Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

To provide an abnormality detection device, an abnormality detection method, and an abnormality detection program capable of accurately detecting the abnormality of parameter values in simple processing.SOLUTION: Abnormality detection processing executes: prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period; correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified; and abnormality detection processing to acquire the value of the parameter in the specified period, determine whether or not the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to an anomaly detection device, an anomaly detection method, and an anomaly detection program. [Background technology]

[0002] In the operation and management of IT (Information Technology) systems that include various devices such as servers and storage, an anomaly detection function is required to notify early on when a device under management is not operating normally. A typical method involves periodically collecting time-series data called performance values ​​that indicate the device's status, and detecting abnormalities when unusual behavior or values ​​are observed. However, in large-scale IT systems, the large number of performance values ​​collected makes manual monitoring and analysis difficult.

[0003] Therefore, we are focusing on AI / ML (Artificial Intelligence / Machine Learning) technology, which has made remarkable progress in recent years. Development of anomaly detection technology that applies techniques is gaining momentum. This technology creates a predictive model that learns the behavior of past performance values ​​and detects anomalies by calculating a threshold that specifies the possible values ​​of future performance values. Predictive models include tree-based models that use decision trees or regression trees, such as random forests.

[0004] However, when predicting performance values ​​using these AI / ML technologies, significant changes in past performance values ​​are observed. However, there is a problem in that accurate predictions are difficult to make when using a predictive model created using training data immediately after a change occurs. This is because the training data, performance values, contain both pre-change and post-change features, and the predictive model learns both features simultaneously. Generally, as time passes after a change in performance values, the predictive model adapts to the post-change features, but immediately after the change, the predicted values ​​of the predictive model become unstable.

[0005] In this regard, it is possible to create a prediction model that corresponds to the characteristics after the change by removing the time series data before the change from the performance values ​​used for learning and learning only the information after the change. However, there is little time series data after the change immediately after the change, and if the time series data before the change is removed, it becomes impossible to predict medium- to long-term cycles or characteristics such as monthly or weekly periods.

[0006] As such, in anomaly detection technology, after a significant change in behavior, it becomes difficult to predict the possible values ​​of performance values, leading to an increase in false positives and false negatives. False positives reduce the reliability of anomaly detection, and false negatives lead to delayed anomaly detection.

[0007] To address this issue, the technology disclosed in Patent Document 1 uses an arbitrary past period as a reference period, calculates a correction coefficient based on the actual measured value and predicted value for the reference period, and multiplies the predicted value for the target period by this correction coefficient to obtain a corrected predicted value. Using a normal range for the target period set based on this predicted value and upper and lower thresholds for the corrected predicted value, the technology determines an abnormality based on whether the actual measured value falls within the normal range, thereby dealing with fluctuations that are difficult to predict and suppressing the detection of unnecessary abnormalities. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent Publication No. 2021-182287 Summary of the Invention [Problem to be solved by the invention]

[0009] In the technology of Patent Document 1, it is necessary to set a reference period, which is a time period during which the actual measured values ​​and predicted values ​​used to calculate the correction coefficients are acquired. The purpose is to calculate an appropriate correction coefficient by setting the reference time as the period during which deviations are likely to occur. In other words, if the performance value tends to record high values ​​during the period that is most characteristic of the performance value, for example, during working hours, then the working hours should be set as the reference time.

[0010] On the other hand, if there is no such characteristic period, it is difficult to set the reference period, and if there is a significant change in behavior outside the reference period, that change will not be taken into account in the correction coefficient that is multiplied by the subsequent predicted value. While it is possible to set a wider reference period, this may result in an inappropriate calculation of the correction coefficient, which may reduce the effectiveness of suppressing false positives.

[0011] Furthermore, with the technology of Patent Document 1, if there is a temporary increase in performance value during the reference period, the normal range will be expanded even though the performance value will return to normal on the predicted date. In this case, even if an abnormal event occurs on the predicted date and there is a large change in performance value, the actual measured value will fall within the normal range, which may lead to missed detection.

[0012] The present invention has been made in consideration of the above circumstances, and its purpose is to provide an anomaly detection device, an anomaly detection method, and an anomaly detection program that are capable of accurately detecting abnormalities in parameter values ​​using simple processing. [Means for solving the problem]

[0013] One aspect of the present invention for solving the above-mentioned problems is an anomaly detection device that includes a processing device that executes the following steps: a prediction process that predicts fluctuations in a normal range of a parameter value over a specified period of time; a correction process that identifies a maximum point of the upper limit from the fluctuations in the predicted upper limit of the normal range, corrects the upper limit of the normal range based on the identified maximum point of the upper limit, identifies a minimum point of the upper limit from the fluctuations in the corrected upper limit of the normal range, and corrects the upper limit of the normal range based on the identified minimum point of the upper limit; and an anomaly detection process that acquires the value of the parameter over the specified period of time, determines whether the acquired parameter value is within the corrected normal range, and outputs specified information if it is determined that the acquired parameter value is not within the corrected normal range. [Effects of the Invention]

[0014] According to the present invention, abnormalities in parameter values ​​can be detected with high accuracy through simple processing. Configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a diagram illustrating an example of the configuration of an anomaly detection system according to an embodiment of the present invention. [Figure 2] FIG. 10 is a diagram illustrating an example of a prediction data table. [Figure 3] FIG. 10 is a diagram illustrating an example of an abnormality record table. [Figure 4] FIG. 10 is a processing flow diagram illustrating an outline of an abnormality detection process. [Figure 5] FIG. 10 is a diagram illustrating an example of a performance data table. [Figure 6] FIG. 10 is a diagram illustrating an example of an abnormality detection management screen. [Figure 7] FIG. 10 is a diagram illustrating an example of a correction parameter table. [Figure 8] FIG. 10 is a diagram illustrating an example of a filter parameter table. [Figure 9] FIG. 10 is a process flow diagram illustrating details of a prediction model generation process. [Figure 10] FIG. 10 is a processing flow diagram illustrating details of normal range calculation processing. [Figure 11] FIG. 10 is a process flow diagram illustrating details of normal range correction processing. [Figure 12] FIG. 10 is a process flow diagram illustrating details of a corrected normal range calculation process. [Figure 13] 10A and 10B are diagrams for explaining the content of a corrected normal range calculation process. [Figure 14] FIG. 10 is a process flow diagram illustrating details of an abnormality detection process. [Figure 15] FIG. 10 is a diagram illustrating an example of the relationship between the behavior of the actual measured values ​​of the performance parameters and the normal range predicted by the prediction model. [Figure 16]10A and 10B are diagrams illustrating an example of the relationship between the behavior of the actual measured value of a performance parameter and its corrected normal range when a corrected normal range calculation process is performed. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0017] 1 is a diagram showing an example of the configuration of an anomaly detection system 1 according to this embodiment. The anomaly detection system 1 includes a management computer 100 (anomaly detection device), an information processing system 120, and an input / output device 107.

