Anomaly detection device and anomaly detection method

Abstract

To provide technology that can detect interval abnormality in time series data.SOLUTION: An abnormality detection device according to one embodiment includes: a linear operator estimation unit that is configured to use time series data generated from a predetermined dynamical system to create an approximation of a Perron-Frobenius operator corresponding to the dynamical system; an abnormality degree calculation unit that is configured to use at least the approximation of the Perron-Frobenius operator to calculate an abnormality degree in a predetermined time interval of the time series data where the dynamical system is generated; and an abnormality detection unit that is configured to detect whether an abnormality occurs in the time interval using the abnormality degree.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an anomaly detection device and an anomaly detection method. [Background technology]

[0002] Many of the various phenomena that occur in nature and human society (e.g., communication traffic, stock prices, temperature, etc.) are expressed as time-series data. For this reason, methods for analyzing time-series data have been studied for a long time, and operator-theoretic data analysis is one of the well-known methods. Operator-theoretic data analysis applies a mathematical theory known as operator theory by expressing the temporal evolution of time-series data using linear operators. In recent years, methods have been proposed that apply operator-theoretic data analysis to anomaly detection (e.g., Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Hashimoto, Y., Ishikawa, I., Ikeda, I., Matsuo, Y., and Kawahara, Y. Krylov Subspace Method for Nonlinear Dynamical Systems with Random Noise. Journal of Machine Learning Research, 21(172):1-29, 2020. Summary of the Invention [Problem to be solved by the invention]

[0004] However, the method described in Non-Patent Document 1 above has the problem that it is not always able to detect anomalies in a time interval (in other words, an interval-specific anomaly) because it calculates the degree of anomaly for each piece of data at each time. For example, while the method described in Non-Patent Document 1 above can detect an anomaly when there is a sudden change in value at a certain time, it cannot always detect an anomaly where the value changes gradually.

[0005] The present disclosure has been made in consideration of the above points, and provides a technology capable of detecting interval abnormalities in time-series data. [Means for solving the problem]

[0006] An anomaly detection device according to one aspect of the present disclosure includes a linear operator estimator configured to use time series data generated from a predetermined dynamical system to create an approximation of a Perron-Frobenius operator corresponding to the dynamical system; an anomaly degree calculation unit configured to use at least the approximation of the Perron-Frobenius operator to calculate a degree of anomaly in a predetermined time interval of the time series data from which the dynamical system is generated; and an anomaly detection unit configured to use the degree of anomaly to detect whether or not an anomaly has occurred in the time interval. [Effects of the Invention]

[0007] A technique is provided that can detect interval abnormalities in time-series data. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 10 is a diagram illustrating an example of a broken line function. [Figure 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of the anomaly detection device according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of the anomaly detection device according to the present embodiment. [Figure 4] 10 is a flowchart illustrating an example of an abnormality detection process according to the present embodiment. [Figure 5]FIG. 10 is a diagram illustrating an example of data to which an anomaly has been added. [Figure 6] FIG. 10 is a diagram (part 1) showing an example of the abnormality degree. [Figure 7] FIG. 10 is a diagram (part 2) showing an example of the abnormality degree. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the present invention will be described below.

[0010] <Theoretical structure> The theoretical configuration of this embodiment will be described below.

[0011] 1. Settings Consider the dynamical system shown in the following equation (1) where X is the state space.

[0012] x t+1 =h(x t ) (1) where h is a generally nonlinear mapping from X to X.

[0013] Let H be a reproducing kernel Hilbert space (RKHS) consisting of a positive definite kernel k: X × X → C on X (where C is the set of all complex numbers). Note that H is a Hilbert space consisting of complex-valued functions on X. For details of RKHS, see, for example, Chapter 3 of the above-mentioned Non-Patent Document 1.

[0014] On H, we define the Perron-Frobenius operator K corresponding to the dynamical system shown in equation (1) as a linear operator that satisfies the following:

[0015] Kφ(x)=φ(h(x)) where φ is the feature mapping for k and is defined as φ(x)=k(·,x).

