will be described with reference to Fig. 8. In the scale unification process, the following process is performed for each piece of past similar case data to normalize it.

[0076] (1) For each case code in the performance data of similar past cases, divide the number of months elapsed by the maximum number of months elapsed for each case. (2) For each project code in the performance data of similar past projects, divide the performance by the maximum performance value of each project.

[0077] The elapsed period is calculated by dividing the number of months elapsed by the maximum number of months elapsed for each project, and the actual period is calculated by dividing the actual period by the maximum actual period for each project.

[0078] After the scale unification process, columns for progress rate and actual achievement rate are added to the performance data of similar past projects. Figure 8(A) shows the performance data of similar past projects after the scale unification process. As shown in Figure 8(A), progress rate and actual achievement rate have been added.

[0079] Figure 8(B) shows a graph of the progress rate and actual achievement rate of the performance data of similar past projects after the scale unification process in Figure 8(A). Because the number of elapsed months and performance have been normalized, the actual achievement rate becomes "1" when the final number of elapsed months (the progress rate is "1") is reached.

[0080] (Equally spaced point acquisition process) The equally spaced point acquisition process will be described with reference to Figure 9. In the equally spaced point acquisition process, the following process is performed for each piece of past similar project data after the scale unification process. In the equally spaced point acquisition process, the key point is to divide the data by the construction period of the project to be judged as abnormal.

[0081] (1) Divide the budget data of the project to be judged as abnormal by the construction period against the axis of the progress rate of the data of similar past projects. (2) Using the relationship between the progress rate and the actual rate, calculate the actual rate for each divided progress rate. (3) The calculated values are named hypothetical elapsed rate and hypothetical actual rate because they are not actual elapsed rate and actual rate.

[0082] 9(A) shows an example of budget data for a project that is subject to abnormality detection. The construction period is "6 months," so the progress rate is divided into 6 parts.

[0083] Figure 9(B) shows the performance data (job code, hypothetical progress rate, hypothetical actual volume rate) of similar past jobs after the equidistant point acquisition process. Figure 9(C) shows the graph calculated when the equidistant point acquisition process is performed. By performing the equidistant point acquisition process, the progress rate and actual volume rate of the square points in the graph are calculated. Since the intermediate points on the broken line are not performance data, the progress rate and actual volume rate are changed to hypothetical progress rate and hypothetical actual volume rate.

[0084] (Scale enlargement processing) The scale expansion process will be described with reference to Figures 10 and 11. In the scale expansion process, the following process is performed for each piece of performance data of similar past cases after the equally spaced points acquisition process. The key point in the scale expansion process is to expand the scale based on the budget data of the case that is the target of anomaly detection.

[0085] (1) The hypothetical elapsed months are calculated by multiplying the hypothetical elapsed rate obtained by the equally spaced point acquisition process by the construction period of the budget data of the project to be judged as abnormal. (2) The virtual performance rate obtained by the equally spaced point acquisition process is multiplied by the budget of the budget data for the case to be judged as abnormal to calculate the virtual performance.

[0086] 10(A) shows an example of budget data for a project that is subject to abnormality detection. The construction period is "6 months" and the budget is "10 million yen."

[0087] Figure 10(B) shows the performance data (project code, hypothetical elapsed rate, hypothetical actual amount rate, hypothetical elapsed months, hypothetical actual results) of similar past projects after scale expansion processing. The hypothetical elapsed months are calculated by multiplying the hypothetical elapsed rate by the construction period of the project to be judged as abnormal, and the hypothetical actual amount is calculated by multiplying the hypothetical actual amount rate by the budget of the project to be judged as abnormal. After scale expansion processing, columns for hypothetical elapsed months and hypothetical actual results are added to the data.

[0088] Figure 10(C) shows a graph of the hypothetical number of months elapsed and the hypothetical actual results for the data on similar past projects after the scale expansion process in Figure 10(B). Because the data has been inverse normalized to match the construction period and budget of the abnormal project, the hypothetical actual results at the final elapsed number of months, "6 months," are 10 million yen.