[0018] The information processing system 120 is a target of anomaly detection. The information processing system 120 is configured to include a plurality of virtual computers 130, 131 (VM1, VM2, ... VM: Virtual Machine) and software (not shown) such as an OS (Operating System) that runs on the virtual computers 130, 131. The virtual computers 130, 131 in the information processing system 120 are computers that have the same components as the management computer 100. Note that, although in this embodiment the information processing system 120 is configured from virtual computers, it may also be a physical computer.

[0019] The management computer 100 is an information processing device that detects whether an abnormality has occurred in the virtual computers 130, 131 by collecting parameters (hereinafter referred to as performance parameters) that represent the operating status of the virtual computers 130, 131 running in the information processing system 120.

[0020] The management computer 100 and the information processing system 120 are connected via a wired or wireless network such as the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), or a dedicated line. are connected by a wired communication network 110.

[0021] In this embodiment, the management computer 100 and the information processing system 120 are connected to the same communications network 110, but the management computer 100 may be connected to a communications network different from that of the target of anomaly detection. For example, all or part of the program of the management computer 100 may be implemented by a service provided by a cloud system via an API (Application Programming Interface) or the like. In this case, an administrator of the information processing system 120 can access the management computer 100 running on the cloud using a browser via the Internet, for example, and check the results of anomaly detection from anywhere.

[0022] The input / output device 107 is made up of an output device such as a display or touch panel connected to the management computer 100, and an input device such as a keyboard, mouse or touch panel. The input / output device 107, for example, accepts information input from a user and stores it in the management computer 100, and also displays information on the processing results of the management computer 100, etc.

[0023] Next, the management computer 100 processes the processing device 10 such as a CPU (Central Processing Unit). 1, memory 102 such as RAM (Random Access Memory) or ROM (Read Only Memory), storage device 103 such as HDD (Hard Disk Drive) or SSD (Solid State Drive), and network interface 106 configured with a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like.

[0024] The management computer 100 also includes an abnormality detection program 104, a performance information collection program 105, a performance data table 300, a prediction data table 400, and a correction parameter table 501. 00, a filter parameter table 600, and an abnormality record table 700 are stored.

[0025] The anomaly detection program 104 performs a prediction process that predicts fluctuations in the normal range of the value of a performance parameter during a period designated by the user for predicting the normal range of the performance parameter (hereinafter referred to as a prediction period).

[0026] In this embodiment, the fluctuation in the normal range is calculated using a prediction model, which is a trained model. The prediction model is constructed based on algorithms such as a neural network, a decision tree, a random forest, and a support vector machine (SVM). The neural network is a neural network, such as a convolution neural network (CNN), that has an input layer that receives input data, one or more intermediate layers (hidden layers) that extract and output features from the input data, and an output layer that outputs output data. Note that although the prediction model in this embodiment is a trained model based on a decision tree, this is not intended to limit the algorithm of the prediction model. Furthermore, the prediction model is not limited to a trained model, and may be any numerical model that uses a prediction period for a performance parameter as an input value and a normal range of the performance parameter value during the prediction period as an output value.

[0027] The abnormality detection program 104 identifies a maximum point of the upper limit (details will be described later) from the fluctuation of the upper limit of the normal range predicted in this way, and corrects the upper limit of the normal range based on the identified maximum point of the upper limit (hereinafter this process will be referred to as maximum-to-maximum smoothing, or first correction process). Next, the abnormality detection program 104 identifies a minimum point of the upper limit from the fluctuation of the corrected upper limit of the normal range, and further corrects the upper limit of the normal range based on the identified minimum point of the upper limit (hereinafter this process will be referred to as minimum-to-minimum smoothing, or second correction process). Note that hereinafter, the maximum-to-maximum smoothing and minimum-to-minimum smoothing are collectively referred to as corrected normal range calculation process.

[0028] Furthermore, the abnormality detection program 104 acquires the value of the performance parameter for the prediction period, determines whether the acquired value of the performance parameter is within the above-mentioned corrected normal range, and outputs the abnormality determination result if it determines that the value of the performance parameter is not within the corrected normal range.

[0029] The performance information collection program 105 receives performance parameters measured by the information processing system 120 from the information processing system 120 .

[0030] The performance data table 300 is a database that stores performance parameters received from the information processing system 120 .

[0031] The prediction data table 400 is a database that stores information on fluctuations in the normal range calculated by the prediction model.

[0032] The correction parameter table 500 is a database that stores parameters (correction parameters) related to a method for correcting the upper limit of the normal range.

[0033] The filter parameter table 600 is a database that stores parameters (filter parameters) used to determine whether a performance parameter is abnormal.

[0034] The abnormality record table 700 is a database that stores the results of abnormality determination of performance parameters.

[0035] Here, the prediction data table 400 and the abnormality record table 700 will be described in detail.

[0036] (Prediction data table) 2 is a diagram showing an example of a prediction data table 400. The prediction data table 400 has the following data items: a timestamp 401, which sets each date and time in a period (prediction period) for predicting a normal range; a performance value lower limit 402, which sets the lower limit of the normal range of a performance parameter value (hereinafter referred to as a performance value) at each date and time in the prediction period; a performance value upper limit 403, which sets the upper limit of the normal range of a performance value at each date and time in the prediction period; a corrected upper limit 404, which sets an upper limit (corrected upper limit) obtained by performing a corrected normal range calculation process on the upper limit of the normal range; an actual measurement value 405, which sets the performance value (measured value) measured at each date and time in the prediction period; and an abnormality score 406, which sets the abnormality score at each date and time in the prediction period.

[0037] Note that the method for calculating the values ​​of the lower limit performance value 402 and the upper limit performance value 403 is not particularly limited. For example, in the case of ensemble learning using decision trees (random forest), a method may be used in which any quantile is taken from the distribution of predicted values ​​of performance values ​​obtained from each decision tree and used as the lower limit performance value and the upper limit performance value, or a method may be used in which values ​​obtained by adding or subtracting values ​​that may fluctuate in the performance value around the average of the distribution of predicted values ​​are used as the upper limit performance value and the lower limit performance value, respectively.

[0038] If the corrected normal range calculation process has not been executed, the value of the performance value upper limit 403 of the same record is stored in the corrected upper limit 404 .