[0016] 2. Estimation of the Perron-Frobenius operator The data (normal data) x0,...,x up to time T generated by the dynamical system shown in Eq. (1) T In this case, for a given natural number n, we consider the orthonormal system q1, ,q that minimizes the following equation (2). n Find ∈H.

[0017]

number

[0018] Map P from H to q1, ,q n Let it be a projection onto the space spanned by .

[0019] In this case, we construct an approximation of the Perron-Frobenius operator K by PKP. Similarly, for any l=1,2,...,q (where q is a predetermined integer greater than or equal to 1), we l Approximation of PK l It consists of P.

[0020] 3. Calculation of abnormality level Let d be a given natural number. Consider calculating an anomaly in an interval with a time width of d. When capturing an anomaly in a long interval, d is set to a relatively large value, such as 100. Conversely, when capturing an anomaly in a short interval, d is set to a relatively small value, such as 10. Below, three methods, Methods 1 to 3, are explained as methods for calculating the degree of anomaly.

[0021] ·Method 1 Let τ be a given natural number, and normal data x from time τ to τ+d τ ,···,x τ+d is assumed to be given. τ can be any natural number, but for example, it is set to τ=0.

[0022] x at time τ τ The predicted value of xτ In this case, first, we define w0, ,w that approximately satisfies the following equation (3): q-1 Compute ∈C.

[0023]

number

[0024] The above equation (3) is approximately satisfied by w0, ,w q-1 ∈C can be calculated as follows. First, the broken-line functions f and g are constructed as shown in Figure 1 (note that Figure 1 shows the case where t = τ + i + 1 as an example). Specifically, for i = 0, , d, the broken-line functions f and g shown in the following equation (4) are constructed.

[0025]

number

[0026]

number

[0027] Next, for each time t (t>T, t>τ), w *and the PK approximation of the Perron-Frobenius operator constructed in "2. Estimation of the Perron-Frobenius operator" l P is used to calculate predicted values ​​(more precisely, values ​​obtained by mapping predicted values ​​to the feature space) for times t to t+d, and the error between these predicted values ​​and the actual measured values ​​is used to calculate the degree of anomaly in the interval from times t to t+d. Specifically, the degree of anomaly in the interval from times t to t+d is calculated as err(t, w * ) For example, err(τ,w * ) and err(t,w * ) and the difference |err(τ,w * )-err(t,w * )| may be used as the degree of abnormality.

[0028] ·Method 2 φ(x τ+i ')(i=0, ,d-1) i+1 φ(x τ-1 ) to construct the function f, the prediction error defined in equation (5) does not depend on w. Therefore, after making this substitution, the prediction error defined in equation (5) may be used as the degree of anomaly.

[0029] ·Method 3 Methods 1 and 2 use the approximate PK of the Perron-Frobenius operator constructed in "2. Estimation of the Perron-Frobenius operator". l P is used to calculate the degree of abnormality at times beyond T. l When constructing P, normal data x0,...,x T is necessary.

[0030] However, there may be cases where normal data is not available in advance. In such cases, the degree of anomaly from time t to t+d (t=0, 1, . . .) may be calculated as follows. First, an approximate PKP of the Perron-Frobenius operator is constructed using the data from time t to t+d using a method similar to that described in "2. Estimating the Perron-Frobenius Operator." Then, the number of eigenvalues ​​of magnitude 1 in this PKP is used as the degree of anomaly from time t to t+d. In this case, for example, when the degree of anomaly from time t to t+d has changed compared to the previous time (that is, when it has changed compared to the degree of anomaly from time t-1 to t+d-1), it is possible to detect that an anomaly has occurred in the interval from time t to t+d.