[0089] In this example, for ease of understanding, two similar past cases (B0001, B0002) are used as an example, but in reality, data processing is performed on many similar past cases to ensure the validity of the final anomaly determination results. When data processing is performed on many cases up to an expanded scale, the graph will look like the one shown in Figure 11, for example.

[0090] The following threshold calculation process and abnormality determination process enable abnormality determination to be performed using a threshold that takes into account the degree of dispersion of the results for each elapsed month.

[0091] (Threshold calculation process) The threshold calculation process will be described with reference to Fig. 12. In the threshold calculation process, the average value and standard deviation are calculated for each hypothetical result for which the hypothetical number of elapsed months matches, for the performance data of past similar cases after the scale expansion process, to calculate a threshold.

[0092] When determining an abnormality, the upper tolerance value of the actual results is set as the upper threshold, and the lower tolerance value is set as the lower threshold. As an example, data such as that shown in Figure 12(A) is calculated. Figure 12(A) shows the data after threshold calculation processing. For each hypothetical number of elapsed months, a hypothetical actual results average (10,000 yen), an upper threshold (10,000 yen), and a lower threshold (10,000 yen) are calculated. Figure 12(B) is a graph of the hypothetical actual results average (10,000 yen), an upper threshold (10,000 yen), and a lower threshold (10,000 yen) from Figure 12(A).

[0093] (Abnormality determination processing) The abnormality determination process will be described with reference to Figures 13 to 15. In the abnormality determination process, the following process is performed for each piece of data in which the hypothetical number of elapsed months of a similar past case is equal to the number of elapsed months of the case to be determined as abnormal.

[0094] The hypothetical number of months elapsed in threshold data calculated from similar past cases is compared with the actual number of months elapsed in the actual data of the case to be judged as abnormal for each data item, and if the actual result is greater than the upper threshold or less than the lower threshold, it is judged to be abnormal. Data for which no actual results yet exist is not judged to be abnormal.

[0095] Fig. 13(A) shows an example of threshold data calculated from similar past cases, Fig. 13(B) shows actual data for a case that is subject to abnormality judgment, and Fig. 13(C) shows the abnormality judgment result (abnormal "TRUE", normal "FALSE"). In the example shown in the figure, for data where the hypothetical number of elapsed months and the number of elapsed months are "3 months", the actual result of "2.5 million yen" is below the lower threshold of "3.0858 million yen", so it is judged to be abnormal "TRUE".

[0096] Figure 14 is a diagram showing an example of an anomaly detection graph. The graph displays a hypothetical performance average calculated based on similar past cases, threshold data (upper threshold, lower threshold), and performance data for cases subject to anomaly detection. In this case, an anomaly is detected when the performance data for a case subject to anomaly detection falls outside the threshold range (the range formed by the upper and lower thresholds) on the graph. As the focus is on how the performance data for cases subject to anomaly detection accumulates, the axes are "months elapsed" and "performance" to match the performance data for cases subject to anomaly detection.

[0097] When an abnormality is detected, a message indicating this is displayed. Figure 15 shows an example of an abnormality detection message. The abnormality detection message displays the calculation method, the case code for which the abnormality was detected, the number of months elapsed, the actual results, and the deviation amount from the reference value. In the example shown in the figure, the message displayed is "Calculation method: Similar comparison method (threshold rate 1.0), Case A0001, number of months elapsed: 3 months, actual results: 2.5 million yen, which is 580,000 yen below the reference value."

[0098] (3-3. Details of the process for obtaining equally spaced points) The equally spaced point acquisition process will be described in detail with reference to FIGS.

[0099] Figure 16(A) shows the performance data (B0001, B0002) of similar past cases after the scale unification process. Figure 16(B) shows a graph of the progress rate and actual performance rate of the performance data of similar past cases after the scale unification process of Figure 16(A).

[0100] In the process of obtaining equidistant points, (1) the construction period of the budget data for the project to be judged as abnormal is obtained and used as the division number. (2) The value of 1 / (division number) is used as the range of the progress rate of equidistant points. (3) The virtual actual rate is calculated.