[0039] The actual measurement value 405 stores a value extracted from the VM information 302 in the performance data table 300 .

[0040] The anomaly score is a value indicating the degree (difference) to which the actual measurement value 405 deviates from the normal range (upper or lower limit). For example, if the actual measurement value 405 at a certain time falls within the normal range (greater than or equal to the performance value lower limit 402 and less than or equal to the corrected upper limit 404), the anomaly score 406 at that time is 0. If the actual measurement value 405 is greater than the corrected upper limit 404, the anomaly score at that time is a positive value obtained by subtracting the corrected upper limit 404 from the actual measurement value 405. If the actual measurement value 405 is smaller than the performance value lower limit 402, the anomaly score at that time is a negative value obtained by subtracting the performance value lower limit 402 from the actual measurement value 405. If the anomaly score exceeds a predetermined positive or negative threshold, the performance value is determined to be abnormal. Note that the calculation method of the anomaly score described here is merely an example, and the anomaly score may indicate the degree to which the actual measurement value deviates from the normal range.

[0041] (Abnormality Record Table 700) 3 is a diagram showing an example of an abnormality record table 700. The abnormality record table 700 has data items of date 701, in which the target date is set, and abnormality presence / absence 702, in which information indicating whether or not an abnormality was determined on that date is set. This abnormality record table 700 is also used to determine whether or not correction is necessary in the normal range correction process, which will be described later.

[0042] The programs of the management computer 100 described above are executed by the processing unit 101 reading them from the memory 102 or storage device 103. Furthermore, each program can be recorded on a portable or fixed recording medium and distributed, for example. Next, the processing performed by the anomaly detection system will be described.

[0043] <Abnormality detection processing> 4 is a processing flow diagram illustrating an outline of the abnormality detection processing performed in the abnormality detection system. The abnormality detection processing is executed, for example, when a predetermined input is made by the user to the management computer 100, or at a predetermined timing (for example, at a predetermined time or a predetermined time interval).

[0044] First, the performance information collection program 105 collects performance parameters from the information processing system 120 (S20).

[0045] For example, the performance information collection program 105 collects historical information on performance parameters such as CPU utilization rate and memory consumption of the virtual machines 130 and 131 (VMs) running in the information processing system 120, which are measured by measurement agents (not shown) running on the VMs. The performance information collection program 105 receives the performance parameters from the VM 120. The performance information collection program 105 may collect each performance parameter directly from the VM without using a measurement agent (agentless method).

[0046] The process of S20 may be executed repeatedly at a predetermined timing (for example, at a predetermined time or at predetermined time intervals) independently of the abnormality detection process.

[0047] (Performance data table) 5 is a diagram showing an example of a performance data table 300. The performance data table 300 has data items such as a timestamp 301 in which the date and time when the performance parameter value of each VM is measured is set, and VM information 302 (302a, 302b, ...) in which information on the performance parameters of each VM is set. Each VM information 302 has data sub-items such as a CPU usage rate 303 (303a, 303b, ...) in which information on the CPU usage rate of the VM is set, and a memory consumption 304 (304a, 304b, ...) in which information on the memory consumption of the VM is set. Note that the performance parameter items shown in the figure are merely examples.

[0048] Next, as shown in FIG. 4, the abnormality detection program 104 displays the abnormality detection management screen 200 described below, and accepts input of information necessary for detecting abnormalities in the information processing system 120 from a user (e.g., an administrator of the information processing system 120) (S50).

[0049] (Anomaly detection management screen) 6 is a diagram showing an example of an anomaly detection management screen 200. The anomaly detection management screen 200 includes an input section 260 and a result display section 270. The input section 260 is an area that accepts input of setting values ​​required for anomaly detection from the user. The result display section 270 is an area that displays the results of anomaly detection.

[0050] The input unit 260 has selection fields for a target VM selection unit 201, a performance value selection unit 202, a learning period setting unit 211, a prediction period setting unit 212, a learning period setting unit 211, a prediction period setting unit 212, a maximum value smoothing maximum time interval setting unit 221, a minimum value smoothing maximum time interval setting unit 222, a time threshold setting unit 231, an actual measurement threshold setting unit 232, and a predicted / actual difference threshold setting unit 233.

[0051] The target VM selection unit 201 receives, from a user, a selection of a VM (hereinafter referred to as a target VM) for which anomaly detection is to be performed from a list of VMs running in the information processing system 120.

[0052] The performance value selection unit 202 receives from the user a selection of performance parameters to be used for anomaly detection from among the various types of performance parameters measured by the target VM.

[0053] The target VM selection unit 201 and the performance value selection unit 202 may each receive selections of multiple target VMs or multiple performance parameters from the user.

[0054] The learning period setting unit 211 and the prediction period setting unit 212 receive input of parameters related to the learning and use of a prediction model that calculates a normal range from a user.

[0055] Specifically, the learning period setting unit 211 receives, from a user, an input specifying a learning period, which is a period related to performance parameters used for learning a prediction model. An input specifying the period (prediction period) for predicting performance values ​​using the prediction model is accepted from the user.

[0056] Each date and time in the timestamp 401 of the prediction data table 400 is stored based on the prediction period specified by the prediction period setting unit 212. For example, when time-series data of performance values ​​for two months from April 15 to June 14 is used to learn a prediction model and to calculate the normal range for one day, the prediction period is one day, June 15. In this case, each date and time at any time interval (five-minute intervals in the figure) in the prediction period is stored in the timestamp 401.

[0057] The maximum value smoothing maximum time interval setting unit 221 and the minimum value smoothing maximum time interval setting unit 222 receive input of correction parameters from the user. The correction parameters are stored in a correction parameter table 500. Specifically, the maximum value smoothing maximum time interval setting unit 221 receives input of the maximum value smoothing maximum time interval from the user. The minimum value smoothing maximum time interval setting unit 222 receives input of the minimum value smoothing maximum time interval from the user. The maximum value smoothing maximum time interval and the minimum value smoothing maximum time interval will be described in detail later.

[0058] The time threshold setting unit 231, the actual measurement threshold setting unit 232, and the predicted / actual difference threshold setting unit 233 receive input of filter parameters, which are parameters used to determine the presence or absence of an abnormality, from the user. The filter parameters are stored in a filter parameter table 600.

[0059] Specifically, the time threshold setting unit 231 receives an input of a minimum duration from the user. The actual measurement threshold setting unit 232 receives an input of a minimum parameter value from the user. The predicted / actual difference threshold setting unit 233 receives an input of a minimum abnormality score from the user.