[0031] <Hardware configuration of the abnormality detection device 10> An example of the hardware configuration of an anomaly detection device 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the anomaly detection device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0032] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the anomaly detection device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0033] The external I / F 103 is an interface with an external device such as a recording medium 103a. The anomaly detection device 10 can read from and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0034] The communication I / F 104 is an interface for connecting the anomaly detection device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0035] The anomaly detection device 10 according to this embodiment has the hardware configuration shown in Fig. 2, and is therefore capable of performing the anomaly detection process described below. Note that the hardware configuration shown in Fig. 2 is merely an example, and the hardware configuration of the anomaly detection device 10 is not limited to this. For example, the anomaly detection device 10 may have multiple auxiliary storage devices 107 and multiple processors 108, or may have various other hardware components in addition to the hardware shown in the figure.

[0036] <Functional configuration of the abnormality detection device 10> An example of the functional configuration of the anomaly detection device 10 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the anomaly detection device 10 according to this embodiment includes a linear operator estimation unit 201, an anomaly degree calculation unit 202, and an anomaly detection unit 203. These units are realized, for example, by a process in which one or more programs installed in the anomaly detection device 10 are executed by the processor 108. The anomaly detection device 10 according to this embodiment also includes a storage unit 204. The storage unit 204 is realized, for example, by the auxiliary storage device 107.

[0037] The linear operator estimation unit 201 constructs an approximation of the Perron-Frobenius operator by the method described in "2. Estimation of the Perron-Frobenius operator".

[0038] The abnormality degree calculation unit 202 calculates the abnormality degree by one of methods 1 to 3 described in "3. Calculation of abnormality degree."

[0039] The anomaly detection unit 203 uses the degree of anomaly calculated by the anomaly degree calculation unit 202 to detect the occurrence of an anomaly.

[0040] The storage unit 204 stores various data (for example, given normal data and parameters (d, n, etc.), an approximation of the Perron-Frobenius operator, etc.).

[0041] <Abnormality detection processing> Anomaly detection processing according to this embodiment will be described below with reference to Fig. 4. As an example, the following describes a case where the degree of anomaly is calculated using Method 1 described in "3. Calculation of the degree of anomaly." In this case, steps S101 to S102 in Fig. 4 are executed in advance, while steps S103 to S105 are repeatedly executed for each time t.

[0042] The linear operator estimation unit 201 estimates the approximate PK of the Perron-Frobenius operator by the method described in "2. Estimation of the Perron-Frobenius operator". l P is constructed (step S101).

[0043] Next, the abnormality degree calculation unit 202 calculates w * is calculated (step S102).

[0044] The abnormality degree calculation unit 202 calculates the w * and the approximate PK of the Perron-Frobenius operator calculated in step S101 above. l Using P, a predicted value (more precisely, a value obtained by mapping the predicted value onto the feature space) at time t to t+d is calculated (step S103). This predicted value can be calculated using equation (3). That is, in equation (3), τ=t, w=w * As a result, φ(x' t ),···,φ(x' t+d ) can be calculated.

[0045] The anomaly degree calculation unit 202 calculates the actual measurement values ​​(more precisely, values ​​obtained by mapping the actual measurement values ​​onto the feature space) at times t to t+d as φ(x t ),···,φ(x t+d ) and the abnormality degree err(t, w * ) is calculated (step S104). * )-err(t,w * )| may be calculated as the degree of anomaly.

[0046] Then, the anomaly detection unit 203 detects the occurrence of an anomaly using the degree of anomaly calculated in the above step S104 (step S105). For example, the anomaly detection unit 203 may detect an anomaly if the degree of anomaly is greater than a predetermined threshold, and may not detect an anomaly if the degree of anomaly is not greater than a predetermined threshold.

[0047] When calculating the degree of abnormality using Method 2 described in "3. Calculation of the degree of abnormality", in step S102, φ(x τ+i ')(i=0, ,d-1) i+1 φ(x τ-1 ) to construct the function f and then w *Just calculate it.