[0101] The case of performing the equally spaced point acquisition process for project B0001 will be described with reference to Figure 17. (1) The construction period of the project data that is the target of abnormality detection is acquired and used as the division number. Figure 17(A) shows the budget data of the project data that is the target of abnormality detection. Here, the division number is set to "6 months", which is the construction period of project "A0001" that is the target of abnormality detection.

[0102] (2) The value of 1 / (number of divisions) is set as the width of the progress rate of equally spaced points, and the virtual progress rate of the equally spaced points to be calculated is calculated. Figure 17(B) is a diagram for explaining the calculation of the virtual progress rate for "B0001" of similar case data. Although not shown, "B0002" can be calculated in the same way. In Figure 17(B), the number of divisions = 6, the width of the progress rate of equally spaced points = 1 / 6, and the virtual progress rates of equally spaced points = 0, 1 / 6, 2 / 6, 3 / 6, 4 / 6, 5 / 6, 1.

[0103] (3) Calculate the virtual performance rate for each equally spaced progress rate. It is necessary to find the relationship between the progress rate and performance rate between the performance data points on the graph.

[0104] Methods for calculating the hypothetical performance rate from the relational expression between the progress rate and the performance rate include, for example: (a) when approximating the relational expression between the progress rate and the performance rate with a straight line: connect two adjacent points on the graph with a straight line and calculate the hypothetical performance rate corresponding to the hypothetical progress rate on that line; (b) when approximating the relational expression between the progress rate and the performance rate with a quadratic function curve: draw a quadratic function that passes through three adjacent points on the graph and calculate the hypothetical performance rate corresponding to the hypothetical progress rate on that curve; and (c) there are other cases where approximation is done with a nonlinear function.

[0105] In this example, to simplify the calculation, the case where the relational expression between the progress rate and the actual rate is obtained using method (a) will be explained as an example. As a specific example, the calculation process of the virtual actual rate at the point where the virtual progress rate is 3 / 6 = 0.5 will be shown below. Figures 18 to 20 are diagrams for explaining the calculation process of the virtual actual rate.

[0106] (3)-1. Obtain continuous data such that the virtual progress rate is between progress rates. In Figure 18(A), the virtual progress rate of 0.5 is between the progress rates of 0.4 and 0.6 for Project B0001, so to calculate the virtual actual progress rate, the rows with elapsed months of "2," actual results of "3.5 million yen," progress rate of "0.4," and actual results rate of "0.43" and the rows with elapsed months of "3," actual results of "5.5 million yen," progress rate of "0.6," and actual results rate of "0.68" are used, as shown in Figure 18(B). Figure 18(C) shows an image of the graph used to obtain data for calculating the virtual actual results rate.

[0107] (3)-2. Find the equation for the relationship between the progress rate and the actual rate. Find the equation for the line that passes through the two points in Figure 18(D). Figure 18(E) shows the equation for the solid line on the graph, and the actual rate is as shown in Figure 18(E), where actual rate = {(0.68 - 0.43) / (0.6 - 0.4)} x (progress rate - 0.4) + 0.43.

[0108] (3)-3. Calculate the virtual actual volume ratio. Calculate the virtual actual volume ratio so that the virtual progress rate is "0.5". Figure 19(B) is a diagram showing an image of the graph when calculating the virtual actual volume ratio. Calculate the virtual actual volume ratio based on the progress rate and actual rate at both ends of the broken line.

[0109] In this case, the hypothetical performance rate is 0.55. As shown in Figure 19(A), the columns for the number of months elapsed, performance, elapsed rate, and actual performance rate disappear from the data table, and columns for the hypothetical performance rate and hypothetical actual performance rate are added.

[0110] Figure 20(A) shows an example of data after the equally spaced points acquisition process. Figure 20(B) shows a graph of the data obtained after the equally spaced points acquisition process. By performing process (3) on all of the hypothetical elapsed rates calculated in (2) = 0, 1 / 6, 2 / 6, 3 / 6, 4 / 6, 5 / 6, 1, data on equally spaced points B0001 and B0002 can be obtained, as shown in Figures 20(A) and (B).