[0060] The minimum duration is the threshold for the duration during which the anomaly score exceeds a predetermined threshold, which is required to determine that an anomaly exists. The minimum parameter value is the minimum value of the performance value, which is required to determine that an anomaly exists. The minimum anomaly score is the threshold for the anomaly score, which is required to determine that an anomaly exists. These parameters are specified as numerical values, percentages, etc.

[0061] The details of the result display unit 270 will be described later.

[0062] (Correction parameter table) 7 is a diagram showing an example of a correction parameter table 500. The correction parameter table 500 stores filter parameters. Specifically, the correction parameter table 500 has data items of smoothing application time width (maximum) 501, in which the maximum time interval for smoothing a maximum value is set, and smoothing application time width (minimum) 502, in which the maximum time interval for smoothing a minimum value is set. The correction parameter table 500 stores values ​​specified in the maximum time interval for smoothing a maximum value setting unit 221 and the maximum time interval for smoothing a minimum value setting unit 222 of the anomaly detection management screen 200.

[0063] (Filter parameter table) 8 is a diagram showing an example of a filter parameter table 600. The filter parameter table 600 stores filter parameters. The filter parameters are used to remove small deviations and extract large deviations when actual measurement values ​​deviate from the normal range. If this filter determines that there is a large deviation, i.e., an abnormality, "abnormal" is recorded in the abnormality presence / absence 702 for the corresponding date in the abnormality record table 700.

[0064] The filter parameter table 600 has data items of a time threshold 601 for setting a minimum duration, an actual measurement value threshold 602 for setting a minimum parameter value, and a predicted / actual difference threshold 603 for setting a minimum abnormality score. In the example shown in the figure, the time threshold 601 is set to "120 minutes." Therefore, if the deviation of the abnormality score continues for 120 minutes or more, it will be determined to be abnormal.

[0065] 4, the anomaly detection program 104 and the performance information collection program 105 execute a prediction model creation process S100 for acquiring performance values ​​of the information processing system 120 and creating a prediction model. The prediction model creation process S100 will be described in detail later.

[0066] The abnormality detection program 104 executes a normal range calculation process S200 for calculating a normal range of a performance value based on the prediction model created in S100. Details of the normal range calculation process S200 will be described later.

[0067] The abnormality detection program 104 determines whether or not it is necessary to perform normal range correction processing for the normal range calculated in the normal range calculation processing S200, and if it is determined that normal range correction processing is necessary, executes normal range correction processing S300. Details of the normal range correction processing S300 will be described later.

[0068] The abnormality detection program 104 executes an abnormality detection process S400, which performs an abnormality detection based on the normal range calculated in the normal range correction process S300 (hereinafter referred to as the corrected normal range), and records the result of the abnormality detection in the abnormality record table 700. The details of the abnormality detection process S400 will be described later. Next, each of the processes described above will be described in detail.

[0069] <Prediction model generation process> FIG. 9 is a process flow diagram illustrating the details of the prediction model generation process S100.

[0070] First, the anomaly detection program 104 acquires the target VM, performance parameters, and learning period from the target VM selection unit 201, performance value selection unit 202, and learning period setting unit 211 of the anomaly detection management screen 200, respectively (S101).

[0071] The anomaly detection program 104 extracts time-series data of the performance value identified by the information acquired in S101 from the performance data table 300 (S102). That is, the anomaly detection program 104 acquires data of the performance value measured by the target VM during the learning period.

[0072] The anomaly detection program 104 creates a prediction model using the time-series data of the performance values ​​acquired in S102 as learning data (S103). This completes the prediction model generation process S100.

[0073] The prediction model is a trained model that uses the measurement time (timestamp) of the performance value as an explanatory variable (input value) and the performance value measured at that timestamp as a response variable (output value). The information on the timestamp used as an explanatory variable may further include attributes such as the date, time, day of the week, week number in the month, or whether the date is a weekday or a public holiday.

[0074] In this embodiment, a prediction model is created for each performance information item in the performance data table 300. For example, if two types of performance values ​​are measured for two VMs and anomaly detection is performed for all performance values, four prediction models that predict normal ranges in one prediction period are created. One prediction data table 400 is created for each performance value of each VM, resulting in the creation of the same number of prediction models.

[0075] <Normal range calculation process> FIG. 10 is a process flow diagram illustrating the details of the normal range calculation process S200.

[0076] First, the anomaly detection program 104 acquires the target VM, performance parameters, and prediction period from the target VM selection unit 201, performance value selection unit 202, and prediction period setting unit 212 of the anomaly detection management screen 200. Then, the anomaly detection program 104 stores time-series data of the performance values ​​for the prediction period specified by the acquired information in the prediction data table 400 (S201).

[0077] Specifically, the anomaly detection program 104 stores each time of the prediction period in the timestamp 401 of a new record in the prediction data table 400. The anomaly detection program 104 also acquires the value of the performance parameter at each time of the prediction period corresponding to the acquired target VM and performance parameter from the performance data table 300, and stores the acquired value of the performance parameter in the actual measurement value 405.

[0078] Next, the anomaly detection program 104 inputs the prediction period of each record in the prediction data table 400 created in S201 into the prediction model created in the prediction model generation process S100, thereby acquiring the possible range (normal range) of the performance value at each time of the prediction period (S202). Note that this updates the prediction model based on the data for the specified prediction period.

[0079] The anomaly detection program 104 stores information on fluctuations in the normal range of the performance parameters identified from the output results of the prediction model in the prediction data table 400 (S203).

[0080] Specifically, the abnormality detection program 104 stores the lower limit and upper limit of the performance values ​​identified from the performance values ​​acquired in S202 in the performance value lower limit 402 and performance value upper limit 403 in the prediction data table 400. This completes the normal range calculation process S200.

[0081] <Normal Range Correction Process S300> FIG. 11 is a process flow diagram illustrating the normal range correction process S300 in detail.

[0082] The anomaly detection program 104 acquires the data contents of the anomaly record table 700 (S301). Then, based on the acquired data, the anomaly detection program 104 determines whether there is an anomaly in the performance value for a predetermined period immediately before the prediction period (S302).

[0083] Specifically, the anomaly detection program 104 identifies the period from the time immediately preceding the earliest time stored in the timestamp 401 of the prediction data table 400 to a time a predetermined period (one week in this embodiment) before that. Then, the anomaly detection program 104 extracts the anomaly presence / absence 702 of each record for the identified period from the anomaly record table 700, and determines whether there is a record in which "anomaly" is recorded.

[0084] In this embodiment, the anomaly detection program 104 checks the anomaly determination for the past week, but this period is not limited to one week and may be adjusted depending on the length of the period of the performance parameters used to train the prediction model.