[0048] Furthermore, when calculating the degree of anomaly using Method 3 described in "3. Calculation of the Degree of Anomaly," steps S101 and S102 are not executed, and steps S104 and S105 are repeatedly executed for each time t. However, in step S104, first, the linear operator estimation unit 201 constructs an approximated PKP of the Perron-Frobenius operator using data from times t to t+d, and then the anomaly degree calculation unit 202 calculates the number of eigenvalues ​​of magnitude 1 of the approximated PKP as the degree of anomaly. Furthermore, in step S105, the anomaly detection unit 203 detects that an anomaly has occurred in the interval from time t to t+d when the degree of anomaly has changed compared to the previous time.

[0049] <Evaluation> The following describes the evaluation of the anomaly detection device 10 according to this embodiment.

[0050] As an example, we artificially added anomalies with a time range to data on communication traffic volume published by the TOTEM Project (http: / / totem.run.montefiore.ulg.ac.be / datatools.html), and then calculated the anomaly level using Method 2 described in "3. Calculating the Anomaly Level." The time interval in which the anomaly was added was from 1500 to 1600. Figure 5 shows the data with the anomaly added.

[0051] The data at time t is expressed as y t Let x in equation (1) be t As [y t ,···,y t+99 ], a 100-dimensional vector. t ,···,y t+99 and y t+1 ,···,y t+100 The relationship can be expressed by equation (1).

[0052] In this case, using the data from time 0 to 1300, the approximate PK of the Perron-Frobenius operator is calculated using the method explained in "2. Estimation of the Perron-Frobenius operator". l P was constructed. Then, the degree of anomaly was calculated using Method 2 explained in "3. Calculation of the degree of anomaly" for two cases, when d = 13 and when d = 103.

[0053] The calculation results of the degree of anomaly when d = 13 are shown in Fig. 6, and the calculation results of the degree of anomaly when d = 103 are shown in Fig. 7. As shown in Fig. 6 and Fig. 7, it can be seen that the degree of anomaly is high in both the sections where an artificial anomaly was added (time 1500 to 1600).

[0054] In both Figures 6 and 7, the degree of abnormality is also high around time 2000. This is because the value of the original data increases suddenly around time 2000, resulting in a localized abnormality.

[0055] When d=103, the degree of anomaly near time 2000 is smaller than the degree of anomaly between times 1500 and 1600. This is because the larger the value of d, the smaller the influence of local anomalies, and the more importance is placed on global anomalies.

[0056] As described above, the anomaly detection device 10 according to this embodiment can detect interval anomalies in time-series data (i.e., non-local, global anomalies) with high accuracy. The anomaly detection device 10 according to this embodiment can be applied to various devices or systems that use time-series data to detect anomalies in a space with a temporal width. An example of such a device or system is a device or system that detects communication anomalies from communication traffic.

[0057] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0058] 10. Anomaly detection device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Linear operator estimator 202 Abnormality calculation section 203 Anomaly detection unit 204 Storage section

Claims

1. a linear operator estimator configured to generate an approximation of a Perron-Frobenius operator corresponding to a predetermined dynamical system using time series data generated from the dynamical system; an anomaly degree calculation unit configured to calculate an anomaly degree in a predetermined time interval of time-series data from which the dynamical system is generated by using at least an approximation of the Perron-Frobenius operator; an anomaly detection unit configured to detect whether an anomaly has occurred in the time interval using the anomaly degree; and When X is a state space, the dynamical system is expressed as x t+1 =h(x t ) by a mapping h:X →X, The linear operator estimation unit Using normal data x 0 , ..., x T up to time T generated from the dynamical system, a natural number n less than T, and a feature map φ(x) defined as φ(x) = k(·, x) where k is a positive definite kernel on X: X × X → C, an orthonormal system q 1 , ..., q n ∈ H (where H is a reproducing kernel Hilbert space configured by the positive definite kernel k) that minimizes the sum of ||φ(x i ) - (q 1 〈φ(x i ), q 1 〉 + ... + q n 〈φ(x i ), q n 〉)|| 2 from i = 1 to T is obtained, a projection P from the reproducing kernel Hilbert space H onto a space spanned by the orthonormal systems q 1 , ..., q n to generate an approximation PK l P (where l=1, 2, ..., q (where q is a predetermined integer of 1 or more)) of the Perron-Frobenius operator K; The abnormality degree calculation unit Using normal data x τ , ..., x τ+d from time τ to τ+d generated from the dynamical system, calculate w = (w 0 , ..., w q-1 ) that approximately satisfies φ(x' τ+i ) = w 0 J 1 (φ(x τ+i )) + ... + w q-1 J q (φ(x τ+i-q )) (where x' τ+i is the predicted value of x τ+i , and J l = PK l P) for i = 0, ..., d; The anomaly detection device is configured to calculate the degree of anomaly for the time interval represented by time t to t+d (where t>T, t>τ) using the w and an approximation PK l P of the Perron-Frobenius operator K.