[0111] (3-4. Details of threshold calculation process) The threshold calculation process will be described in detail with reference to FIGS.

[0112] Figure 21(A) shows the performance data (B0001, B0002) of similar past projects after the scale expansion process. Figure 21(B) shows a graph of the hypothetical elapsed months and hypothetical performance of the performance data of similar past projects after the scale expansion process of Figure 21(A).

[0113] In the threshold calculation process, the following process is executed. (1) Divide the data into groups that match the number of virtual months elapsed. (2) Calculate the average value and standard deviation of the virtual results for each divided data. (3) Calculate the threshold. (4) Select the threshold data to be used for abnormality determination.

[0114] (1) Divide into data that match the number of virtual months elapsed. Figure 22(A) shows the same data as Figure 21(A). The data is sorted in ascending order of the number of hypothetical months elapsed. Figure 22(B) shows a graph of the data in Figure 22(A).

[0115] (2) Calculate the average value and standard deviation of the hypothetical results for each divided data. Figure 23 is a diagram for explaining how to calculate the average value and standard deviation of the hypothetical results for each divided data. As shown in Figure 23, by calculating the average value and standard deviation of the hypothetical results for each hypothetical number of months elapsed, it is possible to take into account the differences in the degree of dispersion of the hypothetical results for the early, middle, and late stages of multiple similar past projects (B0001, B0002).

[0116] Figure 24 shows an image of a graph in which the average value and standard deviation of the hypothetical results are calculated for each divided data. A single average value and standard deviation that shows the dispersion of the hypothetical results can be obtained from a data group with the same hypothetical number of elapsed months. The figure shows the hypothetical results for B0001, B0002, and the average and standard deviation of the hypothetical results.

[0117] (3) Calculate the threshold value. In this process, the tolerance for abnormality determination can be set, and a parameter called the threshold rate can be set. The threshold rate is a parameter that determines how far the actual result of the abnormality determination target must deviate from the virtual actual result average before it is determined to be abnormal. Figure 25 is a diagram for explaining the calculation of the threshold value.

[0118] Figure 25(A) is a diagram for explaining the calculation formulas for the upper and lower thresholds. The upper and lower thresholds are calculated based on the threshold rate as follows: The upper threshold is calculated as follows: Upper threshold = virtual performance average + threshold rate x standard deviation. The lower threshold is calculated as follows: Lower threshold = virtual performance average - threshold rate x standard deviation.

[0119] Figure 25(B) shows the relationship between the threshold rate and tolerance in a normal distribution. σ represents the standard deviation. When the coefficient of σ is "1", it indicates that there is a 68% probability that the deviation from the mean will be between (mean) -1σ and (mean) +1σ.

[0120] The threshold rate is the coefficient of standard deviation used when calculating the upper and lower thresholds. The relationship between the threshold rate, tolerance, and "interpretation of events when the threshold defined by the threshold rate is exceeded" is shown in Figure 25(C). When the threshold rate is "1", the tolerance is "68%", and it is an abnormal event that can occur with a probability of 32% or less. When the threshold rate is "2", the tolerance is "95%", and it is an abnormal event that can occur with a probability of 5% or less. When the threshold rate is "3", the tolerance is "99.7%", and it is an abnormal event that can occur with a probability of 0.3% or less.

[0121] "Tolerance" refers to the allowable deviation of the actual results of a case subject to abnormality judgment from the hypothetical average results. The value of threshold rate x standard deviation is called the tolerance range. The tolerance range is calculated as tolerance range = threshold rate x standard deviation, as shown in Figure 25(D).

[0122] 26(A) shows the data after the threshold calculation process, where the threshold rate is set to 1.0. The figure also shows the calculation results of the hypothetical performance average, tolerance range, upper threshold, and lower threshold for each hypothetical number of elapsed months.