[0085] If the performance value is determined to be abnormal (S302: Yes), the abnormality detection program 104 executes the process of S303, and if the performance value is not determined to be abnormal (S302: No), the abnormality detection program 104 executes the process of S304.

[0086] In S303, the abnormality detection program 104 acquires correction parameters (maximum time interval for smoothing maximum value and maximum time interval for smoothing minimum value) from the maximum time interval for smoothing maximum value setting unit 221 and the maximum time interval for smoothing minimum value setting unit 222 of the abnormality detection management screen 200.

[0087] Then, the abnormality detection program 104 executes a corrected normal range calculation process S310 that calculates a corrected normal range based on the maximum time interval for smoothing the maximum maximum value and the maximum time interval for smoothing the minimum value, and stores the corrected normal range in the prediction data table 400. The details of the corrected normal range calculation process S310 will be described later. This completes the normal range correction process S300.

[0088] On the other hand, in S304, the anomaly detection program 104 stores the current upper limit performance value in the prediction data table 400 without calculating a corrected normal range. Specifically, the anomaly detection program 104 copies the value of the performance value upper limit 403 of each record in the prediction data table 400 and stores it in the corrected upper limit 404 of the same record. This completes the normal range correction process S300.

[0089] <Corrected normal range calculation process> 12 is a process flow diagram illustrating the details of the corrected normal range calculation process S310. Here, the maximum time interval for smoothing the maximum value acquired in S303 is designated as X, and the maximum time interval for smoothing the minimum value is designated as Y.

[0090] First, the anomaly detection program 104 copies the value of the performance value upper limit 403 of each record in the prediction data table 400 and stores it in the correction upper limit 404 of the same record (S311).

[0091] Then, the abnormality detection program 104 corrects the upper limit value of the normal range by smoothing through interpolation between local maximum values ​​(S312 to S316).

[0092] That is, the anomaly detection program 104 stores the performance value at the first time in the prediction data table 400 as the first maximum point (S312). Specifically, the anomaly detection program 104 associates the value of the corrected upper limit 404 of the record with the earliest timestamp 401 in the prediction data table 400 with that time, and stores this as "maximum point 1."

[0093] The anomaly detection program 104 stores the maximum value (or the maximum value) and the time of each performance value from the time of the first maximum point to the time X has elapsed since that time as the second maximum point (S313). Specifically, the anomaly detection program 104 identifies the fluctuation of the performance value within X from the time of "maximum value 1" by referring to each record of the prediction data table 400. The maximum value (or maximum value) of the maximum point closest to the first maximum point indicated by the fluctuation is stored as "maximum point 2" in association with the time. In other words, the first maximum point and the second maximum point are two maximum points adjacent to each other within X.

[0094] The abnormality detection program 104 calculates each performance value in the predicted data table 400 between the time of the first maximum point and the time of the second maximum point based on the first maximum point and the second maximum point, and stores the calculated values ​​in the predicted data table 400 (S314).

[0095] Specifically, for example, the anomaly detection program 104 performs linear interpolation based on the first and second maximum points. That is, the anomaly detection program 104 generates an equation for a line segment connecting the first and second maximum points (time-performance value equation), applies the generated equation for the line segment to the time of the timestamp 401 of each record in the prediction data table 400 in which a time between the time of the first and second maximum points is registered in the timestamp 401, and calculates a performance value at that time, and sets the calculated performance value as the correction upper limit 404 of that record.

[0096] The anomaly detection program 104 may perform interpolation processing other than linear interpolation. For example, the anomaly detection program 104 may use other polynomials (curve equations) as equations connecting the first and second maximum points, or may further increase the values ​​of the first and second maximum points. It is also possible to perform linear interpolation or other interpolation processing based on each increased value. In other words, the anomaly detection program 104 needs to perform processing to correct (increase) upward the value of each point (performance value) between the first maximum point and the second maximum point.

[0097] Next, the abnormality detection program 104 replaces the information on the first local maximum point with information on the second local maximum point and stores the information (S315).

[0098] The abnormality detection program 104 refers to the prediction data table 400 and determines whether the time of the first maximum point is the time of the last performance value of the corrected upper limit 404 in the prediction data table 400 (S316).

[0099] If the time of the first maximum point is the time of the last performance value of the corrected upper limit 404 (S316: Yes), the abnormality detection program 104 executes the processing of S317, and if the time of the first maximum point is not the time of the last performance value of the corrected upper limit 404 (S316: No), the abnormality detection program 104 executes the processing of S313.

[0100] In S317 to S321, the abnormality detection program 104 corrects (recorrects) the upper limit value of the normal range by smoothing through interpolation between local minimum values.

[0101] That is, the anomaly detection program 104 identifies the performance value at the first time in the prediction data table 400 and stores it as the first minimum point (S317). Specifically, the anomaly detection program 104 associates the value of the corrected upper limit 404 of the record with the earliest timestamp 401 in the prediction data table 400 with that time, and stores it as "minimum point 1."

[0102] The anomaly detection program 104 identifies the fluctuation in the performance value from the time of the first minimum point to the time Y has elapsed since that time, and stores the minimum value (or smallest value) closest to the first minimum point and its time as the second minimum point (S318). Specifically, the anomaly detection program 104 references each record in the prediction data table 400 to identify the minimum value (or smallest value) among the performance values ​​within Y from the time of "minimum value 1," and stores the identified performance value as "minimum point 2" in association with that time. In other words, the first minimum point and the second minimum point are two minimum points adjacent to each other within Y.

[0103] The anomaly detection program 104 calculates each performance value in the predicted data table 400 between the time of the first minimum value and the time of the second minimum value by linear interpolation based on the first minimum value and the second minimum value, and stores the calculated values ​​in the predicted data table 400 (S319).

[0104] Specifically, for example, the anomaly detection program 104 performs linear interpolation based on the first and second minimum points. That is, the anomaly detection program 104 generates an equation for a line segment connecting the first and second minimum points (time-performance value equation), applies the generated equation for the line segment to the time of the timestamp 401 of each record in the prediction data table 400 in which a time between the time of the first and second minimum points is registered in that timestamp 401, and calculates the performance value at that time, and sets the calculated performance value as the correction upper limit 404 of that record.

[0105] The anomaly detection program 104 may perform interpolation processing other than the linear interpolation described here. For example, the anomaly detection program 104 may use another polynomial (curve equation) as an equation connecting the first and second minimum points, or may further increase or decrease the values ​​of the first and second minimum points and perform linear interpolation or other interpolation based on the increased or decreased values. That is, the anomaly detection program 104 needs to perform a process to slightly correct (decrease) downward the value of each point (performance value) between the first minimum point and the second minimum point.