2. A linear operator estimator configured to create an approximation of a Perron-Frobenius operator corresponding to a predetermined dynamical system using time series data generated from the dynamical system; an anomaly degree calculation unit configured to calculate an anomaly degree in a predetermined time interval of time-series data from which the dynamical system is generated by using at least an approximation of the Perron-Frobenius operator; an anomaly detection unit configured to detect whether an anomaly has occurred in the time interval using the anomaly degree; and When X is a state space, the dynamical system is expressed as x t+1 =h(x t ) by a mapping h:X →X, The linear operator estimation unit Using actual values ​​x 0 , ..., x T of the time series data in the time interval represented by time t to t+d, a natural number n less than T, and a feature map φ(x) defined as φ(x) = k(·, x) where k is a positive definite kernel on X: X × X → C, an orthonormal system q 1 , ..., q n ∈ H (where H is a reproducing kernel Hilbert space configured by the positive definite kernel k) that minimizes the sum of ||φ(x i ) - (q 1 〈φ(x i ), q 1 〉 + ... + q n 〈φ(x i ), q n 〉)|| 2 from i = 1 to T is obtained, a projection P from the reproducing kernel Hilbert space H to a space spanned by the orthonormal systems q 1 , ..., q n is used to generate an approximation PKP of the Perron-Frobenius operator K; The abnormality degree calculation unit The anomaly detection device is configured to calculate the number of eigenvalues ​​of magnitude 1 of the PKP as the degree of anomaly in the time interval represented by time t to t+d.

3. The abnormality degree calculation unit f| for i = 0, ..., d ［τ＋ｉ－１，τ＋ｉ］ (t)=(t-(τ+i-1))φ(x' τ＋ｉ )+((τ+i)-t)φ(x' τ＋ｉ－１ ) and g| ［τ＋ｉ－１，τ＋ｉ］ (t)=(t-(τ+i-1))φ(x τ＋ｉ )+((τ+i)-t)φ(x τ＋ｉ－１ ) and functions f and g defined as err(τ, w):=(||f(t)-g(t)|| ２ Calculate w by minimizing the integral of w with respect to t from t=τ−1 to t=τ+d, Approximation PK of the w and the Perron-Frobenius operator K ｌ P, for i=0,...,d, φ(x' ｔ＋ｉ ) = w ０ J １ (φ(x ｔ＋ｉ )) +... +w ｑ－１ J ｑ (φ(x ｔ＋ｉ－ｑ )) and φ(x' ｔ ), ..., φ(x' ｔ＋ｄ ) and the actual value x of the time series data in the time interval ｔ , ..., x ｔ＋ｄ φ(x ｔ ), ..., φ(x ｔ＋ｄ ) and err(t, w) = (||f(t) - g(t)|| ２ 3. The anomaly detection device according to claim 1, wherein the anomaly detection device is configured to calculate |err(τ, w)−err(t, w)| as the degree of anomaly, or |err(τ, w)−err(t, w)| as the degree of anomaly.