[0123] Figure 26(B) shows a graph of the data after the threshold calculation process. The figure shows the average of the hypothetical actual results, the upper threshold, the lower threshold, and the tolerance range. As shown in the figure, the tolerance range is wide in the mid-stage because there is a large difference in the progress of each project. In contrast, the tolerance range is narrow in the early and late stages. In this way, it is possible to determine the tolerance range that captures the tendency of the dispersion of statistical distribution in the early, mid, and late stages of multiple similar past projects (B0001, B0002).

[0124] (4) Selecting Threshold Data to be Used for Abnormality Judgment The following methods A to D are available as methods for selecting data to be used for abnormality judgment.

[0125] A. The data after threshold calculation is used as is to determine anomalies. This can be used to strictly check that the project data subject to anomaly detection is completed according to the original budget and schedule.

[0126] B. Allow for a tolerance range for the threshold for the final month. Taking into account a certain deviation from the original budget and construction period of the project for which anomaly detection is being performed, this can be used when a deviation within the same range as the tolerance range for the previous month is considered normal.

[0127] C. Use only the upper threshold. This can be used when you want to detect anomalies specifically by regarding anything outside the upper threshold as a tendency for actual results to exceed the budget.

[0128] D. Use only the lower threshold. This can be used when you want to detect anomalies specifically by considering anything outside the lower threshold as an abnormal trend of project stagnation based on the number of months that have passed.

[0129] We will explain the case of A, "using the data after threshold calculation processing as is for anomaly detection." In this case, it is possible to strictly check that the data for the project subject to anomaly detection is completed according to the original budget and construction period. Figure 27(A) shows the threshold data used for anomaly detection, and Figure 27(B) shows a graph of the threshold data used for anomaly detection.

[0130] We will now explain the case of B, "giving a tolerance range to the threshold for the final month." In method A, even the slightest deviation from the original budget and construction period of the project to be judged as abnormal will result in it being judged as abnormal, so a tolerance range is set for the final month. The tolerance range for the final month is set to the tolerance range for the month before the final month. Figure 28(A) shows the threshold data used for abnormality judgment, and Figure 28(B) shows a graph of the threshold data used for abnormality judgment. As shown in Figure 28(A), the tolerance range "282,800 yen" for the hypothetical number of elapsed months "6 months" is set to the same as the tolerance range "282,800 yen" for the hypothetical number of elapsed months "5 months."

[0131] Case C, "Using only the upper threshold value," and case D, "Using only the lower threshold value," will be explained. You can choose to use only the upper threshold value or only the lower threshold value. Below, we will explain the case where only the lower threshold value is used. Figure 29(A) shows the threshold value data used for abnormality determination. Figure 29(B) shows a graph of the threshold value data used for abnormality determination. Since only the lower threshold value is used for abnormality determination, the upper threshold value data is not used.

[0132] As described above, according to this embodiment, the control unit 102 adjusts the number of months elapsed and the actual results of the performance data of a plurality of similar past cases to the scale of the budget data of the case to be determined to be abnormal, calculates a threshold based on the number of months elapsed and the actual results of the performance data of the plurality of similar past cases whose scales have been adjusted, and compares the performance data of the case to be determined to be abnormal with the calculated threshold to determine whether there is an abnormality.Therefore, by comparing the threshold based on a large number of past cases with the way in which the performance of the target case has accumulated, it is possible to detect an abnormality in the case.

[0133] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to the achievement of SDGs Goals 8 and 9.

[0134] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0135] Furthermore, this embodiment can contribute to strengthening control and governance, which can contribute to the achievement of Goal 16 of the SDGs.

[0136] 5. Other Embodiments The present invention may be implemented in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0137] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0138] Furthermore, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings can be changed as desired unless otherwise specified.

[0139] Furthermore, with regard to the anomaly detection system 100, the components shown in the figures are functional concepts, and do not necessarily have to be physically configured as shown in the figures.