[0106] Next, the abnormality detection program 104 replaces the information on the first minimum point with information on the second minimum point and stores the information (S320).

[0107] The abnormality detection program 104 refers to the prediction data table 400 and determines whether the time of the second minimum point is the time of the last performance value of the corrected upper limit 404 (S321).

[0108] If the time of the first minimum point is the time of the last performance value of the corrected upper limit 404 (S321: Yes), the corrected normal range calculation process S310 ends, and the time of the first minimum point is the time of the last performance value of the corrected upper limit 404. If it is not the time of the last performance value of 4 (S321: No), the abnormality detection program 104 executes the process of S318.

[0109] The above-described smoothing by interpolation between local minimum values ​​may be performed only when the performance value is decreasing. When the performance value is decreasing, the smoothing by interpolation between local minimum values ​​tends to have a strong effect, so that an extreme increase in the upper limit value due to the smoothing by interpolation between local maximum values ​​can be suppressed, and as a result, it is possible to prevent anomalies from being missed.

[0110] 13 is a diagram for explaining the content of the corrected normal range calculation process S310. As shown in (a) of the same figure, the predicted value of the upper limit of the normal range repeatedly increases and decreases significantly. It is assumed that the local maximum points 1301 are returned and have a plurality of local maximum points 1301. The time interval between each of the local maximum points 1301 is equal to or less than the maximum time interval X for smoothing the local maximum value.

[0111] In this case, as shown in FIG. 1(b), first, the maximum value interpolation smoothing process (S312-S3 16), the upper limit value 1302 at each time between the maximum points is corrected and increased to a value 1303 near the value of each maximum point based on linear interpolation between the maximum points. That is, the normal range based on this corrected value 1303 is expanded by the area 1304 colored in black, and as a result, the actual measured value of the parameter is more likely to fall within the normal range, and unnecessary abnormality detection is suppressed.

[0112] Next, as shown in (c) of the same figure, the variation of the upper limit value corrected by the local maximum value interpolation smoothing process is The time interval between each minimum point 1305 in the movement is assumed to be equal to or less than the minimum smoothing maximum time interval Y. Then, by the minimum interpolation smoothing process (S317-S321), the upper limit value at each time between each minimum point 1305 is corrected and reduced to a value 1306 near the value of each minimum point 1305 based on linear interpolation between each minimum point 1305, as shown in (d) of the same figure. That is, The risk of overlooking abnormality detection, which occurs when the normal range is excessively interpolated by the maximum value interpolation smoothing process, is reduced by the minimum value interpolation smoothing process.

[0113] <Abnormality detection processing> Next, FIG. 14 is a process flow diagram illustrating the details of the abnormality detection process S400. The anomaly detection program 104 determines whether each actual measurement value in the prediction data table 400 is within the range between the performance lower limit and the corrected upper limit (whether the actual measurement value is equal to or greater than the performance lower limit and equal to or less than the corrected upper limit) (S401). Specifically, the anomaly detection program 104 acquires the contents of each record in the prediction data table 400, and compares the magnitude relationship between the value of the performance value lower limit 402, the value of the corrected upper limit 404, and the value of the actual measurement value 405 in each acquired record.

[0114] If a certain measured value (hereinafter referred to as the actual measured value) is within the range between the performance lower limit and the correction upper limit (S401: Yes), the anomaly detection program 104 executes the process of S402 for that measured value. If a certain measured value (the actual measured value) is not within the range between the performance lower limit and the correction upper limit ( If S401: No), the abnormality detection program 104 executes the process of S404 for the actual measurement value.

[0115] In S402, the anomaly detection program 104 sets the anomaly score of the actual measurement value to 0. Specifically, the anomaly detection program 104 stores 0 in the anomaly score 406 of the record related to the actual measurement value in the prediction data table 400.

[0116] Then, the anomaly detection program 104 acquires filter parameters (minimum duration, minimum parameter value, and minimum anomaly score) from the time threshold setting unit 231, actual measurement threshold setting unit 232, and predicted / actual difference threshold setting unit 233 of the anomaly detection management screen 200, and stores the acquired filter parameters in the filter parameter table 600 (S404). After that, the process of S405 is performed.

[0117] Meanwhile, in S403, the anomaly detection program 104 sets the deviation of the actual measurement value from the corrected upper limit value or the performance lower limit value as the anomaly score. Specifically, the anomaly detection program 104 stores the value obtained by subtracting the value of the corrected upper limit value 404 of the record from the value of the actual measurement value 405 of the record (or the value obtained by subtracting the performance lower limit value 402 of the record from the value of the actual measurement value 405 of the record) in the anomaly score 406 of the record related to the actual measurement value in the prediction data table 400. Thereafter, the processing of S404 is performed.

[0118] In S405, the anomaly detection program 104 determines whether the actual measurement value is abnormal based on the filter parameters. For example, the anomaly detection program 104 determines whether the actual measurement value continues to show a value greater than the minimum parameter value for a minimum duration or longer, and whether the anomaly score of the actual measurement value is greater than the minimum anomaly score.

[0119] The anomaly detection program 104 may apply the minimum parameter value and minimum anomaly score to the actual measured value at each time, or may apply them by calculating the average of the actual measured values ​​405 and the average anomaly score over a certain time unit (for example, one hour).

[0120] If the actual measured value is abnormal (S406: Yes), the abnormality detection program 104 executes the process of S407, and if the actual measured value is not abnormal (S406: No), the abnormality detection program 104 executes the process of S408.

[0121] In S408, the anomaly detection program 104 records the determination result that there was no anomaly on the measurement date (detection date) of the actual measurement value in the anomaly record table 700. Specifically, the anomaly detection program 104 stores the detection date (corresponding to the timestamp 401 in the prediction data table 400) related to the actual measurement value in the date 701 in the anomaly record table 700, records "normal" in the anomaly presence / absence 702, and then executes the processing of S409.

[0122] In S407, the anomaly detection program 104 records the determination result that an anomaly was present on the measurement date (detection date) of the actual measurement value in the anomaly record table 700. Specifically, the anomaly detection program 104 stores the detection date (corresponding to the timestamp 401 in the prediction data table 400) related to the actual measurement value in the date 701 in the anomaly record table 700, records "anomaly" in the anomaly presence / absence 702, and then executes the processing of S409.

[0123] The abnormality record table 700 created by the abnormality detection process S400 is used to determine whether or not the corrected normal range calculation process S310 is required in the normal range correction process S300 from the next time onwards.

[0124] In S409, the abnormality detection program 104 displays the result display section of the abnormality detection management screen 200. The results of the processing up to this point are displayed in 270. This completes the abnormality detection processing S400.