4. The abnormality degree calculation unit f| for i = 0, ..., d ［τ＋ｉ－１，τ＋ｉ］ (t)=(t-(τ+i-1))J ｉ＋１ φ(x τ－１ )+((τ+i)-t)J ｉ φ(x τ－１ ) and g| ［τ＋ｉ－１，τ＋ｉ］ (t)=(t-(τ+i-1))φ(x τ＋ｉ )+((τ+i)-t)φ(x τ＋ｉ－１ ) and functions f and g are defined as err(τ):=(||f(t)-g(t)|| ２ 2. The anomaly detection device according to claim 1, wherein the anomaly detection device is configured to calculate, as the degree of anomaly, a value obtained by integrating the above with respect to t from t=τ−1 to t=τ+d.

5. a linear operator estimation procedure for creating an approximation of a Perron-Frobenius operator corresponding to a given dynamical system using time series data generated from the dynamical system; an anomaly calculation procedure for calculating an anomaly degree in a predetermined time interval of time series data from which the dynamical system is generated, using at least an approximation of the Perron-Frobenius operator; an anomaly detection step of detecting whether or not an anomaly has occurred in the time interval using the anomaly degree; The computer executes When X is a state space, the dynamical system is expressed as x t+1 =h(x t ) by a mapping h:X →X, The linear operator estimation procedure is Using normal data x 0 , ..., x T up to time T generated from the dynamical system, a natural number n less than T, and a feature map φ(x) defined as φ(x) = k(·, x) where k is a positive definite kernel on X: X × X → C, an orthonormal system q 1 , ..., q n ∈ H (where H is a reproducing kernel Hilbert space configured by the positive definite kernel k) that minimizes the sum of ||φ(x i ) - (q 1 〈φ(x i ), q 1 〉 + ... + q n 〈φ(x i ), q n 〉)|| 2 from i = 1 to T is obtained, , q n , and generate an approximation PK l P (where l=1, 2, ..., q (where q is a predetermined integer of 1 or more)) of the Perron-Frobenius operator K using a projection P from the reproducing kernel Hilbert space H onto the space spanned by the orthonormal systems q 1 , ..., q n ; The abnormality degree calculation procedure includes: Using normal data x τ , ..., x τ+d from time τ to τ+d generated from the dynamical system, calculate w = (w 0 , ..., w q-1 ) that approximately satisfies φ(x' τ+i ) = w 0 J 1 (φ(x τ+i )) + ... + w q-1 J q (φ(x τ+i-q )) (where x' τ+i is the predicted value of x τ+i , and J l = PK l P) for i = 0, ..., d; An anomaly detection method for calculating an anomaly degree for the time interval represented by time t to t+d (where t>T, t>τ) using the w and an approximation PK l P of the Perron-Frobenius operator K.

6. A linear operator estimation procedure for creating an approximation of a Perron-Frobenius operator corresponding to a predetermined dynamical system using time series data generated from the dynamical system; an anomaly calculation procedure for calculating an anomaly degree in a predetermined time interval of time series data from which the dynamical system is generated, using at least an approximation of the Perron-Frobenius operator; an anomaly detection step of detecting whether or not an anomaly has occurred in the time interval using the anomaly degree; The computer executes When X is a state space, the dynamical system is expressed as x t+1 =h(x t ) by a mapping h:X →X, The linear operator estimation procedure is Using actual values ​​x 0 , ..., x T of the time series data in the time interval represented by time t to t+d, a natural number n less than T, and a feature map φ(x) defined as φ(x) = k(·, x) where k is a positive definite kernel on X: X × X → C, an orthonormal system q 1 , ..., q n ∈ H (where H is a reproducing kernel Hilbert space configured by the positive definite kernel k) that minimizes the sum of ||φ(x i ) - (q 1 〈φ(x i ), q 1 〉 + ... + q n 〈φ(x i ), q n 〉)|| 2 from i = 1 to T is obtained, Using a projection P from the reproducing kernel Hilbert space H to the space spanned by the orthonormal systems q 1 , . . . , q n , an approximation PKP of the Perron-Frobenius operator K is created; The abnormality degree calculation procedure includes: An anomaly detection method that calculates the number of eigenvalues ​​of magnitude 1 of the PKP as the degree of anomaly in the time interval represented by time t to t+d.

Images