[0140] For example, all or any part of the processing functions of the anomaly detection system 100, particularly the processing functions performed by the control unit, may be implemented by a CPU and a program interpreted and executed by the CPU, or may be implemented as hardware using wired logic. The program is recorded on a non-transitory computer-readable recording medium containing programmed instructions for causing an information processing device to execute the processes described in this embodiment, and is mechanically read by the anomaly detection system 100 as needed. That is, a computer program for providing instructions to the CPU in cooperation with an OS and performing various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). The computer program is executed by being loaded into RAM, and cooperates with the CPU to form the control unit.

[0141] Furthermore, this computer program may be stored in an application program server connected to the anomaly detection system 100 via any network, and all or part of it may be downloaded as needed.

[0142] Furthermore, the program for executing the processes described in this embodiment may be stored in a non-transitory computer-readable recording medium, or may be configured as a program product. Here, the term "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) disc.

[0143] Furthermore, a "program" is a data processing method written in any language or description method, regardless of the format, such as source code or binary code. Note that a "program" is not necessarily limited to a single program, but also includes programs that are distributed as multiple modules or libraries, or programs that achieve their functions by working together with other programs, such as an OS. Note that the specific configurations and reading procedures for reading a recording medium in each device shown in the embodiments, as well as the installation procedures after reading, can use well-known configurations and procedures.

[0144] The various databases stored in the memory unit are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and providing websites.

[0145] The anomaly detection system 100 may be configured as an information processing device such as a known personal computer or workstation, or may be configured as the information processing device to which any peripheral device is connected. The anomaly detection system 100 may also be realized by installing software (including programs, data, etc.) that causes the device to perform the processing described in this embodiment.

[0146] Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the drawings, and all or part of them can be configured by functionally or physically distributing and integrating them in any unit according to various additions or functional loads. In other words, the above-described embodiments can be implemented in any combination, or embodiments can be implemented selectively. [Explanation of symbols]

[0147] 100 Anomaly Detection System 102 Control section 102a Data acquisition section 102b Scale Unification Section 102c Equally spaced point acquisition part 102d Scale enlargement 102e Threshold calculation unit 102f Abnormality determination section 104 Communication interface unit 106 Storage section 106a Data Table 108 Input / Output Interface Section 112 Input Device 114 Output Device 200 servers 300 Network

Claims

1. An anomaly detection system including a control unit, The control unit Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget; Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results; performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data; It is configured to be accessible to a scale unification means for calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time, for each of the performance data of the plurality of past similar cases, and executing a scale unification process to unify the scales; an equally-spaced point acquisition means for calculating a hypothetical progress rate by dividing the progress rate axis by the construction period of the budget data of the case to be determined as an anomaly for each of the performance data of a plurality of similar past cases after the scale unification process, and for the performance data, executing an equally-spaced point acquisition process for calculating a hypothetical performance rate corresponding to the hypothetical progress rate; a scale expansion means for executing a scale expansion process for calculating a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the case to be determined to be abnormal, for each of the performance data of a plurality of similar past cases after the equally-spaced point acquisition process, and calculating a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the case to be determined to be abnormal; a threshold calculation means for executing a threshold calculation process for calculating a threshold from an average value and a standard deviation of the hypothetical results for each hypothetical number of elapsed months based on the performance data of a plurality of similar past cases after the scale expansion process; an abnormality determination means for executing an abnormality determination process that compares the performance data of the case to be determined to be abnormal with the calculated threshold value and determines whether an abnormality has occurred; An anomaly detection system comprising:

2. The anomaly detection system according to claim 1, characterized in that the performance data of the plurality of similar past projects has a relative error in construction period and / or budget of a predetermined percentage or less compared to the budget data of the project to be judged as an anomaly.

3. 2. The anomaly detection system according to claim 1, wherein the equally-spaced point acquisition means calculates, for each of the actual data of a plurality of similar past projects after scale unification processing, a virtual performance rate corresponding to each virtual performance rate from a relational expression between the performance rate and the performance rate, with the construction period of the budget data of the project to be determined as the number of divisions, and a range of 1 / the number of divisions as the range of the progress rates of the equally-spaced points.