[0125] Here, the display contents of the result display section 270 will be explained using the anomaly detection management screen 200 illustrated in FIG.

[0126] The result display unit 270 includes a behavior display unit 240 and a detection result display unit 250. The behavior display unit 240 displays a time change 241 of the performance parameter used in learning the prediction model. Specifically, the time change 241 of the performance parameter is a time change of the performance value of the target VM selected by the target VM selection unit 201 and the performance value selection unit 202 during the period selected by the learning period setting unit 211.

[0127] An abnormality symbol 242 (in the figure, a symbol consisting of an exclamation mark superimposed on a triangle) may be displayed in the behavior display unit 240. The abnormality symbol 242 is displayed when an abnormality is determined in the performance parameters used to train the prediction model.

[0128] The detection result display section 250 displays the change 251 in the actual measured value of the performance parameter during the prediction period specified in the prediction period setting section 212, the normal range 253 of the performance parameter, and the upper and lower limit values ​​254 of the performance parameter (upper limit value 254a and lower limit value 254b).

[0129] Furthermore, an abnormality symbol 252 (in the figure, a symbol consisting of an exclamation mark superimposed on a triangle) may be displayed in the detection result display section 250. The abnormality symbol 252 is displayed when the actual measured value of the performance parameter deviates from the range of the upper and lower limit values ​​254 (i.e., when an abnormality is detected).

[0130] The upper limit value of the upper and lower limit values ​​254 is the upper limit value of the corrected normal range during a period in which the normal range correction process is applied, whereas the upper limit value of the upper and lower limit values ​​254 during a period in which the normal range correction process is not applied is the upper limit value of the normal range.

[0131] <Effects of corrected normal range calculation process> Next, the suppression of unnecessary abnormality detection by the corrected normal range calculation process S310 will be described with reference to the drawings.

[0132] FIG. 15 is a diagram illustrating an example of the relationship between the behavior of the measured values ​​of the performance parameters and the normal range predicted by the prediction model.

[0133] As shown in the figure, the actual measured value 1501 of the performance parameter continued to be below the upper limit value 1502, which is the normal range of the performance parameter, but at a certain time T on the X-1th day, it suddenly rose significantly, deviating from the upper limit value 1502, and continued to have an elevated value thereafter.

[0134] In this case, on day X, the prediction model learns the upper limit (normal range) of the performance parameter using the actual measured value 1503 of the performance parameter on day X-1, which includes the times before and after time T, as learning data. Then, the prediction model learns the upper limit (normal range) of the performance parameter using the actual measured value 1501 of the performance parameter on day X-1. For example, the upper limit value 1504 of the performance parameter predicted by this prediction model is a value that alternately reflects the actual measured values ​​of the performance parameter before and after time T, and therefore fluctuates rapidly over a short period of time.

[0135] That is, this prediction model uses the actual measured value of the performance parameter at time T on the X-1 day. The model inappropriately interpreted the sudden rise in 1 (specifically, the value of the performance parameter after the sudden rise was no longer abnormal as of day X, but it still judged it to be abnormal). The prediction model is in a transitional learning stage. Based on this unstable normal range value, the management computer 100 will frequently judge the measured value of the performance parameter to be abnormal even when it is not abnormal.

[0136] Next, FIG. 16 is a diagram showing an example of the relationship between the behavior of the actual measurement value of the performance parameter and its corrected normal range when the corrected normal range calculation process S310 is performed.

[0137] As shown in the figure, the corrected normal range calculation process S310 raises (increases) the upper limit value of the performance parameter predicted by the prediction model based on the maximum point in the upper limit value 1504 of the performance parameter that repeatedly increases and decreases, and corrects it to a corrected upper limit value 1602. As a result, the management computer 100 can correctly determine whether or not there is an abnormality in the value of the performance parameter based on this corrected upper limit value 1602 (unnecessary abnormality detection is suppressed).

[0138] As described above, the management computer 100 (abnormality detection device) of this embodiment predicts fluctuations in the normal range of the value of a performance parameter during a prediction period, corrects the upper limit of the normal range based on the maximum point of the upper limit identified from the fluctuations in the upper limit of the predicted normal range (first correction process), corrects the upper limit of the normal range based on the minimum point of the upper limit identified from the fluctuations in the corrected upper limit of the normal range (second correction process), and if it determines that the actual measured value of the performance parameter during the prediction period is not within the corrected normal range, it displays the result on the abnormality detection management screen 200.

[0139] In other words, the anomaly detection device of this embodiment expands the normal range by correcting the upper limit of the calculated normal range based on the maximum value, and then further corrects the expanded normal range based on the minimum value of the normal range to narrow the normal range. In this way, when the calculated normal range fluctuates significantly and there is a possibility that the determination of the presence or absence of an anomaly may become unstable, the normal range can be appropriately corrected, making it possible to stabilize the determination of the presence or absence of an anomaly.

[0140] As described above, the anomaly detection device of this embodiment can accurately detect anomalies in parameter values ​​through simple processing. For example, it is possible to reduce unnecessary false positives and accurately detect anomalies. Furthermore, there is no need to introduce other parameters such as a reference period.

[0141] In addition, the anomaly detection device of this embodiment predicts fluctuations in the normal range of the value of a performance parameter during a prediction period using a prediction model in which the period of the performance parameter is used as an input value and the normal range of the value of the performance parameter during that period is used as an output value.

[0142] This allows the upper limit value of the performance parameter to be calculated with high accuracy.

[0143] Furthermore, the anomaly detection device of this embodiment updates the prediction model as needed based on the measured values ​​of the performance parameters during the prediction period.

[0144] This can further improve the accuracy of the prediction model.

[0145] Furthermore, the anomaly detection device of this embodiment corrects the upper limit of the normal range only when the value of the performance parameter prior to the prediction period was abnormal.

[0146] This allows the upper limit of the normal range to be corrected only when it is necessary to correct the normal range in order to correctly detect an abnormality, thereby improving the efficiency of processing related to abnormality detection.

[0147] In addition, the anomaly detection device of this embodiment determines an anomaly in the value of a performance parameter by determining whether the value of the parameter at a time prior to the prediction period exceeds the minimum parameter value, whether the value of the performance parameter exceeds the threshold value for a minimum duration or longer, or whether the anomaly score of the performance parameter exceeds the minimum anomaly score.

[0148] This can prevent excessive abnormality determinations from occurring.

[0149] Furthermore, the anomaly detection device of this embodiment identifies two maximum points of the upper limit value that are adjacent to each other within the maximum time interval for maximum value smoothing from the fluctuation of the upper limit value of the normal range calculated by the prediction model, calculates each value between the two identified maximum points by linearly interpolating between those maximum points, and corrects the upper limit value of the normal range between the two maximum points based on each calculated value (first correction process).