4. The anomaly detection system according to claim 1, wherein the threshold calculation means separates performance data of a plurality of similar past cases after scale expansion processing into data sets that match in virtual elapsed months, calculates an average value and standard deviation of the virtual performance for each separated data set, calculates threshold data using the formula: upper threshold = virtual performance average value + threshold rate × standard deviation, and lower threshold = virtual performance average value - threshold rate × standard deviation, and selects a threshold to be used for anomaly detection from the calculated threshold data.

5. The anomaly detection system according to claim 4, characterized in that the selection of the threshold value to be used for the abnormality determination is made by using the calculated threshold value data as is for the abnormality determination, by giving the threshold value for the final month an allowable range (= threshold rate × standard deviation), by using only the upper threshold value, or by using only the lower threshold value.

6. 2. The anomaly detection system according to claim 1, wherein the anomaly determination means outputs an anomaly detection message to a display unit when it determines that an anomaly has occurred.

7. An anomaly detection system described in any one of claims 1 to 6, characterized in that the cases to be judged as anomalies and the similar cases include cases that are subject to project-based management.

8. An anomaly detection method executed by an information processing device including a control unit, The control unit Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget; Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results; performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data; It is configured to be accessible to The control unit executes a scale unification step of calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time for each of the plurality of past similar cases, and executing a scale unification process to unify the scales; an equally-spaced point acquisition process for calculating a hypothetical progress rate by dividing the progress rate axis by the construction period of the budget data of the project to be determined as an anomaly for each of the performance data of the multiple similar past projects after the scale unification process, and for the performance data, performing an equally-spaced point acquisition process for calculating a hypothetical performance rate corresponding to the hypothetical progress rate; a scale expansion process for executing a scale expansion process to calculate a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the project to be determined for an abnormality, for each of the performance data of a plurality of similar past projects after the equally-spaced point acquisition process, and to calculate a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the project to be determined for an abnormality; a threshold calculation step of executing a threshold calculation process to calculate a threshold from an average value and a standard deviation of the hypothetical actual results for each hypothetical number of elapsed months based on the actual results data of a plurality of similar past cases after the scale expansion process; an abnormality determination step of executing an abnormality determination process by comparing the performance data of the case to be determined to be abnormal with the calculated threshold value and determining whether an abnormality has occurred; An anomaly detection method comprising:

9. An abnormality detection program to be executed by an information processing device having a control unit, The control unit Budget data for the project to be judged as abnormal, including project identification information, construction period, and budget; Actual data of the cases subject to abnormality judgment, including case identification information, number of months elapsed, and results; performance data of a plurality of similar past cases similar to the case to be determined as abnormal, including case identification information, number of months elapsed, and performance data; It is configured to be accessible to The control unit a scale unification step of calculating an elapsed time rate by dividing the number of elapsed months by the maximum value of the number of elapsed months and an actual time rate by dividing the actual time by the maximum value of the actual time, for each of the performance data of the plurality of past similar cases, and executing a scale unification process to unify the scales; an equally-spaced point acquisition process for calculating a hypothetical progress rate by dividing the budget data of the project to be determined as an anomaly by the construction period on the progress rate axis for each of the actual data of the multiple similar projects after the scale unification process, and for the actual results, performing an equally-spaced point acquisition process for calculating a hypothetical achievement rate corresponding to the hypothetical progress rate; a scale expansion process for executing a scale expansion process to calculate a virtual number of elapsed months by multiplying a virtual elapsed rate by the construction period of the budget data of the project to be determined for an abnormality, for each of the performance data of a plurality of similar past projects after the equally-spaced point acquisition process, and to calculate a virtual performance by multiplying the virtual performance rate by the budget of the budget data of the project to be determined for an abnormality; a threshold calculation step of executing a threshold calculation process to calculate a threshold from an average value and a standard deviation of the hypothetical actual results for each hypothetical number of elapsed months based on the actual results data of a plurality of similar past cases after the scale expansion process; an abnormality determination step of executing an abnormality determination process by comparing the performance data of the case to be determined to be abnormal with the calculated threshold value and determining whether an abnormality has occurred; An anomaly detection program to execute the above.

Images