[0150] In this way, by increasing the upper limit between two maximum points based on those maximum points, the upper limit of the normal range is increased overall, preventing erroneous judgments such as performance parameter values ​​frequently exceeding the upper limit and being judged to be abnormal.

[0151] Furthermore, after the first correction process, the anomaly detection device of this embodiment identifies two minimum points of the upper limit value that are adjacent to each other within the maximum time interval for maximum value smoothing from the fluctuation of the upper limit value in the normal range indicated by each linearly interpolated value and the maximum point of the upper limit value in the normal range, calculates each value between the identified two minimum points by linearly interpolating between the two minimum points, and corrects the upper limit value of the normal range between the two minimum points based on each calculated value (second correction process).

[0152] In this way, by increasing the upper limit between two minimum points based on those minimum points, the upper limit of the normal range that was previously increased is slightly decreased, thereby preventing erroneous determinations in which the value of the performance parameter does not exceed the upper limit and is not determined to be abnormal.

[0153] Furthermore, the anomaly detection device of this embodiment executes the second correction process only when the fluctuation of the upper limit value in the normal range is reduced in the interpolation process.

[0154] By executing the second correction process only when the upper limit value is on a decreasing trend, which would make the second correction process more effective, it is possible to perform efficient correction of the upper limit value.

[0155] The present invention is not limited to the above-described embodiments, and can be implemented using any components within the scope of the present invention. The above-described embodiments and modifications are merely examples, and the present invention is not limited to these contents as long as the characteristics of the invention are not impaired. Furthermore, although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other aspects conceivable within the scope of the technical idea of ​​the present invention are also included within the scope of the present invention.

[0156] For example, part of the hardware provided in each device of this embodiment may be provided in another device.

[0157] Furthermore, each program of the anomaly detection device may be provided in another device, a program may consist of multiple programs, or multiple programs may be integrated into one program.

[0158] Although the present embodiment has been described using an example of detecting an anomaly in performance values ​​measured in the operation and management of an IT system, the present invention is not limited to this example and can be applied to various types of time-series data, such as the temperature or vibration of factory equipment, or the flow rate of water, gas, electricity, etc. [Explanation of symbols]

[0159] 1 Anomaly detection system, 100 Management computer, 104 Anomaly detection program, 105 Information Collection Program

Claims

1. a prediction process for predicting fluctuations in the normal range of parameter values ​​over a specified period; a correction process of identifying a maximum point of the upper limit from the fluctuation of the predicted upper limit of the normal range, correcting the upper limit of the normal range based on the identified maximum point of the upper limit, identifying a minimum point of the upper limit from the fluctuation of the corrected upper limit of the normal range, and correcting the upper limit of the normal range based on the identified minimum point of the upper limit; an abnormality detection process of acquiring parameter values ​​for the specified period, determining whether the acquired parameter values ​​are within the corrected normal range, and outputting predetermined information when it is determined that the acquired parameter values ​​are not within the corrected normal range; An anomaly detection device comprising a processing device that executes the above.

2. a storage device that stores a prediction model in which a period related to the parameter is used as an input value and a normal range of the value of the parameter in the period is used as an output value; the processing device inputs information for the specified period into the prediction model to predict fluctuations in the normal range of the parameter value for the period; The anomaly detection device according to claim 1 .

3. The anomaly detection device according to claim 2 , wherein the processing device updates the prediction model based on the acquired parameter values ​​for the specified period.

4. 2. The anomaly detection device according to claim 1, wherein the processing device determines whether the value of the parameter prior to the specified period was abnormal, and performs the correction process only if it determines that the value of the parameter was abnormal.

5. 5. The anomaly detection device according to claim 4, wherein the processing device determines whether the value of the parameter before the specified period was abnormal by determining whether the value of the parameter at a time before the specified period exceeds a threshold, whether the value of the parameter has continuously exceeded the threshold for a predetermined period or more, or whether a difference between the value of the parameter and the threshold at the time exceeds a predetermined value.

6. 2. The anomaly detection device according to claim 1, wherein the processing device, in the correction process, identifies two maximum points of the upper limit value that are adjacent to each other within a predetermined time period from fluctuations in the upper limit value in the predicted normal range, calculates each value between the identified two maximum points by performing linear interpolation between the two maximum points, and executes a first correction process that corrects the upper limit value of the normal range between the two maximum points based on the calculated values.

7. 7. The anomaly detection device according to claim 6, wherein the processing device, after the first correction process, identifies two minimum points of the upper limit value that are adjacent to each other within a predetermined time from fluctuations in the upper limit value in the normal range specified by the calculated values ​​and the specified maximum point of the upper limit value in the normal range, calculates each value between the identified two minimum points by linear interpolation between the two minimum points, and executes a second correction process to correct the upper limit value of the normal range between the two minimum points based on the calculated values.

8. 8. The anomaly detection device according to claim 7, wherein the processing device determines whether a fluctuation in the upper limit value in the calculated normal range is decreasing in the correction process, and performs the second correction process only when it determines that the fluctuation in the upper limit value is decreasing.

9. The information processing device a prediction process for predicting fluctuations in the normal range of parameter values ​​over a specified period; a correction process of identifying a maximum point of the upper limit from the fluctuation of the predicted upper limit of the normal range, correcting the upper limit of the normal range based on the identified maximum point of the upper limit, identifying a minimum point of the upper limit from the fluctuation of the corrected upper limit of the normal range, and correcting the upper limit of the normal range based on the identified minimum point of the upper limit; and (b) executing an abnormality detection process for acquiring parameter values ​​for the specified period, determining whether the acquired parameter values ​​are within the corrected normal range, and outputting predetermined information if it is determined that the acquired parameter values ​​are not within the corrected normal range. Anomaly detection methods.

10. In the information processing device, a prediction process for predicting fluctuations in the normal range of parameter values ​​over a specified period; a correction process of identifying a maximum point of the upper limit from the fluctuation of the predicted upper limit of the normal range, correcting the upper limit of the normal range based on the identified maximum point of the upper limit, identifying a minimum point of the upper limit from the fluctuation of the corrected upper limit of the normal range, and correcting the upper limit of the normal range based on the identified minimum point of the upper limit; and executing an abnormality detection process for acquiring parameter values ​​for the specified period, determining whether the acquired parameter values ​​are within the corrected normal range, and outputting predetermined information when it is determined that the acquired parameter values ​​are not within the corrected normal range. Anomaly detection program.

Images